Method for controlling internet access service, electronic device, storage medium, and chip

Abstract

The present application provides a method for controlling an Internet access service, an electronic device, a storage medium, and a chip. In the method, packet features are sequentially acquired in a protocol stack of a router. After each acquisition of packet features, the acquired packet features undergo detection. If the detection result indicates control of an Internet access service, the Internet access service is controlled; and if the detection result indicates no control of the Internet access service, the Internet access service is not controlled. This process continues until, on the basis of the acquired packet features, the obtained detection result indicates no control of the Internet access service, whereupon no further packet features are acquired. Compared with related solutions, Internet access services can be controlled without acquiring a sufficient number of packet features, thereby reducing the amount of data that needs to be processed. Thus, less memory and Flash are required for data processing, thereby improving the data processing efficiency of the router when controlling Internet access services and enhancing user experience.

Description

A method for controlling internet access services, electronic devices, storage media, and chips.

[0001] This application claims priority to Chinese patent application filed on August 30, 2024, with application number 202411220339.2 and entitled "A method for controlling Internet access services, electronic device, storage medium and chip", the entire contents of which are incorporated herein by reference. Technical Field

[0002] This application relates to the field of terminals, and more particularly to a method for controlling Internet access services, electronic devices, storage media, and chips. Background Technology

[0003] Routers are widely used in homes, offices, and other settings. Electronic devices such as mobile phones and tablets can access the internet by connecting to a router.

[0004] In the relevant solutions, when managing Internet access services, the router needs to obtain a sufficient number of packet characteristics from the electronic devices connected to the router in order to manage the Internet access services based on these characteristics. However, managing Internet access services based on a sufficient number of packet characteristics requires processing a large amount of data, which in turn requires a large amount of memory and non-volatile flash storage. This results in low data processing efficiency for the router when managing Internet access services, affecting the user experience. Summary of the Invention

[0005] This application provides a method, electronic device, storage medium, and chip for managing internet access services, which can improve the efficiency of routers in processing data when managing internet access services and enhance user experience.

[0006] Firstly, a method for managing internet access services is provided, applied to a first electronic device. The first electronic device includes a deep packet inspection module and a protocol stack, the protocol stack including N protocol layers, where N is an integer greater than 1. The method includes:

[0007] The system receives a first message sent by a second electronic device based on an internet access service; performs M checks on the first message at the M-layer protocol layer using a deep packet inspection module; and sends the first message or manages the internet access service based on the check results, where M is less than or equal to N. The detection process of performing the i-th check on the first message at the i-th protocol layer of the M-layer protocol layer using the deep packet inspection module includes: obtaining partial message features of the first message at the i-th protocol layer using the deep packet inspection module; and detecting the partial message features of the first message at the i-th protocol layer using the deep packet inspection module to obtain the detection result. If i is less than M and M is less than or equal to N, and the detection result indicates that no control is exercised over internet access services, a first message is sent from the i-th protocol layer to the (i+1)-th protocol layer, and the (i+1)-th detection is performed at the (i+1)-th protocol layer in the M-layer protocol layer by the deep packet inspection module; or, if i is equal to M and M is equal to N, and the detection result indicates that no control is exercised over internet access services, a first message is sent through the deep packet inspection module; or, if i is equal to M, and the detection result indicates that control is exercised over internet access services, the internet access services are controlled through the deep packet inspection module.

[0008] In this embodiment, the first electronic device can perform M detections on the packet at the M-layer protocol layer using a deep packet inspection module. During each detection, partial features of the packet are acquired (e.g., partial features of the packet are acquired once in the i-th detection). If the detection result indicates that the internet access service should be controlled, the internet access service is controlled through the deep packet inspection module. If the detection result indicates that the internet access service is not controlled, partial features of the packet are acquired again (e.g., partial features of the packet are acquired again in the i+1-th detection), until the detection result obtained by detecting partial features of the packet indicates that the internet access service should be controlled. Then, the internet access service is controlled through the deep packet inspection module. In other words, this application embodiment can obtain partial features of packets sequentially at the N-layer protocol layer through a deep packet inspection module. Then, it can detect the partial features of each acquired packet to manage internet access services. After the detection result based on the partial features of a single acquired packet is used to manage internet access services, it is no longer necessary to obtain partial features of the packet. Compared with related solutions, it is not necessary to obtain enough packet features to manage internet access services, which can reduce the amount of data that needs to be processed. Therefore, less memory and Flash are required for data processing, thereby improving the efficiency of the router in processing data when managing internet access services and improving the user experience.

[0009] In conjunction with the first aspect, in one possible implementation of the first aspect, the deep packet inspection module includes multiple inspection modules, with inspection points configured on each of the N protocol layers, and inspection modules of the deep packet inspection module configured on each inspection point; and, the deep packet inspection module obtains partial packet features of the first packet at the i-th protocol layer, including:

[0010] The first message is parsed by the i-th protocol layer to obtain some message features of the first message; the detection module obtains some message features of the first message at the detection points on the i-th protocol layer.

[0011] In this embodiment of the application, each of the N protocol layers in the first electronic device is configured with a detection point, and a detection module of a deep message detection module is configured on the detection point. The first electronic device can obtain part of the message features of the first message parsed by the i-th protocol layer through the detection module at the detection point on the i-th protocol layer, which can improve the acquisition efficiency of data (the data is part of the message features of the first message parsed by the i-th protocol layer).

[0012] In conjunction with the first aspect, in one possible implementation of the first aspect, the first electronic device further includes a knowledge base and permission configuration information. The knowledge base includes multiple business types, each of which includes multiple message features. The permission configuration information includes a correspondence between at least one message feature and at least one permission information. Each message feature in the at least one message corresponds to at least one permission information, and each permission information includes a correspondence between at least one business type and one permission content. Furthermore, a deep message detection module detects some message features of the first message at the i-th protocol layer to obtain detection results, including:

[0013] The deep packet inspection module detects the permission content corresponding to certain packet features of the first packet within the permission configuration information; or...

[0014] The deep message detection module detects the first business type to which some features of the first message belong in the knowledge base, and detects the permission content corresponding to the first business type in the permission configuration information.

[0015] If the first message is found to contain permission content corresponding to some of its message features, or if the first message is found to contain some of its features belonging to a first service type, or if the first service type contains permission content, the detection result is determined to be to control the Internet access service.

[0016] If no permission content corresponding to some of the characteristics of the first message is detected, or if no first service type to which some of the characteristics of the first message belong is detected, or if the first service type to which some of the characteristics of the first message belong is detected, and no permission content corresponding to the first service type is detected, the detection result is determined to be that no control is exercised over the Internet access service.

[0017] In this embodiment of the application, the electronic device also includes a knowledge base and permission configuration information. The electronic device can detect the permission content corresponding to some message features of the first message in the permission configuration information through the deep message detection module; it can also detect the first service type to which some features of the first message belong in the knowledge base through the deep message detection module, and detect the permission content corresponding to the first service type in the permission configuration information. Different detection methods can improve detection efficiency.

[0018] Furthermore, during the detection process, the electronic device can obtain the same detection result regardless of the circumstances. For example, if the electronic device detects the permission content corresponding to some of the message features of the first message, or if it detects the first service type to which some of the message features belong, and also detects the permission content corresponding to that first service type, the detection result can be determined as "controlling internet access services." Conversely, if the electronic device does not detect the permission content corresponding to some of the message features, the first service type to which some of the message features belong, or the first service type to which some of the message features belong, but does not detect the permission content corresponding to that first service type, the detection result can be determined as "no control over internet access services." In other words, the electronic device can obtain the same detection result regardless of the circumstances, thus improving the accuracy of the detection results.

[0019] In conjunction with the first aspect, in one possible implementation of the first aspect, the N-layer protocol layer includes a first protocol layer and at least one second protocol layer, wherein the first protocol layer is the lowest layer in the N-layer protocol layer; and, by using a deep message detection module to detect some message features of the first message at the i-th protocol layer, a detection result is obtained, including:

[0020] At the first protocol layer, the deep packet inspection module detects the permission content corresponding to some packet features of the first packet in the permission configuration information;

[0021] Upon detecting the permission content corresponding to certain message characteristics of the first message, the detection result is determined to be to control internet access services.

[0022] If no permission content corresponding to the characteristics of some packets in the first packet is detected, the detection result is determined to be no control over internet access services; and...

[0023] The deep message inspection module detects some message features of the first message at the i-th protocol layer to obtain the detection results, which also include:

[0024] At each protocol layer in at least one second protocol layer, the deep message detection module detects the first service type to which some features of the first message belong in the knowledge base, and detects the permission content corresponding to the first service type in the permission configuration information.

[0025] If the first service type to which some features of the first message belong are detected, and if the permission content corresponding to the first service type is detected, the detection result is determined to be to control the Internet access service.

[0026] If the first service type to which some features of the first message belong is not detected, or if the first service type to which some features of the first message belong is detected, and if the permission content corresponding to the first service type is not detected, the detection result is determined to be that no control is exercised over the Internet access service.

[0027] In this embodiment of the application, the deep message detection module can perform different detection operations in the first protocol layer and in each of the at least one second protocol layer, which can flexibly detect some features of the first message.

[0028] In conjunction with the first aspect, in one possible implementation of the first aspect, when i equals M and the detection result indicates that internet access services are to be controlled, internet access services are controlled through a deep packet inspection module, including:

[0029] When i equals M and the detection result indicates that internet access services are to be controlled, the memory occupied by the first packet is released through the deep packet inspection module in order to control internet access services.

[0030] In this embodiment of the application, regardless of which protocol layer in the N-layer protocol stack the detection result obtained by the deep packet inspection module indicates that internet access services need to be controlled, the memory occupied by the first packet can be released to control internet access services. In other words, this embodiment of the application can flexibly block the transmission of the first packet at different protocol layers of the N-layer protocol stack to control internet access services.

[0031] In conjunction with the first aspect, in one possible implementation of the first aspect, when i equals M and the detection result indicates that internet access services are to be controlled, internet access services are controlled through a deep packet inspection module, including:

[0032] When i equals M and the detection result indicates that internet access services are to be controlled, an interference message is sent to the second or third electronic device through the deep packet inspection module to disconnect the network connection between the second and third electronic devices in order to control internet access services. The third electronic device is the device that receives the first message.

[0033] In conjunction with the first aspect, in one possible implementation of the first aspect, the interfering message includes a Transmission Control Protocol Reset message or an Internet Control Message Protocol Unreachable message.

[0034] In this embodiment of the application, when the deep packet inspection module obtains a detection result indicating that internet access services should be controlled, the first electronic device sends an interference message to the second or third electronic device through the deep packet inspection module to disconnect the network connection of the second and third electronic devices, thereby improving the control efficiency of internet access services.

[0035] In conjunction with the first aspect, in one possible implementation of the first aspect, when i equals M and the detection result indicates that internet access services are to be controlled, internet access services are controlled through a deep packet inspection module, including:

[0036] When i equals M and the detection result indicates that internet access services are to be controlled, a notification of domain name resolution anomaly is sent to the second electronic device through the deep packet inspection module to restrict the second electronic device from accessing the third electronic device, thereby controlling internet access services. The third electronic device is the device that receives the first packet.

[0037] The typical process of a second electronic device accessing a third electronic device involves the second electronic device sending the domain name of the third electronic device to the first electronic device. The first electronic device then determines the IP address of the third electronic device using the domain name. Afterward, the first electronic device needs to configure network settings, set port numbers, security settings, and test the connection before the second electronic device can access the network to access the third electronic device. In this embodiment, if the detection result indicates that internet access is to be controlled, the first electronic device can send a notification of domain name resolution anomaly to the second electronic device via a deep packet inspection module. Therefore, it can block the second electronic device's network access from the source (e.g., the source could be the first electronic device determining the IP address of the third electronic device through its domain name during the access process), thereby controlling internet access and improving blocking efficiency.

[0038] In conjunction with the first aspect, in one possible implementation of the first aspect, the first electronic device further includes a knowledge base storage module and a permission configuration module. The knowledge base storage module is used to store the knowledge base, and the permission configuration module is used to store permission configuration information. The knowledge base storage module is decoupled from the deep message detection module, and the permission configuration module is decoupled from the deep message detection module.

[0039] In this embodiment, the permission configuration module is decoupled from the deep message detection module, which facilitates the maintenance of data in the permission configuration module, and the knowledge base is decoupled from the deep message detection module, which facilitates the maintenance of data in the knowledge base.

[0040] In a second aspect, an electronic device is provided for performing the method provided in the first aspect. Specifically, the electronic device may include a processing unit for performing any possible implementation of the first aspect.

[0041] Thirdly, an electronic device is provided, comprising: one or more processors; one or more memories; wherein the one or more memories store one or more computer programs, the one or more computer programs including instructions that, when executed by the one or more processors, cause the electronic device to perform any possible implementation of the method in the first aspect described above.

[0042] Fourthly, a computer-readable storage medium is provided, including computer instructions that, when executed on an electronic device, cause the electronic device to perform the method described in the first aspect.

[0043] Fifthly, a chip is provided, including a memory for storing instructions; and a processor for retrieving and executing the instructions from the memory, causing an electronic device on which the chip is mounted to perform the method described in the first aspect above. Attached Figure Description

[0044] Figure 1 is a schematic diagram of the structure of a router provided in an embodiment of this application.

[0045] Figure 2 is a software structure block diagram of a router provided in an embodiment of this application.

[0046] Figure 3 is an example diagram of a configuration knowledge base provided in an embodiment of this application.

[0047] Figure 4 is an example diagram of a router downloading, loading, and updating a knowledge base according to an embodiment of this application.

[0048] Figure 5 is a schematic diagram of setting Internet access permissions according to an embodiment of this application.

[0049] Figure 6 is a schematic diagram of setting a green mode according to an embodiment of this application.

[0050] Figure 7 is a timing diagram of generating permission configuration information provided in an embodiment of this application.

[0051] Figure 8 is an example diagram of a mobile phone enabling internet access through a router, provided in an embodiment of this application.

[0052] Figure 9 is a timing diagram of an embodiment of this application for identifying and managing Internet access services.

[0053] Figure 10 is a timing diagram of another method for identifying and managing Internet access services provided in an embodiment of this application. Detailed Implementation

[0054] The technical solutions in the embodiments of this application will now be described with reference to the accompanying drawings.

[0055] Routers are widely used in homes and offices. Electronic devices such as mobile phones and tablets can access the internet through routers to perform various online services, such as watching videos and playing games. In some scenarios, users need to control the internet access of these devices. For example, in the home, children often have poor self-control and are prone to internet addiction. Therefore, it's necessary to control the amount of time children spend online on their phones and the applications they can use. For instance, children can use video applications, but are prohibited from using game applications.

[0056] In the relevant solutions, when managing Internet access services, the router needs to obtain a sufficient number of packet characteristics from the electronic devices connected to the router in order to manage the Internet access services based on these characteristics. However, managing Internet access services based on a sufficient number of packet characteristics requires processing a large amount of data, which in turn requires a large amount of memory and non-volatile flash storage. This results in low data processing efficiency for the router when managing Internet access services, affecting the user experience.

[0057] To address the aforementioned issues, this application provides a method for managing internet access services. A router can sequentially acquire packet characteristics of an electronic device. After acquiring packet characteristics for one iteration, if the acquired packet characteristics allow for management of internet access services, the router stops acquiring packet characteristics. If the acquired packet characteristics do not allow for management of internet access services, the router continues acquiring packet characteristics until management of internet access services is achieved. Compared to related solutions, this application's method sequentially acquires packet characteristics of electronic devices to manage internet access services, eliminating the need to acquire a sufficient number of packet characteristics. This reduces the amount of data that needs to be processed, thus requiring less memory and Flash storage. Consequently, it improves the router's data processing efficiency when managing internet access services, enhancing the user experience.

[0058] The Internet access service management method provided in this application is applied to a first electronic device with the function of identifying service type. The first electronic device may be a router, gateway, modem, and switch, etc. The embodiments of this application do not limit the specific technology and specific device form adopted by the first electronic device.

[0059] A device that can access various internet services by connecting to the first electronic device is called a second electronic device. The second electronic device can be referred to as a terminal, user equipment (UE), mobile station (MS), mobile terminal (MT), etc. The second electronic device can be a mobile phone, smart TV, tablet computer, laptop computer, desktop computer, computer with wireless transceiver capabilities, virtual reality (VR) electronic device, augmented reality (AR) electronic device, wireless terminal in industrial control, wireless terminal in self-driving, wireless terminal in remote medical surgery, wireless terminal in smart grid, wireless terminal in transportation safety, wireless terminal in smart city, wireless terminal in smart home, etc. The embodiments of this application do not limit the specific technology or device form used in the second electronic device.

[0060] To better understand the embodiments of this application, the structure of the first electronic device in the embodiments of this application will be described below, taking a router as an example.

[0061] Please refer to Figure 1, which is a schematic diagram of a router provided in an embodiment of this application. The router includes at least one processor 101, a communication bus 102, a memory 103, and at least one communication interface 104. The processor 101 may be a microprocessor (such as a central processing unit (CPU)), an application-specific integrated circuit (ASIC), or one or more integrated circuits used to control the execution of programs according to this application. The communication bus 102 may include a path for transmitting information between the aforementioned components. The memory 103 may be a read-only memory (ROM), random access memory (RAM), electrically erasable programmable read-only memory (EEPROM), or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures that can be accessed by the router, but is not limited thereto. The memory 103 may exist independently and be connected to the processor 101 via the communication bus 102. The memory 103 may also be integrated with the processor 101.

[0062] Communication interface 104 uses any transceiver-like device for communicating with other devices or communication networks. In a specific implementation, as one embodiment, processor 101 may include one or more CPUs, such as CPU0 and CPU1 shown in FIG1. ​​In a specific implementation, as one embodiment, router may include multiple processors, such as processor 101 and processor 105 shown in FIG1. ​​Each of these processors may be a single-core processor or a multi-core processor. Here, "processor" can refer to one or more devices, circuits, and / or processing cores for processing data (such as computer program instructions). As one embodiment, router may also include output device 106 and input device 107. Output device 106 communicates with processor 101 and can display information in various ways. For example, output device 106 may be a liquid crystal display (LCD), a light emitting diode (LED) display device, etc. Input device 107 communicates with processor 101 and can receive user input in various ways. For example, input device 107 may be a mouse, keyboard, touch screen device, or sensing device, etc. The memory 103 stores program code 108 for executing the scheme of this application, and the processor 101 executes the program code 108 stored in the memory 103. The router can implement the methods provided in the various embodiments below through the processor 101 and the program code 108 in the memory 103.

[0063] This concludes the introduction to the router's hardware structure. It is understood that the components included in the hardware structure shown in Figure 1 do not constitute a specific limitation on the router. A router may have more or fewer components than shown in the figure, may combine two or more components, or may have different component configurations. The various components shown in Figure 1 can be implemented in hardware, software, or a combination of hardware and software, including one or more signal processing and / or application-specific integrated circuits (ASICs).

[0064] In addition, an operating system runs on top of the aforementioned components. Examples include Windows Server™, Mac OS X™, Unix™, Linux™, and FreeBSD™. This application uses a Linux system incorporating Netfilter as an example to describe the router's operating system.

[0065] Netfilter refers to a kernel firewall framework. As a general-purpose, abstract framework, it provides a complete management mechanism for hook point functions, enabling features such as packet filtering, packet processing, address masquerading, transparent proxying, dynamic Network Address Translation (NAT), as well as filtering based on user and Media Access Control (MAC) addresses, stateful filtering, and packet rate limiting. In other words, when using a Linux kernel with Netfilter integrated for data transmission, the above functions can be implemented according to business needs based on the management mechanism provided by Netfilter, thereby better ensuring network security and preventing malicious third-party access and virus intrusion.

[0066] Figure 2 is a software structure block diagram of a router provided in an embodiment of this application. As shown in Figure 2, the router's software structure includes a configuration management module, a permission configuration module, a knowledge base storage module, a protocol stack, a deep packet inspection module, a tagging module, a memory management module, and a driver module, etc.

[0067] The configuration management module receives external input to access the router's management interface and perform various configuration and management tasks. For example, when parents control children's mobile phones connected to the router, they can activate parental controls on the phone to prevent children from playing games. In this scenario, the parent's user actions can be called external input, and preventing children from playing games can be called permission configuration.

[0068] In one example, the configuration management module includes a World Wide Web (Web) service and a Content Management System (CMS), where the Web service includes a Control Management Object (CMO) node. In the implementation, the router receives external input via an interface (such as a RESTful interface), which could be user permission configuration operations. This external input is then sent to the CMO node in the Web service. The CMO node generates permission configuration information based on the external input, such as disabling internet access for gaming services. The CMS in the router monitors whether the CMO node has generated permission configuration information. If the CMS detects that the CMO node has generated permission configuration information, it encapsulates the information and sends the encapsulated permission information to the permission configuration module in the kernel space.

[0069] The permission configuration module stores permission configuration information. Details regarding this information can be found in the embodiments below, and will not be elaborated upon here. In this embodiment, the router can identify the service type of internet access services through the deep packet inspection module in the protocol stack. After identifying the service type, it can match the service type with the data in the permission configuration module to determine the permission configuration information corresponding to the service type. Then, it manages and controls internet access services based on this permission configuration information. Specific implementation details can be found in the embodiments below, and will not be elaborated upon here. In this embodiment, the permission configuration module and the deep packet inspection module are decoupled, facilitating the maintenance of data in the permission configuration module.

[0070] The knowledge base storage module stores the knowledge base, which includes message characteristics of the application. These characteristics may include the port number used to transmit the message, the protocol used, etc. Detailed information about the knowledge base can be found in the embodiments below, and will not be repeated here. In other embodiments, the knowledge base may also be called a rule base, traffic rule base, traffic fingerprint base, application rule base, application identification module, etc., and this application embodiment does not limit this. In this application embodiment, the router can parse the message characteristics through the protocol stack, intercept the message characteristics through hook points in Netfilter, and then retrieve the message characteristics from the knowledge base to identify the service type to which the message characteristics belong. Specific implementation methods can be found in the embodiments below, and will not be repeated here. In this application embodiment, the knowledge base storage module is decoupled from the deep packet inspection module, facilitating the maintenance of data in the permission configuration module.

[0071] The tagging module is used to tag internet access services, providing identification factors for other permission configurations. For example, permission configuration information may include prohibiting access. For gaming and tracking internet usage time, the router uses the deep packet inspection module in the protocol stack to identify the service type of an internet access activity. After the game service is completed, the permission configuration module can be used to determine... If the game service permission configuration information is set to "prohibited," then the router can block this packet from accessing the network, thereby prohibiting this service type. (Game services in the network). The router identifies the service type of an internet access service through the deep packet inspection module in the protocol stack. After the video service was added, the permission configuration module did not have a separate configuration for this service type. If a device has permission information for video services but is also configured to have permission information for counting internet access time, then the router can mark the internet access service (for example, mark the internet access service as 1 or 0, without limitation) to provide an identification factor for counting internet access time.

[0072] A protocol stack is a collection of network protocols and forms the core framework of network communication. It defines how electronic devices such as mobile phones and tablets connect to the Internet and the rules governing data transmission between networks. Protocol stacks are based on layered models of communication protocols; for example, a protocol stack could be a Transmission Control Protocol (TCP) / Internet Protocol (IP) stack, or it could be based on the Open Systems Interconnection Model (OSI). Figure 2 illustrates a protocol stack based on the OSI model.

[0073] As shown in Figure 2, the OSI model's layered structure, from bottom to top, is typically described as follows: Physical Layer (not shown in Figure 2): Handles physical connections and electrical signals, such as cables and switches. Data Link Layer: Responsible for frame transmission between adjacent nodes, including error detection and physical address addressing. Network Layer: Handles packet routing throughout the network; this layer is equivalent to the Internet layer of the TCP / IP protocol stack. Transport Layer: Provides end-to-end data transmission services, ensuring data integrity and reliability; this layer is equivalent to the transport layer of the TCP / IP protocol stack. Session Layer: Establishes, manages, and terminates sessions between applications. Presentation Layer: Handles data representation, encoding, and conversion, ensuring that information sent by the application layer of one system can be read by the application layer of another system. Application Layer: Provides network services for application software.

[0074] Let me briefly introduce the layered model of the TCP / IP protocol stack. From bottom to top, the TCP / IP protocol stack is typically described as follows: Link Layer: Equivalent to the Physical and Data Link Layers in the OSI model. The Link Layer can include Ethernet protocols and bridges, responsible for transmitting data frames over the physical medium. Internet Layer: Primarily includes protocols such as Internet Protocol (IP), Address Resolution Protocol (ARP), and routing protocols, responsible for packet routing and delivery from source to destination. Transport Layer: Includes the TCP and User Datagram Protocol (UDP) protocols, providing end-to-end data transmission services. Application Layer: Includes Hypertext Transfer Protocol (HTTP), File Transfer Protocol (FTP), and Simple Mail Transfer Protocol (SMTP). The Session, Presentation, and Application layers in the OSI model correspond to the Application Layer of the TCP / IP protocol stack.

[0075] Netfilter operates within the protocol stack. At its core, Netfilter provides a set of hook points, each corresponding to a different network processing stage. Different processing functions can be registered at these hook points, typically organized in chains. For example, hook points include pre-routing hooks (NF_IP_PRE_ROUTING), local upload hooks (NF_IP_LOCAL_IN), forwarding hooks (NF_IP_FORWARD), local send hooks (NF_IP_LOCAL_OUT), and post-routing hooks (NF_IP_POST_ROUTING). The PREROUTING chain can be registered at the pre-routing hook point. This chain processes incoming packets, such as performing network address translation and modifying the destination IP address of the packet. The INPUT chain can be registered at the local upload hook point. This chain controls which packets can be received by the router's local processes. At the forwarding detection point, a FORWARD chain can be registered. This chain handles packets that pass through the router but whose destination is not the router itself (i.e., forwarded packets), and controls whether and how the router forwards specific traffic, such as deciding whether to forward based on packet characteristics. At the local sending detection point, an OUTPUT chain is registered. This chain handles packets generated by the router and about to be sent out. At the post-routing detection point, a POSTROUTING chain is registered. This chain handles packets about to leave the router.

[0076] In this embodiment of the application, Netfilter can configure one or more hook points for multiple layers of the protocol stack. For example, the router can be configured with a forwarding detection point at the data link layer shown in Figure 2. For ease of description, the forwarding detection point is represented by ① in Figure 2. The detection module 6 in the deep packet inspection module is configured in the FORWARD chain of the forwarding detection point ①. The detection module 6 is mainly used to obtain the physical address (MAC address) in the packet and match the MAC address with the data in the permission configuration module to determine the permission configuration information of the packet.

[0077] For example, the router can be configured with a forwarding detection point or a local upload detection point in the network layer shown in Figure 2. For ease of description, the local upload detection point is represented by ② in Figure 2. For example, a detection module 5 is configured in the INPUT chain of the local upload detection point ② or in the FORWARD chain of the forwarding detection point ①. The detection module 5 is mainly used to obtain the protocol type, destination domain name, etc. in the packet. The destination domain name can be the domain name of the server that the mobile device or other electronic device will access. Then, based on the destination domain name and the knowledge base, the source IP address or destination IP address associated with the destination domain name is matched. The source IP address can be the IP address of the party sending the packet, and the destination IP address can be the IP address of the party receiving the packet. Then, the detection module 5 identifies the service type of the Internet access service based on the destination IP address or the source IP address, and matches the service type with the data in the permission configuration module to determine the permission configuration information of the packet.

[0078] For example, the router can be configured with a forwarding detection point ① at the transport layer shown in Figure 2. A detection module 4 is configured in the FORWARD chain of the forwarding detection point ①. The detection module 4 is mainly used to obtain the port used when transmitting packets, for example, a packet uses port 80 during transmission. Based on this port and a knowledge base, it determines the service type of the internet access service. For example, Application 1 and Application 2 in the knowledge base use general-purpose ports to transmit data, while Application 3 uses a non-general-purpose port. For instance, the numerical identifier of a general-purpose port ranges from 0 to 1023, while the numerical identifier of a non-general-purpose port is greater than 1023. Therefore, after the detection module 4 detects the numerical identifier of the port used by the message, if the numerical identifier is greater than 1023, it can search for the numerical identifier in the knowledge base and determine the service type of the Internet access service based on the numerical identifier (for example, the service type of the Internet access service is Application 3). However, if the numerical identifier is within the range of 0 to 1023, the detection module 4 detects that the service type of the Internet access service is multiple, such as Application 1 and Application 2, and cannot accurately determine the service type. In this case, the transport layer needs to continue sending the message to the upper-layer protocol stack to obtain more message features and identify the service type based on more message features.

[0079] For example, the router can configure a forwarding detection point ① or a local upload detection point ② at the session layer shown in Figure 2. A detection module 3 is configured in the INPUT chain of the local upload detection point ② or in the FORWARD chain of the forwarding detection point ①. The detection module 3 is mainly used to obtain the destination domain name of the packet, then match the destination domain name in the knowledge base, identify the service type of the Internet access service based on the destination domain name, and match the service type with the data in the permission configuration module to determine the permission configuration information of the packet.

[0080] For example, the router can configure a forwarding detection point ① or a local upload detection point ② in the presentation layer shown in Figure 2. A detection module 2 is configured in the INPUT chain of the local upload detection point ② or in the FORWARD chain of the forwarding detection point ①. The detection module 2 is mainly used to obtain the protocol content of various protocols, then match the protocol content in the knowledge base, identify the service type of the Internet access service based on the protocol content, and match the service type with the data in the permission configuration module to determine the permission configuration information of the packet.

[0081] For example, the router can configure a forwarding detection point ① at the application layer shown in Figure 2. A detection module 1 is configured in the FORWARD chain of the forwarding detection point ①. The detection module 1 is mainly used to obtain the payload data of the packet. The payload data of the packet is the actual data transmitted in network communication, excluding protocol header information used for control and addressing. Then, the payload data is matched in the knowledge base, the service type of the Internet access service is identified based on the payload, and the permission configuration information of the packet is determined by matching the service type with the data in the permission configuration module.

[0082] In some embodiments, the router can also configure other hook points in the OSI layer besides those shown in Figure 2. For example, it can configure a pre-route detection point in the data link layer and a local transmission detection point in the network layer. At the same time, it can configure various detection modules in the deep packet inspection module shown in Figure 2 at other hook points to identify the service type of Internet access services.

[0083] In other protocol stacks with a layered model, such as the TCP / IP protocol stack, the methods for configuring hook points at each layer and configuring the various detection modules in the deep packet inspection module at the hook points can refer to the configuration methods of the OSI layer, which will not be elaborated here.

[0084] The memory management module can allocate memory for the protocol stack to store the data that the protocol stack needs to process.

[0085] The driver module in Figure 2 acts as a bridge between hardware and software, ensuring the efficient and reliable operation of hardware devices and their coordination with other software components of the router. The driver module includes a Wi-Fi port (also called a Wi-Fi driver) and a network port (also called a network port driver). When electronic devices such as mobile phones and tablets connect to the router via Wi-Fi, data packets transmitted from the device to the router are forwarded through the Wi-Fi port. When electronic devices connect to the router via a wired network interface (i.e., the network port), data packets transmitted from the device to the router are forwarded through the network port driver.

[0086] The driver module also includes an acceleration module, which allows the router to improve packet forwarding performance.

[0087] It should be understood that the software architecture shown in Figure 2 is only illustrative and should not be construed as limiting the embodiments of this application.

[0088] The above embodiments describe the hardware structure and software architecture of the router. The following embodiments describe the implementation process of the Internet access service management method provided in this application.

[0089] It should be understood that the implementation process of the method provided in this application embodiment may include the following four parts: the first part: configuration of the knowledge base, the second part: generation of permission configuration information, and the third part: identification and control of Internet access services.

[0090] The implementation process of the method provided in the embodiments of this application will be described below in conjunction with the above three parts.

[0091] Part 1: Configuration of the knowledge base.

[0092] It should be understood that the knowledge base includes indexes and application message characteristics. The index may include application identifiers, type identifiers, and application names as shown in Table 1 below. For example, the application identifier could be the application's identification number (id), for instance... The ID number is 401. The ID number is 336, etc. In this embodiment of the application, the ID number can be different in different modes of the same application, for example, The ID number for the green mode is 409. The normal mode ID number is 401, etc. The "green mode" refers to the restriction of WeChat mini-programs, mini-games, video accounts, payment functions, etc. when using WeChat. The normal mode refers to the unrestricted access to various internet services while using WeChat. This application does not limit the specific value of the ID number in its embodiments.

[0093] The type identifier can be a type (category, category) number, for example, It belongs to the social networking category, with category number 128. It belongs to the audio category application, and the category number of audio is 32, etc. This application embodiment does not limit the specific value of the category number.

[0094] It should also be understood that the application names in different modes of the same application within the index can be different, for example, The application name in normal mode is The application name for the green mode is Green mode.

[0095] The message characteristics of the application include the protocol content of the Transport Layer Security Protocol (TLS) as shown in Table 1, the regular expression of the domain name, the protocol content of the HTTP protocol, the port forwarding configuration, the protocol content of the Google Quick UDP Internet Connections (GQIC) based on the User Datagram Protocol, the request content of the Domain Name System Request (DNS Request), the regular expression of the payload data, the calculation parameters of the application usage duration, the calculation threshold of the application usage duration, and other message characteristics.

[0096] The TLS protocol content mainly includes the content of the servername field in the client hello message of the TLS protocol. The servername field mainly includes the domain name of the server (which may be the server to be accessed or connected to) and the default port for data transmission based on the TLS protocol. The format of the TLS protocol content in the knowledge base is as shown in Table 1: tls = content1:port1; content2:port2. In the knowledge base, multiple domain names and ports are separated by semicolons. Here, content1 and content2 refer to the server's domain name, and port1 and port2 refer to the default port of the TLS protocol. For example, the TLS protocol content can be tls = wa.qq.com:443, which means accessing or connecting to the domain name wa.qq.com based on the default port 443 of the TLS protocol.

[0097] A domain name regular expression is a string of text patterns used to match the format of a domain name. A basic domain name regular expression may contain the following elements: Start and end: ^ is usually used to indicate the beginning of the regular expression, and $ to indicate the end, ensuring the entire string matches the pattern. Tags: A domain name consists of multiple tags, separated by dots. Length limit: Each tag is usually no more than 63 characters, and the entire domain name length is no more than 253 characters. Character limit: Domain names can contain letters, numbers, and hyphens (-), but cannot begin or end with a hyphen. Top-level domain (TLD): The last part of a domain name is the top-level domain, such as .com, .org, .net, .tv, etc., usually 2 to 63 characters long. The format of a domain name regular expression in the knowledge base is game_extern = content1; content2. In the knowledge base, multiple regular expressions are separated by semicolons, where content1 and content2 refer to different regular expressions. For example, the regular expression shown in Table 1 could be game_extern = ^hxqapi\.hiyun\.tv$.

[0098] The HTTP protocol content includes the content of the Uniform Resource Locator (url) field. The url field mainly includes the protocol, domain name, hostname, port number, access path, query parameters, and fragment identifier. In this embodiment, the url field mainly includes the access path and the default port of the HTTP protocol. For example, as shown in Table 1, http_url = qqmusic:80, where qqmusic represents the access path pointing to resources or pages related to the QQ Music service, and 80 represents the default port of the HTTP protocol.

[0099] The HTTP protocol also includes the content of the HTTP UserAgent field. The UserAgent field is an important part of the HTTP protocol; it's a field in the request header used to identify the client browser or application initiating the request. In this embodiment, the UserAgent field mainly includes the application identifier and the default port of the HTTP protocol. For example, Table 1 shows http_useragent = MicroMessenger:80, where MicroMessenger refers to... The client's identifier, which can be used to determine whether the user has passed the authentication process. You have accessed a webpage or service. 80 represents the default port for the HTTP protocol.

[0100] The HTTP protocol also includes the content of the HTTP host field. The HTTP host field is a request header used to specify the domain name (or IP address) and port number of the server being requested. For example, Table 1 shows http_host = weixin.qq.com:80, where weixin.qq.com refers to... The domain name, 80 refers to the default port of the HTTP protocol.

[0101] Port forwarding configurations include the ports used to forward traffic, which typically refers to the amount of data transmitted through a router. This includes all data packets passing through the router, whether entering or leaving the network. Port forwarding is a network address translation (NAT) technique that allows devices on one network to forward traffic from a specific port to a specific port on another network or device. For example, the format of a port forwarding configuration in the knowledge base is port=port1:port2, such as port=8000:17. port=8000:17 means that any data sent from the internet to port 8000 of the router will be forwarded to port 17 of the corresponding device on the internal network.

[0102] The main content of the gquic protocol includes the Server Name Indication (SNI) field, which contains the domain name to be accessed and the default port number of the gquic protocol. For example, Table 1 shows gquic = photo.qq.com; 443, where photo.qq.com represents the domain name of Tencent's online photo album service to be accessed, and 443 represents the default port number of the gquic protocol.

[0103] The DNS request content mainly includes the domain name to be accessed and the default port of the DNS protocol. For example, Table 1 shows dns=miguvideo:53, where miguvideo represents the domain name to be accessed. The domain name of the video application; 53 represents the default port for the DNS protocol.

[0104] Regular expressions for payload data can be used to query payload data that matches a specific pattern (this payload data can be represented as a string in the implementation). The design of this regular expression usually depends on the specific data format of the payload data that you want to match or parse. For example, in a regular expression, \d can match any number (0-9), \w can match any alphanumeric character, including underscores, \s can match any whitespace character (space, tab, etc.), parentheses can be used to create a group, which can be used to capture matched text or apply quantifiers, . can match any single character (except newline), \ can escape special characters or represent special sequences, such as \n (newline) and \t (tab), and [abc] can match any single character within square brackets. This application does not limit the form of the regular expression for payload data; for example, the regular expression for payload data could be https?: / / [^\s / $.? #].[^\s]* is used to match URLs that start with "http". For example, the regular expression for payload data can be \b(?:\d{1,3}\.){3}\d{1,3}\b, which is used to match IP addresses.

[0105] The regular expression for the payload data in this embodiment typically includes an identifier for the regular expression, the port number for transmitting the payload data, and the regular expression itself. The regular expression for the payload data is represented in the knowledge base using `payload_regex`. For example, Table 1 shows `payload_regex = 6:443:16 64 097765697869E6E756D000000`, where 6 represents the identifier for the regular expression, 443 represents the port number for transmitting the payload data, and 16 64 097765697869E6E756D000000 represents the hexadecimal regular expression. Hexadecimal regular expressions are typically used to represent bytecode pattern matching; in practical use, the hexadecimal regular expression needs to be converted to a binary regular expression.

[0106] The calculation parameters for application usage duration are represented by the character accel in the knowledge base. It should be understood that when calculating application usage duration, traffic based on different protocols, traffic conforming to regular expressions in payload data, or port-based traffic can be counted. Application usage duration is then calculated based on these traffic types. For example, the calculation parameters for application usage duration include various types such as 1, 2, 4, 8, 16, and 32 as shown in Table 1. Here, 1 represents traffic based on the HTTP protocol, 2 represents traffic conforming to payload_regex, 4 represents traffic based on the TLS protocol, 8 represents traffic based on the Gquic protocol, 16 represents traffic based on ports configured in the port forwarding settings, and 32 represents traffic based on the DNS protocol. In the implementation, the transmitted traffic can be used to calculate application usage time based on at least one of the parameters mentioned above. For example, `accel=1` indicates that the traffic transmitted by an application using the HTTP protocol is counted, and then the application usage time is calculated based on this traffic. `accel=32` indicates that the traffic transmitted by an application using the DNS protocol is counted, and then the application usage time is calculated based on this traffic. `accel=1+2+4=7` indicates that the traffic transmitted by an application using the HTTP protocol, the traffic conforming to `payload_regex`, and the traffic transmitted using the TLS protocol are counted, and then the application usage time is calculated based on the total traffic. In the implementation, when configuring the specific value of the application usage time calculation parameter in the knowledge base, bit operations can be performed according to actual needs or the application transmission traffic situation. For example, bit operations can be bitwise AND operations, OR bitwise OR operations, etc.

[0107] In existing solutions, when calculating application usage time, the knowledge base does not configure the type of calculation parameter for application usage duration. Instead, it calculates the overall traffic of an application. This may lead to inaccurate traffic statistics, as some applications may transmit traffic even when the user is not using them, resulting in inaccurate usage time statistics. In this embodiment, the knowledge base can be configured with one or more types of calculation parameters for application usage time, allowing for precise statistics on a specific type of traffic, such as traffic transmitted via the HTTP protocol. This removes redundancy, improves the accuracy of traffic statistics, and thus enhances the accuracy of calculating application usage time.

[0108] The threshold for calculating application usage time is represented by the symbol PPS in the knowledge base. For example, the default PPS value is PPS=1 as shown in Table 1, where PPS=1 represents 180 bytes / second. In other embodiments, the PPS value in the knowledge base can be adjusted; for example, PPS=2 represents 180×2=360 bytes / second, and PPS=3 represents 180×3=540 bytes / second. The purpose of configuring this calculation threshold in the knowledge base is to improve the accuracy of calculating application usage time. For example, when a user uses video applications (e.g.,...)... While watching the video, If the data transfer rate per second is relatively high, then the PPS value in the knowledge base can be configured to be relatively high, for example, PPS=3. Another example is when users use social applications (such as...). During the chat, If the amount of data transmitted per second is relatively small, then the PPS value in the knowledge base can be configured to be relatively small, for example, PPS=1.

[0109] Other message characteristics can be regular expressions for interfering domains, which are represented by the symbol `exclude_url` in the knowledge base. When calculating application usage time, some applications transmit traffic even when users are not using them, which can interfere with the statistical results. Therefore, applications causing interference can be excluded when calculating application usage time. Specifically, regular expressions for excluding interfering applications can be configured in the knowledge base. For example, `exclude_url = ^m\.ximalaya\.com$` as shown in Table 1 indicates the exclusion of... The regular expression for the domain name of this application.

[0110] Table 1

[0111] It should be noted that when configuring specific applications in the knowledge base, the indexes shown in Table 1 above and the application's message characteristics can be combined and configured in the knowledge base as needed. For example, Table 2 below shows a knowledge base including... Configuration information for WeChat (Normal Mode) and WeChat (Green Mode):

[0112] Table 2

[0113] In implementation, the knowledge base can be configured using the method shown in Figure 3 in the embodiments of this application. Figure 3 is an example diagram of configuring a knowledge base provided by the embodiments of this application.

[0114] For example, before the router leaves the factory, it can feed back data related to the embodiments of this application (such as the data shown in Tables 1 and 2) to the data collection server via a data feedback interface and the Internet. The knowledge base construction server constructs a knowledge base based on the information collected by the data collection server. The knowledge base publishing server publishes the knowledge base constructed by the knowledge base construction server for the router to download.

[0115] After the router leaves the factory, if the versions of applications installed on mobile phones, laptops, and desktop computers are updated, the router can update the message characteristics in its knowledge base through the Higher Order Tracking Accuracy (HOTA) component to ensure that the message characteristics are consistent with the application versions. It should be understood that HOTA can use automated tools to monitor changes in message characteristics and perform content reviews and updates periodically or irregularly.

[0116] In other embodiments, the functions of the data collection server, knowledge base construction server, and knowledge base publishing server described above can be integrated into a single server. This server may also be referred to as a computing cloud, server cluster, etc.

[0117] It should also be understood that, as shown in Figure 2, the knowledge base is mainly used to enable the deep packet inspection module to identify the service type of Internet access services based on the knowledge base. Therefore, after the router downloads the knowledge base from the knowledge base construction server shown in Figure 3, it first stores the downloaded knowledge base in the knowledge base storage module shown in Figure 2. Then, after the router is powered on and started, the knowledge base is loaded into the deep packet inspection module and updated through the HOTA component.

[0118] For example, please refer to Figure 4, which is an example diagram of a router downloading, loading and updating a knowledge base provided in an embodiment of this application.

[0119] In implementation, the process of the router downloading the knowledge base can be as follows: For example, referring to Figure 4, the router first downloads the original knowledge base configuration file from the knowledge base publishing server. For example, the name of this configuration file could be rule.txt. Then, the router can encrypt the configuration file to generate an encrypted knowledge base. For example, the router can encrypt it using a script tool that executes an encryption algorithm, or it can encrypt it using a script tool that executes an encryption algorithm via a computing cloud. The encryption algorithm can be a symmetric encryption algorithm, an asymmetric encryption algorithm, a hash function, or a random number generation algorithm, etc. This application embodiment does not limit this; for example, this application embodiment can use the Advanced Encryption Standard (AES) for encryption.

[0120] The router then stores the encrypted knowledge base in the knowledge base storage module shown in Figure 2 and generates a storage path. For example, the encrypted knowledge base may include the knowledge base date information, knowledge base version information, key, knowledge base payload length, the index and message characteristics of the encrypted application, and an encryption signature, as shown in Figure 4. The key can be an AES key, the application index and message characteristics refer to the content shown in Tables 1 and 2, and the encryption signature can be a Message Digest Algorithm 5 (MD5) signature. For example, the storage path could be / etc / dpie. For example, the configuration file name for the encrypted knowledge base could be rule.dat.

[0121] The process of updating the knowledge base by the router can be as follows: For example, please refer to Figure 4. The router updates the knowledge base in the knowledge base storage module through the HOTA component and generates the updated storage path, for example, the storage address is / config / dpie.

[0122] The process of a router loading a knowledge base can be illustrated as follows (see Figure 4): After the router powers on, the deep packet inspection module can read the version information of the knowledge base from its encrypted storage path (e.g., / etc / dpie). Then, the deep packet inspection module decrypts and loads the knowledge base with the higher version number. After the knowledge base is updated, the deep packet inspection module can also read the updated knowledge base from its updated storage path (e.g., / config / dpie), and decrypt and load the updated knowledge base.

[0123] Part Two: Generation of Permission Configuration Information.

[0124] It should be understood that router permission configuration information typically involves internet access control, management password settings, and guest network settings. Router permission configuration can be applied in various scenarios. For example, in an office setting, the router's internet access control function can be used to differentiate internet access permissions for internal hosts. For instance, the manager's computer can be set to have no internet access restrictions, while employee computers can only access specific websites and applications during work hours. Another example is in a home setting, where parents can use a primary device (such as the parent's phone or tablet) to configure internet access permissions for children's secondary devices (such as the child's phone or laptop) through the router. For example, they can set internet access time limits for the child's phone and configure settings for the child's phone's... For example, green mode.

[0125] The following section uses setting up internet access permissions in a home setting as an example to introduce the process of generating permission configuration information on a router.

[0126] For example, please refer to Figure 5, which is a schematic diagram of setting internet access permissions according to an embodiment of this application. Interface 510 shown in Figure 5(a) can refer to the main interface of the parent's mobile phone. Interface 510 includes a control 511, which the parent can click. In response to the parent clicking the control 511, interface 520 shown in Figure 5(b) is displayed. Interface 520 includes a card 521, which the parent can click. In response to the parent clicking the control 521, interface 530 shown in Figure 5(c) is displayed. Interface 530 includes a card 531, which the parent can click. In response to clicking the card 531, interface 540 shown in Figure 5(d) is displayed. The online devices in interface 540 include one or more device names connected to the router, where control 541 refers to the device name of the child's mobile phone, which the parent can click. In response to a parent clicking control 541, interface 550 shown in Figure 5(e) is displayed. Interface 550 includes control 551 corresponding to the child internet protection function, which the parent can click. In response to a parent clicking control 551, interface 560 shown in Figure 5(f) is displayed. Interface 560 can be understood as a permission information configuration interface, where the user can set the child's mobile phone's internet access permissions. For example, the user can set the child's mobile phone's internet access time and duration through card 564 in interface 560, set the internet access permissions for video applications on the child's mobile phone through card 562, set the internet access permissions for social applications on the child's mobile phone through card 561, and can also add websites and applications that are prohibited from being accessed by the child to a blacklist through card 563.

[0127] The following section, with reference to Figure 6, describes the process of setting the internet access permissions for applications on a child's mobile phone to green mode.

[0128] For example, Figure 6 is a schematic diagram of setting a green mode according to an embodiment of this application. The interface 610 shown in Figure 6(a) can be understood as a permission information configuration interface, which includes a card 611 that parents can click. In response to the parent clicking the card 611, the interface 620 shown in Figure 6(b) is displayed. Interface 620 includes applications that can be set to green mode, such as... and Each application has a corresponding control to enable / disable the green mode; for example, control 621 refers to... The on / off control can be accessed by clicking control 621. The interface 620 also includes a select all control 622, which users can click to enable green mode for all applications displayed in the interface 620.

[0129] It should also be understood that upon receiving the aforementioned external input, such as user operations on interface 560 shown in Figure 5, or user operations on interface 620 shown in Figure 6, the router can generate and store permission configuration information based on the external input. For example, please refer to Figure 7, which is a timing diagram for generating permission configuration information according to an embodiment of this application. This timing diagram includes steps S701 to S706.

[0130] In the S701 router, the CMO node in the Web service of the user space configuration management module receives external input.

[0131] It should be understood that explanations regarding user space, configuration management module, web services, CMO node, and external inputs can be found in the above embodiments, and will not be repeated here.

[0132] In practice, for example, after a user performs a user operation on the mobile phone interface 560 shown in Figure 5, the mobile phone can send the user operation to the router through the RESTful interface (the user operation can be understood as external input), and then the router sends the user operation to the CMO node in the Web service.

[0133] S702, the CMO node generates permission configuration information based on external input.

[0134] It should be understood that the permission configuration information includes multiple permission entries, each of which includes a mapping between the device's MAC address and at least one service permission entry. For example, this mapping can be found in Table 3:

[0135] Table 3

[0136] In Table 3, MAC address 1, MAC address 2, or MAC address 3 can refer to the MAC address of an electronic device whose internet access permissions are restricted, such as the MAC address of a child's mobile phone mentioned in the above embodiment.

[0137] As can be seen from Table 3, a single permission information item corresponds to one or more business permission information items, and a single business permission information item includes the correspondence between one or more business parameters and permission parameters.

[0138] For example, in the first business permission information corresponding to MAC address 1, the business parameter included in this first business permission information is only business parameter 1. Business parameter 1 can refer to the application's ID number. For example, this ID number can refer to... The green mode ID number, for example, ID number 409 shown in Table 3. The permission parameter corresponding to business parameter 1 is "prohibit network access". This permission can be understood as: if a parent sets a restriction on a child's phone... In green mode, children can use the phone... During the process, WeChat mini-programs, mini-games, video accounts, payment services, and other internet-enabled services are prohibited from accessing the network. In practice, parents can enable this through card 621 on interface 620 shown in Figure 6. In the green mode, the router then generates the first service permission information corresponding to MAC address 1 (which can be considered the MAC address of the child's mobile phone) shown in Table 3 through S701 and S70 in the above embodiment.

[0139] For example, in the second business permission information corresponding to MAC address 1 in Table 3, this second business permission information only includes business parameter 1. Business parameter 1 can refer to the application's ID number. For example, this ID number can refer to... The ID number. The permission parameter corresponding to business parameter 1 is "Deny network access". This permission can be understood as: if a parent sets certain permissions on the child's phone... If internet access is restricted, children will be unable to use TikTok for any online activities. In practice, parents can set this through card 562 in interface 560 (as shown in Figure 5). The child's internet access permission is set to be prohibited from accessing the network. Subsequently, the router generates the second service permission information corresponding to MAC address 1 (which can be considered the MAC address of the child's mobile phone) shown in Table 3 through S701 and S702.

[0140] For example, in the third business permission information corresponding to MAC address 1 in Table 3, this third business permission information includes business parameter 1. Business parameter 1 can refer to the application ID number. For example, this ID number can include the ID numbers of multiple browser applications, such as application C and application D. Application C can be... Application D can be The service parameter 1 corresponds to the permission parameter for blocking access to domain 1. This permission can be understood as follows: if a parent sets their child's phone to block access to domain 1 via a browser, the child will be unable to access that website through various browsers on their phone. In implementation, parents can set up the blocking of a website through card 563 in interface 560 shown in Figure 5. Afterwards, the router generates the third service permission information corresponding to MAC address 1 (which can be considered the MAC address of the child's phone) shown in Table 3 via S701 and S702.

[0141] For example, in the first permission information entry corresponding to MAC address 2 in Table 3, this first permission information entry includes business parameter 1, which includes the IDs of multiple applications. These application IDs can be directly filled in using the application IDs, for example: ID number The ID number, etc., can also be filled with special characters, such as the special characters "all" or "null". This application embodiment does not limit the use of special characters. The permission parameter corresponding to business parameter 1 is that the online time does not exceed duration 1, for example, duration 1 is 3 hours. This application embodiment does not limit the specific value of duration 1. This permission can be understood as: for example, if business parameter 1 includes multiple applications (e.g., ... and If a child uses an electronic device with an ID number, then the child can use the device... and The internet connection will be automatically disconnected if the child's online time exceeds the allotted time limit of 1. If service parameter 1 includes special characters, the internet connection will be automatically disconnected if the child uses any application on the electronic device for more than the allotted time limit of 1. In practice, parents can set the allowed internet access time for the entire child's electronic device (e.g., a tablet computer with MAC address 2) or the internet access time for certain applications on the electronic device through card 564 in interface 560 shown in Figure 5. After that, the router generates the first service permission information corresponding to MAC address 2 as shown in Table 3 through S701 and S702.

[0142] For example, in the second permission information corresponding to MAC address 2 in Table 3, this second permission information includes service parameter 2, which is category number = number 1 (for example, number 1 refers to the game type). The permission parameter corresponding to number 1 is to prohibit network access. This permission can be understood as: if parents set their children's mobile phones to prohibit playing games, then the children cannot play games provided by various applications through their mobile phones. In implementation, parents can set to prohibit playing all game applications through the "Games" card in the interface 560 shown in Figure 5. Afterwards, the router generates the second service permission information corresponding to MAC address 2 shown in Table 3 through S701 and S702.

[0143] For example, in the business permission information corresponding to MAC address 3 in Table 3, this business permission information includes business parameter 1, which includes the IDs of multiple applications. These application IDs can be directly filled in using the application IDs, for example: ID number The ID number, etc., can also be filled with special characters, such as the special characters "all" or "null". This application embodiment does not limit the use of special characters. The permission parameter corresponding to business parameter 1 and business parameter 2 is to prohibit network access. This application embodiment does not limit the specific value of duration 1. This permission can be understood as: for example, if business parameter 1 includes multiple applications (e.g., ... and The ID number of the child's electronic device. and If the network connection fails, and special characters are included in service parameter 1, the child's electronic device will be unable to connect to the network. In practice, parents can operate on interface 560 shown in Figure 5 to set the child's electronic device (e.g., if the child's electronic device is a smartwatch, and the tablet's MAC address is MAC address 3) to disconnect from the network with one click or prevent certain applications from connecting to the network. Afterwards, the router generates the service permission information corresponding to MAC address 3 as shown in Table 3 via S701 and S702.

[0144] In this embodiment of the application, the domain name mentioned above may refer to the domain name of a specific website, server, or application, or it may refer to a regular expression of the domain name. This embodiment of the application does not limit this.

[0145] It should be understood that Table 3 only shows some permission configuration information as an example. In other embodiments, the permission configuration information may include more or fewer correspondences between MAC addresses and business permission information. This application embodiment does not limit this.

[0146] In the S703 router's user control, the Content Management System (CMS) monitors whether the Content Management Object (CMO) has generated permission configuration information.

[0147] S704, when CMS detects that CMO has generated permission configuration information, it encapsulates the permission configuration information.

[0148] It should be understood that encapsulating permission configuration information usually refers to organizing configuration data into a structured form for easier management and use.

[0149] In S705, CMS sends permission configuration information to the permission configuration module in the router's kernel space.

[0150] S706, the permission configuration module stores the encapsulated permission configuration information.

[0151] Part Three: Identification and Control of Internet Access Services

[0152] It should be understood that the process by which an electronic device (e.g., a mobile phone) enables internet access (e.g., watching videos, playing games) through a router can be as follows: For example, please refer to Figure 8, which is an example diagram of a mobile phone enabling internet access through a router according to an embodiment of this application.

[0153] In Figure 8, the mobile phone receives a user's operation on the application (for example, the operation could be that the user opens...). How to watch videos and open them After the mini-program plays the game, the application generates data that needs to be sent over the network. This data includes the application's payload data, which usually refers to the effective data portion actually transmitted over the network after removing protocol overhead. For example, the payload data of a game application may refer to the game's plot, characters, gameplay, levels, etc., while the payload data of a video application may refer to video images, audio samples, etc.

[0154] The application then sends the data to the phone's internal protocol stack (Figure 8 uses the OSI model as an example of this layered protocol stack). The internal protocol stack encapsulates the data into messages. During data encapsulation, each layer is responsible for different communication tasks, and each layer encapsulates the data, adding corresponding header information (and sometimes trailer information), before passing it to the next layer. For example, on a mobile phone, data is passed down from the application layer, with each layer adding its own header information until the physical layer, and then sent out through the physical medium.

[0155] For example, as shown in Figure 8, the application layer can add protocol control information to application data (including payload data), such as the URL and method of an HTTP request (e.g., POST, GET), encapsulating the payload data into application layer data units. The application layer passes these data units to the presentation layer, which adds presentation layer header information, including encryption information, a description of the data format, and protocol content. For example, the protocol content could refer to HTTP, TLS, Gquic, or DNS protocol content. The presentation layer then passes the data to the session layer, which adds session layer header information, including session control information and DNS protocol content. Finally, the session layer passes the data to the transport layer, which adds transport layer header information, including the source and destination port numbers, which are used to identify the sending and receiving applications. The transport layer passes transport layer data to the network layer. The network layer adds a network layer header to the transport layer data, which includes the source IP address, destination IP address, and destination domain name. The network layer then passes transport layer data to the data link layer, which adds a data link layer header, including the source MAC address and destination MAC address. Finally, the data link layer passes the data to the physical layer. The physical layer does not add a header, but it converts the encapsulated message into a bit stream (usually an optical signal, electrical signal, or radio wave) and transmits the bit stream to the router over a physical medium, such as air, fiber optic cable, or cable. The bit stream consists of 0s and 1s.

[0156] Subsequently, on the router side, the encapsulated message is passed upwards from the physical layer, with each layer removing the corresponding header information until the application layer, to complete the decapsulation of the encapsulated message. For example, as shown in Figure 8, the data link layer header information is removed at the router's data link layer, the network layer header information is removed at the network layer, the transport layer header information is removed at the transport layer, the session layer header information is removed at the session layer, the presentation layer header information is removed at the presentation layer, and the protocol control information is removed at the application layer to obtain the payload data.

[0157] It should be understood that during the process of the router decapsulating the encapsulated packets through the protocol stack, the router can identify the service type of the internet access service based on the decapsulated data, and control the internet access service based on the service type and the permission configuration information mentioned in the above embodiments. The router's control over the internet access service includes, for example, forwarding the packets to the internet through the WIFI port or network port shown in Figure 2 to achieve the aforementioned internet access service. It can also include: the router blocking the aforementioned internet access service.

[0158] For example, please refer to Figure 9, which is a timing diagram of identifying and managing Internet access services according to an embodiment of this application. Figure 9 describes the identification and management of Internet access services in conjunction with the software structure shown in Figure 2. The timing diagram in Figure 9 includes S901 to S924.

[0159] S901, the router's physical layer receives message 1 and passes message 1 to the data link layer.

[0160] It should be understood that message 1 can refer to the message encapsulated by the mobile phone's protocol stack as shown in Figure 8, received by the router's physical layer. The structure of message 1 can be referenced from the message encapsulated in the data link layer on the mobile phone side as shown in Figure 8.

[0161] It should also be understood that the physical layer receives message 1 in the form of a bit stream. The physical layer can amplify the signal, filter noise, and perform clock recovery on the bit stream so that it can correctly parse the bit stream according to the bit rate on the mobile phone side as shown in Figure 8. After that, the physical layer can pass message 1 to the data link layer.

[0162] In other embodiments, after receiving message 1, the physical layer can first pass message 1 to the acceleration module in the driver module shown in Figure 2. The acceleration module determines whether message 1 meets the acceleration conditions. If message 1 meets the acceleration conditions, it can be directly forwarded to the Internet through the network shown in Figure 2 without going through the upper-layer protocol stack (e.g., the upper-layer protocol stack can be the data link layer to the application layer shown in Figure 2). If message 1 does not meet the acceleration conditions, the physical layer can pass message 1 to the upper-layer protocol stack. It should be understood that the acceleration conditions can include an acceleration identifier in message 1, etc., and the embodiments of this application do not limit the acceleration conditions.

[0163] S902, the data link layer parses message 1 to obtain the data link layer header information and message 1.1. The data link layer header information includes the source MAC address and destination MAC address of message 1.

[0164] It should be understood that parsing message 1 at the data link layer can be interpreted as the data link layer decapsulating or unpacking message 1. As shown in Figure 8, during the message encapsulation process on the mobile phone side, the data link layer can add data link layer header information to the message. This header information includes the source MAC address and destination MAC address, etc. The source MAC address can refer to the sender's MAC address, and the destination MAC address can refer to the receiver's MAC address. For example, when a child uses a mobile phone... When playing games, the source MAC address is the phone's MAC address, and the destination MAC address is... The server's MAC address. After decapsulating packet 1, the router's data link layer can obtain the data link layer header information and packet 1.1. The data link layer header information includes the source MAC address and destination MAC address of packet 1. Packet 1.1 refers to the packet remaining after removing the data link layer header information from packet 1, such as the packet shown in the router's data link layer in Figure 8.

[0165] S903, a Netfilter forwarding detection point is configured in the data link layer, and a detection module 6 is configured in the FORWARD chain on the forwarding detection point. The detection module 6 obtains the source MAC address and destination MAC address of packet 1 parsed by the data link layer.

[0166] It should be understood that the function of detection module 6 is to intercept data parsed by the data link layer. The configuration of the detection points in S903 has been described in the above embodiments and will not be repeated here.

[0167] S904, the detection module 6 matches the source MAC address and destination MAC address with the data in the permission configuration information to obtain the matching result.

[0168] It should be understood that the method for generating permission configuration information can refer to the method shown in Part II above, and the data in the permission configuration information can refer to the data shown in Table 3. As shown in Table 3, the data in the permission configuration information includes multiple permission information entries. Each permission information entry includes the correspondence between a device's MAC address and at least one service permission information entry. Each service permission information entry includes the correspondence between one or more service parameters and permission parameters.

[0169] In implementation, when performing matching, the detection module 6, for example, can traverse each piece of permission information in the permission configuration information to determine whether a source MAC address exists in the permission configuration information (since the permission configuration information is for restricting the device's internet access services, the MAC address in the permission configuration information shown in Table 3 refers to the sender's MAC address, i.e., the source MAC address; for example, the source MAC address refers to the MAC address of a child's mobile phone, tablet, etc.). If a source MAC address is found in the permission configuration information, it is determined whether each service parameter in the permission configuration information is a specific parameter. If each service parameter is determined to be a specific parameter, the matching result for this matching is obtained as matching result 1. Matching result 1 includes the service permission information corresponding to the source MAC address, which includes the permission parameter corresponding to the specific parameter. Then, internet access services are controlled based on this permission parameter. For example, matching result 1 could be the service permission information corresponding to MAC address 3 in Table 3, or it could be the first piece of service permission information corresponding to MAC address 2.

[0170] It should be understood that a specific parameter can refer to a business parameter that is a special character. For example, the business parameter 1 corresponding to MAC address 2 or MAC address 3 shown in Table 3 is the special character "all".

[0171] For example, suppose the source MAC address intercepted by the detection module 6 is MAC address 3, the destination MAC address is MAC address 4, and the permission configuration information is the data shown in Table 3. After the detection module 6 traverses the permission configuration information, it determines that MAC address 3 exists in the permission configuration information and that the business parameter 1 corresponding to MAC address 3 is the special character "all". Then the detection module 6 can obtain the matching result 1. Afterwards, the detection module 6 controls the Internet access service based on the permission parameter in the permission configuration information (such as the permission parameter being prohibited from accessing the network). For example, children cannot access the Internet using mobile phones, and the MAC address of the mobile phone is MAC address 3.

[0172] Of course, if the matching result is 1, the permission parameter can also be any permission other than prohibiting network access. For example, the permission parameter in the first service permission information corresponding to MAC address 2 is "Internet access time not exceeding 1 minute". When the permission parameter is the above permission, the child's use of the mobile phone to access the Internet using MAC address 2 will not exceed 1 minute. If the time exceeds 1 minute, the mobile phone will be disconnected from the Internet. Figure 9 illustrates this with the permission parameter "prohibit network access".

[0173] If the detection module 6 determines that a source MAC address does not exist in the permission configuration information, or if the detection module 6 determines that a source MAC address exists in the permission configuration information and that at least one of the one or more service parameters in the permission configuration information is not a specific parameter, then the matching result for this match is called Matching Result 2. Matching Result 2 includes the service permission information corresponding to the source MAC address, which includes the permission parameters corresponding to the non-specific parameters. Non-specific parameters refer to service parameters that are not special characters. For example, Matching Result 2 could be the service permission information corresponding to MAC address 1 in Table 3, or it could be the second service permission information corresponding to MAC address 2. Afterwards, the detection module 6 sends Notification 1 to the data link layer based on Matching Result 2, and the data link layer transmits Message 1.1 to the network layer based on Notification 1.

[0174] For example, suppose the source MAC address intercepted by the detection module 6 is MAC address 5, the destination MAC address is MAC address 4, and the permission configuration information is the data shown in Table 3. After the detection module 6 traverses the permission configuration information, it cannot determine the MAC address in Table 3. Therefore, the detection module 6 determines the matching result of this time as matching result 2. Then, the detection module 6 sends notification 1 to the data link layer based on matching result 2, and the data link layer transmits message 1.1 to the network layer.

[0175] For example, suppose the source MAC address intercepted by the detection module 6 is MAC address 1, the destination MAC address is MAC address 4, and the permission configuration information is the data shown in Table 3. After traversing the permission configuration information, the detection module 6 determines that MAC address 1 exists in the permission configuration information, and determines that at least one of the one or more business parameters in the permission configuration information is not a specific parameter. For example, the business parameter 1 in the first business permission information corresponding to MAC address 1 is the ID of application A, the business parameter 1 in the second business permission information is the ID of application B, the business parameter 1 in the third business permission information is the ID of application C and the ID of application D, and the business parameter 2 is domain name 1. Then the detection module 6 determines that the matching result is matching result 2. After that, the detection module 6 sends notification 1 to the data link layer based on matching result 2, and the data link layer transmits message 1.1 to the network layer.

[0176] S905, when the detection module 6 determines that the matching result is matching result 1, it sends instruction 1 to the memory management module.

[0177] S906, the memory management module, based on instruction 1, releases the memory occupied by the socket buffer associated with message 1.

[0178] It should be understood that S705 and S706 are the processes by which the router controls internet access services when the permission parameters included in the matching result 1 are set to prohibit network access.

[0179] It should be understood that a socket buffer (sk_buff), or simply a buffer, is a data structure in kernel space that stores network data packets. This data structure is used by various layers in the protocol stack to store their header information, user data, and other data required for them to perform their work.

[0180] It should also be understood that the `sk_buff` structure requires memory. In the router's kernel space, the `sk_buff` structure is dynamically allocated. When the router kernel needs to process network packets, it allocates an `sk_buff` to store this information. This process involves memory allocation, which is typically handled by the router's memory management module in the kernel space, as shown in Figure 2. For example, when the protocol stack on the mobile phone side (as shown in Figure 8) needs to process data, the memory management module allocates an `sk_buff` to store data, such as payload data, presentation layer header data, session layer header data, transport layer header data, network layer header data, and data link layer header data. When the `sk_buff` is no longer needed, the memory it occupies needs to be released to avoid memory leaks. Memory release is usually accomplished by calling the `kfree_skb()` function, which appropriately releases the `sk_buff` and all its associated resources.

[0181] In this embodiment, when the detection module 6 determines that the matching result is matching result 1, the detection module 6 can send a memory release instruction (e.g., instruction 1) to the memory management module, causing the memory management module to release the memory occupied by the sk_buff associated with the currently processed packet. It should be understood that the packet currently being processed by the router's protocol stack is packet 1, as shown in Figure 8, which has been encapsulated on the mobile phone side. Therefore, the currently processed packet can be considered as packet 1 mentioned above. Because the memory management module releases the memory occupied by the sk_buff associated with packet 1, packet 1 cannot be transmitted to the upper layer of the router's protocol stack, thereby preventing the sender (e.g., a child's mobile phone) from accessing the network based on the relevant data contained in packet 1 (e.g., the MAC address of the child's mobile phone).

[0182] In other embodiments, the matching result 1 may also include other permission parameters, such as the online time not exceeding duration 1. The process of controlling online services may also be as follows: For example, the detection module 6 marks the source MAC address included in the message 1 through the marking module shown in Figure 2, then counts the traffic transmitted based on the source MAC address, and then determines the online time based on the counted traffic. If the counted online time exceeds duration 1, the memory occupied by the socket buffer associated with the message 1 is released. Thus, if the online time exceeds duration 1, the function of prohibiting the sender (e.g., a child's mobile phone) from accessing the network based on the relevant data (e.g., the MAC address of the child's mobile phone) contained in the message 1 can be implemented.

[0183] S907, if the detection module 6 determines that the matching result is matching result 2, it sends notification 1 to the data link layer.

[0184] S908, after receiving notification 1, the data link layer sends message 1.1 to the network layer.

[0185] Notification 1 can include matching result 2.

[0186] S909, the network layer parses message 1.1 to obtain the network layer header information and message 1.2. The network layer header information includes the domain name A of message 1.

[0187] It should be understood that parsing message 1.1 at the network layer can be interpreted as the network layer decapsulating or unpacking message 1.1. As shown in Figure 8, during the message encapsulation process on the mobile phone side, the network layer can add network layer header information to the message. This header information includes the destination domain name, which can refer to the recipient's domain name, such as the domain name of a child using a mobile phone. If you're playing games, then the target domain is... The server's domain name. After the router's network layer decapsulates packet 1, it can obtain the network layer header information and packet 1.2. The network layer header information includes the destination domain name of packet 1. Packet 1.2 refers to the packet remaining after removing the network layer header information from packet 1.1, such as the packet shown in the router's network layer in Figure 8.

[0188] Assuming message 1 is a DNS message, a DNS message includes a header, a question section, an answer section, an authority section, and an additional section. The header includes basic information about the message, such as the transaction ID, flags (including query / response flags, authority answer flags, etc.), the number of questions, the number of answers, the number of authority records, and the number of additional records.

[0189] The question section includes: Domain Name (QNAME): The domain name being queried. Query Type (QTYPE): The type of query, such as A record, AAAA record, MX record, etc. Query Class (QCLASS): Usually IN, indicating the Internet.

[0190] If the message is a response, the answer portion contains information responding to the question portion, including: NAME: The domain name of the response, usually the same as the domain name in the question portion. TYPE: The record type of the response. CLASS: The record class of the response, usually IN. TTL (Time to Live): The time the record has been cached on the DNS server. RDLENGTH: The length of the resource record data portion. RDATA: The actual response data, such as the IP address.

[0191] The Authorized Resource Records section contains information about the authoritative servers, which are the DNS servers responsible for that zone.

[0192] The additional record section contains extra information, such as the address of the DNS server.

[0193] In implementation, when the network layer parses a DNS message, it can extract the query field (qry.name) from the question section of the DNS message. The qry.name field refers to the domain name field in the question section, thus allowing the retrieval of domain name A. Domain name A refers to the recipient's domain name, for example, the domain name of a child using a mobile phone. Playing games, domain A refers to The domain name.

[0194] The network layer can then send a query request to the DNS server, including the `qry.name` field, to obtain the IP address corresponding to domain name A. Assuming the DNS server returns the IP address of domain name A to the network layer, the sender (e.g., a child's phone) can then access the receiver's server (e.g., a child's mobile phone) based on that IP address. (server).

[0195] S910, a Netfilter forwarding detection point is configured in the network layer, and a detection module 5 is configured in the FORWARD chain of the forwarding detection point. Alternatively, a Netfilter local upload detection point is configured in the network layer, and a detection module 5 is configured in the INPUT chain of the local upload detection point. The detection module 5 obtains the domain name A of the packet 1.1 resolved by the network layer.

[0196] It should be understood that the function of the detection module 5 is to intercept the data parsed by the network layer. The configuration of the detection points in S910 has been described in the above embodiments and will not be repeated here.

[0197] S911, Detection module 5 determines whether the service type of Internet access service can be identified based on domain name A and knowledge base.

[0198] In implementation, the detection module 5 can determine whether the service type of Internet access can be identified by checking whether a regular expression corresponding to domain A exists in the knowledge base. If the detection module 5 determines that a regular expression corresponding to domain A exists in the knowledge base, it determines the service type of Internet access based on the regular expression corresponding to domain A. If the detection module 5 determines that a regular expression corresponding to domain A does not exist in the knowledge base, it cannot determine the service type of Internet access.

[0199] For example, assuming the knowledge base is Table 2 mentioned in the above embodiment, and the regular expression corresponding to the domain name in Table 2 is represented by the symbol game_extern, the detection module 5 searches Table 2 for a regular expression that matches domain name A. If a regular expression matching domain name A is found in Table 2, for example, regular expression 6 in Table 2 matches domain name A, then the detection module determines that the service type of the Internet access service is id = 409 (where id represents...). If the application ID for the green mode is not found in Table 2, and no regular expression matching the domain name A is found, the service type of the internet access service cannot be determined. Detection module 5 can search for the existence of a regular expression matching the domain name A based on efficient string search algorithms (Knuth-Morris-Pratt Algorithm, KMP), trie, etc., but this application does not limit this.

[0200] It should be understood that business types can be categorized based on the granularity of the application, for example, Alternatively, categorization can be based on the granularity of the application's category, such as games, video, social media, etc. For example, the games category includes... Videos include... Business types can also be categorized based on other granularities, such as distinguishing different types within the same application, for example... The application includes text transmission services, financial transaction services, image transmission services, video transmission services, redirection services, and game services, etc., but the specifics are not limited here. Therefore, the service types in this application embodiment can be characterized using the application's ID number, the application's category number, etc.

[0201] It should also be understood that the regular expression of a domain name corresponds to at least one IP address. Assuming the domain name is a source domain name, then the regular expression of the domain name corresponds to at least one source IP address. Assuming the domain name is a destination domain name, then the regular expression of the domain name corresponds to at least one destination IP address. If the detection module 5 determines that there is a regular expression corresponding to domain name A in the knowledge base, in one possible case, the router can achieve network connection through at least one destination IP address corresponding to the regular expression corresponding to domain name A.

[0202] It's also understandable that, to avoid a problem with one domain name jeopardizing the entire internet service, application servers typically deploy multiple domain names, for example, The domain names can be: pull-tsl-vr-l3.douyincdn.com, pull-flv-f1.douyincdn.com, pull-rtmp-l29.douyincdn.com, etc. Related solutions configure multiple domain names in the knowledge base to identify the service type of internet access. However, the number of domain names for application servers is large, and it's difficult to include all of them in the knowledge base. This can lead to the failure of service type identification, allowing controlled services to bypass regulations. For example, parents setting restrictions on children's phones... Network access is blocked. The router's knowledge base is configured with the domains pull-tsl-vr-l3.douyincdn.com and pull-flv-f1.douyincdn.com. The server's domain name is pull-rtmp-l29.douyincdn.com. Based on this domain name and knowledge base, the business type cannot be determined, rendering business type identification ineffective. This domain name can be used to bypass controls, allowing children to continue using it. To access the internet.

[0203] In this embodiment of the application, the knowledge base is configured with regular expressions for domain names, such as... The regular expression is: douyincdn\.com$. Therefore, any domain name that matches this regular expression can be considered as having the following service type: [service type missing].

[0204] For example, pull-tsl-vr-l3.douyincdn.com, pull-flv-f1.douyincdn.com, and pull-rtmp-l29.douyincdn.com all conform to the above regular expression. Therefore, the service type of the internet access service can be determined from the knowledge base based on this regular expression. After that This allows for effective management and control, meaning that the embodiments of this application can accurately identify the business type, thereby improving the user experience.

[0205] S912, when the detection module 5 determines that the service type of the Internet access service can be identified, it matches the service type of the Internet access service with the data in the permission configuration information to obtain the matching result.

[0206] In the implementation, when performing matching, the detection module 5, for example, can iterate through each piece of permission information in the permission configuration information to determine whether there is a service type for internet access services in the permission configuration information. If it is determined that there is a service type for internet access services in the permission configuration information, the matching result for this matching is obtained as matching result 3. Matching result 3 includes the service permission information corresponding to the source MAC address. This service permission information includes the permission parameters corresponding to the service type of internet access services. Then, internet access services are controlled based on these permission parameters.

[0207] For example, assuming the business type is application A's ID and the permission configuration information is the data in Table 3 above, the detection module 5 traverses each permission information in Table 3 and determines that application A's ID exists in Table 3. Then the detection module can obtain matching result 3. Matching result 3 includes the first business permission information corresponding to MAC address 1 shown in Table 3. The first business permission information includes application A's ID and the permission parameter corresponding to application A's ID: network access prohibited.

[0208] Of course, if the matching result is 3, the permission parameter can also be other permissions besides prohibiting network access, such as the permission parameter being that the internet access time cannot exceed 1 minute.

[0209] When the detection module 5 performs matching, if it determines that there is no Internet access service type in the permission configuration information, the matching result for this match is match result 4. Then, the detection module 5 sends notification 2 to the network layer based on match result 4, and the network layer transmits message 1.2 to the transport layer based on notification 2.

[0210] For example, suppose the service type of the internet access service is the ID of application A, and the permission configuration information only includes the data corresponding to MAC address 3 in Table 3 above. Then, the detection module 5 iterates through the data corresponding to MAC address 3. The service parameter 1 corresponding to MAC address 3 is filled with the special character "all". The detection module 5 determines that the ID of application A does not exist, so the detection module 5 can obtain matching result 4. As another example: suppose the service type of the internet access service intercepted by the detection module 5 is the ID of application A, and the permission configuration information only includes the third data corresponding to MAC address 1 in Table 3 above. The service parameter 1 of the third data corresponding to MAC address 1 is filled with the IDs of application C and application D. Then, the detection module 5 iterates through the third data corresponding to MAC address 1, determines that the ID of application A does not exist, and obtains matching result 4.

[0211] S913, if the detection module 5 determines that the matching result is matching result 3, it sends instruction 2 to the memory management module.

[0212] S914, the memory management module, based on instruction 2, releases the memory occupied by the socket buffer associated with message 1.

[0213] The implementation process of this step can be referred to the above embodiment, and will not be repeated here.

[0214] In other embodiments, the matching result 3 may also include other permission parameters, such as the online time not exceeding duration 1. The implementation process for controlling the online service may also be as follows: For example, the detection module 5 marks the service type of the online service to which the message 1 belongs through the marking module shown in Figure 2, and then counts the traffic transmitted based on the service type of the online service and the source MAC address in the above embodiment. Then, the online time is determined based on the traffic counted above. If the counted online time exceeds duration 1, the memory occupied by the socket buffer associated with the message 1 is released. Thus, if the online time exceeds duration 1, the function of prohibiting the sender (such as a child's mobile phone) from accessing the network based on the relevant data (such as the destination domain name) contained in the message 1 can be realized.

[0215] In other embodiments, if the detection module 5 determines that the matching result is matching result 3, and the permission parameter included in matching result 3 is "prohibit network access," it can also control internet access services in the following ways: For example, the detection module 5 sends an interference message to the source device or destination device based on the protocol type. After receiving the interference message, the source device or destination device closes its own socket connection to disconnect the network connection. Alternatively, the detection module 5 returns a notification to the network layer. Based on this notification, the network layer determines the protocol type of message 1. After determining the protocol type of message 1, the network layer sends an interference message to the source device or destination device based on the protocol type. After receiving the interference message, the source device or destination device closes its own socket connection to disconnect the network connection.

[0216] A socket connection is used for bidirectional communication between a source device and a destination device. It is an abstraction layer between the application layer and the transport layer, providing a mechanism to create, manage, and terminate connections between two network endpoints. In computer networks, a socket typically refers to an endpoint, one end of a communication chain, capable of sending or receiving data. Socket connections allow data to flow between applications, whether these applications are running on the same system or distributed across different machines. Socket connections can be based on different protocols, most commonly TCP and UDP. TCP provides a reliable, connection-oriented service, ensuring packets arrive in order, while UDP provides a connectionless service, allowing packets to be sent independently but without guaranteeing order or reliability. The general steps for creating a socket connection include: the destination device creates a socket and listens on a specific port for a connection from the source device. The source device creates a socket and initiates a connection request to the specified port on the destination device. The destination device accepts the connection request and establishes a socket connection to the source device. Data exchange begins between the source and destination devices. After the data exchange is complete, either party can close the connection.

[0217] It should be noted that because TCP is a connection-oriented protocol, requiring a connection to be established, while UDP is connectionless and does not require a connection, the interfering message may differ depending on the protocol type of message 1. For example, if message 1 is a TCP message, the interfering message could be a Transmission Control Protocol Reset (TCPRESET) message. Conversely, if message 1 is a UDP message, the interfering message could be an Internet Control Message Protocol (ICMP) unreachable message.

[0218] In implementation, before the detection module 5 or the network layer sends the interference message to the source or destination device, it is necessary to first determine the protocol type of message 1. The protocol type of message 1 can be determined by the following method: the header information of the transport layer intercepted by the detection module 5 or the header information of the transport layer parsed by the network layer includes a protocol field, which indicates the protocol type of the message. For example, a value of 6 indicates that message 1 uses the TCP protocol; a value of 17 indicates that message 1 uses the UDP protocol. In other embodiments, the protocol type of message 1 can also be determined based on other methods, such as determining the protocol type based on the source port number or destination port number. This application embodiment does not limit the method for determining the protocol type of message 1.

[0219] After determining the protocol type of message 1, if message 1 is a TCP message, detection module 5 sends a TCPRESET message to the source or destination device, or sends a TCPRESET message to the network layer, which in turn sends a TCPRESET message to the source or destination device. Upon receiving the TCPRESET message, the source or destination device closes its own socket connection to disconnect the network connection. If message 1 is a UDP message, detection module 5 sends an ICMP unreachable message to the source or destination device, or sends an ICMP unreachable message to the network layer, which in turn sends an ICMP unreachable message to the source or destination device. Upon receiving the ICMP unreachable message, the source or destination device closes its own socket connection to disconnect the network connection.

[0220] As can be seen from the above embodiments, the network layer can send a query request to the DNS server, which includes the qry.name field, which includes the domain name A, to obtain the IP address corresponding to the domain name A. Therefore, in other embodiments, when the detection module 5 determines that the matching result is matching result 3 and the permission parameter included in matching result 3 is to prohibit network access, it can also control the Internet access service in the following ways. For example, the detection module 5 can send a notification of domain name resolution error to the network layer. For example, the notification can carry the field "no such name", notifying the network layer DNS server of the domain name resolution error. This notification can be understood as the detection module 5 "tricking" the network layer, so that after the network layer sends a query request to the DNS server, it gets a "domain name resolution error" response. Then the network layer sends a notification of domain name resolution error to the sender (such as a child's mobile phone) (the notification can also carry the field "no such name"), thereby preventing the sender (such as a child's mobile phone) from accessing the network based on the IP address corresponding to the domain name A. The typical process of an electronic device accessing a network can be as follows: the electronic device sends the domain name to the router, the router determines the IP address through the domain name, and then the router needs to perform operations such as configuring network settings, setting port numbers, security settings, and testing connections. In this embodiment of the application, the detection module 5 can send a notification of abnormal domain name resolution to the network layer. The detection module 5 can "trick" the network layer into resolving the domain name abnormally, so the network layer will not be able to obtain the IP address corresponding to the domain name and will return the IP address to the electronic device. Therefore, it can block the electronic device from accessing the network at the source (for example, the source could be the step of the router determining the IP address through the domain name during the process of the electronic device accessing the network), which can improve the blocking efficiency.

[0221] S915, if the detection module 5 determines that the service type of the Internet access service cannot be identified, or if the matching result is match result 4, it sends notification 2 to the network layer.

[0222] The notification 2 can carry the matching result 4.

[0223] S916, after receiving notification 2, the network layer sends message 1.2 to the transport layer.

[0224] S917, the transport layer parses message 1.2 to obtain the transport layer header information and message 1.3. The transport layer header information includes the destination port number and source port number of message 1.

[0225] It should be understood that parsing message 1.2 at the transport layer can be interpreted as the transport layer decapsulating or unpacking message 1.2. As shown in Figure 8, during the message encapsulation process on the mobile phone side, the transport layer can add transport layer header information to the message. This header information includes the source port number and destination port number, etc. The source port number refers to the port number used by the device sending the data, and the destination port number refers to the port number used by the device receiving the data. Therefore, after decapsulating message 1.2 at the router's transport layer, we can obtain the transport layer header information and message 1.3. The transport layer header information includes the source and destination port numbers of message 1.3, and message 1.3 refers to the message remaining after removing the transport layer header information from message 1.2, such as the message shown in the router's transport layer in Figure 8.

[0226] S918, the transport layer is configured with a Netfilter forwarding detection point, and the FORWARD chain on the forwarding detection point is configured with a detection module 4. The detection module 4 obtains the destination port number and source port number of packet 1 parsed by the transport layer.

[0227] It should be understood that the function of the detection module 4 is to intercept the data parsed by the transport layer. The configuration of the detection points in S918 has been described in the above embodiments and will not be repeated here.

[0228] S919, the detection module 4 determines whether the service type of the Internet access service can be identified based on the destination port number and / or the source port number.

[0229] In implementation, the detection module 4 can determine the service type of the Internet access service by checking whether the destination port number and / or source port number exist in the knowledge base.

[0230] It should be understood that most common applications use general-purpose ports to transmit data. For example, both Application 1 and Application 2 use the general-purpose port number 80. Some special applications use non-general-purpose ports to transmit data. For example, Application 3 uses the non-general-purpose port number 1240. The numerical identifier of a general-purpose port number ranges from 0 to 1023, while the numerical identifier of a non-general-purpose port number is greater than 1023. Therefore, in the implementation, the detection module 4 can first determine whether the target port number and / or the source port number is a general-purpose port number or a non-general-purpose port number. If it is a general-purpose port number, the detection module 4 can determine whether the general-purpose port number exists in the knowledge base. Since most common applications use general-purpose ports to transmit data, such as Application 1 and Application 2, even if the detection module 4 can determine that the general-purpose port number exists in the knowledge base, it cannot determine the service type of the Internet access service (for example, the service type may be Application 1 or Application 2). If it is a non-general port number, then the detection module 4 determines whether the non-general port number exists in the knowledge base. Since only some special applications use non-general port numbers to transmit data, such as application 3, the detection module can determine the service type of the Internet access service (e.g., the service type is application 3) after determining that the non-general port number exists in the knowledge base.

[0231] S920, when the detection module 4 determines that the service type of the Internet access service can be identified, it matches the service type of the Internet access service with the data in the permission configuration information to obtain the matching result.

[0232] It should be understood that the implementation method of this step can refer to the above embodiment, and will not be repeated here. The matching results in this step include matching result 3 and matching result 4 in the above embodiment.

[0233] S921, when the detection module 4 determines that the matching result is matching result 3, it sends instruction 3 to the memory management module.

[0234] S922, the memory management module, based on instruction 3, releases the memory occupied by the socket buffer associated with message 1.

[0235] The implementation method for this step can be referred to the above embodiment, and will not be repeated here.

[0236] In other embodiments, the matching result 3 may also include other permission parameters, such as the online time not exceeding duration 1. The implementation process for controlling the online service may also be as follows: For example, the detection module 5 marks the service type of the online service to which the message 1 belongs through the marking module shown in Figure 2, and then counts the traffic transmitted based on the service type of the online service and the source MAC address and destination domain name in the above embodiment. Then, the online time is determined based on the traffic counted above. If the counted online time exceeds duration 1, the memory occupied by the socket buffer associated with the message 1 is released. Thus, if the online time exceeds duration 1, the function of prohibiting the sender (such as a child's mobile phone) from accessing the network based on the relevant data (such as the destination domain name) contained in the message 1 can be realized.

[0237] S923, if the detection module 4 determines that the service type of the Internet access service cannot be identified, or if the matching result is match result 4, it sends notification 3 to the transport layer.

[0238] Notification 3 can include matching result 4.

[0239] S924, after receiving notification 3, the transport layer sends message 1.3 to the session layer.

[0240] For ease of description, the process of identifying and managing services at and after the session layer can be referred to Figure 10, which is a timing diagram of another method for identifying and managing Internet access services provided in an embodiment of this application. The timing diagram in Figure 10 includes S925 to S948.

[0241] S925, the session layer parses message 1.3 to obtain the session layer header information and message 1.4. The session layer header information includes the domain name B of message 1 and the default port number of the network protocol.

[0242] It should be understood that the session layer resolving message 1.3 can be interpreted as the session layer decapsulating or unpacking message 1.3. As shown in Figure 8, during the message encapsulation process on the mobile phone side, the session layer can add session layer header information to the message. This header information includes DNS protocol content, which includes the destination domain name and the default port number for DNS protocol data transmission. Therefore, after the router's session layer decapsulates message 1.3, it obtains the session layer header information and message 1.4. The session layer header information includes DNS protocol content, and message 1.4 refers to the message remaining after removing the session layer header information from message 1.3, such as the message shown in the router's session layer in Figure 8.

[0243] In implementation, for example, when the session layer parses DNS messages, it can extract the `qry.name` field from the question section of the DNS message. The `qry.name` field includes the domain name B of message 1 and the default port number of the network protocol. For example, if the data resolved by the session layer is `leshivideo:53`, then `leshivideo:53` represents the URL to be accessed. The domain name of the video application; 53 represents the default port for the DNS protocol.

[0244] S926, the session layer is configured with a Netfilter forwarding detection point, and the FORWARD chain on the forwarding detection point is configured with detection module 3. Alternatively, the session layer is configured with a Netfilter local upload detection point, and the INPUT chain of the local upload detection point is configured with detection module 3. Detection module 3 obtains the domain name B and the default port number of the network protocol of packet 1 parsed by the session layer.

[0245] It should be understood that the function of the detection module 3 is to intercept the data parsed by the session layer. The configuration of the detection points in S926 has been described in the above embodiments and will not be repeated here.

[0246] S927, the detection module 3 determines whether the service type of the Internet access service can be identified based on the domain name B of message 1, the default port number of the network protocol, and the knowledge base.

[0247] In implementation, the detection module 3 can retrieve the DNS protocol content of message 1 from the knowledge base. After retrieving the DNS protocol content of message 1, it determines the service type that can be identified for Internet access. If the protocol content of message 1 cannot be retrieved, it determines the service type that cannot be identified for Internet access.

[0248] For example: Assuming the knowledge base contains the data shown in Table 2, the DNS protocol content of message 1 includes the domain name and the default port number of the network protocol (e.g., leshivideo:53). Detection module 3 can retrieve leshivideo:53 from the knowledge base. As shown in Table 2, the knowledge base is configured with dns=leshivideo:53. Therefore, detection module 3 can retrieve leshivideo:53, thus determining that the service type that can be identified for internet access is id=349 (this id represents...). (ID). Assuming that dns=leshivideo:53 does not exist in the knowledge base, then detection module 3 cannot retrieve leshivideo:53, thus detection module 3 determines that it cannot identify the service type of Internet access service.

[0249] S928, when the detection module 3 determines that the service type of the Internet access service can be identified, it matches the service type of the Internet access service with the data in the permission configuration information to obtain the matching result.

[0250] It should be understood that the implementation method of this step can refer to the above embodiment, and will not be repeated here. The matching results in this step include matching result 3 and matching result 4 in the above embodiment.

[0251] S929, if the detection module 3 determines that the matching result is matching result 3, the detection module 3 sends instruction 4 to the memory management module.

[0252] S930, the memory management module, based on instruction 4, releases the memory occupied by the socket buffer associated with message 1.

[0253] The implementation method for this step can be referred to the above embodiment, and will not be repeated here.

[0254] S931, if the detection module 3 determines that the service type of the Internet access service cannot be identified, or if the matching result is a matching result 4, it sends a notification 4 to the session layer.

[0255] Notification 4 can include matching result 4.

[0256] S932, after receiving notification 4, the session layer sends message 1.4 to the presentation layer.

[0257] S933, the presentation layer parses message 1.4 to obtain the presentation layer header information and message 1.5. The presentation layer header information includes the protocol content of message 1.

[0258] It should be understood that the presentation layer parsing message 1.4 can be interpreted as the presentation layer decapsulating or unpacking message 1.4. As shown in Figure 8, during the message encapsulation process on the mobile phone side, the presentation layer can add presentation layer header information to the message. This header information includes protocol content, which can be HTTP, TLS, Gquic, etc. The HTTP protocol content can be the content of the `url` field, which mainly includes the access path and the default port of the HTTP protocol. For example, as shown in Table 1, `http_url = qqmusic: 80`, where `qqmusic` indicates an access path pointing to resources or pages related to the QQ Music service, and `80` represents the default port of the HTTP protocol. The HTTP protocol content can also be the content of the `useragent` field, which mainly includes the application identifier and the default port of the HTTP protocol. For example, as shown in Table 1, `http_useragent = MicroMessenger: 80`, where `MicroMessenger` refers to... The client's identifier, which can be used to determine whether the user has passed the authentication process. A webpage or service was accessed. 80 represents the default port for the HTTP protocol. The HTTP protocol content can also be the content of the HTTP host field, which includes the server's domain name (or IP address) and port number. For example, Table 1 shows http_host = weixin.qq.com:80, where weixin.qq.com refers to... The domain name, 80 refers to the default port of the HTTP protocol.

[0259] The TLS protocol content mainly includes the content of the servername field in the client hello message of the TLS protocol. The servername field mainly includes the domain name of the server (which can be the server to be accessed or connected to) and the default port for data transmission based on the TLS protocol.

[0260] The gquic protocol content mainly includes the SNI field, which contains the domain name requested for access and the default port number of the gquic protocol. For example, Table 1 shows gquic = photo.qq.com; 443, where photo.qq.com represents the domain name of Tencent's online photo album service to be accessed, and 443 represents the default port number of the gquic protocol.

[0261] After decapsulating packet 1.4, the router's presentation layer can obtain the presentation layer header information and packet 1.5. The presentation layer header information includes HTTP protocol content, TLS protocol content, or Gquic protocol content, etc. Packet 1.5 refers to the packet remaining after removing the presentation layer header information from packet 1.4, such as the packet shown in the router's presentation layer in Figure 8.

[0262] S934, The presentation layer is configured with a Netfilter forwarding detection point, and the FORWARD chain on the forwarding detection point is configured with a detection module 2. Alternatively, the presentation layer is configured with a Netfilter local upload detection point, and the INPUT chain of the local upload detection point is configured with a detection module 2. The detection module 2 obtains the protocol content of packet 1 parsed by the presentation layer.

[0263] It should be understood that the function of the detection module 2 is to intercept the data parsed by the presentation layer. The configuration of the detection points in S934 has been described in the above embodiments and will not be repeated here.

[0264] S935, the detection module 2 determines whether the service type of the Internet access service can be identified based on the protocol content and knowledge base of message 1.

[0265] In implementation, detection module 2 can retrieve the protocol content of message 1 from the knowledge base. If the protocol content of message 1 is found, it determines that the service type for internet access can be identified; if the protocol content of message 1 is not found, it determines that the service type for internet access cannot be identified. The implementation process of detection module 2 retrieving the protocol content of message 1 from the knowledge base can be referenced in the implementation process of detection module 3 retrieving the DNS protocol content of message 1 from the knowledge base, and will not be elaborated here.

[0266] S936, when the detection module 2 determines that it can identify the service type of the Internet access service, it matches the service type of the Internet access service with the data in the permission configuration information to obtain the matching result.

[0267] It should be understood that the implementation method of this step can refer to the above embodiment, and will not be repeated here. The matching results in this step include matching result 3 and matching result 4 in the above embodiment.

[0268] S937, if the detection module 2 determines that the matching result is matching result 3, it sends instruction 5 to the memory management module.

[0269] S938, the memory management module, based on instruction 5, releases the memory occupied by the socket buffer associated with message 1.

[0270] The implementation method for this step can be referred to the above embodiment, and will not be repeated here.

[0271] S939, if the detection module 2 determines that the service type of the Internet access service cannot be identified, or if the matching result is match result 4, it sends a notification 5 to the presentation layer.

[0272] Notification 5 can include matching result 5.

[0273] S940, after receiving notification 5, the session layer sends message 1.5 to the application layer.

[0274] S941, the application layer parses message 1.5 to obtain the payload data of message 1.

[0275] It should be understood that the application layer can obtain protocol control information by parsing message 1.5, such as the URL and method of the HTTP protocol request (e.g., POST, GET), as well as the payload data of message 1.

[0276] S942, the application layer is configured with a Netfilter forwarding detection point, and the FORWARD chain on the forwarding detection point is configured with a detection module 1. The detection module 1 obtains the payload data of packet 1 parsed by the application layer.

[0277] It should be understood that the function of detection module 1 is to intercept data parsed by the application layer. The configuration of the detection points in S942 has been described in the above embodiments and will not be repeated here.

[0278] S943, the detection module 1 determines whether the service type of the Internet access service can be identified based on the payload data of message 1.

[0279] In implementation, detection module 1 can determine whether the service type of Internet access service can be identified by checking whether a regular expression corresponding to the payload data of message 1 exists in the knowledge base. If detection module 1 determines that a regular expression corresponding to the payload data of message 1 exists in the knowledge base, the service type of Internet access service can be determined based on the regular expression corresponding to the payload data of message 1. If detection module 5 determines that a regular expression corresponding to the payload data of message 1 does not exist in the knowledge base, the service type of Internet access service cannot be determined.

[0280] For example, assuming the knowledge base is Table 2 mentioned in the above embodiment, and the regular expression corresponding to the payload data in Table 2 is represented by the symbol payload_regex, the detection module 1 searches Table 2 to see if there is a regular expression that matches the payload data of packet 1. If a regular expression matching the payload data of packet 1 is found in Table 2, for example, regular expression 5 in Table 2 matches the payload data of packet 1, then the detection module determines that the service type of the Internet access service is id=409 (this id represents...). If the application ID for green mode is not found in Table 2, and no regular expression matching the payload data of message 1 is found, the service type of the Internet access service cannot be determined. Detection module 1 can search for the existence of a regular expression matching the payload data of message 1 based on efficient string search algorithms (Knuth-Morris-Pratt Algorithm, KMP), trie, etc., but this application does not limit this search.

[0281] S944, when the detection module 1 determines that it can identify the service type of the Internet access service, it matches the service type of the Internet access service with the data in the permission configuration information to obtain the matching result.

[0282] It should be understood that the implementation method of this step can refer to the above embodiment, and will not be repeated here. The matching results in this step include matching result 3 and matching result 4 in the above embodiment.

[0283] S945, if the detection module 1 determines that the matching result is matching result 3, it sends instruction 6 to the memory management module.

[0284] S946, the memory management module, based on instruction 6, releases the memory occupied by the socket buffer associated with message 1.

[0285] The implementation method for this step can be referred to the above embodiment, and will not be repeated here.

[0286] S947, if the detection module 1 determines that the service type of the Internet access service cannot be identified, or if the matching result is match result 4, it returns notification 6 to the application layer.

[0287] S948, after receiving notification 6, the application layer passes the payload data of message 1 layer by layer to the lower layer protocol stack, re-encapsulates the payload data, and sends the re-encapsulated message to the Internet through the WIFI port or network port shown in Figure 2.

[0288] In this embodiment of the application, the router can successively intercept the packet features parsed at each layer of the protocol stack through detection modules configured at each layer of the protocol stack. After each detection module intercepts packet features, if the detection module can identify the service type based on the packet features obtained, then the detection module can manage the Internet access service based on the service type. If the detection module cannot identify the service type based on the packet features obtained, the router can continue to acquire packet features until the service type is identified, and then manage the Internet access service based on the service type.

[0289] For example, a router uses a detection module 6 configured at the data link layer to intercept the source MAC address resolved by the data link layer. Then, detection module 6 matches the source MAC address with permission configuration information and manages internet access services based on the matching result. Since detection module 6 does not involve service type identification, the router uses a detection module 5 configured at the network layer to intercept the destination domain name resolved by the network layer. Then, detection module 5 determines the service type of the internet access service based on the destination domain name and a knowledge base, and matches it with permission configuration information based on the service type, managing internet access services based on the matching result. If the router cannot determine the service type of the internet access service using detection module 5 based on the destination domain name and the knowledge base, the router uses a detection module 4 configured at the transport layer to intercept the source and destination port numbers resolved by the transport layer. Then, detection module 4 determines the service type of the internet access service based on the source and destination port numbers and a knowledge base, and matches it with permission configuration information based on the service type, managing internet access services based on the matching result. If the router cannot determine the service type of the Internet access service through the detection module 4 based on the source port number, destination port number, and knowledge base, the router intercepts the DNS protocol content resolved at the session layer through the detection module 3 configured at the session layer. Then, the detection module 3 determines the service type of the Internet access service based on the DNS protocol content and the knowledge base, and performs matching based on the service type and permission configuration information. The router then manages the Internet access service according to the matching results.

[0290] If the router cannot determine the service type of the internet access service using detection module 3 based on DNS protocol content and knowledge base, the router uses detection module 2, configured at the presentation layer, to intercept the protocol content resolved at the network layer. Then, detection module 2 determines the service type of the internet access service based on the protocol content and knowledge base, and matches the service type with permission configuration information. Based on the matching result, the router manages the internet access service. If the router cannot determine the service type of the internet access service using detection module 2 based on protocol content and knowledge base, the router uses detection module 1, configured at the application layer, to intercept the payload data resolved at the application layer. Then, detection module 1 determines the service type of the internet access service based on the payload data and knowledge base, and matches the service type with permission configuration information. Based on the matching result, the router manages the internet access service.

[0291] In related solutions, routers first need to identify the service type of the internet access service before managing it. However, identifying the service type requires a large amount of data, consuming significant memory and non-volatile flash storage, resulting in low identification efficiency and slow speed, thus impacting user experience. For example, in related solutions, the router needs to acquire a sufficient number of packet features from the connected electronic devices at once to identify the service type. Acquiring these features involves a large amount of data computation, requiring significant memory and flash storage, further reducing efficiency and speed. In contrast, this embodiment uses detection modules configured at each layer of the protocol stack to sequentially acquire packet features from electronic devices for service type identification. This eliminates the need to acquire a large number of features at once, reducing the amount of data computation required for identifying internet access services. Consequently, less memory and flash storage are needed, improving efficiency and speed, and enhancing user experience.

[0292] Furthermore, the deep packet inspection module (including inspection modules 1 to 6 in the above embodiments) provided in this application embodiment is mounted on the hook point provided by Netfilter in the Linux system. Since the Linux system has high customizability and flexibility, it allows optimization and adaptation according to specific hardware platforms, thereby reducing the hardware dependence of the deep packet inspection module mounted on the hook point provided by Netfilter in the Linux system.

[0293] It should be noted that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0294] The following section provides a summary of the solutions described in the above embodiments.

[0295] This application provides a method for managing internet access services, applied to a first electronic device. The first electronic device includes a deep packet inspection module and a protocol stack. The protocol stack includes N protocol layers, where N is an integer greater than 1. The method includes:

[0296] The first electronic device receives the first message sent by the second electronic device based on the Internet access service;

[0297] The first electronic device performs M inspections on the first packet at the M-layer protocol layer using a deep packet inspection module. Based on the inspection results, it either sends the first packet or manages internet access services, where M is less than or equal to N; where...

[0298] The first electronic device performs the i-th detection process on the first packet at the i-th protocol layer in the M-layer protocol layer through the deep packet inspection module, including:

[0299] The first electronic device obtains partial message features of the first message at the i-th protocol layer through the deep message detection module;

[0300] The first electronic device uses a deep message detection module to detect some message features of the first message at the i-th protocol layer and obtains the detection result;

[0301] If i is less than M and M is less than or equal to N, and the detection result indicates that no control is exercised over internet access services, the first electronic device sends a first message from the i-th protocol layer to the (i+1)-th protocol layer, and performs the (i+1)-th detection at the (i+1)-th protocol layer within the M-layer protocol layer using the deep packet inspection module; or,

[0302] When i equals M and M equals N, and the detection result indicates that no control is exercised over internet access services, the first electronic device sends the first packet through the deep packet inspection module; or,

[0303] When i equals M and the detection result indicates that internet access services are to be controlled, the first electronic device controls internet access services through the deep packet inspection module.

[0304] It should be understood that the first electronic device can be a router, gateway, modem, or switch, for example, the first electronic device can refer to the router in the above embodiment. The second electronic device can refer to a device that can access the first electronic device and perform various Internet services (such as watching videos or playing games), for example, the second electronic device can be a mobile phone or laptop mentioned in the above embodiment.

[0305] The protocol stack is a layered model based on communication protocols. For example, the protocol stack can be a TCP / IP protocol stack, or it can be a protocol stack based on the OSI model as shown in Figure 2. The deep packet inspection module can be referenced in Figure 2, and the deep packet inspection module is mounted on each protocol layer of the protocol stack.

[0306] The first message sent by the second electronic device based on internet access service refers to the message generated by the second electronic device and transmitted in the network when the user accesses the internet on the second electronic device, such as when the user opens an app on their mobile phone. When playing games, the phone needs to connect to the router. The server sends a request to load game resources. This request to load game resources can be considered as the first message. The format of the first message can be referred to as the encapsulated message format shown in the data link layer on the mobile phone side in Figure 8.

[0307] Some message characteristics may be one or more of the following: such as payload data, protocol content, DNS protocol content, source port number, destination port number, destination domain name, source MAC address, destination MAC address, etc., as shown in Figure 8.

[0308] Controlling internet access services can refer to prohibiting internet access services from accessing the network, or tracking the duration of internet access services, etc. This application does not limit this to specific actions.

[0309] The N-layer protocol layer can refer to the seven layers in the OSI model shown in Figure 2: data link layer, network layer, transport layer, session layer, presentation layer, application layer, and physical layer (not shown in Figure 2). It can also refer to the four or five layers of the TCP / IP protocol stack, etc. This application embodiment does not limit this. The M-layer protocol layer can be some or all of the protocol layers in the N-layer protocol layer. For example, if the N-layer protocol layer includes seven layers, then the M-layer can be any layer from 1 to 7. Each protocol layer in the M-layer protocol layer performs one detection process. For example, if the M-layer is layer 2, then the router performs two detection processes through the M-layer protocol layer; if the M-layer is layer 3, then the router performs three detection processes through the M-layer protocol layer.

[0310] It should also be understood that when i is less than M and M is less than or equal to N, it means that the i-th protocol layer refers to any protocol layer in the M protocol layers except the last one. For example, when N=7, M can refer to 6, and i can refer to any number from 1 to 5. Or, for example, when N=7, M can refer to 7, and i can refer to any number from 1 to 6.

[0311] If i equals M and M equals N, it means that the i-th protocol layer refers to the last protocol layer in the N protocol layers. For example, N=7, M=7, i=7.

[0312] If i equals M, and M is less than or equal to N, it means that the i-th protocol layer (where i equals M, and M is less than or equal to N) refers to the last protocol layer in the M protocol layers. For example, N=7, M=6, i=6, or N=6, M=5, i=5, etc.

[0313] It should be understood that, in the case where the detection result indicates that no control will be exercised over internet access services, the actions of the deep packet inspection module based on the detection result at the last layer of the N-layer protocol layer are slightly different from those of the other layers (except the last layer) based on the detection result. Therefore, in this embodiment, the last layer is distinguished from other layers by i being less than M and M being less than or equal to N, and i being equal to M and M being equal to N.

[0314] It should also be understood that when the detection result indicates that internet access services should be controlled, the actions performed by the deep packet inspection module based on the detection result at the last layer of the N-layer protocol layer are the same as those performed at other layers (except the last layer) based on the detection result, so there is no need to distinguish the actions.

[0315] The implementation process of this application embodiment is illustrated below using the protocol stack shown in Figure 2, which includes six protocol layers: data link layer, network layer, transport layer, session layer, presentation layer, and application layer. In the following examples, N = 6.

[0316] For example, assuming M=1, it means that the deep packet inspection module can manage internet access services after performing one inspection process. In implementation, when M=1, the router's inspection process of performing the i-th inspection on the first packet at the i-th protocol layer in layer M can be:

[0317] The router obtains partial packet characteristics of the first packet at the Layer 1 protocol layer (such as the data link layer shown in Figure 2) through the deep packet inspection module; the router performs detection on the partial packet characteristics of the first packet at the Layer 1 protocol layer through the deep packet inspection module and obtains the detection result; when i equals M (i=1, M=1, N=6) and the detection result indicates that internet access services should be controlled, the router controls internet access services through the deep packet inspection module.

[0318] Assuming M is greater than 1 and less than 6, taking M=2 as an example, M=2 means that the deep packet inspection module needs to perform two inspection processes to control internet access services. The result of the first inspection is that internet access services are not controlled, while the result of the second inspection is that internet access services are controlled. In implementation, the router obtains partial packet characteristics of the first packet at the Layer 1 protocol layer (e.g., the data link layer shown in Figure 2) through the deep packet inspection module; the router performs detection on these partial packet characteristics at the Layer 1 protocol layer using the deep packet inspection module, obtaining the detection result; when i is less than M and M is less than or equal to N (i = 1, M = 2, N = 6), and the detection result indicates no control over internet access services, the router uploads the first packet to the Layer 2 protocol layer (e.g., the network layer shown in Figure 2) through the Layer 1 protocol layer; the router obtains partial packet characteristics of the first packet at the Layer 2 protocol layer using the deep packet inspection module; the router performs detection on these partial packet characteristics at the Layer 2 protocol layer using the deep packet inspection module, obtaining the detection result; when i equals M (i = 2, M = 2, N = 6), and the detection result indicates control over internet access services, the router performs control over internet access services using the deep packet inspection module.

[0319] Assuming M=6, in one scenario, this means the deep packet inspection module needs to perform 6 inspection processes to manage internet access. The results of the 1st to 5th inspections indicate no management of internet access, while the 6th inspection indicates management. In implementation, the router, through the deep packet inspection module, performs the 1st to 5th inspections sequentially at the data link layer, network layer, transport layer, session layer, and presentation layer (as shown in Figure 2). The result of all 5 inspections is no management of internet access. After each inspection result indicating no management, a first packet needs to be sent to the upper layer of the protocol stack. Specifically, when i is less than M and M is less than or equal to N (i = any number from 1 to 5, M = 6, N = 6), and the inspection result indicates no management of internet access, the first packet is sent from the i-th protocol layer to the (i+1)-th protocol layer. The deep packet inspection module performs the (i+1)th inspection at the (i+1)th protocol layer in the M-layer protocol layer. For example, if i=5 and the inspection result indicates that no control is exercised over internet access, the first packet is sent from the 5th protocol layer (the presentation layer shown in Figure 2) to the 6th protocol layer (the application layer shown in Figure 2). Subsequently, the router performs the 6th inspection at the 6th protocol layer (the application layer shown in Figure 2) through the deep packet inspection module to obtain the inspection result. If i equals M (i=6, M=6, N=6) and the inspection result indicates that internet access is controlled, the router controls internet access through the deep packet inspection module.

[0320] In another scenario, when M=6, the detection results obtained by the deep packet inspection module after the first to sixth detections are all that internet access services are not controlled. The actions taken by the deep packet inspection module after the first to fifth detections can be referred to the above embodiment, and will not be repeated here. After the deep packet inspection module performs the sixth detection, if the detection result is that internet access services are not controlled, the router forwards the first packet to the Internet through the WIFI port or network port shown in Figure 2 to realize the above-mentioned internet access services. That is, when i equals M and M equals N (i=6, M=6, N=6), and the detection result is that internet access services are not controlled, the first packet is sent through the deep packet inspection module.

[0321] In the relevant solutions, when managing Internet access services, the router needs to obtain a sufficient number of packet characteristics from the electronic devices connected to the router in order to manage the Internet access services based on these characteristics. However, managing Internet access services based on a sufficient number of packet characteristics requires processing a large amount of data, which in turn requires a large amount of memory and non-volatile flash storage. This results in low data processing efficiency for the router when managing Internet access services, affecting the user experience.

[0322] In this embodiment, the first electronic device can perform M detections on the packet at the M-layer protocol layer using a deep packet inspection module. During each detection, partial features of the packet are acquired (e.g., partial features of the packet are acquired once in the i-th detection). If the detection result indicates that the internet access service should be controlled, the internet access service is controlled through the deep packet inspection module. If the detection result indicates that the internet access service is not controlled, partial features of the packet are acquired again (e.g., partial features of the packet are acquired again in the i+1-th detection), until the detection result obtained by detecting partial features of the packet indicates that the internet access service should be controlled. Then, the internet access service is controlled through the deep packet inspection module. In other words, this application embodiment can obtain partial features of packets sequentially at the N-layer protocol layer through a deep packet inspection module. Then, it can detect the partial features of each acquired packet to manage internet access services. After the detection result based on the partial features of a single acquired packet is used to manage internet access services, it is no longer necessary to obtain partial features of the packet. Compared with related solutions, it is not necessary to obtain enough packet features to manage internet access services, which can reduce the amount of data that needs to be processed. Therefore, less memory and Flash are required for data processing, thereby improving the efficiency of the router in processing data when managing internet access services and improving the user experience.

[0323] In some embodiments, the deep packet inspection module includes multiple inspection modules, with inspection points configured on each of the N protocol layers, and inspection modules of the deep packet inspection module configured on each inspection point; and the first electronic device obtains partial packet features of the first packet at the i-th protocol layer through the deep packet inspection module, including:

[0324] The first electronic device parses the first message through the i-th protocol layer to obtain partial message characteristics of the first message;

[0325] The first electronic device obtains partial message characteristics of the first message at the detection point on the i-th protocol layer through the detection module.

[0326] It should be understood that multiple detection modules can refer to detection modules 1 to 6 shown in Figure 2.

[0327] The detection point can include one or more of the following detection points: pre-routing detection point, local upload detection point, forwarding detection point, local transmission detection point, and post-routing detection point. For example, as shown in Figure 2, a forwarding detection point is configured in the data link layer, a forwarding detection point and a local upload detection point are configured in the network layer, a forwarding detection point is configured in the transport layer, a forwarding detection point and a local upload detection point are configured in the session layer, a forwarding detection point and a local upload detection point are configured in the presentation layer, and a forwarding detection point is configured in the application layer.

[0328] The detection modules are configured with deep packet inspection modules at the detection points. For example, as shown in Figure 2, the forwarding detection point in the data link layer is equipped with detection module 6, the forwarding detection point and the local upload detection point in the network layer are both equipped with detection module 5, the forwarding detection point in the transport layer is equipped with detection module 4, the forwarding detection point and the local upload detection point in the session layer are both equipped with detection module 3, the forwarding detection point and the local upload detection point in the presentation layer are equipped with detection module 2, and the forwarding detection point in the application layer is equipped with detection module 1.

[0329] In implementation, assuming that the Nth protocol layer is the protocol layer in the protocol stack shown in Figure 2, the router parses the first packet through the first protocol layer (data link layer) to obtain some packet characteristics of the first packet (such as the source MAC address and destination MAC address in the first packet). Then, the router intercepts the source MAC address and destination MAC address in the first packet at the detection point on the data link layer (such as the forwarding detection point shown in Figure 2) through the detection module 6.

[0330] The router parses the first packet through the second protocol layer (network layer) to obtain some packet characteristics (such as the destination domain name in the first packet). Then, the router intercepts the destination domain name in the first packet at the detection point on the network layer (such as the forwarding detection point or local upload detection point shown in Figure 2) through the detection module 5.

[0331] The router parses the first packet through the third protocol layer (transport layer) to obtain some packet characteristics of the first packet (such as the source port number and destination port number in the first packet). Then, the router intercepts the source port number and destination port number in the first packet at the detection point on the transport layer (such as the forwarding detection point shown in Figure 2) through the detection module 4.

[0332] The router parses the first packet through the fourth protocol layer (session layer) to obtain some packet characteristics of the first packet (such as the DNS protocol content in the first packet). Then, the router intercepts the DNS protocol content in the first packet through the detection module 3 at the detection point on the session layer (such as the forwarding detection point or the local upload detection point shown in Figure 2).

[0333] The router parses the first packet through the 5th protocol layer (presentation layer) to obtain some packet characteristics of the first packet (such as the protocol content in the first packet). Then, the router intercepts the protocol content in the first packet at the detection point on the presentation layer (such as the forwarding detection point or the local upload detection point shown in Figure 2) through the detection module 2.

[0334] The router parses the first packet through the 6th layer (application layer) to obtain some packet characteristics (such as the payload data in the first packet). Then, the router intercepts the payload data in the first packet at the detection point on the application layer (such as the forwarding detection point shown in Figure 2) through the detection module 1.

[0335] In this embodiment of the application, each of the N protocol layers in the first electronic device is configured with a detection point, and a detection module of a deep message detection module is configured on the detection point. The first electronic device can obtain part of the message features of the first message parsed by the i-th protocol layer through the detection module at the detection point on the i-th protocol layer, which can improve the acquisition efficiency of data (the data is part of the message features of the first message parsed by the i-th protocol layer).

[0336] In some embodiments, the first electronic device further includes a knowledge base and permission configuration information. The knowledge base includes multiple service types, each of which includes multiple message features. The permission configuration information includes a correspondence between at least one message feature and at least one permission information. Each message feature in the at least one message corresponds to at least one permission information, and each permission information includes a correspondence between at least one service type and one permission content. Furthermore, a deep message detection module detects some message features of the first message at the i-th protocol layer to obtain detection results, including:

[0337] The first electronic device uses a deep packet inspection module to detect the permission content corresponding to certain packet features of the first packet in the permission configuration information; or...

[0338] The first electronic device uses a deep message detection module to detect the first service type to which some features of the first message belong in the knowledge base, and to detect the permission content corresponding to the first service type in the permission configuration information.

[0339] If the first electronic device detects the permission content corresponding to some of the message features of the first message, or if it detects the first service type to which some of the features of the first message belong, and if it detects the permission content corresponding to the first service type, the first electronic device determines that the detection result is to control the Internet access service.

[0340] If no permission content corresponding to some of the message features of the first message is detected, or if no first service type to which some of the features of the first message belong is detected, or if a first service type to which some of the features of the first message belong is detected, and no permission content corresponding to the first service type is detected, the first electronic device determines that the detection result is no control over the Internet access service.

[0341] It should be understood that the data included in the knowledge base can refer to the data included in Table 2 of the above embodiment. The knowledge base includes multiple business types, such as multiple ID numbers and category numbers shown in Table 2. Its ID number is 349 and its category number is 16. Its ID number is 401 and its category number is 128. The green mode has an ID of 409 and a category of 128. Each of the multiple business types includes multiple message characteristics. For example, when the ID is 409 in Table 2, the multiple message characteristics include the content of the SNI field of the Gquic protocol, the content of the url field of the HTTP protocol, the content of the host field of the HTTP protocol, the content of the servername field of the TLS protocol, the regular expression payload_regex for the payload data, and the regular expression game_extern for the domain name.

[0342] It should also be understood that the data included in the permission configuration information can refer to the data in Table 3 of the above embodiment. The permission configuration information includes at least one message characteristic and at least one corresponding permission information. For example, the message characteristics of at least one message in Table 3 include MAC address 1, MAC address 2, and MAC address 3. MAC address 1 corresponds to 3 permission information entries, MAC address 2 corresponds to 2 permission information entries, and MAC address 1 corresponds to 1 permission information entry. Each permission information entry includes at least one service type and a corresponding permission content. For example, the first permission information entry for MAC address 1 in Table 3 includes the ID of application A, and the permission content corresponding to the ID of application A is "prohibited from accessing the network". The third permission information entry for MAC address 1 includes the IDs of application C and application D, and the permission content corresponding to the IDs of application C and application D is "prohibited from accessing domain name 1".

[0343] In implementation, the first electronic device uses a deep packet inspection module to detect the permission content corresponding to certain packet features of the first packet in the permission configuration information. This permission content can be:

[0344] The deep packet inspection module in the router matches some packet characteristics of the first packet with the data in the permission configuration information to obtain the matching result. For example, the deep packet inspection module is the inspection module 6 shown in Figure 2. The partial packet characteristics of the first packet intercepted by the data link layer parsing module 6 are the source MAC address and the destination MAC address. The inspection module 6 can match the source MAC address and the destination MAC address with the data in the permission configuration information to obtain the matching result.

[0345] Specifically, the detection module 6 detects the permission content corresponding to some message characteristics of the first message, and determines the detection result as requiring control over internet access services, which could mean:

[0346] The detection module 6 can traverse each permission information entry in the permission configuration information to determine whether a source MAC address exists in the permission configuration information (since the permission configuration information is used to restrict the device's internet access services, the MAC address in the permission configuration information shown in Table 3 refers to the sender's MAC address, i.e., the source MAC address; for example, the source MAC address refers to the MAC address of a child's mobile phone, tablet, etc.). If a source MAC address is found in the permission configuration information, it determines whether each service parameter in the permission configuration information is a specific parameter. If each service parameter is determined to be a specific parameter, the matching result for this match is obtained as Match Result 1. Match Result 1 includes the service permission information corresponding to the source MAC address, which includes the permission parameters corresponding to the specific parameters (the permission parameters include permission content). Then, internet access services are controlled based on these permission parameters. For example, Match Result 1 could be the service permission information corresponding to MAC address 3 in Table 3, or it could be the first service permission information corresponding to MAC address 2.

[0347] It should be understood that a specific parameter can refer to a business parameter that is a special character. For example, the business parameter 1 corresponding to MAC address 2 or MAC address 3 shown in Table 3 is the special character "all".

[0348] Of course, if the matching result is 1, the permission parameter (which includes the permission content) can also be other permissions besides prohibiting network access. For example, the permission parameter in the first business permission information corresponding to MAC address 2 is that the internet access time does not exceed 1 minute. When the permission parameter is the above permission, the child's internet access time using the mobile phone with MAC address 2 does not exceed 1 minute. If the time exceeds 1 minute, the mobile phone will be disconnected from the network.

[0349] The detection module 6 did not detect the permission content corresponding to some message features of the first message, and the detection result is that no control is exercised over Internet access services. This could mean:

[0350] If the detection module 6 determines that a source MAC address does not exist in the permission configuration information, or if the detection module 6 determines that a source MAC address exists in the permission configuration information and that at least one of the one or more service parameters in the permission configuration information is not a specific parameter, then the matching result for this match is called Matching Result 2. Matching Result 2 includes the service permission information corresponding to the source MAC address, which includes the permission parameters corresponding to the non-specific parameters. Non-specific parameters refer to service parameters that are not special characters. For example, Matching Result 2 could be the service permission information corresponding to MAC address 1 in Table 3, or it could be the second service permission information corresponding to MAC address 2. Afterwards, the detection module 6 sends Notification 1 to the data link layer based on Matching Result 2, and the data link layer transmits Message 1.1 to the network layer based on Notification 1.

[0351] For example, suppose the source MAC address intercepted by the detection module 6 is MAC address 5, the destination MAC address is MAC address 4, and the permission configuration information is the data shown in Table 3. After the detection module 6 traverses the permission configuration information, it cannot determine the MAC address in Table 3. Therefore, the detection module 6 determines the matching result of this time as matching result 2. Then, the detection module 6 sends notification 1 to the data link layer based on matching result 2, and the data link layer transmits message 1.1 to the network layer.

[0352] For example, suppose the source MAC address intercepted by the detection module 6 is MAC address 1, the destination MAC address is MAC address 4, and the permission configuration information is the data shown in Table 3. After traversing the permission configuration information, the detection module 6 determines that MAC address 1 exists in the permission configuration information, and determines that at least one of the one or more business parameters in the permission configuration information is not a specific parameter. For example, in Table 3, the first business permission information corresponding to MAC address 1 has business parameter 1 as the ID of application A, the second business permission information has business parameter 1 as the ID of application B, the third business permission information has business parameter 1 as the IDs of application C and application D, and business parameter 2 is domain name 1. Then the detection module 6 determines that the matching result for this time is matching result 2.

[0353] It should be understood that matching result 1 in the above text is the detection result of controlling internet access services, and matching result 2 is the detection result of not controlling internet access services.

[0354] In implementation, the first electronic device detects the first service type to which some features of the first packet belong in the knowledge base through the deep packet inspection module, and detects the permission content corresponding to the first service type in the permission configuration information. This can be achieved by the deep packet inspection module in the router determining, based on some packet features of the first packet and the knowledge base, whether the service type to which some packet features of the first packet belong can be identified (for ease of description, this embodiment refers to the service type to which some packet features of the first packet belong as the first service type), and matching the first service type with the data in the permission configuration information to obtain a matching result. For example, the deep packet inspection module is the inspection module 5 shown in Figure 2. The inspection module 5 intercepts some packet features of the first packet parsed by the network layer as the destination domain name (e.g., the destination domain name is domain name A). Based on domain name A and the knowledge base, the inspection module 5 determines whether the first service type of the Internet access service can be identified, and matches the first service type with the data in the permission configuration information to obtain a matching result.

[0355] The detection module 5 detected the first service type to which some features of the first message belonged, and detected the permission content corresponding to the first service type. Determining the detection result as "controlling internet access services" can mean:

[0356] The detection module 5 can determine whether the service type of the Internet access service can be identified by checking if a regular expression corresponding to domain name A exists in the knowledge base. If the detection module 5 determines that a regular expression corresponding to domain name A exists in the knowledge base, it determines the service type of the Internet access service based on the regular expression corresponding to domain name A. The implementation method of this process can be referred to the above embodiment, and will not be repeated here.

[0357] After determining the service type of the Internet access service, the detection module 5 can traverse each permission information in the permission configuration information to determine whether the Internet access service type exists in the permission configuration information. If the Internet access service type exists in the permission configuration information, the matching result for this match is match result 3.

[0358] For example, assuming the business type is application A's ID and the permission configuration information is the data in Table 3 above, the detection module 5 traverses each permission information in Table 3 and determines that application A's ID exists in Table 3. Then the detection module can obtain matching result 3. Matching result 3 includes the first business permission information corresponding to MAC address 1 shown in Table 3. The first business permission information includes application A's ID and the permission parameter corresponding to application A's ID: network access prohibited.

[0359] If detection module 5 fails to detect the first service type to which some features of the first message belong, or if detection module 5 detects the first service type to which some features of the first message belong, but fails to detect the corresponding permission content, determining the detection result as requiring control over internet access services could mean:

[0360] If the detection module 5 determines that there is no regular expression corresponding to domain name A in the knowledge base, then it has not detected the first business type to which some features of the first message belong, and determines the detection result as controlling internet access services.

[0361] If the detection module 5 determines that there is a regular expression corresponding to domain name A in the knowledge base, it detects the first business type to which some features of the first message belong. Then, it traverses each permission information in the permission configuration information and determines that there is no first business type in the permission configuration information. The matching result of this match is the matching result 4.

[0362] For example, suppose the first service type of the internet access service is the ID of application A, and the permission configuration information only includes the data corresponding to MAC address 3 in Table 3 above. Then, the detection module 5 iterates through the data corresponding to MAC address 3. The service parameter 1 corresponding to MAC address 3 is filled with the special character "all". The detection module 5 determines that the ID of application A does not exist, so the detection module 5 can obtain matching result 4. As another example: suppose the service type of the internet access service intercepted by the detection module 5 is the ID of application A, and the permission configuration information only includes the third data corresponding to MAC address 1 in Table 3 above. The service parameter 1 of the third data corresponding to MAC address 1 is filled with the IDs of application C and application D. Then, the detection module 5 iterates through the third data corresponding to MAC address 1, determines that the ID of application A does not exist, and obtains matching result 4.

[0363] It should be understood that matching result 3 in the above text is the detection result of controlling internet access services, and matching result 4 is the detection result of not controlling internet access services.

[0364] In this embodiment of the application, the electronic device also includes a knowledge base and permission configuration information. The electronic device can detect the permission content corresponding to some message features of the first message in the permission configuration information through the deep message detection module; it can also detect the first service type to which some features of the first message belong in the knowledge base through the deep message detection module, and detect the permission content corresponding to the first service type in the permission configuration information. Different detection methods can improve detection efficiency.

[0365] Furthermore, during the detection process, the electronic device can obtain the same detection result regardless of the circumstances. For example, if the electronic device detects the permission content corresponding to some of the message features of the first message, or if it detects the first service type to which some of the message features belong, and also detects the permission content corresponding to that first service type, the detection result can be determined as "controlling internet access services." Conversely, if the electronic device does not detect the permission content corresponding to some of the message features, the first service type to which some of the message features belong, or the first service type to which some of the message features belong, but does not detect the permission content corresponding to that first service type, the detection result can be determined as "no control over internet access services." In other words, the electronic device can obtain the same detection result regardless of the circumstances, thus improving the accuracy of the detection results.

[0366] In some embodiments, the N-layer protocol layer includes a first protocol layer and at least one second protocol layer, wherein the first protocol layer is the bottom layer in the N-layer protocol layer; and the first electronic device detects some message features of the first message at the i-th protocol layer using a deep message detection module to obtain a detection result, including:

[0367] At the first protocol layer, the first electronic device uses a deep packet inspection module to detect the permission content corresponding to some packet features of the first packet in the permission configuration information;

[0368] Upon detecting the permission content corresponding to some message characteristics of the first message, the first electronic device determines the detection result to control the Internet access service.

[0369] If no permission content corresponding to certain message characteristics of the first message is detected, the first electronic device determines that the detection result is no control over internet access services; and...

[0370] The first electronic device uses a deep message inspection module to detect some message features of the first message at the i-th protocol layer to obtain the detection result, which also includes:

[0371] In each protocol layer of at least one second protocol layer, the first electronic device detects the first service type to which some features of the first message belong in the knowledge base through the deep message detection module, and detects the permission content corresponding to the first service type in the permission configuration information;

[0372] If the first electronic device detects that some features of the first message belong to the first service type, and detects the permission content corresponding to the first service type, the first electronic device determines that the detection result is to control the Internet access service;

[0373] If the first service type to which some features of the first message belong is not detected, or if the first service type to which some features of the first message belong is detected, and the permission content corresponding to the first service type is not detected, the first electronic device determines that the detection result is no control over the Internet access service.

[0374] It should be understood that the first protocol layer is the lowest layer in the N-layer protocol layer, such as the data link layer shown in Figure 2. At least one second protocol layer refers to the protocol layer above the data link layer, such as the network layer, transport layer, etc. above the data link layer shown in Figure 2.

[0375] It should also be understood that the detection operations performed by the deep packet inspection module at the first protocol layer are different from the detection operations performed at each of the at least one second protocol layer. For example, at the first protocol layer, the deep packet inspection module needs to check whether there is permission content corresponding to some packet features of the first packet in the permission configuration information. If permission content corresponding to some packet features of the first packet is detected, a detection result indicating that internet access services are controlled is obtained. If permission content corresponding to some packet features of the first packet is not detected, a detection result indicating that internet access services are not controlled is obtained.

[0376] In each second protocol layer, the deep packet inspection module first checks the knowledge base to see if any of the first packet's partial features belong to the first service type. Then, it checks the permission configuration information to see if the corresponding permission content exists. If both the first service type and the corresponding permission content are detected, a detection result indicating that internet access is controlled is obtained. If neither the first service type nor the corresponding permission content is detected, a detection result indicating that internet access is not controlled is obtained.

[0377] In this embodiment of the application, the deep message detection module can perform different detection operations in the first protocol layer and in each of the at least one second protocol layer, which can flexibly detect some features of the first message.

[0378] In some embodiments, when i equals M and the detection result indicates that internet access services should be controlled, the first electronic device controls internet access services through a deep packet inspection module, including:

[0379] When i equals M and the detection result indicates that internet access services are to be controlled, the first electronic device releases the memory occupied by the first packet through the deep packet inspection module in order to control internet access services.

[0380] It should be understood that the memory occupied by the first message refers to the memory occupied by sk_buff associated with the first message. For an explanation of the memory occupied by sk_buff, please refer to the above embodiment, which will not be repeated here.

[0381] It can also be understood that the deep packet inspection module performs inspection operations at each layer of the N-layer protocol stack. The inspection result may indicate that internet access services are being controlled. For example, in the protocol stack shown in Figure 2, when N=6, the inspection result of the first layer protocol stack is that internet access services are being controlled when M=1 and i=1; when M=2 and i=2, the inspection result of the second layer protocol stack is that internet access services are being controlled; and when M=6 and i=6, the inspection result of the sixth layer protocol stack is that internet access services are being controlled. Therefore, when the inspection result indicates that internet access services are being controlled, the router can release the memory occupied by the sk_buff associated with the first packet through the deep packet inspection module. Because the memory occupied by the sk_buff associated with the first packet is released, the first packet cannot be transmitted to the upper layer of the router's protocol stack, thus blocking the transmission of the packet. This can prevent the sender (such as a child's mobile phone) from accessing the network based on the relevant data (such as the MAC address of the child's mobile phone) contained in the first packet.

[0382] In this embodiment of the application, regardless of which protocol layer in the N-layer protocol stack the detection result obtained by the deep packet inspection module indicates that internet access services need to be controlled, the memory occupied by the first packet can be released to control internet access services. In other words, this embodiment of the application can flexibly block the transmission of the first packet at different protocol layers of the N-layer protocol stack to control internet access services.

[0383] In some embodiments, when i equals M and the detection result indicates that internet access services should be controlled, the first electronic device controls internet access services through a deep packet inspection module, including:

[0384] When i equals M and the detection result indicates that internet access services are to be controlled, the first electronic device sends an interference message to the second or third electronic device through the deep packet inspection module to disconnect the network connection between the second and third electronic devices in order to control internet access services. The third electronic device is the device that receives the first message.

[0385] It should be understood that the third electronic device is the device that receives the first message, such as a mobile phone accessing the router. The server, then The server is the third electronic device.

[0386] In some embodiments, the interference messages include Transmission Control Protocol Reset messages (TCPRESET messages) or Internet Control Message Protocol Unreachable messages (ICMP Unreachable messages).

[0387] The implementation process of this solution can be found in the above embodiments, and will not be repeated here.

[0388] In this embodiment of the application, when the deep packet inspection module obtains a detection result indicating that internet access services should be controlled, the first electronic device sends an interference message to the second or third electronic device through the deep packet inspection module to disconnect the network connection of the second and third electronic devices, thereby improving the control efficiency of internet access services.

[0389] In some embodiments, when i equals M and the detection result indicates that internet access services should be controlled, the first electronic device controls internet access services through a deep packet inspection module, including:

[0390] When i equals M and the detection result indicates that internet access services are to be controlled, the first electronic device sends a notification of domain name resolution anomaly to the second electronic device through the deep packet inspection module, in order to restrict the second electronic device from accessing the third electronic device, thereby controlling internet access services. The third electronic device is the device that receives the first packet.

[0391] It should be understood that the notification of domain name resolution error includes "no such name".

[0392] It should also be understood that when the second electronic device accesses the third electronic device, it can first send a query request to the DNS server through the first electronic device to query the IP address corresponding to the domain name of the third electronic device. The DNS server will return a response to the second electronic device through the first electronic device, which includes the domain name and the IP address corresponding to the domain name. The second electronic device can then access the third electronic device based on this IP address. Therefore, if the deep packet inspection module in the first electronic device receives a detection result indicating that it is controlling internet access, the deep packet inspection module can forge a domain name resolution anomaly notification and send this notification to the second electronic device, or first send the notification to the protocol stack of the first electronic device. The protocol stack of the first electronic device then forwards the notification to the second electronic device. Upon receiving the domain name resolution anomaly notification, the second electronic device will be unable to access the third electronic device based on its IP address.

[0393] The typical process of a second electronic device accessing a third electronic device involves the second electronic device sending the domain name of the third electronic device to the first electronic device. The first electronic device then determines the IP address of the third electronic device using the domain name. Afterward, the first electronic device needs to configure network settings, set port numbers, security settings, and test the connection before the second electronic device can access the network to access the third electronic device. In this embodiment, if the detection result indicates that internet access is to be controlled, the first electronic device can send a notification of domain name resolution anomaly to the second electronic device via a deep packet inspection module. Therefore, it can block the second electronic device's network access from the source (e.g., the source could be the first electronic device determining the IP address of the third electronic device through its domain name during the access process), thereby controlling internet access and improving blocking efficiency.

[0394] In some embodiments, the first electronic device further includes a knowledge base storage module and a permission configuration module. The knowledge base storage module is used to store a knowledge base, and the permission configuration module is used to store permission configuration information. The knowledge base storage module is decoupled from the deep packet inspection module, and the permission configuration module is decoupled from the deep packet inspection module.

[0395] The configuration methods for the knowledge base storage module and the permission configuration module can be found in the software architecture shown in Figure 2, and will not be elaborated here.

[0396] In this embodiment, the permission configuration module is decoupled from the deep message detection module, which facilitates the maintenance of data in the permission configuration module, and the knowledge base is decoupled from the deep message detection module, which facilitates the maintenance of data in the knowledge base.

[0397] This application provides a computer program product that, when run on an electronic device, causes the electronic device to execute the technical solutions described in the above embodiments. Its implementation principle and technical effects are similar to those of the related embodiments described above, and will not be repeated here.

[0398] This application provides a readable storage medium containing instructions that, when executed by an electronic device, cause the electronic device to perform the technical solution described in the above embodiments. The implementation principle and technical effects are similar and will not be repeated here.

[0399] This application provides a chip for executing instructions. When the chip is running, it executes the technical solutions described in the above embodiments. Its implementation principle and technical effects are similar and will not be repeated here.

[0400] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions. When the computer instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium accessible to a computer or a data storage device such as a server or data center that integrates one or more available media. The available media may be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., high-density digital video discs (DVDs)), or semiconductor media (e.g., solid-state disks (SSDs)).

[0401] It should be understood that the term "embodiment" used throughout the specification means that a specific feature, structure, or characteristic related to an embodiment is included in at least one embodiment of this application. Therefore, various embodiments throughout the specification do not necessarily refer to the same embodiment. Furthermore, these specific features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. It should be understood that in the various embodiments of this application, the sequence numbers of the above processes do not imply a sequential order of execution; the execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0402] Those skilled in the art will understand that the various numerical designations such as "first," "second," etc., involved in this application are merely for the convenience of description and are not intended to limit the scope of the embodiments of this application, nor do they indicate the order of sequence.

[0403] In this application, the use of singular pronouns to denote "one or more" rather than "one and only one," unless otherwise specified. In this application, unless otherwise specified, "at least one" is intended to mean "one or more," and "more than" is intended to mean "two or more."

[0404] In this article, the term "and / or" is merely a description of the relationship between related objects, indicating that there can be three relationships. For example, A and / or B can represent three cases: A exists alone, A and B exist simultaneously, and B exists alone. Here, A can be singular or plural, and B can be singular or plural.

[0405] In this document, the term "at least one of..." means all or any combination of the listed items. For example, "at least one of A, B and C" can mean: A exists alone, B exists alone, C exists alone, A and B exist simultaneously, B and C exist simultaneously, and A, B and C exist simultaneously. A can be singular or plural, B can be singular or plural, and C can be singular or plural.

[0406] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0407] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0408] The same or similar parts between the various embodiments in this application can be referred to mutually. In the various embodiments of this application, and in the various implementation methods / methods / implementations within each embodiment, unless otherwise specified or logically conflicting, the terminology and / or descriptions between different embodiments and between the various implementation methods / methods / implementations within each embodiment are consistent and can be mutually referenced. The technical features in different embodiments and the various implementation methods / methods / implementations within each embodiment can be combined according to their inherent logical relationships to form new embodiments, implementation methods, methods, or implementation approaches. The above-described embodiments of this application do not constitute a limitation on the scope of protection of this application.

[0409] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of protection of the claims. In conclusion, the above description is merely a preferred embodiment of the technical solution of this application and is not intended to limit the scope of protection of this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A method for managing internet access services, characterized in that, Applied to a first electronic device, the first electronic device including a deep packet inspection module and a protocol stack, the protocol stack including N protocol layers, where N is an integer greater than 1, the method includes: Receive the first message sent by the second electronic device based on Internet access service; The deep packet inspection module performs M inspections on the first packet at the M-layer protocol layer, and sends the first packet or manages internet access services based on the inspection results, where M is less than or equal to N; The detection process, in which the deep packet inspection module performs the i-th inspection on the first packet at the i-th protocol layer in the M-layer protocol layer, includes: The deep packet inspection module obtains partial packet features of the first packet at the i-th protocol layer. The deep packet inspection module detects some packet features of the first packet at the i-th protocol layer to obtain the detection result; If i is less than M and M is less than or equal to N, and the detection result indicates that no control is exercised over internet access services, the first message is sent from the i-th protocol layer to the (i+1)-th protocol layer, and the (i+1)-th detection is performed at the (i+1)-th protocol layer within the M-th protocol layer by the deep packet inspection module; or, When i equals M and M equals N, and the detection result indicates that no control will be exercised over internet access services, the first packet is sent through the deep packet inspection module; or, When i equals M and the detection result indicates that internet access services should be controlled, the deep packet inspection module is used to control internet access services.

2. The method according to claim 1, characterized in that, The deep packet inspection module includes multiple inspection modules. Each protocol layer in the N-layer protocol layer is configured with an inspection point, and the inspection point is configured with the inspection module of the deep packet inspection module. And, the step of obtaining partial message features of the first message at the i-th protocol layer through the deep message detection module includes: The first message is parsed by the i-th protocol layer to obtain some message characteristics of the first message; The detection module obtains partial message features of the first message at the detection point on the i-th protocol layer.

3. The method according to claim 1 or 2, characterized in that, The first electronic device further includes a knowledge base and permission configuration information. The knowledge base includes multiple business types, and each of the multiple business types includes multiple message features. The permission configuration information includes a correspondence between at least one message feature and at least one permission information. Each message feature of the at least one message corresponds to at least one permission information. Each permission information includes a correspondence between at least one business type and one permission content. And, the step of detecting partial message features of the first message at the i-th protocol layer using the deep message detection module to obtain detection results includes: The deep packet inspection module detects the permission content corresponding to certain packet features of the first packet in the permission configuration information; or... The deep message detection module detects the first service type to which some features of the first message belong in the knowledge base, and detects the permission content corresponding to the first service type in the permission configuration information. If the permission content corresponding to some of the message features of the first message is detected, or if the first service type to which some of the features of the first message belong is detected, and if the permission content corresponding to the first service type is detected, the detection result is determined to be to control the Internet access service. If no permission content corresponding to some of the message features of the first message is detected, or if no first service type to which some of the features of the first message belong is detected, or if a first service type to which some of the features of the first message belong is detected, and no permission content corresponding to the first service type is detected, the detection result is determined to be that no control is exercised over the Internet access service.

4. The method according to claim 3, characterized in that, The N-layer protocol layer includes a first protocol layer and at least one second protocol layer, wherein the first protocol layer is the bottom layer of the N-layer protocol layer; and the step of detecting partial message features of the first message on the i-th protocol layer using the deep message detection module to obtain a detection result includes: At the first protocol layer, the deep packet inspection module detects the permission content corresponding to some packet features of the first packet in the permission configuration information; Upon detecting the permission content corresponding to some message features of the first message, the detection result is determined to be to control internet access services. If no permission content corresponding to the characteristics of some packets in the first packet is detected, the detection result is determined to be no control over internet access services; and... The step of detecting partial message features of the first message at the i-th protocol layer using the deep message detection module to obtain a detection result further includes: At each protocol layer in the at least one second protocol layer, the deep message detection module detects the first service type to which some features of the first message belong in the knowledge base, and detects the permission content corresponding to the first service type in the permission configuration information. If the first service type to which some features of the first message belong is detected, and if the permission content corresponding to the first service type is detected, the detection result is determined to be to control the Internet access service. If the first service type to which some features of the first message belong is not detected, or if the first service type to which some features of the first message belong is detected, and the permission content corresponding to the first service type is not detected, the detection result is determined to be that no control is exercised over the Internet access service.

5. The method according to any one of claims 1 to 4, characterized in that, When i equals M and the detection result indicates that internet access services should be controlled, the control of internet access services through the deep packet inspection module includes: When i equals M and the detection result indicates that internet access services are to be controlled, the memory occupied by the first packet is released through the deep packet detection module in order to control internet access services.

6. The method according to any one of claims 1 to 4, characterized in that, When i equals M and the detection result indicates that internet access services should be controlled, the control of internet access services through the deep packet inspection module includes: When i equals M and the detection result indicates that internet access services should be controlled, the deep packet inspection module sends an interference message to the second electronic device or the third electronic device to disconnect the network connection between the second electronic device and the third electronic device in order to control internet access services. The third electronic device is the device that receives the first message.

7. The method according to claim 6, characterized in that, The interference messages include Transmission Control Protocol Reset messages or Internet Control Message Protocol Unreachable messages.

8. The method according to any one of claims 1 to 4, characterized in that, When i equals M and the detection result indicates that internet access services should be controlled, the control of internet access services through the deep packet inspection module includes: When i equals M and the detection result indicates that internet access services are to be controlled, the deep packet inspection module sends a notification of domain name resolution error to the second electronic device to restrict the second electronic device from accessing the third electronic device in order to control internet access services. The third electronic device is the device that receives the first packet.

9. The method according to any one of claims 1 to 8, characterized in that, The first electronic device further includes a knowledge base storage module and a permission configuration module. The knowledge base storage module is used to store a knowledge base, and the permission configuration module is used to store permission configuration information. The knowledge base storage module is decoupled from the deep packet inspection module, and the permission configuration module is decoupled from the deep packet inspection module.

10. An electronic device, characterized in that, include: One or more processors; One or more memory units; The one or more memories store one or more computer programs, the one or more computer programs including instructions that, when executed by the one or more processors, cause the electronic device to perform the method as described in any one of claims 1 to 9.

11. A computer-readable storage medium, characterized in that, Includes computer instructions that, when executed on an electronic device, cause the electronic device to perform the method as described in any one of claims 1 to 9.

12. A chip, characterized in that, The chip includes: Memory, used to store instructions; A processor for retrieving and executing the instructions from the memory, causing an electronic device on which the chip is mounted to perform the method as described in any one of claims 1 to 9.

Images