WO2018141172A1

WO2018141172A1 - Method for controlling web browsing on terminal and for web browsing on terminal, router device, and terminal

Info

Publication number: WO2018141172A1
Application number: PCT/CN2017/113957
Authority: WO
Inventors: 翟景亮
Original assignee: 中兴通讯股份有限公司
Priority date: 2017-02-06
Filing date: 2017-11-30
Publication date: 2018-08-09
Also published as: CN108400953A

Abstract

A method for controlling web browsing on a terminal, comprising: a router device receives an unencrypted domain name resolution request packet transmitted by a terminal, where the domain name resolution request packet is used for requesting a domain name resolution result corresponding to a domain name to be visited by the terminal; the router device generates a domain name resolution response packet to be issued to the terminal and carrying the domain name resolution result, encrypts the domain name resolution response packet, and transmits the encrypted domain name resolution response packet to the terminal.

Description

Method for controlling terminal access to the Internet and terminal access, router device and terminal

Technical field

The present disclosure relates to, but is not limited to, the field of communications, and in particular, a method for controlling a terminal to access the Internet and a terminal, a router device and a terminal.

Background technique

The Domain Name System (DNS) is a distributed database for the Transmission Control Protocol (TCP)/Internet Protocol (IP) application. It provides domain names and IP addresses. Conversion between addresses. Through the domain name system, when users perform certain applications, they can directly use the easy-to-remember and meaningful domain name, and the domain name resolution server in the network resolves the domain name into the correct IP address.

With the continuous popularization of Wireless Fidelity (Wi-Fi) environment, various Internet software are also emerging. With the continuous advancement of the Internet of Things and smart home, more and more home appliances can be connected. Entering the ranks of the network, the home network is suffering an unprecedented impact. Many people choose to encrypt, hide the Service Set Identifier (SSID) or Media Access Control (Medium Access Control) when using the home router. Basic methods such as MAC) address filtering are used to prevent network attacks.

The user equipment can transmit data related to the domain name resolution process by means of two-way resolution and encryption:

The terminal monitors and receives the domain name resolution request data of the local device; encrypts the domain name resolution request data and sends the data to the preset network address; receives the encrypted domain name resolution result data fed back by the network address through the router; the terminal decrypts the domain name resolution The result data is in response to the domain name resolution request data of the local machine.

Summary of the invention

The following is an overview of the topics detailed in this document. This Summary is not intended to limit the scope of the claims.

Controlling the users of the network through the password setting method, the lack of exposure in many network software, and double The domain name resolution encryption mechanism is a waste of limited resources for home routing. Secondly, the home router has no relevant network early warning function and related processing mechanism, and the user cannot know the state of the home router at a certain moment.

The terminal encryption and decryption process is cumbersome.

The embodiments of the present disclosure provide a method for controlling a terminal to access the Internet and a terminal to access the Internet, a router device and a terminal, and a system for controlling the terminal to access the Internet, which can simplify the process of encrypting and decrypting the terminal.

The embodiment of the present disclosure provides a method for controlling a terminal to access the Internet, including: the router device receives an unencrypted domain name resolution request message sent by the terminal, where the domain name resolution request message is used to request to be accessed by the terminal. The domain name resolution result corresponding to the domain name; the router device obtains the domain name resolution response message to be sent to the terminal and carries the domain name resolution result; and encrypts the domain name resolution response message, and the encrypted domain name is encrypted. The parsing response message is sent to the terminal.

In an exemplary embodiment, the encrypting the domain name resolution response message includes:

The router device encrypts part of the data in the domain name resolution response message.

In an exemplary embodiment, the router device generates a domain name resolution response message that is to be delivered to the terminal and carries the domain name resolution result, and includes any one of the following:

When the router device detects that the domain name resolution result is in the local cache of the router device, the router device carries the domain name resolution result in the domain name resolution response packet;

When the router device detects that the domain name resolution result is not in the local cache of the router device, the router device requests the domain name resolution result from the server device, and carries the domain name resolution in the domain name resolution response packet. result.

In an exemplary embodiment, after the encrypted domain name resolution response message is sent to the terminal, the method further includes:

The router device updates the locally stored dynamic information table, wherein the dynamic information table stores the number of accesses by the terminal to access the domain name corresponding to the domain name resolution result within a preset time.

In an exemplary embodiment, in a case where the router device detects that the number of accesses of the terminal exceeds a preset value, the router device determines that the terminal is an illegal connection.

In an exemplary embodiment, after the router device determines that the terminal is an illegal connection, the router device sends an alarm signal, and records the terminal identifier of the terminal for the user to check. read.

In an exemplary embodiment, the key of the router device encrypting the partial data is manually set in advance on the router device and the terminal.

The embodiment of the present disclosure further provides a method for a terminal to access the Internet, including:

The terminal sends an unencrypted domain name resolution request message to the router device, where the domain name resolution request message is used to request a domain name resolution result corresponding to the domain name to be accessed of the terminal;

The terminal receives the encrypted domain name resolution response message carrying the domain name resolution result;

The terminal parses the domain name resolution response packet according to the preset key, and accesses the server corresponding to the IP address in the domain name resolution result.

In an exemplary embodiment, the receiving, by the terminal, the encrypted domain name resolution response message carrying the domain name resolution result includes:

Part of the data in the domain name resolution response message is encrypted.

In an exemplary embodiment, the terminal parses the domain name resolution response message according to the preset key, including:

The DNS client plug-in of the terminal decrypts part of the data in the domain name resolution response message according to the preset key.

In an exemplary embodiment, the key that the terminal parses the domain name resolution response message is manually set in advance on the terminal and the router device.

The embodiment of the present disclosure further provides a router device, including:

The first communication device is configured to: receive an unencrypted domain name resolution request message sent by the terminal, where the domain name resolution request message is used to request a domain name resolution result corresponding to the domain name to be accessed of the terminal; Transmitting the encrypted domain name resolution response message to the terminal;

The first processor is configured to: generate the domain name resolution response message to be sent to the terminal and carry the domain name resolution result, and encrypt the domain name resolution response message.

In an exemplary embodiment, the first processor is further configured to: encrypt part of the data in the domain name resolution response message.

In an exemplary embodiment, the manner in which the first processor acquires the domain name resolution result in the domain name resolution response report includes any one of the following:

The first processor is configured to: detect that the router device has the domain in a local cache Carrying the domain name resolution result in the domain name resolution response packet;

The first processor is configured to: when it is detected that the domain name resolution result is not in the local cache of the router device, request the domain name resolution result from the server device, and carry the domain name resolution response message in the domain name resolution response message Domain name resolution results.

In an exemplary embodiment, the first processor is further configured to: after sending the encrypted domain name resolution response message to the terminal,

The dynamic information table of the local storage is updated, wherein the dynamic information table stores the number of accesses by the terminal to access the domain name corresponding to the domain name resolution result within a preset time.

In an exemplary embodiment, the first processor is further configured to: if it is detected that the number of accesses of the terminal exceeds a preset value, determine that the terminal is an illegal connection.

In an exemplary embodiment, the key that the first processor encrypts the partial data is manually set in advance on the router device and the terminal.

The embodiment of the present disclosure further provides a terminal, including:

The second communication device is configured to: send an unencrypted domain name resolution request message to the router device, where the domain name resolution request message is used to request a domain name resolution result corresponding to the to-be-accessed domain name of the terminal; The encrypted domain name resolution response message carrying the domain name resolution result;

The second processor is configured to: parse the domain name resolution response message according to the preset key, and access a server corresponding to the IP address in the domain name resolution result.

In an exemplary embodiment, the second processor is further configured to: parse the domain name resolution response message that is encrypted by the partial data according to the preset key.

In an exemplary embodiment, the second processor is further configured to: decrypt, by using a DNS client plug-in of the terminal, the encrypted data portion in the domain name resolution response message according to the preset key.

In an exemplary embodiment, the second processor parses the key of the domain name resolution response message to be manually set in advance on the terminal and the router device.

The embodiment of the present disclosure further provides a system for controlling a terminal to access the Internet, including:

The router device generates a domain name solution that is to be delivered to the terminal and carries the domain name resolution result. The response packet is parsed, and the domain name resolution response message is encrypted, and the encrypted domain name resolution response message is sent to the terminal.

In an exemplary embodiment, the encrypting, by the router device, the domain name resolution response message includes:

In an exemplary embodiment, after the encrypted domain name resolution response message is sent to the terminal, the system further includes:

The router device updates the locally stored dynamic information table, where the dynamic information table stores the number of access times that the terminal accesses the domain name corresponding to the domain name resolution result within a preset time;

And in the case that the router device detects that the number of accesses of the terminal exceeds a preset value, the router device determines that the terminal is an illegal connection.

Embodiments of the present disclosure also provide a storage medium. The storage medium is arranged to store program code for performing the following steps:

The router device receives the unencrypted domain name resolution request message sent by the terminal, where the domain name resolution request message is used to request a domain name resolution result corresponding to the domain name to be accessed of the terminal;

The router device generates a domain name resolution response message to be sent to the terminal and carries the domain name resolution result;

The domain name resolution response packet is encrypted, and the encrypted domain name resolution response message is sent to the terminal.

In an exemplary embodiment, the storage medium is further configured to store program code for performing the following steps:

Embodiments of the present disclosure also provide a computer readable storage medium storing a computer executable And an instruction, when the computer executable instruction is executed, implementing the method for controlling the terminal to access the Internet.

The embodiment of the present disclosure further provides a computer readable storage medium storing computer executable instructions, which are implemented when the computer executable instructions are executed.

In the embodiment of the present disclosure, the terminal sends a message for requesting domain name resolution to the router device, and the router device feeds back the encrypted response message carrying the domain name resolution result to the terminal, and the terminal parses the response message after parsing the response message. Access the server corresponding to the domain name resolution result. Thereby, the encryption and decryption process of the terminal online is simplified, the resources of the router device are saved, and the process of the terminal accessing the Internet is greatly reduced.

Other aspects will be apparent upon reading and understanding the drawings and detailed description.

BRIEF abstract

FIG. 1 is a flowchart of a method for controlling a terminal to access the Internet according to an embodiment of the present disclosure;

2 is a network architecture diagram of a half-duplex domain name encryption mechanism in accordance with an embodiment of the present disclosure;

3 is a flow chart of adding and deleting device nodes in accordance with an alternative embodiment of the present disclosure;

4 is a functional block diagram of a network mechanism in accordance with an alternative embodiment of the present disclosure;

FIG. 5 is a schematic diagram of an overall flow of a network detection mechanism according to an alternative embodiment of the present disclosure.

Preferred embodiment of the present disclosure

Embodiments of the present disclosure will be described below with reference to the accompanying drawings.

It may be noted that the terms "first", "second" and the like are used herein to distinguish similar objects, and are not necessarily used to describe a particular order or order.

The method and system of the present disclosure can operate on at least one of a router device and a terminal.

FIG. 1 is a flowchart of a method for controlling a terminal to access the Internet according to an embodiment of the present disclosure. As shown in FIG. 1 , the process may include the following steps:

Step S102: The router device receives an unencrypted domain name resolution request message sent by the terminal, where the domain name resolution request message is used to request a domain name resolution result corresponding to the domain name to be accessed of the terminal;

Step S104: The router device generates a domain name resolution response message that is to be sent to the terminal and carries the domain name resolution result, and encrypts the domain name resolution response message, and sends the encrypted domain name resolution response message to the terminal. It can be added that the domain name resolution result may include an IP address, and may also include several IP addresses.

According to the foregoing technical solution, the terminal sends a packet requesting the domain name resolution data to the router device, and the router device feeds back the encrypted response message carrying the domain name resolution result to the terminal. After the terminal parses the response packet, the terminal may Access the server corresponding to the domain name resolution result. By adopting the above technical solution, the process of encrypting and decrypting the terminal online is avoided, the resources of the router device are saved, and the process of the terminal accessing the Internet is greatly reduced.

Optionally, the router device encrypts part of the data in the domain name resolution response message. The router device can select an important part of the domain name resolution response packet for encryption, such as the domain name resolution result, the data related to the domain name resolution result, the IP address, or the data related to the IP address. It is not possible to encrypt all messages.

Optionally, the router device generates a domain name resolution response packet that is to be sent to the terminal and carries the domain name resolution result, and may include any one of the following:

When the router device detects that the domain name resolution result is obtained in the local cache of the router device, the router device carries the domain name resolution result in the domain name resolution response packet;

When the router device detects that the domain name resolution result is not in the local cache of the router device, the router device requests the domain name resolution result from the server device, and carries the domain name resolution result in the domain name resolution response packet. It can be noted that the domain name parsing packet may be generated by the router device through the group package, and the packet may include data corresponding to the domain name resolution result, and the data may be obtained by using the foregoing two methods. It can be added that the domain name resolution result can be sent to the terminal after requesting the domain name resolution result from the server device. The server device may be a domain name resolution server, and may store a correspondence between a domain name and an IP address.

Optionally, after the encrypted domain name resolution response message is sent to the terminal, the router device may update the locally stored dynamic information table, where the dynamic information table stores the terminal accessing within a preset time. The domain name resolution result corresponds to the number of accesses of the domain name.

Optionally, in a case that the router device detects that the number of accesses of the terminal exceeds a preset value, the router device may determine that the terminal is an illegal connection. Determining a terminal on the router device After the connection is illegal, the terminal can be blacked out, and the terminal is not allowed to access the Internet through the router device.

Optionally, after the router device determines that the terminal is an illegal connection, the router device may send an alarm signal and record the terminal identifier of the terminal. The router device can record the illegal terminal for user access and subsequent processing, such as by other means to prohibit the terminal from accessing the router device local area network.

Optionally, the key that the router device encrypts the part of the data may be manually set in advance on the router device and the terminal. The key can be a key set by the user in advance on the router device and the user's own terminal device, without using the router device and the terminal to negotiate the key, thereby effectively avoiding interception during the key negotiation process. Alternatively, a "symmetric key" encryption algorithm relative to a simple encryption algorithm can be selected when manually setting the key.

The embodiment of the present disclosure further provides a method for a terminal to access the Internet, and the method may include the following steps:

Step 1: The terminal sends an unencrypted domain name resolution request message to the router device, where the domain name resolution request message is used to request a domain name resolution result corresponding to the domain name to be accessed of the terminal;

Step 2: The terminal receives the encrypted domain name resolution response message carrying the domain name resolution result.

Step 3: The terminal parses the domain name resolution response message according to the preset key, and accesses the server corresponding to the IP address in the domain name resolution result, and the domain name resolution result is obtained by parsing the domain name resolution message.

Optionally, part of the data in the domain name resolution response message is encrypted. The part of data includes, for example, domain name resolution results, data related to domain name resolution results, IP addresses, data related to IP addresses, and the like.

Optionally, the DNS client plug-in of the terminal may decrypt part of the data in the domain name resolution response message according to the preset key. The DNS client device can intercept the domain name resolution response packet, and after decrypting, the packet can be submitted to an upper layer application, such as an IE.

Optionally, the key that the terminal parses the domain name resolution response packet may be manually set in advance on the terminal and the router device.

The following is a detailed description in conjunction with alternative embodiments of the present disclosure.

An optional embodiment of the present disclosure provides an effective Wi-Fi management method, and proposes a new detection method for the network, which ensures that legitimate users can use the Wi-Fi network efficiently and safely. Keep track of the current status of your wireless router.

An alternative embodiment of the present disclosure first provides a method for managing a Wi-Fi network, that is, a half-duplex domain name encryption mechanism, including:

After obtaining the domain name resolution result data, the wireless router encrypts the part of the data to generate a domain name resolution response message, and sends the message to the host of the domain name request. The domain name resolution result data obtained by the wireless router may be sent by the domain name resolution server.

After receiving the domain name resolution response message, the access host requesting the domain name first decrypts the key data part of the message, and then submits the decrypted data to the process of requesting the upper layer domain name;

Optionally, the foregoing method further has the following feature: the encryption and decryption key used by the wireless router and the access host may be pre-set by the user on the wireless router and the access host, and not on both sides of the wireless network. The wireless router and the access host negotiate to complete, thereby effectively avoiding the risk of being intercepted during the key negotiation process;

At the same time, the encryption operation may only be for the domain name resolution response message, and not for the entire domain name request process;

The encryption process other than the domain name resolution response message in the key agreement and the domain name request can be reduced, and the limited resources of the wireless router can be alleviated.

Alternatively, the half-duplex domain name encryption mechanism can contain a tight fit of two parts:

The domain name resolution packet detection and encryption module on the wireless router side, the processing of this part generally includes two cases:

1. When the domain name resolution cache of the router can find the domain name to be requested by the downstream access device, the key data is encrypted and the group packet is sent to the domain name requesting device;

2. When the local cache of the router fails to obtain the domain name resolution result and sends a domain name resolution request to the remote domain name resolution server, after receiving the domain name resolution response packet, the key data of the packet is intercepted and then sent to the domain name. Request a device.

The DNS client plug-in measured by the user's Internet terminal, the module can substantially intercept the packet after receiving the domain name resolution response message, and decrypt the decrypted data after decrypting the key data of the packet. Submit to upper-level applications, such as IE.

Optionally, FIG. 2 is a network architecture diagram of a half-duplex domain name encryption mechanism according to an embodiment of the present disclosure. As shown in FIG. 2, it may include: a domain name resolution server in a host, a router, and an Internet (Internet) network. Referring to FIG. 2, a detailed description of the entire domain name resolution process may be performed: a DNS domain name resolution plug-in may be installed in the entire network architecture. The host device P1 can also be installed with a router R1 including functions such as encryption and detection. The P1 can access the Wi-Fi LAN of the device R1, and the R1 device can communicate with the internet network.

Step 1: The device P1 is to access a certain website, and the upper layer application, such as a web browser (IE), may initiate a domain name resolution request including the website to the router device R1;

Step 2: After the device R1 receives the domain name resolution request of the P1, the R1 may first search for the domain name resolution cache. If the domain name resolution record is not found, the domain name resolution server may be sent to the remote domain name resolution server on the internet network.

Step 3: After the device R1 finds the related domain name resolution data packet or after receiving the domain name resolution response packet sent by the remote domain name resolution server, the R1 device may encrypt the key data portion of the domain name response message, and then Sending the packet to the domain name resolution requesting device P1;

Step 4: After receiving the domain name resolution response packet, the device P1 can intercept the packet and decrypt the key data part in the packet before submitting the data to the upper application process. The subsequent data is submitted to the upper application process;

Step 5, in this way, the device P1 can get the correct domain name resolution result, and the P1 device can access the Internet normally.

Another key part of an alternative embodiment of the present disclosure is a network early warning method, which may generally include:

The wireless router dynamically maintains a list of access devices in the Wi-Fi LAN, and the dynamic information of each access device node is recorded in the list;

Monitoring the domain name response message transmission status of the Wi-Fi LAN access device, and updating the domain name request dynamic information to the device node dynamic information;

Determining whether the device in the access list is illegal according to the corresponding determination rule according to the dynamic information of the Wi-Fi LAN access device node;

When it is detected that there is a device illegal in the access device list, after the illegal user information is saved, Early warning mechanism to alert users;

Optionally, elaborate on the details of the method:

The dynamic information of the access device node can roughly include the following information:

IP address of the access device;

MAC address of the access device;

The access device requests dynamic data of each domain name node within a certain period of time;

Pointer to the next access device node (this pointer can be used to go to the dynamic statistics table of other terminals);

The dynamic data of the request domain name node may include the following parts of data:

The requested domain name;

The number of times each terminal requests the domain name;

The next request domain name node pointer (this pointer can be used to transfer to the dynamic data table of other domain names, where the number of times other domain names are requested by the terminal is stored);

The update of the dynamic data of the access device node can roughly include data update in three cases:

Addition and deletion of access device nodes in case of new user access and disconnected users disconnected, in this case, FIG. 3 is a new and deleted device node according to an alternative embodiment of the present disclosure. The flow chart, as shown in FIG. 3, may add a device node record when a new user accesses; if a user disconnects, the device node record corresponding to the user may be deleted;

The device requests the update of the domain name dynamic data, that is, the number of requests for the domain name, and the request for the addition of the domain name node. The update of the data may be substantially updated after confirming that the encrypted domain name resolution response message has been successfully sent by the router;

After a certain period of time (such as 5 minutes), the domain name request data of one or more access device nodes (for example, all access device nodes) may be emptied;

The rule of the illegal user may include: if the number of times the user requests a certain domain name exceeds the specified pre-production (for example, 3 times), the access device cannot correctly decrypt the received encrypted domain name resolution response message, thereby determining that the user The user is an illegal access user. Because the normal access user, after receiving the correct domain name resolution data in a relatively short period of time, the domain name resolution is generally It is temporarily stored locally, so that it can be used directly afterwards, and the same domain name may not be requested multiple times.

The early warning mechanism can be set up with an independent indicator light on the wireless router. When the illegal access user is detected and the whole point is blinking, the indicator light flashes for a period of time to warn the wireless router device user to illegally access the user.

In summary, the method for detecting the network in the present disclosure may generally include the following modules:

The device connection management module: dynamically maintains a list of Wi-Fi LAN access devices of the wireless router device, where the device information of the access device and the information of the domain name access of the device for a period of time are recorded;

The domain name resolution response packet detection module: the module listens to the domain name resolution response message in the domain name resolution server or the wireless router kernel, so as to perform data encryption, information statistics or other actions to trigger;

Network detection module: The module determines the access device node according to the information recorded in the wireless router dynamic access list according to the rules described above, distinguishes whether the device node is illegal, and establishes and dynamically maintains the illegal device list. The data structure of the illegal access device node may include the following information:

MAC address;

IP address;

Super-threshold access to the domain name;

The number of times to access the above domain name;

The next illegal access device node pointer;

蹭 Network Early Warning Module: This module triggers the blinking behavior of the indicator light according to the result of the detection module, thereby alerting the wireless router user.

4 is a functional module relationship diagram in a network mechanism according to an alternative embodiment of the present disclosure. As shown in FIG. 4, a relationship between a plurality of modules is shown.

First, the domain name resolution response packet detection module can detect that the wireless router receives or sends a domain name resolution response data packet;

Secondly, the domain name resolution response packet detection module confirms that the domain name response packet has succeeded. After being sent, the device connection management module may be triggered to update the device node information sent by the domain name response message;

Third, after the device node information is updated, the domain name resolution response packet detecting module may immediately trigger the network detection module to determine whether the device node is illegal;

Fourth, if it is determined that the user is illegal, the network detection module can record the illegal user information to the nonsense user list, and can trigger the network warning module to alert the wireless router user.

The following are optional examples in alternative embodiments of the present disclosure.

An optional instance, domain name resolution one-way encryption mechanism

The domain name resolution one-way encryption mechanism can roughly include the following two aspects: domain name resolution client plug-in and router domain name resolution agent.

The domain name resolution client may be: receiving and storing the encryption key set by the user, and decrypting the data part of the corresponding domain name received by the host device and then handing it over to the corresponding application process.

The wireless router domain name resolution server can also accept and save the encryption key set by the user, and then encrypt the result data of the domain name resolution according to the key set by the user, and send the encrypted data to the domain name requesting host;

Regarding the encryption and decryption process in the domain name resolution one-way encryption mechanism, first, both the domain name resolution client and the router domain name resolution agent may have a user input key requirement, wherein the key format is similar to a dotted decimal IP address, but Users can enter any 12 digits;

Secondly, the encryption process may be that the domain name resolution response packet detection module detects the domain name resolution response message, intercepts the message, and takes out the domain name resolution address in the packet, and converts it into a dotted decimal IP address, and the user. The input key is used for packet encryption. The encryption method is: each IP address block is added to the key block of the corresponding order, and then the remainder is 255, and finally the bit is inverted.

Finally, after the domain name resolution client intercepts the domain name response message by means of a hook (HOOK), the domain name resolution response IP address in the message can be extracted and converted into a dotted decimal format, which is divided into four groups, and at the same time, the user is input. The 12-bit key is also divided into four groups, and then according to the order of domain name resolution agent encryption, firstly, the four groups of data in the domain name parsing data packet are inverted by bit, and each group is added with appropriate data (such as 1020). Then, each group of data is subtracted from the user's 12-key grouping data in the corresponding order, and finally, the result of each grouping data operation is 255, and the correct result is obtained. Domain name resolution results.

In summary, although we have described a relatively simple method of packet encryption in terms of encryption, more complex encryption algorithms can be used.

Another optional example, the device connection management module of the router device

The module can roughly perform the following functions:

1. Dynamically record a list of devices accessed by the current router in a specific data structure;

2. When the domain name resolution response packet is successfully sent by the domain name resolution server of the wireless router, the related information in the device list is updated.

3. After the specified time period has elapsed, the domain name request information of all users is uniformly cleared.

Optional implementations of this section can include:

First, one or more access devices of the wireless router use the data structure to establish an access device node, where the data structure includes the MAC address, the IP address, and the access domain name resolution list and the next access device node pointer of the device;

Secondly, a domain name resolution node is established for each domain name accessed by the access device, and the data structure includes the accessed domain name, the number of times the same domain name is accessed within a specified time period, and the next domain name pointer; the data structure is embedded The domain name resolution list of the device node data structure.

Third, the basic information of one or more devices in the wireless router's wireless fidelity Wi-Fi local area network may be obtained by acquiring the MAC address of the access device through the wireless network card, and combining the Dynamic Host Configuration Protocol (Dynamic Host Configuration Protocol, The method of obtaining the IP address information corresponding to each device by means of the bootses file and the arpping method corresponding to the DHCP process; each access device can correspond to a node in the access device list; at the same time, to ensure the device After the update of the access list information, the update of the access device node in the access device list may be completed by means of starting a timer;

Finally, to ensure that the domain name resolution list information in the access device list is cleared after the end of the listening period, a timer of the listening period can be started. When the time period ends, the domain name resolution list information of the access device node used is cleared.

Another optional example, the domain name resolution response packet detection module of the router device

The module can roughly perform the following functions:

1. Listening to the domain name resolution response message;

2. The device connection management module is notified to update the domain name resolution list information of the corresponding user;

3. The trigger network detection module performs an illegal determination on the domain name requesting user.

For the foregoing three functions, the corresponding steps may include: first, listening to the domain name resolution response message, and substantially modifying the domain name resolution response function of the domain name resolution agent process, or by using the HOOK function to fetch the domain name resolution response message from the kernel. Way to achieve

Secondly, the domain name response request device or the packet capture function can effectively obtain the domain name resolution request device information and the request domain name information. After confirming that the encrypted domain name response message is successfully sent, the message can be notified by the message or directly invoke the access device list update function. The method triggers the update of the domain name resolution list;

Finally, the network detection function can also be triggered by means of message notification or function call.

Another optional example, the network detection module of the router device

The module can roughly perform the following functions:

1. Determine whether the device in the device access list is illegal;

2. Establish and dynamically maintain an illegal user list;

3. Notify the warning module of the network to perform the warning.

For the above three functions, the corresponding steps may include:

First, determining whether the device in the device access list is illegal may be substantially for the access domain name node in the newly updated access device node, and extracting the number of times the device accesses each domain name is compared with a specific threshold condition, if it is greater than a threshold The access device is determined to be illegal. Otherwise, the access device is legal. In addition, the latest update device node can be implemented by transmitting parameters.

Secondly, the establishment and dynamic maintenance of the illegal user list may be performed by integrating the basic information of the illegal access device node into the illegal user linked list when the illegal access device is detected in the previous step, which may be substantially through a list of similar access device lists. Way organization

Third, the notification network warning module performs the warning, which can be completed by setting the wireless router device node. For example, when there is a value in the illegal user list, when the system detects that there is an illegal user or the system time is full, the value of the specific device node is set to 1, and the indicator light flashes and can be set. The timer (30s) turns off the indicator after the timer expires.

Another optional example, the network device early warning module of the router device, related processing may include:

First, add a new indicator on the router board, and add a circuit connection on the board, so that the indicator light is connected to a usable pin (GPIO) of the microprocessor, and through the electronic components such as diodes and GPD (ground) Line) forming a loop;

Secondly, a timer program is set in the underlying baseband code to periodically raise the level of the pin connected to the indicator light on the microprocessor, so that the switch in the circuit loop is periodically turned on, thereby realizing the blinking event of the indicator light. control;

Third, the interface for the upper layer and the underlying baseband is encapsulated in the baseband program so that the upper layer or the bottom layer can effectively control the indicator light after detecting the relevant event, such as the device node value change.

Finally, the user can log in to the device management page to view and process the abnormal access device information.

FIG. 5 is a schematic diagram of an overall process of a network detection mechanism according to an alternative embodiment of the present disclosure. As shown in FIG. 5, the process includes the following steps:

Step 1: The user may pre-mand the same key in the router and the legal access device installed with the domain name resolution client.

Step 2: When a device on the downstream access device initiates a domain name resolution request, after the resolution is successful, the router may receive the domain name resolution response data packet.

Step 3: After receiving the domain name resolution response packet, the router may extract the data in the packet, such as the destination IP address, the requested domain name information, and the domain name resolution result.

Step 4: First, the result data of the domain name resolution may be encrypted by using a user pre-made key. After the encryption is completed, the encrypted data may be sent to the domain name requesting host.

Step 5: If the downstream access device is a legal access device, the user can use the pre-made key to decrypt the correct domain name resolution and initiate a normal data request. If it is an illegal user, the device will not obtain the correct data. The domain name resolution request may send a request to the wrong address, and generally cannot achieve the purpose of the network;

Step 6: After the domain name requesting host successfully sends the response packet, the device may update the access device information list according to the information obtained from the domain name resolution message, otherwise the update operation is not performed;

Step 7: After the update of the access device node information is completed, the updated data node information may be transmitted to the network detection module, and the detection module may determine, according to the statistics of the requested domain name of the access device, whether the user is Internet users who are illegally connected;

Step 8: If the network detection module detects that an illegal user accesses the device, the network early warning module may be triggered periodically, and the network early warning module may periodically prompt the user to flash the user through the flashing indicator. Access, prompting the user to process the user of the network;

Step 9. After the entire processing mechanism is completed, you can return to step 2 to perform loop detection again.

The technical solution in the optional embodiment of the present disclosure has many advantages of ensuring network security through domain name encryption, and provides a convenient, fast, simple, and flexible way to complete domain name encryption key setting and downstream access device deployment. Moreover, only encrypting the domain name response result to some extent reduces the occupation of the limited resources of the wireless router; in addition, the user can clearly know the status of the wireless router at any time, whether it is being accessed by the illegal user, and then Time to pay attention to understand whether your home router is regular or occasionally illegal users try to access.

Through the description of the above embodiments, those skilled in the art can clearly understand that the method according to the foregoing embodiment can be implemented by means of software plus an optional general hardware platform, and of course, by hardware. Based on such understanding, portions of the technical solution of the present disclosure that are essential or contribute to the field may be embodied in the form of a software product stored in a storage medium (eg, ROM/RAM, disk, optical disk). A number of instructions are included to cause a terminal device (which may be a cell phone, computer, server, or network device, etc.) to perform the methods described in various embodiments of the present disclosure.

The first communication device is configured to: receive an unencrypted domain name resolution request message sent by the terminal, where the domain name resolution request message is used to request a domain name resolution result corresponding to the domain name to be accessed of the terminal; The encrypted domain name resolution response message is sent to the terminal;

Optionally, the first processor is further configured to: encrypt part of the data in the domain name resolution response message. The part of data includes, for example, domain name resolution results, data related to domain name resolution results, IP addresses, data related to IP addresses, and the like.

Optionally, the manner in which the first processor obtains the data portion of the domain name resolution response packet includes any one of the following:

The first processor is configured to: when detecting the domain name resolution result in the local cache of the router device, the first processor carries the domain name resolution result in the domain name resolution response message;

The first processor is configured to: when detecting that the domain name resolution result is not in the local cache of the router device, the first processor requests the domain name resolution result from the server device, and carries the domain name in the domain name resolution response packet Analyze the results.

Optionally, the first processor is further configured to: after the encrypted domain name resolution response message is sent to the terminal, update the locally stored dynamic information table, where the dynamic information table stores the terminal in the The number of accesses to the domain name corresponding to the domain name resolution result during the preset time.

Optionally, the first processor is further configured to: if it is detected that the number of accesses of the terminal exceeds a preset value, determine that the terminal is an illegal connection.

Optionally, the key that the first processor encrypts the partial data is manually set in advance on the router device and the terminal.

The second communication device is configured to: send an unencrypted domain name resolution request message to the router device, where the domain name resolution request message is used to request a domain name resolution result corresponding to the domain name to be accessed of the terminal; and receive the encrypted A domain name resolution response message carrying the domain name resolution result;

The second processor is configured to: parse the domain name resolution response message according to the preset key, and access the server corresponding to the IP address in the domain name resolution result. It can be added that after obtaining the domain name resolution result, the second processor uploads the domain name resolution result to an application of the upper layer requesting the domain name request, such as a browser, by the specific application, and the domain name is accessed by the specific application.

Optionally, the second processor is further configured to: parse the domain name resolution response message that is encrypted by the partial data according to the preset key. The part of data includes, for example, domain name resolution results, data related to domain name resolution results, IP addresses, data related to IP addresses, and the like.

Optionally, the second processor is further configured to: decrypt, by using the DNS client plug-in of the terminal, part of the data in the domain name resolution response message according to the preset key.

Optionally, the second processor parses the key of the domain name resolution response message to be manually set in advance on the terminal and the router device.

The router device generates a domain name resolution response message to be sent to the terminal, and the domain name resolution response message is encrypted, and the encrypted domain name resolution response message is sent to the terminal.

Optionally, the encrypting, by the router device, the domain name resolution response packet includes:

The router device encrypts part of the data in the domain name resolution response message. The part of data includes, for example, domain name resolution results, data related to domain name resolution results, IP addresses, data related to IP addresses, and the like.

Optionally, after the encrypted domain name resolution response message is sent to the terminal, the system further includes:

The router device updates the dynamically stored dynamic information table, where the dynamic information table stores the number of access times that the terminal accesses the domain name corresponding to the domain name resolution result within a preset time;

And if the router device detects that the number of accesses of the terminal exceeds a preset value, the router device determines that the terminal is an illegal connection.

Embodiments of the present disclosure also provide a storage medium. Optionally, in the embodiment, the foregoing storage medium may be configured to store program code for performing the following steps:

S1. The router device receives an unencrypted domain name resolution request message sent by the terminal, where the domain name resolution request message is used to request a domain name resolution result corresponding to the domain name to be accessed of the terminal.

S2. The router device generates a domain name resolution response message that is sent to the terminal and carries the domain name resolution result.

S3: Encrypt the domain name resolution response message, and send the encrypted domain name resolution response message to the terminal.

Optionally, the storage medium is further arranged to store program code for performing the following steps:

S4, the terminal sends an unencrypted domain name resolution request message to the router device, where the domain name resolution request message is used to request a domain name resolution result corresponding to the domain name to be accessed of the terminal;

S5. The terminal receives the encrypted domain name resolution response message carrying the domain name resolution result.

S6: The terminal parses the domain name resolution response packet according to the preset key, and accesses the server corresponding to the IP address in the domain name resolution result.

Optionally, in this embodiment, the foregoing storage medium may include, but not limited to, a USB flash drive, a Read-Only Memory (ROM), a Random Access Memory (RAM), a mobile hard disk, and a magnetic memory. A variety of media that can store program code, such as a disc or a disc.

Optionally, in this embodiment, the processor performs the method steps in the foregoing embodiments according to the stored program code in the storage medium.

For an alternative example in this embodiment, reference may be made to the examples described in the foregoing embodiments and the optional embodiments, and details are not described herein again.

The embodiment of the present disclosure further provides a computer readable storage medium storing computer executable instructions, where the computer executable instructions are executed to implement the method for controlling the terminal to access the Internet.

Those skilled in the art will appreciate that the above-described modules or steps of the present disclosure can be used universally. Implemented by computing devices, which may be centralized on a single computing device or distributed over a network of computing devices, optionally implemented in program code executable by the computing device, such that they may be The storage is performed by the computing device in a storage device, and in some cases, the steps shown or described may be performed in an order different than that herein, or they may be separately fabricated into different integrated circuit modules, or Multiple modules or steps are made into a single integrated circuit module. As such, the disclosure is not limited to any specific combination of hardware and software.

Those of ordinary skill in the art will appreciate that all or some of the steps, systems, and functional blocks/units of the methods disclosed above may be implemented as software, firmware, hardware, and suitable combinations thereof. In a hardware implementation, the division between functional modules/units mentioned in the above description does not necessarily correspond to the division of physical components; for example, one physical component may have multiple functions, or one function or step may be composed of several physical The components work together. Some or all of the components may be implemented as software executed by a processor, such as a digital signal processor or microprocessor, or as hardware, or as an integrated circuit, such as an application specific integrated circuit. Such software may be distributed on a computer readable medium, which may include computer storage media (or non-transitory media) and communication media (or transitory media). As is well known to those of ordinary skill in the art, the term computer storage medium includes volatile and nonvolatile, implemented in any method or technology for storing information, such as computer readable instructions, data structures, program modules or other data. Sex, removable and non-removable media. Computer storage media include, but are not limited to, Random Access Memory (RAM), Read-Only Memory (ROM), and Electrically Erasable Programmable Read-only Memory (EEPROM). Flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical disc storage, magnetic cassette, magnetic tape, disk storage or other magnetic storage device, or Any other medium used to store the desired information and that can be accessed by the computer. Moreover, it is well known to those skilled in the art that communication media typically includes computer readable instructions, data structures, program modules, or other data in a modulated data signal, such as a carrier wave or other transport mechanism, and can include any information delivery media. .

A person skilled in the art can understand that the technical solutions of the present disclosure may be modified or equivalently substituted without departing from the spirit and scope of the technical solutions of the present disclosure. Within the scope of the claims.

Industrial applicability

Claims

A method for controlling a terminal to access the Internet includes:

The router device receives the unencrypted domain name resolution request message sent by the terminal, where the domain name resolution request message is used to request a domain name resolution result corresponding to the domain name to be accessed of the terminal;

The router device generates a domain name resolution response message to be sent to the terminal and carries the domain name resolution result;

The domain name resolution response packet is encrypted, and the encrypted domain name resolution response message is sent to the terminal.
The method of claim 1, wherein the encrypting the domain name resolution response message comprises:

The router device encrypts part of the data in the domain name resolution response message.
The method of claim 1, wherein the manner in which the router device obtains the domain name resolution result comprises any one of the following:

When the router device detects that the domain name resolution result is in the local cache of the router device, the router device carries the domain name resolution result in the domain name resolution response packet;

When the router device detects that the domain name resolution result is not in the local cache of the router device, the router device requests the domain name resolution result from the server device, and carries the domain name resolution in the domain name resolution response packet. result.
The method of claim 1, after the encrypted domain name resolution response message is sent to the terminal, the method further includes:

The router device updates the locally stored dynamic information table, wherein the dynamic information table stores the number of accesses by the terminal to access the domain name corresponding to the domain name resolution result within a preset time.
The method of claim 4 further comprising:

When the router device detects that the number of accesses of the terminal exceeds a preset value, the router device determines that the terminal is an illegal connection.
The method of claim 5 further comprising:

After the router device determines that the terminal is an illegal connection, the router device sends an alarm signal, and records the terminal identifier of the terminal.
The method according to any one of claims 1 to 6, wherein the key of the router device encrypting the partial data is manually set in advance on the router device and the terminal.
A method for a terminal to access the Internet includes:

The terminal sends an unencrypted domain name resolution request message to the router device, where the domain name resolution request message is used to request a domain name resolution result corresponding to the domain name to be accessed of the terminal;

The terminal receives the encrypted domain name resolution response message carrying the domain name resolution result;

The terminal parses the domain name resolution response packet according to the preset key, and accesses the server corresponding to the internet protocol IP address in the domain name resolution result.
The method of claim 8, wherein the receiving, by the terminal, the encrypted domain name resolution response message carrying the domain name resolution result comprises:

Part of the data in the domain name resolution response message is encrypted.
The method of claim 9, wherein the terminal parses the domain name resolution response message according to the preset key, including:

The domain name system DNS client plug-in of the terminal decrypts the domain name resolution response message according to the preset key.
The method according to any one of claims 8 to 10, wherein the key for the terminal to parse the domain name resolution response message is manually set in advance on the terminal and the router device.
A router device comprising:

The first communication device is configured to: receive an unencrypted domain name resolution request message sent by the terminal, where the domain name resolution request message is used to request a domain name resolution result corresponding to the domain name to be accessed of the terminal; Transmitting the encrypted domain name resolution response message to the terminal;

The first processor is configured to: generate the domain name resolution response message to be sent to the terminal and carry the domain name resolution result, and encrypt the domain name resolution response message.
The router device according to claim 12, wherein the first processor is further configured to: And encrypting part of the data in the domain name resolution response message.
The router device according to claim 12, wherein the manner in which the first processor generates the domain name resolution response message comprises any one of the following:

The first processor is configured to: when detecting the domain name resolution result in the local cache of the router device, carrying the domain name resolution result in the domain name resolution response packet;

The first processor is configured to: when it is detected that the domain name resolution result is not in the local cache of the router device, request the domain name resolution result from the server device, and carry the domain name resolution response message in the domain name resolution response message Domain name resolution results.
The router device according to claim 12, wherein the first processor is further configured to: after transmitting the encrypted domain name resolution response message to the terminal,

The dynamic information table of the local storage is updated, wherein the dynamic information table stores the number of accesses by the terminal to access the domain name corresponding to the domain name resolution result within a preset time.
The router device according to claim 15, wherein the first processor is further configured to: if it is detected that the number of accesses of the terminal exceeds a preset value, determine that the terminal is an illegal connection.
The router device according to any one of claims 12 to 16, wherein the key for encrypting the partial data by the first processor is manually set in advance on the router device and the terminal.
A terminal comprising:

The second communication device is configured to: send an unencrypted domain name resolution request message to the router device, where the domain name resolution request message is used to request a domain name resolution result corresponding to the to-be-accessed domain name of the terminal; The encrypted domain name resolution response message carrying the domain name resolution result;

The second processor is configured to: parse the domain name resolution response message according to the preset key, and access a server corresponding to the internet protocol IP address in the domain name resolution result.
The terminal according to claim 18, wherein the second processor is further configured to: parse the domain name resolution response message that is encrypted by the partial data according to the preset key.
The terminal according to claim 19, wherein the second processor is further configured to: through the domain name system DNS client plug-in of the terminal, parse the part data to be encrypted according to the preset key The domain name resolution response message.
The terminal according to any one of claims 18 to 20, wherein the key that the second processor parses the domain name resolution response message is manually set in advance on the terminal and the router device.
A system for controlling a terminal to access the Internet, comprising:

The terminal sends an unencrypted domain name resolution request message to the router device, where the domain name resolution request message is used to request a domain name resolution result corresponding to the domain name to be accessed of the terminal;

The router device generates a domain name resolution response message to be sent to the terminal and carries the domain name resolution result, and encrypts the domain name resolution response message, and sends the encrypted domain name resolution response message to the The terminal.
The system of claim 22, wherein the encrypting the domain name resolution response message by the router device comprises:

The router device encrypts part of the data in the domain name resolution response message.
The system of claim 22, after the encrypted domain name resolution response message is sent to the terminal, the system further includes:

The router device updates the locally stored dynamic information table, where the dynamic information table stores the number of access times that the terminal accesses the domain name corresponding to the domain name resolution result within a preset time;

And in the case that the router device detects that the number of accesses of the terminal exceeds a preset value, the router device determines that the terminal is an illegal connection.