CN108124258A - A kind of control method and network monitoring apparatus of terminal communication service - Google Patents

Abstract

The invention discloses a terminal communication service control method, comprising: receiving user authentication request information sent by a terminal, the user authentication request information carrying the user identification information of the terminal; according to the user authentication request information to perform user identification authentication, if the user identification authentication is passed, then search the user identity information corresponding to the user identification information in the setting database, and judge the user of the terminal based on the sub-information in the user identity information Whether it is a service-restricted user; when it is determined that the user of the terminal is a service-restricted user, provide the user with a set communication service. The invention also discloses a network monitoring device at the same time.

Description

A control method for terminal communication services and a network monitoring device

technical field

The invention relates to communication technology, in particular to a terminal communication service control method and a network monitoring device.

Background technique

With the rapid development of economy, society and communication network technology, the number of users of mobile terminals such as mobile phones and tablet computers is increasing. The impact is the focus of people's attention. Many parents buy mobile phones for their underage children in order to facilitate contact with their children and meet their learning needs. Although mobile phones provide convenient services to these minors to a certain extent, due to minors' lack of safety awareness and poor self-control ability, mobile phones are also likely to cause many harms to the normal growth and learning of minors, such as easy Make minors addicted to the Internet, or even fall into bad websites and cannot extricate themselves.

For these problems, most of the existing technical solutions are solved by parents controlling the minors' mobile Internet access rights. However, the existing parental control systems based on mobile phones basically only control Internet access rights when accessing a home gateway or a wireless network. However, minors spend most of their time studying and living at school, so it is difficult for mobile phones to access wireless networks. Therefore, minors basically use the traffic of operators to surf the Internet at school. At this time, it is more difficult for parents to effectively supervise the online behavior of minors; moreover, existing technical solutions require parents to manually configure the binding relationship of different user names, passwords and different connections in advance, which has higher requirements for users.

Contents of the invention

In view of this, the embodiments of the present invention provide a terminal communication service control method and a network monitoring device, which can uniformly and effectively monitor the terminal communication services of service-limited users.

In order to achieve the above object, the technical solution of the present invention realizes the process as follows:

An embodiment of the present invention provides a method for controlling terminal communication services, the method comprising:

receiving user authentication request information sent by the terminal, the user authentication request information carrying the user identification information of the terminal;

Perform user identity authentication according to the user authentication request information, and if the user identity authentication passes, search the user identity information corresponding to the user identity information in the setting database, and based on the subfield in the user identity information information to determine whether the user of the terminal is a service-restricted user;

When it is determined that the user of the terminal is a service-restricted user, the set communication service is provided for the user.

In the above solution, the sub-information includes at least one of the following information: age and occupation; the user identification information includes an International Mobile Subscriber Identity (IMSI).

In the above solution, the provision of the set communication service for the user includes:

Judging whether the time of the user's communication service request is within the allowed communication service time corresponding to the user identification information, if not, prohibiting the terminal corresponding to the user identification information from using the communication service.

In the above solution, when the communication service is a network data service, the time of determining that the user's communication service request is after the time allowed for using the communication service corresponding to the user identification information, the method further includes:

Judging whether the traffic currently used by the terminal is greater than or equal to a set traffic threshold, and if it is greater than or equal to, prohibiting the terminal from using network data services.

In the above solution, after it is determined that the traffic currently used by the terminal is less than the set traffic threshold, the method further includes:

judging whether the website accessed by the terminal is in the set website whitelist, if not, prohibiting the terminal from accessing the website;

And/or, determine whether the APP application used by the terminal is in the set APP whitelist list, and if not, prohibit the terminal from using the APP application.

In the above solution, when the communication service is downloading an APP application, the method further includes:

When it is determined that the terminal downloads a new APP application that is not included in the set APP whitelist, it is determined whether the new APP application meets the set APP application download conditions, and if not, the terminal is prohibited from downloading the APP application. New APP application.

In the above scheme, the method also includes:

Receive an update request for at least one of allowed communication service time, traffic threshold, URL whitelist, and APP whitelist;

At least one of the allowed communication service time, the traffic threshold, the URL whitelist, and the APP whitelist is updated according to the update request.

An embodiment of the present invention provides a network monitoring device, which includes: a first receiving module, an authentication module, and a control module; wherein,

The first receiving module is configured to receive user authentication request information sent by a terminal, where the user authentication request information carries user identification information of the terminal;

The authentication module is configured to perform user identity authentication according to the user authentication request information, and if the user identity authentication is passed, search for user identity information corresponding to the user identity information in the setting database, and based on The sub-information in the user identity information judges whether the user of the terminal is a service-restricted user;

The control module is configured to provide a set communication service for the user when it is determined that the user of the terminal is a service-restricted user.

In the above solution, the sub-information includes at least one of the following information: age and occupation; the user identification information includes an International Mobile Subscriber Identity (IMSI).

In the above solution, the control module is specifically used for:

Judging whether the time of the user's communication service request is within the allowed communication service time corresponding to the user identification information, if not, prohibiting the terminal corresponding to the user identification information from using the communication service.

In the above scheme, when the communication service is a network data service, the control module is further configured to determine that the time of the user's communication service request is after the time allowed to use the communication service corresponding to the user identification information , judging whether the traffic currently used by the terminal is greater than or equal to a set traffic threshold, and if it is greater than or equal to, prohibiting the terminal from using network data services.

In the above solution, the control module is further configured to determine whether the website accessed by the terminal is in the set website whitelist after it is determined that the traffic currently used by the terminal is less than the set traffic threshold, if If not, the terminal is prohibited from accessing the website;

And/or, after it is determined that the traffic currently used by the terminal is less than the set traffic threshold, it is judged whether the APP application used by the terminal is in the set APP whitelist list, and if not, the terminal is prohibited Use the APP application.

In the above solution, when the communication service is to download an APP application, the control module is further configured to determine that the terminal downloads a new APP application that is not included in the set APP whitelist, and judges that the new APP application Whether the APP application satisfies the set APP application downloading condition, if not, prohibiting the terminal from downloading the new APP application.

In the above solution, the control module includes a second receiving module and an updating module; wherein,

The second receiving module is configured to receive an update request for at least one of allowed communication service time, traffic threshold, URL whitelist, and APP whitelist;

The update module is configured to update at least one of the allowed communication service time, the traffic threshold, the URL whitelist, and the APP whitelist according to the update request.

In the terminal communication service control method and network monitoring device provided in the embodiments of the present invention, the receiving terminal sends user authentication request information, and the user authentication request information carries the user identification information of the terminal; according to the user authentication Requesting information for user identification authentication, if the user identification authentication is passed, then searching the user identity information corresponding to the user identification information in the setting database, and judging the identity of the terminal based on the sub-information in the user identity information Whether the user is a service-restricted user; when it is determined that the user of the terminal is a service-restricted user, provide the user with a set communication service. It can be seen that the embodiment of the present invention performs user ID authentication on the user of the terminal according to the user authentication request information sent by the terminal, and after the user ID authentication passes, judges the user of the terminal according to the user identity information of the terminal Whether it is a service-restricted user, if it is determined that the user of the terminal is a service-restricted user, then provide the user with the set communication service, that is, control the terminal communication service corresponding to the user identification information, the set The specified communication service content may include: Internet time control, network traffic usage control, network access object control, etc., so as to realize unified and effective supervision of terminal communication services of users with limited services, and the operation is simple and convenient.

The beneficial effect of the present invention is that: the terminal communication service control method and the network monitoring device provided by the embodiment of the present invention can uniformly and effectively monitor the terminal communication services of service-restricted users, that is, as long as the service-restricted users use the operator's network or traffic, it will only provide the set communication service to the user with limited business; for the underage user, the online behavior of the underage user can be limited to the set time period allowed to surf the Internet and the websites allowed to visit and APP applications to protect the normal growth and learning of minors; and, it can automatically and uniformly manage service-restricted users and set communication services on the network side, such as configuring or updating service-restricted users. Flow thresholds, etc., do not require parents to preset one by one, making the operation simple and convenient.

Description of drawings

FIG. 1 is a schematic diagram of an implementation flow of a method for controlling a terminal communication service according to an embodiment of the present invention;

FIG. 2 is a schematic diagram of the system composition of the terminal access network side in the embodiment of the present invention;

FIG. 3 is a schematic diagram of a specific implementation flow of a method for controlling a terminal communication service according to an embodiment of the present invention;

FIG. 4 is a schematic diagram of a specific processing flow of the network side controlling the use of the Internet service by the user of the mobile phone in the embodiment of the present invention;

FIG. 5 is a second schematic diagram of the specific processing flow of the network side controlling the downloading of the APP application by the user of the mobile phone in the embodiment of the present invention;

FIG. 6 is a schematic diagram of the composition and structure of a network monitoring device according to an embodiment of the present invention.

Detailed ways

The implementation process of the control method of the terminal communication service in the embodiment of the present invention is shown in Figure 1, the method includes:

Step 101: receiving user authentication request information sent by the terminal, the user authentication request information carrying the user identification information of the terminal;

Specifically, when the terminal needs to connect to and/or use the network, and after the mutual authentication between the terminal and the base station passes, the terminal sends the user ID information carrying the user identification information of the terminal to the network side through the base station. Authentication request information, to request the operator core network in the network side to authenticate the user of the terminal, then the network side receives the user authentication request information sent by the terminal, and performs authentication according to the user authentication request information User ID authentication.

The terminal can be a mobile phone, a tablet computer, etc.; the network can be a mobile network; the subscriber identification information of the terminal can be a Subscriber Identity Module (Subscriber Identity Module, SIM) in the terminal, which is the International Mobile Subscriber Identity of the SIM card The code (International Mobile Subscriber Identification Number, IMSI), may also be the International Mobile Equipment Identity (International Mobile Equipment Identity, IMEI) of the terminal.

Before step 101, the method may further include: storing the user identity information of the terminal and the user identity information of the terminal in a setting database, and binding the user identity information and the terminal's identity information in the setting database User identification information.

Specifically, the user identity information of the terminal and the user identification information of the terminal are stored in a setting database on the network side in advance, and the user identity information and the user of the terminal are stored in the setting database. The identification information is bound, so that the user identity information can be acquired in the setting database according to the user identification information of the terminal.

The user identity information includes but is not limited to gender, height, age, occupation, ID number, etc.; the age can be represented by numbers alone or by ID number; for example, the seventh digit in the ID number The 14th digit is the date of birth, and the age can be known by comparing the date of birth with the current time and date; the occupations include but are not limited to students, workers, civil servants, etc., and the students can be further subdivided into primary school students, Middle school students, college students, etc.

In the prior art, network operators usually store the terminal user identification information of mobile phones such as IMSI on the core network side in advance, so as to realize subsequent user authentication operations performed on the core network side; When applying for a SIM card, the network operator will store the IMSI information of the SIM card assigned to the user in the authentication center (AUthentication Centre, AUC), which is used to determine whether the user is a subscription identification user when performing user authentication.

Taking LTE authentication as an example, a schematic diagram of the system composition of the terminal access network side is shown in FIG. MME), home subscriber server (Home Subscriber Server, HSS), AUC, serving gateway (Serving Gateway, S-GW), packet data network gateway (Packet Data Network Gateway, P-GW), policy and charging rule functional entity (Policy and Charging Rule Functionality, PCRF) and so on.

When the terminal (User Equipment, UE) initiates a network connection request, the UE will send user authentication request information carrying the user identification information of the UE to the evolved mobile base station eNodeB; then, the eNodeB will receive the The user authentication request information sent by the UE is sent to the MME; after receiving the user authentication request information sent by the eNodeB, the MME sends an authentication information request (Authentication Information Request, AIR) message to the HSS/AUC, the The AIR message carries the user authentication request information, so that the HSS/AUC performs user identification authentication according to the user authentication request information. Among them, the network monitoring module is a module added in the embodiment of the present invention that can control the terminal to access the network, and is used to authenticate the user identity information after the HSS/AUC passes the user identification authentication, so as to Whether the terminal is connected to the network is controlled.

When the terminal is a mobile phone, the AIR message includes information such as an IMSI of the mobile phone, a Public Land Mobile Network Identity (Public Land Mobile Network Identity, PLMN Identity), and the like.

Here, the user identity information of the terminal and the user identity information of the terminal bound to the user identity information of the terminal may be stored in a Home Location Register (Home Location Register, HLR).

Step 102: Perform user identity authentication according to the user authentication request information, and if the user identity authentication passes, search the user identity information corresponding to the user identity information in the setting database, and based on the user identity information The sub-information in judging whether the user of the terminal is a service-restricted user;

Specifically, the network side performs user ID authentication according to the user authentication request information sent by the terminal in step 101, and if the user ID authentication of the terminal is passed, the network side searches for information related to the user ID in the setting database. Corresponding user identity information, determine whether the sub-information in the user identity information meets the setting requirements of the service-restricted user, if so, determine that the user is a service-restricted user, otherwise determine that the user is not a service-restricted user user.

Regardless of whether the user ID authentication of the terminal is passed, the network side will feed back the user ID authentication result to the terminal, that is, the HSS/AUC performs user ID authentication according to the AIR message, if the user ID If the authentication is passed, that is, when it is determined that the user of the UE is a subscriber ID user, the authentication information feedback (AuthenticationInformation Answer, AIA) message will be used to send the authentication vector containing the user identification authentication success notification to the MME, so that the MME will The user identity authentication success notification is sent to the UE; if the user identity authentication fails, that is, when it is determined that the user of the UE is not a subscriber identity user, the AIA message will include the user identity authentication failure notification. The vector is sent to the MME, so that the MME sends a notification of failure of the user identity authentication to the UE.

The setting requirement of the service-restricted user can be set by the user or network operator on the network side, and stored in the AUC or HLR; the setting requirement needs to be set according to the user identity information; for example, when the When the user information is age, the setting requirement should be set as age threshold; when the user information is age and occupation, the setting requirement should be set as age threshold or occupation category, or age threshold and occupation category .

Here, the sub-information can be one or more types of information in the user identity information. For example, when the user identity information includes age and occupation, the sub-information can be either age or occupation, or age and career. When the sub-information is age, the setting requirements should be set according to the age of the object to be controlled, that is, the user with limited services; for example, when minors need to be controlled, the age under 18 can be set The setting requirements of the restricted user, as long as the user of the terminal bound with the user identification information is younger than 18 years old, it can be determined that the user of the terminal is a minor, that is, a service-restricted user.

Step 103: When it is determined that the user of the terminal is a service-restricted user, provide the user with a set communication service.

Specifically, when it is determined according to the judgment result in step 102 that the user of the terminal is a service-restricted user, a set communication service is provided for the user, so as to realize effective supervision of the communication service of the terminal.

Wherein, the communication service includes at least one of the following: network data service, voice call service, information service, and APP application download service; the provision of the set communication service for the user includes: judging the communication service request of the user Whether the time is within the allowed communication service time corresponding to the user identification information, if not, prohibit the terminal corresponding to the user identification information from using the communication service, otherwise allow the terminal corresponding to the user identification information to use the communication service.

Here, the operator or user can pre-set the allowed communication service time on the network side, store the allowed communication service time in the network side database, and then compare the terminal user identification information with the corresponding allowed communication service time. Bind the time to realize the supervision of the user corresponding to the user identification information; of course, it is also possible to bind the user identity information with the time allowed to use the communication service; for different user identification information, you can set Not the same time allowed to use the communication service can also be set to allow the same time to use the communication service; in the prior art, since the same SIM card can be switched and used in multiple mobile phones, if the terminal is allowed to use the communication service If the business time is bound, then the communication service of the mobile phone is controlled according to the allowed communication service time corresponding to the mobile phone where the SIM card is currently located, and it may not be possible to realize the effective supervision of the communication service of the SIM card owner using the mobile phone .

Further, when the communication service is a network data service, when it is determined that the user's communication service request is within the allowed communication service time corresponding to the user identification information, the user identification information corresponding to the user is allowed to use the communication service. Before the terminal uses the communication service, the method further includes:

Judging whether the traffic currently used by the terminal is greater than or equal to a set traffic threshold, if greater than or equal to, prohibiting the terminal from using the network data service, otherwise allowing the terminal to use the network data service.

The network data service is a service that relies on the network to provide data services, such as accessing a website; when the network side device determines that the current traffic used by the terminal is greater than or equal to the set traffic threshold, the terminal is prohibited from using the network data service , can achieve the purpose of saving traffic and Internet access costs.

Further, before it is determined that the traffic currently used by the terminal is less than the set traffic threshold, and before allowing the terminal to use network data services normally, the method further includes:

Judging whether the website accessed by the terminal is in the set website whitelist, if not, prohibiting the terminal from accessing the website, otherwise allowing the terminal to access the website;

And/or, determine whether the APP application used by the terminal is in the set APP whitelist list, if not, prohibit the terminal from using the APP application, otherwise allow the terminal to use the APP application.

Here, when the network side judges that the website visited by the terminal is in the set website blacklist or not in the set website whitelist, the terminal is prohibited from accessing the website; When the APP application is in the set APP blacklist list or not in the set APP whitelist list, the terminal is prohibited from using the APP application; in this way, the effective supervision of the terminal communication service can be realized.

In addition, when the communication service is to download an APP application, the method also includes:

When it is determined that the terminal downloads a new APP application that is not included in the set APP whitelist, it is determined whether the new APP application satisfies the set APP application download condition, and if so, the terminal is allowed to download the APP application. the new APP application, otherwise the terminal is prohibited from downloading the new APP application.

The APP application download conditions can be set according to the category and purpose of the APP application, the APP applications included in the set APP white list list, etc.; The downloaded new APP can only be downloaded when it is for learning. For example, the download of learning APPs such as English Liulishuo and Happy Cichang is allowed, and the download of game APPs such as Angry Birds is prohibited.

Here, after the terminal is allowed to download the new APP, the new APP may also be updated to the set APP whitelist.

The above-mentioned allowable communication service time, traffic threshold, URL whitelist and blacklist, APP application whitelist and blacklist, and APP application download conditions can be set in advance by users or operators and stored in the database on the network side ; In addition, the information in the database can also be updated at any time according to the actual situation.

Further, the method also includes:

Receive an update request for at least one of allowed communication service time, traffic threshold, URL whitelist, and APP whitelist;

At least one of the allowed communication service time, the traffic threshold, the URL whitelist, and the APP whitelist is updated according to the update request.

Specifically, when an update request for at least one of the allowed communication service time, traffic threshold, URL whitelist, and APP whitelist is received, the allowed communication service time, the traffic At least one of the threshold, the URL whitelist, and the APP whitelist is updated to better control terminal communication services.

The following will further illustrate the embodiment of the present invention through a specific example. FIG. 3 is a schematic diagram of the specific implementation flow of the method for controlling the terminal communication service in the embodiment of the present invention. This embodiment takes the control of the communication service of minors as an example. To illustrate, the method includes:

Step 201: the mobile phone initiates a network connection request to the network side;

Specifically, when the user turns on the network data switch, web page or APP application on the mobile phone, and after the mutual authentication between the mobile phone and the base station passes, the mobile phone initiates a network connection request to the network side through the base station, and the network connection request carries The IMSI number of the SIM card of the mobile phone.

Before step 201, the method further includes: binding the user's age with the IMSI number of the SIM card of the mobile phone, and recording it in the HLR.

Step 202: Whether the user identification authentication performed by the network side according to the network connection request passes, if passed, then perform step 203, otherwise end the analysis;

Specifically, after receiving the network connection request, the MME on the network side sends an AIR message to the HSS and AUC, and the AIR message includes information such as the IMSI number and PLMN Identity of the SIM card of the mobile phone; the HSS/AUC receives the After the AIR message, according to the stored IMSI number information and the received IMSI number, check whether the IMSI number of the SIM card of the mobile phone is a known subscriber, that is, perform user ID authentication. If the authorization passes, execute step 203; otherwise, end the analysis; and return the authentication vector containing the authentication result to the MME through the AIA message.

Step 203: determine whether the user identity of the mobile phone is a minor, if so, execute step 204, otherwise execute step 205;

Specifically, the network side obtains the age of the user of the mobile phone bound to the IMSI number from the HLR according to the received IMSI number of the SIM card of the mobile phone, and judges according to the set age threshold of minors Whether the user is a minor, that is, perform user identity information authentication, if so, execute step 205, otherwise execute step 204.

Wherein, the age threshold of minors may be set to 18 years old, and when the user's age is younger than 18 years old, the user is a minor.

Step 204: The network side does not control the communication services of the user;

When it is determined in step 203 that the user is an adult, the mobile phone of the user is allowed to connect to the network, and the communication service of the user is not controlled.

Step 205: the network side controls the user's communication services;

Specifically, the network side controls the communication service of the user of the mobile phone, for example, monitors the user's online access content and time according to the monitoring content, and maintains the mobile phone's access to the Internet. Wherein, the guardianship content may include: effective surfing time period, flow limit, website list black and white list, APP application list; the network side can control whether the user's mobile phone is connected to the network, and can also regularly update the guardianship content.

When the communication service is an Internet access service, the specific processing flow for the network side to control the use of the Internet access service by the user of the mobile phone is shown in Figure 4, and the specific processing methods include:

Step 20501: Determine whether the time for requesting to access the Internet is within the effective Internet access time period, if so, execute step 20502, otherwise execute step 20506;

Specifically, after receiving an Internet access request sent by a user who is a minor through a mobile phone, the network side first determines whether the time for requesting Internet access is within the preset effective Internet access time period; for example, the effective Internet access time period is preset for daily classes Time, weekends and holidays are used to determine whether minors are allowed to access the network; the online request may be to visit a website or an APP application; when it is determined that the time for the online request is within the effective online time period, Go to step 20502, otherwise go to step 20506.

Step 20502: Determine whether the used traffic exceeds the limit, if not, go to step 20503, otherwise go to step 20506;

Specifically, when it is determined that the time for requesting Internet access is within the effective Internet access time period, continue to judge whether the total traffic used by the mobile phone exceeds a preset traffic threshold; The percentage of traffic can also be set dynamically as a basis; when it is judged that the total traffic used by the mobile phone exceeds the preset traffic threshold, go to step 20503, otherwise go to step 20506.

Step 20503: Determine whether the visited website/APP is in the website list white list/APP application list, if so, execute step 20505, otherwise execute step 20504;

Specifically, when it is judged that the current online time and traffic both meet the preset conditions, continue to judge whether the website visited by the user is in the white list of the allowed website list, or judge whether the APP application accessed by the user is in the allowed APP In the application list, if the website accessed by the user is in the allowed website list whitelist or the APP application accessed by the user is in the allowed APP application list, perform step 20505, otherwise perform step 20504.

Here, both the website list whitelist and the APP application list can be reasonably set by authoritative departments or experts in related fields.

Step 20504: Deny access to the website/APP;

Step 20505: Allow access to the website/APP;

Step 20506: Deny the user's Internet access request.

When the communication service is to download an APP application, the second schematic diagram of the specific processing flow for the network side to control the download of the APP application by the user of the mobile phone, as shown in FIG. 5 , the specific processing method includes:

Step 20501a: Determine whether the downloaded new APP application meets the set APP application download conditions, if so, execute step 20502b, otherwise execute step 20503c;

Specifically, when the network side receives a request to download a new APP application as a minor user, it is judged whether the new APP application requested to be downloaded satisfies the set APP application download condition, and if so, then execute step 20502b; if not , then execute step 20503c.

Here, the APP application downloading condition may be set according to the APP application category, usage, APP application included in the set APP list, and the like.

Step 20502b: Download the new APP, and update to the APP list;

Specifically, the new APP application is downloaded, and the new APP application is updated to the APP application list composed of APP applications allowed to be used by the user.

Step 20503c: Refuse to download the new APP.

In order to implement the above method, the embodiment of the present invention also provides a network monitoring device. FIG. 6 is a schematic diagram of the composition and structure of the network monitoring device according to the embodiment of the present invention. The network monitoring device includes: a first receiving module 11, an authentication module 12, control module 13;

Wherein, the first receiving module 11 is configured to receive user authentication request information sent by the terminal, the user authentication request information carrying the user identification information of the terminal;

The authentication module 12 is configured to perform user identity authentication according to the user authentication request information, and if the user identity authentication passes, then search the user identity information corresponding to the user identity information in the setting database, and judging whether the user of the terminal is a service-restricted user based on the sub-information in the user identity information;

The control module 13 is configured to provide a set communication service for the user when it is determined that the user of the terminal is a service-restricted user.

The first receiving module 11 is specifically configured to: when the terminal needs to connect and/or use the network, and after the mutual authentication between the terminal and the base station passes, the terminal reports to the first receiving module 11 through the base station Send user authentication request information carrying the user identification information of the terminal to request the authentication module 12 to authenticate the user of the terminal, then the first receiving module 11 receives the user authentication information sent by the terminal Request information, so that the authentication module 12 performs user identification authentication according to the user authentication request information.

The terminal may be a mobile phone, a tablet computer, etc.; the network may be a mobile network; the user identification information of the terminal may be the IMSI number of the SIM card in the terminal, or the IMEI of the terminal.

When the terminal is a mobile phone, the AIR includes information such as IMSI and PLMN Identity of the mobile phone.

Further, the authentication module 12 is also configured to store the user identity information of the terminal and the user identification information of the terminal in the setting database before the first receiving module 11 receives the user authentication request information sent by the terminal , and bind the user identity information and the user identity information of the terminal in the setting database.

Specifically, the authentication module 12 stores the user identity information of the terminal and the user identification information of the terminal in a setting database in advance, and associates the user identity information with the user of the terminal in the setting database. The identification information is bound, so that the user identity information can be acquired in the setting database according to the user identification information of the terminal.

The database can be set in the authentication module 12 or in the control module 13; the user identity information includes but not limited to gender, height, age, occupation, ID number, etc.; Age can be represented by numbers alone or by ID card number; for example, the 7th to 14th digits in the ID card number are the date of birth, and the age can be obtained by comparing the date of birth with the current time and date; The occupations include, but are not limited to, students, workers, and civil servants, and the students can be further subdivided into primary school students, middle school students, and college students.

In the prior art, network operators usually store mobile phone user identification information such as IMSI on the core network side in advance, so as to implement subsequent user authentication operations performed on the core network side; When a mobile phone applies for a SIM card, the network operator will store the IMSI information of the SIM card allocated to the user in the AUC, which will be used to determine whether the user is a signed user during user authentication.

The authentication module 12 is specifically configured to: perform user identification authentication according to the user authentication request information sent by the terminal, and if the user identification authentication of the terminal is passed, the authentication module 12 is set in the database Find the user identity information corresponding to the user identification information, and determine whether the sub-information in the user identity information meets the setting requirements of the service-restricted user, and if so, determine that the user is a service-restricted user, otherwise determine The user is not a service-restricted user.

The setting requirements of the service-restricted users can be set by the user or the network operator on the network side, and stored in the authentication module 12 or the control module 13; the setting requirements need to be set according to the user information ; For example, when the user information is age, the setting requirement should be set to age threshold; when the user information is age and occupation, the setting requirement should be set to age threshold or occupation category, or set to Age thresholds and occupational categories.

The sub-information may be one or more types of information in the user identity information. For example, when the user identity information includes age and occupation, the sub-information may be age or occupation, or age and occupation . When the sub-information is age, the setting requirements should be set according to the age of the object to be controlled, that is, the user with limited services; for example, when minors need to be controlled, the age under 18 can be set The setting requirements of the restricted user, as long as the user of the terminal bound with the user identification information is younger than 18 years old, it can be determined that the user of the terminal is a minor, that is, a service-restricted user.

The control module 13 is specifically configured to: when it is determined according to the judgment result in the authentication module 12 that the user of the terminal is a service-restricted user, provide the user with a set communication service, so as to realize Effective supervision of the communication services of the terminal.

The communication service includes at least one of the following: network data service, voice call service, information service, APP application download service, etc.; providing the user with a set communication service includes: judging the time of the user's communication service request Whether it is within the allowed communication service time corresponding to the user identification information, if not, prohibit the terminal corresponding to the user identification information from using the communication service, otherwise allow the terminal corresponding to the user identification information to use the communication service.

Here, the control module 13 may preset the allowed communication service time, store the allowed communication service time in the database, and then bind the terminal user identification information with the corresponding allowed communication service time, To realize the supervision of the user corresponding to the user identification information; of course, the user identity information can also be bound with the time allowed to use the communication service; in the prior art, since the same SIM card can be used in multiple Switching and using in a mobile phone, if the terminal is bound with the time allowed to use the communication service of the terminal, then it may not be possible to control the communication service of the mobile phone according to the time allowed to use the communication service corresponding to the mobile phone where the SIM card is currently located. The owner of the SIM card uses the mobile phone to effectively supervise the communication service.

Further, when the communication service is a network data service, the control module 13 is further configured to determine that the time of the user's communication service request is within the allowed communication service time corresponding to the user identification information, then Before allowing the terminal corresponding to the user identification information to use the communication service, determine whether the current traffic used by the terminal is greater than or equal to the set traffic threshold, if greater than or equal to, prohibit the terminal from using the network data service, otherwise allow all The terminal uses network data services.

Here, the network data service is a service that relies on the network to provide data services, such as visiting a website; when the control module 13 determines that the current traffic used by the terminal is greater than or equal to the set traffic threshold, the terminal is prohibited The use of network data services can achieve the purpose of saving traffic and Internet access fees.

Further, the control module 13 is further configured to judge that the current traffic used by the terminal is less than the set traffic threshold, and before the terminal is allowed to use the network data service normally, judge the Whether the visited website is in the set website whitelist, if not, the terminal is prohibited from accessing the website, otherwise the terminal is allowed to access the website;

And/or, before it is determined that the traffic currently used by the terminal is less than the set traffic threshold, before allowing the terminal to use the network data service normally, it is judged whether the APP application used by the terminal is in the set APP If it is not in the white list, the terminal is prohibited from using the APP, otherwise, the terminal is allowed to use the APP.

When the control module 13 judges that the website accessed by the terminal is not in the set website whitelist or in the set website blacklist, the terminal is prohibited from accessing the website; When the APP application used by the terminal is not in the set APP whitelist list or in the set APP blacklist list, the terminal is prohibited from using the APP application; in this way, effective supervision of the terminal communication service can be realized.

In addition, when the communication service is to download an APP application, the control module 13 is also used to determine that the terminal downloads a new APP application that is not included in the set APP white list, and judges whether the new APP application is downloaded. Whether the APP application satisfies the set APP application downloading condition, if so, the terminal is allowed to download the new APP application, otherwise, the terminal is prohibited from downloading the new APP application.

Wherein, the APP application downloading conditions can be set according to the APP application category, purpose, APP application included in the set APP whitelist list, etc.; The new APPs that need to be downloaded can only be downloaded when they are learning apps. For example, the download of learning apps such as English Liulishuo and Happy Words is allowed, while the download of game apps such as Angry Birds is prohibited. The above-mentioned allowable communication service time, traffic threshold, URL whitelist and blacklist, APP application whitelist and blacklist, and APP application download conditions can all be set in advance by the control module 13 and stored in the control module 13. In addition, the information in the database can be updated at any time according to the actual situation.

Here, the control module 13 includes a second receiving module 131 and an updating module 132; wherein,

The second receiving module 131 is configured to receive an update request for at least one of allowed communication service time, traffic threshold, URL whitelist, and APP whitelist;

The update module 132 is configured to update at least one of the allowed communication service time, the traffic threshold, the URL whitelist, and the APP whitelist according to the update request.

Specifically, when the second receiving module 131 receives an update request for at least one of allowed communication service time, traffic threshold, URL whitelist, and APP whitelist, the update module 132 At least one of the allowed communication service time, the traffic threshold, the website whitelist, and the APP whitelist is updated to better control terminal communication services.

In practical applications, the first receiving module 11 and the second receiving module 131 can be realized by interfaces or ports; (MPU), Digital Signal Processor (DSP), or Field Programmable Gate Array (FPGA).

The above descriptions are only preferred embodiments of the present invention, and are not intended to limit the protection scope of the present invention. Any modifications, equivalent replacements and improvements made within the spirit and scope of the present invention are included in the protection scope of the present invention.

Claims (14)

1. A method for controlling communication service of a terminal, the method comprising:

receiving user authentication request information sent by a terminal, wherein the user authentication request information carries user identification information of the terminal;

performing user identification authentication according to the user authentication request information, if the user identification authentication passes, searching user identity information corresponding to the user identification information in a set database, and judging whether the user of the terminal is a service-limited user or not based on sub-information in the user identity information;

and when the user of the terminal is determined to be the user with limited service, providing the set communication service for the user.

2. The method of claim 1, wherein the sub-information comprises at least one of the following information: age, occupation; the subscriber identity information comprises an international mobile subscriber identity IMSI.

3. The method according to claim 1 or 2, wherein the providing the set communication service for the user comprises:

and judging whether the time of the communication service request of the user is within the allowed communication service time corresponding to the user identification information, if not, prohibiting the terminal corresponding to the user identification information from using the communication service.

4. The method according to claim 3, wherein when the communication service is a network data service, the time of the communication service request of the user is determined to be within the allowed communication service time corresponding to the user identification information, and the method further comprises:

and judging whether the current used flow of the terminal is greater than or equal to a set flow threshold, and if so, prohibiting the terminal from using the network data service.

5. The method according to claim 4, wherein after determining that the currently used traffic of the terminal is smaller than a set traffic threshold, the method further comprises:

judging whether the website accessed by the terminal is in a set website white list or not, and if not, prohibiting the terminal from accessing the website;

and/or judging whether the APP used by the terminal is in a set APP white list or not, and if not, prohibiting the terminal from using the APP.

6. The method of claim 3, wherein when the communication service is downloading an APP application, the method further comprises:

and when determining that the terminal downloads a new APP which is not contained in a set APP white list, judging whether the new APP meets the set APP downloading condition, and if not, prohibiting the terminal from downloading the new APP.

7. The method according to any one of claims 4 to 6, further comprising:

receiving an update request aiming at least one of the time for allowing the communication service to be used, a flow threshold value, a website white list and an APP white list;

and updating at least one of the communication service use permission time, the flow threshold, the website white list and the APP white list according to the updating request.

8. A network monitoring apparatus, characterized in that the network monitoring apparatus comprises: the device comprises a first receiving module, an authentication module and a control module; wherein,

the first receiving module is configured to receive user authentication request information sent by a terminal, where the user authentication request information carries user identification information of the terminal;

the authentication module is used for carrying out user identification authentication according to the user authentication request information, searching user identity information corresponding to the user identification information in a set database if the user identification authentication passes, and judging whether the user of the terminal is a service limited user or not based on sub-information in the user identity information;

and the control module is used for providing set communication service for the user when the user of the terminal is determined to be the service limited user.

9. The network monitoring device of claim 8, wherein the sub-information comprises at least one of the following information: age, occupation; the subscriber identity information includes an IMSI.

10. The network monitoring device according to claim 8 or 9, wherein the control module is specifically configured to:

and judging whether the time of the communication service request of the user is within the allowed communication service time corresponding to the user identification information, if not, prohibiting the terminal corresponding to the user identification information from using the communication service.

11. The network monitoring device according to claim 10, wherein when the communication service is a network data service, the control module is further configured to determine whether a currently used traffic of the terminal is greater than or equal to a set traffic threshold after the time of the communication service request of the user is determined to be within the allowed usage communication service time corresponding to the user identification information, and if the currently used traffic of the terminal is greater than or equal to the set traffic threshold, prohibit the terminal from using the network data service.

12. The network monitoring device according to claim 11, wherein the control module is further configured to determine whether the website accessed by the terminal is in a set website white list after the determination that the traffic currently used by the terminal is smaller than a set traffic threshold, and if not, prohibit the terminal from accessing the website;

and/or after the current used flow of the terminal is judged to be smaller than a set flow threshold value, judging whether the APP used by the terminal is in a set APP white list or not, and if not, forbidding the terminal to use the APP.

13. The network monitoring device of claim 10, wherein when the communication service is downloading an APP application, the control module is further configured to determine whether the new APP application satisfies a set APP application downloading condition when the terminal downloads a new APP application that is not included in a set APP white list, and if not, prohibit the terminal from downloading the new APP application.

14. The network monitoring device according to any one of claims 11 to 13, wherein the control module comprises a second receiving module, an updating module; wherein,

the second receiving module is used for receiving an update request aiming at least one of the time for allowing the communication service to be used, the flow threshold value, the website white list and the APP white list;

and the updating module is used for updating at least one of the allowed communication service time, the flow threshold, the website white list and the APP white list according to the updating request.