KR100813203B1 - Network system for controlling internet access service of children for isp - Google Patents

Abstract

A network system for controlling Internet access of children in an ISP(Internet Service Provider) is provided to offer an Internet access service centering on websites useful to the children without increasing communication load and delay by separating a function for determining access control based on authentication and the function for blocking harmful network access according to a predetermined policy. A first routing structure(100) determines children access control for a network access request of a member terminal(10) based on member authentication, performs access for the network access control when the children access control is not required, and blocks or forwards the network access request based on a first access control policy when the children access control is required. A second routing structure(200) blocks or permits the network access request based on a second access control policy by receiving the network access request routed from the first router structure. A member information management structure(300) manages member information, and the first routing structure determines whether a member corresponds to the children access control based on a terminal or member ID by communicating with the member information management structure.

Description

NETWORK SYSTEM FOR CONTROLLING INTERNET ACCESS SERVICE OF CHILDREN FOR ISP}

1 is an exemplary block diagram of a network system for youth access control at an internet access service provider side in accordance with the present invention.

2 is an exemplary block diagram of a first router configuration in a network system for youth access control at an Internet access service provider side according to the present invention.

3 is an exemplary state diagram of a first router configuration in a network system for youth access control at an Internet access service provider side according to the present invention;

4 is an exemplary block diagram of a second router configuration in a network system for youth access control at an Internet access service provider side according to the present invention.

<Description of the symbols for the main parts of the drawings>

10: subscriber station 100: first router configuration

110: first router 130: control target determination unit

150: first router control server 200: second router configuration

210: second router 230: blocking determination server

250: second router control server 300: subscriber information management configuration

400: access allow list management unit 500: access block list management unit

The present invention relates to a network system for youth access control on the Internet access service provider side. More particularly, the present invention relates to a traffic analysis due to an increase in the communication load and an increase in the communication load when the access control for the youth is performed on the conventional Internet access service provider. It improves the time delay that follows and the disadvantage that the site-centered internet access service is not provided for the youth, and the function to make the judgment on the access control based on the authentication and the youth according to the predetermined policy when the access control is performed. By separating the function to block harmful network access and configuring the decision function to block the direct access or forward it to the blocking function, it is possible to improve the communication load and the shortcomings of the time delay, and to make the Internet suitable for the youth. The side of the Internet access service provider can provide services in related to youth access control network system.

Due to the rapid expansion of the Internet, various services are provided on the Internet. Most of these Internet services are open so that anyone can access them easily.

However, there are sites that provide useful information for living on the Internet service, but there are sites that are likely to cause psychological stimulation and confusion of values of the growing youth, such as violence / sexual pornography sites and suicide promotion sites. Also, in recent years, excessive use of addictive online games, chat via P2P messenger, and community services is also increasing.

For example, online game sites often have bad effects on teenagers due to addictiveness. These services are one of the side effects of the development of the Internet, which adversely affects the emotions of adolescents.

In order to solve this problem, a number of methods have been developed to block access to harmful sites and to restrict the use of the Internet.

There are two ways to implement the youth internet access control service.

First of all, it is a case where a harmful site is blocked or an internet access time is controlled based on a terminal of a user, i.

In other words, if a user stores a list of harmful sites on a terminal such as a user's PC, and the user tries to access a site included in the list of harmful sites, the web function is set so that even if the contents of the site are downloaded, There is a way to block access to harmful sites by not displaying on the screen.

However, in such a case, there is a situation that has not been implemented so far to control the Internet access time, and the youth Internet access control service based on the subscriber terminal has a problem that a harmful site blocking program must be installed on the user's PC.

In addition, the criterion for blocking harmful sites is to restrict access to the site by using access information such as the URL or IP of the harmful site, but it is difficult to identify harmful sites on the Internet. In case of restriction, it is difficult to effectively block the IP address only. In addition, there is a disadvantage that the list of harmful sites must be continuously updated and transmitted to the user's terminal. In addition, when deleting a list of harmful sites, etc. in the user terminal has a disadvantage that the blocking is not performed.

Another method is to block harmful sites at Internet service providers (ISPs) that users use to access the Internet.

In other words, if the traffic of the user is classified on the network and the traffic to the harmful site is determined, the traffic is blocked to restrict the access to the harmful site.

This method has the advantage of restricting access to harmful sites at the network level without adding a function for blocking service to the user's terminal. However, the disadvantage of having a large bandwidth of a physical connection link to the blocking server and It has the disadvantage of increasing the communication load by complicating the function, and has the disadvantage that the user does not receive the Internet service in the event of a blocking system failure.

In addition, since only the sites that are explicitly blocked are blocked, it is very difficult to explicitly block the sites for a large number of sites on the Internet.

In addition, if the user is an adult is configured to use freely without such restrictions, in most cases it is determined whether the user is a youth or an adult through a separate youth certification or adult certification. Therefore, especially in the case of youth, there is a disadvantage that the process of performing authentication may be difficult.

 Although convenient from the user's point of view, the method of blocking harmful sites on the Internet access service provider side causes an increase in communication load for blocking harmful sites, and also has a disadvantage of delaying time for internet access according to traffic analysis.

An object of the present invention is to provide a site-oriented internet access service suitable for a youth and a time delay caused by an increase in communication load and a traffic analysis due to an increase in the communication load when performing an access control for a youth, etc. in the conventional internet access service provider. To improve the disadvantages, separate the function of judging whether to control access based on authentication and the function of blocking harmful network access according to a predetermined policy when performing access control. Blocking or forwarding it to the blocking function can improve the disadvantages of increased communication load and time delay, and it is possible to control the network system for youth access on the Internet access service provider side, which can provide Internet access service centered on the site suitable for the youth. To provide for.

In order to achieve the above technical problem, the present invention determines whether to perform the youth access control based on user authentication for the network access request from the subscriber's terminal, and determines that the youth access control is not necessary. A first router configuration for blocking or forwarding the network connection request based on a first connection control policy previously determined in response to determining that the youth access control is necessary, and the first connection in the first router configuration. And a second router configuration that receives the network connection request forwarded based on a control policy and performs a block or allow for the network connection request based on a second predetermined connection control policy. Control network Provide a system.

Further, in the network system for youth access control at the Internet access service provider side according to the present invention, the network information system further comprises a subscriber information management configuration for managing information on the subscriber, wherein the first routing configuration communicates with the subscriber information management configuration. The subscriber may include a control target determination unit determining whether the subscriber is the youth access control target.

In addition, in the youth access control network system at the Internet access service provider side according to the present invention, the control target determination unit, based on the terminal identification information of the subscriber terminal or the identification information of the subscriber to determine whether the youth access control object. Can be.

Further, in the network system for youth access control at the Internet access service provider side according to the present invention, the first router configuration receives the network connection request from the subscriber station and controls the Internet access based on the first access control policy. A first router and a first router control server for managing the first access control policy for the Internet access control of the first router.

In addition, in the network system for youth access control at the Internet access service provider side according to the present invention, the first access control policy is the youth access only when the subscriber is contracted to perform the youth access control with the Internet access service provider in advance. It may include a policy for performing control.

In addition, in the network system for youth access control at the Internet access service provider side according to the present invention, the first access control policy may include a policy that does not restrict the Internet access when the adult authentication is confirmed for the subscriber.

In addition, in the network system for youth access control at the Internet access service provider side according to the present invention, the first access control policy is configured to send the network connection request when the youth authentication is confirmed or the adult authentication is not confirmed for the subscriber. 2 may include a policy of forwarding (forwarding) to the router configuration.

In addition, in the network system for youth access control at the Internet access service provider side according to the present invention, the first access control policy is a case where the child authentication is confirmed for the subscriber or the adult authentication for a time other than a preset available time period. If not, it may include a policy to block the network access request.

In addition, in the network system for youth access control at the Internet access service provider side according to the present invention, the first access control policy is a preset total available time when the youth authentication is confirmed for the subscriber or the adult authentication is not confirmed. It may include a policy to block the network connection request beyond.

In addition, in the network system for youth access control at the Internet access service provider side according to the present invention, the first access control policy may include a policy for blocking all network connection requests except when the network connection request is an HTTP request. have.

In addition, in the network system for youth access control at the Internet access service provider side according to the present invention, the first access control policy may include a policy for forwarding the network connection request to the second router configuration.

Further, in the network system for youth access control at the Internet access service provider side according to the present invention, the first router control server can receive the first access control policy from the subscriber information management configuration.

In addition, in the network system for youth access control at the Internet access service provider side according to the present invention, the subscriber information management configuration may include a first access control policy change unit for changing the first access control policy.

Further, in the youth access control network system at the Internet access service provider side according to the present invention, the first access control policy changing unit may receive a change to the first access control policy from a predetermined user.

In addition, in the network system for youth access control at the Internet access service provider side according to the present invention, the second router configuration comprises: a second router that receives the network connection request from the first router configuration and controls the Internet connection; A blocking determination server that analyzes an access request based on the second access control policy and determines blocking or allowing of the network connection request at the second router; and the Internet connection of the second router and the blocking determination server. It may include a second router control server for managing the second access control policy for control.

In addition, in the network access control network system for a youth on the service provider side according to the present invention, the access permission list management unit for maintaining a list of sites that are explicitly allowed access to the youth, the second Internet access The policy may include a policy for allowing the Internet access to the network access request when the site corresponding to the network access request is a site maintained by the access allow list manager.

In addition, in the network access control network system for a youth on the service provider side according to the present invention, the access block list management unit for maintaining a list of sites that are explicitly blocked access to the youth, the second Internet access The policy may include a policy for blocking the Internet access to the network access request when the site corresponding to the network access request is a site maintained by the access block list manager.

In addition, in the network system for youth access control at the Internet access service provider side according to the present invention, an access allow list management unit for maintaining a list of sites that are explicitly allowed access to the youth, and an explicit access to the youth. The apparatus may further include an access blocking list manager configured to maintain a list of blocked sites, wherein the second internet access policy includes a site where a site corresponding to the network access request is maintained in the access allowed list manager and the access allowed list manager. If the site is not maintained at may include a policy for suspending the Internet connection for the network connection request.

In addition, in the network system for a youth access control at the Internet access service provider side according to the present invention, the second Internet access policy includes a site where a site corresponding to the network access request is maintained in the access allow list management unit and the access allow list management unit. If the site is not maintained, it may include a policy for allowing the Internet access for the network connection request based on the approval from the additional subscriber.

Further, in the network system for youth access control at the Internet access service provider side according to the present invention, the second router control server can receive the second access control policy from the subscriber information management configuration.

In addition, in the youth access control network system at the Internet access service provider side according to the present invention, the subscriber information management configuration may include a second access control policy changer for changing the second access control policy.

Further, in the youth access control network system at the Internet access service provider side according to the present invention, the second access control policy changing unit may receive a change to the second access control policy from a predetermined user.

In addition, in the network system for youth access control at the Internet access service provider side according to the present invention, the access allow list management unit may receive the site information that is explicitly allowed to access the youth from a predetermined user and update the list. have.

In addition, in the network system for youth access control at the Internet access service provider side according to the present invention, the access blocking list manager may receive site information from which a connection is explicitly blocked for a youth from a predetermined user and update the list. have.

Hereinafter, with reference to the accompanying drawings, an embodiment of a network system for youth access control at the Internet access service provider side of the present invention will be described in more detail.

1 is an exemplary block diagram of a network system for youth access control at an internet access service provider side according to the present invention.

As illustrated, the network system for controlling access of a youth at the Internet access service provider side according to the present invention includes a first router configuration 100 and a second router configuration 200.

In addition, as shown, the network system for the youth access control at the Internet access service provider side according to the present invention may further include a subscriber information management configuration 300, access permission list management unit 400 or access block list management unit 500.

The first router configuration 100 determines whether to perform the youth access control on the basis of user authentication for the network connection request from the subscriber terminal 10.

In this case, if the youth access control is not necessary, the access is performed for the network access request from the subscriber terminal 10.

However, if a youth access control is required, the first router configuration 100 transmits a network connection request from the subscriber terminal 10 to the second router configuration 200.

The first router configuration 100 will be described in detail later with reference to FIGS. 2 to 3.

The second routing configuration 200 receives a network connection request from the subscriber terminal 10 transmitted when the first router configuration 100 determines that the youth access control is necessary.

Thereafter, blocking or allowing of the network access request from the subscriber terminal 10 is performed.

The second router configuration 200 will be described in detail later with reference to FIG. 4.

As shown, the network system for youth access control at the Internet access service provider side according to the present invention may further include a subscriber information management configuration 300.

The subscriber information management configuration 300 is a configuration for managing information on subscribers, and may be, for example, a subscriber management system on the Internet access service provider side.

The subscriber information management configuration 300 may manage identification information, including identification information for the subscriber, for example, an ID and a password. The subscriber information management configuration 300 may also manage identification information of the subscriber terminal, for example.

The subscriber information management configuration 300 can also be configured to manage a policy based on the operation of the first router configuration 100 or the second router configuration 200.

The subscriber information management configuration 300 will be further described based on the embodiment of the first router configuration 100 or the second router configuration 200 with reference to FIGS. 2 to 4.

In addition, as shown, the network system for youth access control at the Internet access service provider side according to the present invention may further include an access allow list management unit (400).

The access permission list manager 400 maintains a list of sites that are explicitly allowed to access the youth.

The connection allow list management unit 400 will be further described based on the embodiment of the second router configuration 200 with reference to FIG. 4.

In addition, as shown, the network system for youth access control at the Internet access service provider side according to the present invention may further include an access block list management unit (500).

The access blocking list manager 500 maintains a list of sites for which access is explicitly blocked for the youth.

The connection blocking list manager 500 will be further described based on the embodiment of the second router configuration 200 with reference to FIG. 4.

2 is an exemplary block diagram of a first router configuration in a network system for youth access control at an Internet access service provider side according to the present invention.

As illustrated, the first router configuration 100 may include a control target determination unit 130, a first router 110, and a first router control server 150.

The first router 110 receives a network connection request from the subscriber station 10 and controls the Internet connection based on a first connection control policy previously specified.

The control target determination unit 130 determines whether the subscriber is a youth access control target based on the communication with the subscriber information management configuration 300.

In other words, the subscriber may agree to provide a blocking service for a harmful site to the youth through a youth authentication through a contract with an internet access service provider.

In this case, the control target determination unit 130 checks whether the user corresponding to the subscriber station 10 is a subscriber who has previously agreed to receive such a blocking service through communication with the subscriber information management configuration 300.

Whether to subscribe to such a blocking service can be performed using, for example, identification information of the subscriber station 10 or identification information of the subscriber.

If it is not subscribed to such a blocking service, the control target determination unit 130 is configured to perform an Internet connection without restriction for the network connection request from the subscriber terminal 10 without the need for such blocking.

However, if the subscription to the blocking service, the control target determination unit 130 determines in particular whether the subscriber is an adult or a youth.

In other words, if adult authentication is performed and the subscriber is an adult, the Internet connection can be performed without restriction on the network connection request from the subscriber station 10 without the need for blocking.

However, if the subscriber is a child, it is necessary to provide a blocking service for the network access request from the subscriber terminal 10.

In this case, the first router configuration 100 transmits a network connection request from the subscriber station 10 to the second router configuration 200.

The first router control server 150 is a server that manages a first access control policy used for internet access control of the first router 110.

The first router control server 150 is provided, for example, to facilitate maintenance, update or change of the first access control policy.

Hereinafter, the first access control policy will be described in detail.

1. It may include a policy to perform youth access control only if the subscriber is contracted to perform youth access control with the Internet service provider in advance.

That is, the youth access control may be configured to be performed only for the user who wants the youth access control.

2. If you have verified adult authentication for your subscribers, you may include a policy that does not restrict access to the Internet.

In other words, if you are an adult, you do not need to restrict access to the Internet.

3. In the case of confirming the youth authentication for the subscriber or in the case of failing to confirm the adult authentication, a policy of forwarding a network connection request from the subscriber station 10 to the second router configuration 200 may be included.

That is, the first routing configuration 100 determines whether to allow or transmit based only on information such as whether the youth access control service is used or adult, and the detailed connection blocking or allowing based on the analysis of the network access request or the like. Is configured to be performed by the second router configuration 200.

Such forwarding may be implemented in various forms, for example, forwarding all traffic, forwarding only upstream traffic, or forwarding only HTTP upstream traffic.

Here, "uplink traffic" means traffic transmitted from the subscriber station 10 to the Internet. Therefore, the traffic received by the subscriber station 10 can be marked as "downward traffic."

In this case, the downlink traffic can also be forwarded to determine whether it is harmful to the youth.

4. It may include a preset available time zone. That is, for example, a youth may set a time zone in advance so that it can be used only from 9 am to 10 pm. In this case, a policy for blocking a network access request may be included in the case of confirming the youth certification for the subscriber for a time other than the available time period or when the adult certification is not confirmed.

That is, even in this case, even if it is confirmed as a youth, the second router configuration 200 may block the connection in the first router configuration 100 without analyzing the network connection request separately in the second router configuration 200. To reduce the load.

5. The total available time can be set in advance for the subscriber. That is, for example, set to allow only two hours of Internet access per day. After the setting is performed, if the user authentication is confirmed or the adult authentication is not confirmed, the policy may include a policy of blocking a network access request exceeding a preset total available time.

That is, even in this case, even if it is confirmed as a youth, the second router configuration 200 may block the connection in the first router configuration 100 without analyzing the network connection request separately in the second router configuration 200. To reduce the load.

6. May contain a policy to block all network access requests except when the network access request is an HTTP request. That is, for example, it may be configured to block an application program using a messenger or P2P or other network when accessing the network.

That is, even if it is determined as a youth, the second router configuration 200 does not need to analyze the network connection request separately, and the first router configuration 100 blocks the connection for the connection request other than the HTTP request, thereby allowing the second connection. It is to reduce the load on the router configuration 200.

In this case, the HTTP request is mainly sent using port 80. Therefore, it is possible to simply configure to block a network connection request other than a connection request using port 80.

7. The policy may include forwarding the network connection request to the second router configuration 200. That is, the second router configuration 200 analyzes the HTTP request or other requests that need to be determined whether or not it is suitable for the youth, and configures the access control based on whether or not it is suitable for the youth.

Based on the first access control policy, the first router configuration 100 may determine whether to allow the access without limitation, whether the youth access control is necessary, or whether to block the access without performing the youth access control.

Meanwhile, as described above, the first router control server 150 manages the first access control policy. Preferably this first access control policy may be received from subscriber information management configuration 300.

The subscriber information management configuration 300 may include a first access control policy changer (not shown) for performing a change to the first access control policy for this purpose.

Such a first access control policy can be managed, for example, in association with the subscriber information management configuration 300 since it can be set for each subscriber.

In this case, the first access control policy changing unit (not shown) may be configured to receive a change to the first access control policy from a predetermined user.

For example, a parent of a youth may change a setting such as the available time zone or the total available time for the child. In this case, the parent changes it, and the first access control policy changing unit (not shown) receives and maintains the change of the first access control policy, and the first router control server 150 receives the changed first access. The control policy is controlled to update the operation of the first router 110 by receiving the control policy.

However, all or some of these first access control policies may be configured to apply to all general youth.

3 is an exemplary state diagram of a first router configuration in a network system for youth access control at an Internet access service provider side according to the present invention.

As shown, the first router configuration 100 can have three states: "block" or "allow" or "transmit."

For example, it may be started in a blocking or allowing or transmitting state depending on the setting after initialization. This setting is determined according to the policy of the Internet access service provider.

In the blocking state, when the adult authentication is performed, the state is changed to the allowed state, and when the youth authentication is performed, the state is changed to the transmission state.

The permission status applies to the network connection request without restriction and is limited in the case where the adult is confirmed. In this case, if the youth authentication for the subscriber is performed in the allowed state, the state is changed to the transmission state. If the adult is logged out, it may be changed to a blocked state.

The blocking state is a state that performs blocking for network access.

The transmission state means transmitting a network connection request for analysis in the second router configuration 200. That is, when the youth authentication is performed or when the adult authentication is not performed, the transmission state can be maintained.

Also, in the transmission state, if adult authentication is performed for the subscriber, it may be changed to the allowed state.

In addition, even in the transmission state, if the logout is performed, or if the time is not the above available time period or exceeds the total available time, the state may be changed to the blocked state.

4 is an exemplary block diagram of a second router configuration in a network system for youth access control at the Internet access service provider side according to the present invention.

As shown, the second router configuration 200 may include a second router 210, a blocking determination server 230, and a second router control server 250.

The second router 210 receives a network connection request from the first router configuration 100 to control internet access. That is, when the first router configuration 100 determines that the youth access control is necessary, the network connection request from the terminal 10 of the subscriber to be transmitted is received and control is performed based on this.

The blocking determination server 230 analyzes the network connection request received from the second router 210 based on a second predetermined access control policy to determine blocking or allowing of the network connection request from the second router 200. do.

For example, the network connection request packet is analyzed to extract information such as to which site the connection request is made, and to block or allow based on the information.

The second router control server 250 manages the second access control policy to control the Internet access of the second router 210 and the blocking determination server 230.

That is, the second router control server 250 is provided, for example, to facilitate maintenance, update or change of the second access control policy.

Hereinafter, the second access control policy will be described in detail.

1. This is a case where the aforementioned access permission list manager 400 maintains a list of sites that are explicitly allowed to access a youth.

In this case, when the site corresponding to the network access request is a site maintained by the access allow list management unit 400, the policy may allow a network access to the network access request.

In other words, access to a site or the like that is determined to be suitable for the youth in advance and managed by the access permission list manager 400 is allowed.

2. The above-described access blocking list manager 500 maintains a list of sites for which access is explicitly blocked for a youth.

In this case, when the site corresponding to the network access request is a site maintained by the access blocking list manager 500, the network access request may include a policy of blocking internet access.

In other words, it is determined that it is harmful to the youth in advance, and the access to the site managed by the access blocking list manager 500 is blocked.

3. The above-mentioned connection allow list management unit 400 maintains a list of sites that are explicitly allowed to access the youth, and the site that is explicitly blocked access to the youth in the access blocking list management unit 500. This is the case for maintaining lists of fields.

In this case, when the site corresponding to the network access request is not a site maintained by the access allow list management unit 400 or a site maintained by the access allow list management unit 500, a policy for suspending Internet access for such network access requests. It may include.

That is, if it is not included in the list of sites that are explicitly identified as harmful or harmful to a young person, the access is suspended.

4. In the case of 3, it may include a policy to allow internet access for network connection request based on the approval from the subscriber or the like.

In other words, it is difficult to maintain the access allow list management unit 400 or the access block list management unit 500 by judging whether the Internet site is harmful or not, based on the approval of the subscriber.

Meanwhile, in order to maintain the access permission list manager 400 or the access block list manager 500, the access allow list manager 400 or the access block list manager 500 may be performed as follows.

The access permission list management unit 400 may receive a site information that is explicitly allowed to access a youth from a predetermined user and update the list maintained based on the site information.

For example, it is possible to authorize an authorized user such as a parent or teacher to recommend such a suitable site, and then update the list based on the recommendation.

Similarly, the access blocking list manager 500 may receive a site information for which a connection is explicitly blocked for a youth from a predetermined user and update the list maintained based on the site information.

For example, it is possible to grant an authorized user such as a parent or teacher to recommend such a harmful site, and then update the list based on the recommendation.

Meanwhile, as described above, the second router control server 250 manages the second access control policy. Preferably this second access control policy may be received from the subscriber information management configuration 300.

The subscriber information management configuration 300 may include a second access control policy changer (not shown) for performing a change to the second access control policy for this purpose.

This second access control policy can be managed, for example, in association with the subscriber information management configuration 300 since it can be set for each subscriber.

In this case, the second access control policy changer (not shown) may be configured to receive a change to the second access control policy from a predetermined user.

For example, a parent of a child can be configured to block a harmful site for his or her child or add a suitable site. In this case, the parent changes this, and the second access control policy changing unit (not shown) receives and maintains the change of the second access control policy, and the second router control server 250 receives the changed second. Receives an access control policy and controls to update the operation of the second router 210 or the blocking determination server 230.

However, some or all of these second access control policies may be configured to apply to all general youth.

Although the configuration of the present invention has been described in detail, these are merely illustrative of the present invention, and various modifications may be made by those skilled in the art without departing from the essential characteristics of the present invention. This will be possible.

Therefore, the embodiments disclosed herein are not intended to limit the present invention but to describe the present invention, and the spirit and scope of the present invention are not limited by these embodiments. It is intended that the scope of the invention be interpreted by the following claims, and that all descriptions within the scope equivalent thereto will be construed as being included in the scope of the present invention.

As described above, according to the present invention, a site-oriented Internet connection suitable for a youth and a time delay caused by traffic analysis due to an increase in the communication load and an increase in the communication load when the access control for the youth is performed in the conventional Internet access service provider It improves the disadvantage that service is not provided, and separates the function to judge whether to control access based on authentication and the function to block harmful network access according to a predetermined policy in case of access control. It can be configured to block direct access or forward it to the blocking function, which can improve the disadvantage of increased communication load and time delay, and can provide Internet access service centered on the site suitable for youth.

Claims (24)

If it is determined that the youth access control is not necessary based on user authentication for the network access request from the subscriber's terminal, and it is determined that the youth access control is not necessary, the access is performed for the network access request and the youth access control is performed. A first router configuration for blocking or forwarding the network connection request based on a first predetermined access control policy if determined to be necessary; A second router configuration configured to receive the network connection request forwarded based on the first access control policy in the first router configuration and to block or allow the network access request based on a second predetermined access control policy; Network system for youth access control at the Internet access service provider side comprising a. The method of claim 1, Further comprising a subscriber information management configuration for managing information about the subscriber, The first routing configuration includes a control target determination unit that determines whether the subscriber is the youth access control target based on communication with the subscriber information management configuration. Network system for youth access control at the Internet access service provider side comprising a. The method of claim 2, And the control target determination unit determines whether the youth connection control target is based on terminal identification information of the subscriber terminal or identification information of the subscriber. The method of claim 2, The first router configuration, A first router that receives the network connection request from the subscriber station and controls internet access based on the first access control policy; A first router control server managing the first access control policy for controlling the internet access of the first router Network system for youth access control at the Internet access service provider side comprising a. The method of claim 4, wherein The first access control policy includes a policy for performing the youth access control only when the subscriber is contracted to perform the youth access control with the internet access service provider in advance. Network system. The method of claim 5, And the first access control policy includes a policy for not restricting the internet access when the adult authentication is confirmed for the subscriber. The method of claim 5, The first access control policy may include a policy for forwarding the network connection request to the second router configuration when the user authentication for the subscriber or the adult authentication is not confirmed. Network system for youth access control at provider side. The method of claim 5, The first access control policy may include a policy for blocking the network access request when the youth authentication is confirmed for the subscriber for a time other than the preset available time period or when the adult authentication is not confirmed. Network system for youth access control at service provider side. The method of claim 5, The first access control policy may include a policy for blocking the network access request exceeding a preset total available time in case of confirming youth authentication or adult verification for the subscriber. Network system for youth access control at provider side. The method of claim 5, And the first access control policy includes a policy for blocking all the network connection requests except when the network connection request is an HTTP request. The method of claim 5, And the first access control policy includes a policy for forwarding the network connection request to the second router configuration. The method of claim 4, wherein And the first router control server is configured to receive the first access control policy from the subscriber information management configuration. The method of claim 12, The subscriber information management configuration may include a first access control policy changer configured to change the first access control policy. Network system for youth access control at the Internet access service provider side comprising a. The method of claim 13, And the first access control policy changing unit receives a change to the first access control policy from a predetermined user. The method of claim 2, The second router configuration, A second router that receives the network connection request from the first router configuration to control internet access; A blocking determination server for analyzing the network connection request based on the second access control policy and determining blocking or allowing of the network connection request at the second router; A second router control server managing the second access control policy for controlling the internet access of the second router and the blocking determination server; Network system for youth access control at the Internet access service provider side comprising a. The method of claim 15, Access control list management unit that maintains a list of sites that are explicitly allowed access for youth. More, The second Internet access policy may include a policy for allowing the Internet access to the network access request when the site corresponding to the network access request is a site maintained by the access allow list management unit. Network system for youth access control. The method of claim 15, Block access list management, which maintains a list of sites that are explicitly blocked from accessing youth. More, The second Internet access policy may include a policy for blocking the Internet access for the network access request when the site corresponding to the network access request is a site maintained by the access block list manager. Network system for youth access control. The method of claim 15, An access control list management unit that maintains a list of sites that are explicitly allowed access to youth; Block access list management, which maintains a list of sites that are explicitly blocked from accessing youth. More, The second Internet access policy may be configured to suspend the Internet access for the network access request when the site corresponding to the network access request is not a site maintained by the access allow list management unit and a site maintained by the access allow list management unit. A network system for youth access control at the Internet access service provider side, which includes a policy. The method of claim 18, The second Internet access policy is based on the approval from the additional subscriber when the site corresponding to the network access request is not a site maintained by the access allow list management unit and a site maintained by the access allow list management unit. And a policy for allowing the internet access for a request. The method of claim 15, And the second router control server is configured to receive the second access control policy from the subscriber information management configuration. The method of claim 20, The subscriber information management configuration may include a second access control policy changing unit configured to change the second access control policy. Network system for youth access control at the Internet access service provider side comprising a. The method of claim 21, And the second connection control policy changing unit receives a change to the second connection control policy from a predetermined user. The method of claim 16, And the access permission list manager is configured to update the list by receiving site information that is explicitly allowed access to the youth from a predetermined user, and updating the list. The method of claim 17, And the access blocking list manager is configured to update the list by receiving site information for which access is explicitly blocked for a youth from a predetermined user, and updating the list.

Images