WO2018099016A1 - 一种终端通信业务的控制方法及网络监控装置、存储介质 - Google Patents

一种终端通信业务的控制方法及网络监控装置、存储介质 Download PDF

Info

Publication number
WO2018099016A1
WO2018099016A1 PCT/CN2017/085741 CN2017085741W WO2018099016A1 WO 2018099016 A1 WO2018099016 A1 WO 2018099016A1 CN 2017085741 W CN2017085741 W CN 2017085741W WO 2018099016 A1 WO2018099016 A1 WO 2018099016A1
Authority
WO
WIPO (PCT)
Prior art keywords
user
terminal
communication service
app
information
Prior art date
Application number
PCT/CN2017/085741
Other languages
English (en)
French (fr)
Inventor
胡英杰
Original Assignee
深圳市中兴微电子技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 深圳市中兴微电子技术有限公司 filed Critical 深圳市中兴微电子技术有限公司
Publication of WO2018099016A1 publication Critical patent/WO2018099016A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W24/00—Supervisory, monitoring or testing arrangements
    • H04W24/02—Arrangements for optimising operational condition

Definitions

  • the present invention relates to communication technologies, and in particular, to a terminal communication service control method, a network monitoring device, and a computer storage medium.
  • the embodiment of the present invention is to provide a control method for a terminal communication service, a network monitoring device, and a computer storage medium, which can uniformly and effectively supervise terminal communication services of service-limited users.
  • An embodiment of the present invention provides a method for controlling a terminal communication service, where the method includes:
  • the user When it is determined that the user of the terminal is a service-limited user, the user is provided with the set communication service.
  • the sub-information includes at least one of the following information: age, occupation; and the user identification information includes an International Mobile Subscriber Identification Number (IMSI).
  • IMSI International Mobile Subscriber Identification Number
  • the providing the user with the set communication service includes:
  • the time for determining the communication service request of the user is allowed to use the communication service time corresponding to the user identification information.
  • the method further includes:
  • the method further includes:
  • the method when the communication service is an application for downloading an APP, the method further includes:
  • the method further includes:
  • An embodiment of the present invention provides a network monitoring apparatus, where the network monitoring apparatus includes: a first receiving module, an authentication module, and a control module;
  • the first receiving module is configured to receive user authentication request information sent by the terminal, where the user authentication request information carries user identification information of the terminal;
  • the authentication module is configured to perform user identity authentication according to the user authentication request information, and if the user identity authentication passes, searching for a user identity information corresponding to the user identifier information in the setting database, and based on The sub-information in the user identity information determines the user of the terminal Whether it is a business-limited user;
  • the control module is configured to provide the user with the set communication service when the user of the terminal is determined to be a service-limited user.
  • the sub-information includes at least one of the following: age, occupation; and the user identification information includes an International Mobile Subscriber Identity (IMSI).
  • IMSI International Mobile Subscriber Identity
  • control module is specifically configured to:
  • control module when the communication service is a network data service, is further configured to allow the use of the communication service time corresponding to the user identification information at the time of determining the communication service request of the user. After the determination, whether the traffic currently used by the terminal is greater than or equal to the set traffic threshold is determined. If the traffic is greater than or equal to, the terminal is prohibited from using the network data service.
  • control module is further configured to: after determining that the traffic currently used by the terminal is less than a set traffic threshold, determining whether the URL accessed by the terminal is in the whitelist of the configured URL If not, prohibiting the terminal from accessing the website address;
  • control module when the communication service is an application for downloading an APP, the control module is further configured to determine that the terminal downloads a new APP application that is not included in the set APP whitelist, and determines that the Whether the new APP application satisfies the set APP application download condition, and if not, the terminal is prohibited from downloading the new APP application.
  • control module includes a second receiving module and an update module
  • the second receiving module is configured to receive an update request for allowing at least one of a communication service time, a traffic threshold, a URL whitelist, and an APP whitelist;
  • the update module is configured to update at least one of the allowed communication service time, the traffic threshold, the URL whitelist, and the APP whitelist according to the update request.
  • the embodiment of the present invention further provides a computer storage medium, where the computer storage medium stores computer executable instructions, and the computer executable instructions are used to execute the control method of the terminal communication service according to the embodiment of the present invention.
  • the receiving terminal sends the user authentication request information, where the user authentication request information carries the user identification information of the terminal; Requesting information for user identification, and if the user identification is authenticated, searching for the user identity information corresponding to the user identification information in the setting database, and determining the terminal based on the sub information in the user identity information Whether the user is a service-limited user; when the user of the terminal is determined to be a service-limited user, the user is provided with the set communication service.
  • the user identification of the user of the terminal is performed according to the user authentication request information sent by the terminal, and after the user identification is authenticated, the user of the terminal is determined according to the user identity information of the terminal.
  • the user is provided with the set communication service, that is, the terminal communication service corresponding to the user identification information is controlled, and is set.
  • the specified communication service content may include: online time control, network traffic usage control, network access object control, etc., thereby realizing unified and effective supervision of the terminal communication service of the service-limited user, and the operation is simple and convenient.
  • the beneficial effects of the embodiments of the present invention are: the method for controlling the terminal communication service provided by the embodiment of the present invention, the network monitoring device, and the computer storage medium, which can uniformly and effectively supervise the terminal communication service of the service-limited user, that is, as long as the service Restricted users use the carrier’s network or When traffic is used, only the limited communication users are provided with the set communication service; for the underage users, the online behavior of the underage users can be limited to the set allowed time-access period, the websites and APPs that are allowed to access. In-app to protect the normal growth and learning of minors; and, on the network side, can automatically manage the service-limited users and the set communication services, such as configuring or updating the allowed Internet access time period and traffic threshold for service-limited users. Wait, no need for parents to preset, making the operation simple and convenient.
  • FIG. 1 is a schematic flowchart of implementing a method for controlling a terminal communication service according to an embodiment of the present invention
  • FIG. 2 is a schematic structural diagram of a system in which a terminal accesses a network side according to an embodiment of the present invention
  • FIG. 3 is a schematic flowchart of a specific implementation process of a method for controlling a terminal communication service according to an embodiment of the present invention
  • FIG. 4 is a schematic diagram 1 of a specific processing flow for controlling, by the network side, a user of the mobile phone to use an Internet service according to an embodiment of the present invention
  • FIG. 5 is a second schematic diagram of a specific processing flow for controlling a user to download an APP application by the network side according to the embodiment of the present invention
  • FIG. 6 is a schematic structural diagram of a network monitoring apparatus according to an embodiment of the present invention.
  • the implementation process of the control method for the terminal communication service in the embodiment of the present invention is as shown in FIG. 1 , and the method includes:
  • Step 101 Receive user authentication request information sent by the terminal, where the user authentication request information carries user identification information of the terminal.
  • the terminal after the terminal needs to connect and/or use the network, and the authentication between the terminal and the base station passes, the terminal sends the bearer to the network side through the base station.
  • the user authentication request information of the user identification information of the terminal is used to request the user core network in the network side to authenticate the user of the terminal, and the network side receives the user authentication request information sent by the terminal, User identification authentication is performed according to the user authentication request information.
  • the terminal may be a mobile phone, a tablet computer, or the like; the network may be a mobile network; the user identification information of the terminal may be an international mobile user identification of a subscriber identity module (SIM), ie, a SIM card, in the terminal.
  • SIM subscriber identity module
  • IMSI International Mobile Subscriber Identification Number
  • IMEI International Mobile Equipment Identity
  • the method may further include: storing user identity information of the terminal and user identification information of the terminal to a setting database, and binding the user identity information to the terminal in the setting database User identification information.
  • the user identity information of the terminal and the user identification information of the terminal are stored in a setting database on the network side in advance, and the user identity information is described in the setting database.
  • the user identification information of the terminal is bound to obtain the user identity information in the setting database according to the user identification information of the terminal.
  • the user identity information includes, but is not limited to, gender, height, age, occupation, ID card number, etc.; the age may be represented by a single number or by an ID number; for example, the number in the ID number 7 to 14 are the date of birth, and the age can be known by comparing the date of birth with the current time and date; the occupation includes but not limited to students, workers, civil servants, etc., and the student can be further subdivided into Primary school students, middle school students, college students, etc.
  • the network operator usually stores the terminal user identification information of the mobile phone, such as the IMSI, on the core network side in advance, so as to implement the subsequent user authentication operation performed on the core network side; when the user gives the mobile phone at the network operator
  • the network operator stores the IMSI information of the SIM card allocated to the user to an Authentication Centre (AUC) for determining whether the user is a subscription identity user when performing user authentication.
  • AUC Authentication Centre
  • FIG. 2 a schematic diagram of the system configuration of the terminal accessing the network side is shown in FIG. 2; wherein the network element in the Evolved Packet Core (EPC) is evolved. Including Mobility Management Entity (MME), Home Subscriber Server (HSS), AUC, Serving Gateway (S-GW), Packet Data Network Gateway (P-GW) ), Policy and Charging Rule Functionality (PCRF), etc.
  • MME Mobility Management Entity
  • HSS Home Subscriber Server
  • AUC Serving Gateway
  • S-GW Packet Data Network Gateway
  • PCRF Policy and Charging Rule Functionality
  • the UE When the terminal (User Equipment, UE) initiates a connection network request, the UE sends the user authentication request information carrying the user identification information of the UE to the evolved mobile base station (eNodeB, Evolved Node B); then, the eNodeB Sending the received user authentication request information sent by the UE to the MME; after receiving the user authentication request information sent by the eNodeB, the MME sends an authentication information request to the HSS/AUC (Authentication Information Request)
  • the AIR message carries the user authentication request information, so that the HSS/AUC performs user identity authentication according to the user authentication request information.
  • the network monitoring module is a module that can be controlled by the terminal to access the network, and the network monitoring module is configured to authenticate the user identity information after the HSS/AUC authenticates the user identifier, according to the The authentication result controls whether the terminal accesses the network.
  • the AIR message includes information such as an IMSI of the mobile phone, a Public Land Mobile Network Identity (PLMN Identity), and the like.
  • PLMN Identity Public Land Mobile Network Identity
  • the user identification information of the terminal and the user identity information of the terminal bound to the user identification information of the terminal may be stored in a Home Location Register (HLR).
  • HLR Home Location Register
  • Step 102 Perform user identification authentication according to the user authentication request information, and if the user identification authentication passes, search for a user identity letter corresponding to the user identification information in the setting database. And determining, according to the sub information in the user identity information, whether the user of the terminal is a service limited user;
  • the network side performs user identity authentication according to the user authentication request information sent by the terminal in step 101, and if the user identifier of the terminal is authenticated, the system searches for and describes in the setting database.
  • User identity information corresponding to the user identification information determining whether the child information in the user identity information meets the setting requirement of the service-limited user, and if yes, determining that the user is a service-limited user, otherwise determining that the user is not Business limited users.
  • the network side will feed back the user identity authentication result to the terminal, that is, the HSS/AUC performs user identity authentication according to the AIR message, if the user identity is authenticated.
  • the authentication information including the user identity authentication success notification is sent to the MME through an Authentication Information Answer (AIA) message, so that the MME is enabled.
  • AIA Authentication Information Answer
  • the weight vector is sent to the MME, so that the MME sends the user identity authentication failure notification to the UE.
  • the setting requirement of the service-limited user may be set by the user or the network operator in the network side, and stored in the AUC or the HLR; the setting requirement needs to be set according to the user identity information; for example, When the user information is age, the setting requirement should be set as an age threshold; when the user information is age and occupation, the setting requirement should be set to an age threshold or an occupation category, or may be set as an age threshold and an occupation category. .
  • the sub-information may be one or more kinds of information in the user identity information, such as when the user identity information includes age and occupation, the sub-information may be age or occupation, or may be age. And occupation.
  • the sub-information is age
  • the setting requirement is set according to an age of a business-limited user that needs to be controlled; for example, when it is necessary to When the annual person performs control, the age less than 18 years old may be used as a setting requirement of the service limited user, as long as the user age of the terminal bound to the user identification information is less than 18 years old, the terminal may be determined
  • the user is a minor, that is, a business-limited user.
  • Step 103 When it is determined that the user of the terminal is a service-limited user, provide the set communication service for the user.
  • the user of the terminal is determined to be a service-limited user according to the determination result in step 102, the user is provided with the set communication service to implement effective supervision of the terminal communication service. .
  • the communication service includes at least one of the following: a network data service, a voice call service, an information service, and an APP application download service; and the providing the set communication service for the user, including: determining a communication service request of the user. If the time is within the allowed communication service time corresponding to the user identification information, if not, the terminal corresponding to the user identification information is prohibited from using the communication service; otherwise, the terminal corresponding to the user identification information is allowed to use the communication service.
  • the operator or the user may pre-set the allowed communication service time on the network side, and store the allowed communication service time to the database on the network side, and then the user identification information of the terminal and the corresponding permitted communication service.
  • Time binding is performed to implement supervising the user corresponding to the user identification information; of course, the user identity information may be bound to the allowed communication service time; for different user identification information, it may be set.
  • Different communication hours are allowed, and the same allowed communication service time can be set; in the prior art, since the same SIM card can be used for switching among multiple mobile phones, if the terminal is allowed to communicate with the terminal, If the service time is bound, the mobile phone communication service may be controlled according to the allowed communication service time corresponding to the mobile phone currently located in the SIM card, and the owner of the SIM card may not be effectively supervised by using the mobile phone for communication service. .
  • the method when the communication service is a network data service, when the time for determining the communication service request of the user is in the permission to use the communication service corresponding to the user identification information, The method further includes: before the terminal corresponding to the user identification information is allowed to use the communication service, the method further includes:
  • the network data service is a service that provides a data service according to the network, such as accessing a website; and when the network side device determines that the current used traffic of the terminal is greater than or equal to the set traffic threshold, the terminal is prohibited from using the network data service. , can achieve the purpose of saving traffic and Internet access costs.
  • the method before the determining that the traffic currently used by the terminal is less than the set traffic threshold, the method further includes: before allowing the terminal to use the network data service normally:
  • the terminal when the network side determines that the web address accessed by the terminal is in the blacklist of the set URL or is not in the whitelist of the set URL, the terminal is prohibited from accessing the web address; when the network side determines that the terminal uses When the APP application is in the setting APP blacklist list or not in the setting APP whitelist, the terminal is prohibited from using the APP application; thus, effective supervision of the terminal communication service can be implemented.
  • the method further includes:
  • the terminal downloads a new APP application that is not included in the set APP whitelist
  • the APP application downloading condition may be set according to a category, a use of the APP application, an APP application included in the set APP whitelist, and the like; for example, for a minor, that is, a person under the age of 18, only when needed
  • the downloaded new APP application can be downloaded only when it is a learning class. For example, it is allowed to download English fluent, happy word field and other learning APP applications, and it is forbidden to download game apps such as Angry Birds.
  • the new APP application may also be updated to the set APP whitelist.
  • the above-mentioned allowed communication service time, traffic threshold, URL whitelist and blacklist, APP application whitelist and blacklist, and APP application download conditions can be set in advance by the user or the operator, and stored in the database on the network side.
  • the information in the database can be updated at any time according to actual conditions.
  • the method further includes:
  • the allowed communication service time is used according to the update request, At least one of the traffic threshold, the whitelist of the URL, and the list of the whitelist of the APP is updated to better control the communication service of the terminal.
  • FIG. 3 is a schematic flowchart of a specific implementation process of a method for controlling a terminal communication service according to an embodiment of the present invention, which is an example of controlling a communication service of a minor. To illustrate, the method includes:
  • Step 201 The mobile phone initiates a connection network request to the network side.
  • the mobile phone After the user opens the network data switch, the webpage or the APP application on the mobile phone, and the authentication between the mobile phone and the base station passes, the mobile phone initiates a connection network request to the network side through the base station, where the connection network requests The IMSI number of the SIM card carrying the mobile phone is carried in.
  • the method further comprises: binding the age of the user to the IMSI number of the SIM card of the mobile phone, and recording into the HLR.
  • Step 202 Whether the user identity authentication performed by the network side according to the connection network request is passed, if yes, step 203 is performed, otherwise the analysis is ended;
  • the MME after receiving the connection network request, the MME sends an AIR message to the HSS and the AUC, where the AIR message includes the IMSI number and the PLMN identity of the SIM card of the mobile phone; HSS/AUC After receiving the AIR message, checking whether the IMSI number of the SIM card of the mobile phone is a known subscription user according to the stored IMSI number information and the received IMSI number, that is, performing user identification authentication, if If the user ID authentication is passed, step 203 is performed, otherwise the analysis is ended; and the authentication vector including the authentication result is returned to the MME through the AIA message.
  • Step 203 Determine whether the user identity of the mobile phone is a minor, if yes, proceed to step 205, otherwise perform step 204;
  • the network side acquires, according to the received IMSI number of the SIM card of the mobile phone, the age of the user of the mobile phone bound to the IMSI number from the HLR, and according to the set minor
  • the age threshold determines whether the user is a minor, that is, performs user identity information authentication. If yes, step 205 is performed; otherwise, step 204 is performed.
  • the age threshold of the minor can be set to 18 years old, and when the age of the user is less than 18 years old, the user is a minor.
  • Step 204 The network side does not control the communication service of the user.
  • step 203 When it is determined in step 203 that the user is an adult, the user's mobile phone connection is allowed.
  • the network does not control the communication service of the user.
  • Step 205 The network side controls the communication service of the user.
  • the network side controls the communication service of the user of the mobile phone, for example, monitoring the access content and time of the user's Internet access according to the monitoring content, and maintaining the mobile phone access authority.
  • the monitoring content may include: an effective online time period, a traffic restriction, a website list black and white list, and an APP application list; the network side may control whether the user's mobile phone is connected to the network, or may regularly update the monitoring content.
  • the specific processing procedure for the network side to control the use of the Internet service by the user of the mobile phone is as shown in FIG. 4, and the specific processing method includes:
  • Step 20501 Determine whether the time for requesting the Internet access is in the effective online time period, if yes, go to step 20502, otherwise go to step 20506;
  • the network side after receiving the Internet access request sent by the user as a minor through the mobile phone, the network side first determines whether the time for requesting the Internet access is within the preset effective online time period; for example, the effective online time period preset For daily school hours, weekends, and holidays, to determine whether to allow minors to access the network; the online request may be to visit a website or an APP application; when it is determined that the requested time is online during the effective online time period If yes, go to step 20502, otherwise go to step 20506.
  • Step 20502 Determine whether the used traffic is out of limits, if not, go to step 20503, otherwise go to step 20506;
  • the traffic threshold may be based on the service of the carrier.
  • the percentage of the monthly traffic may be dynamically set; when it is determined that the total traffic used by the mobile phone exceeds the preset traffic threshold, step 20503 is performed; otherwise, step 20506 is performed.
  • Step 20503 Determine whether the visited website/APP is in the website list white list/APP application column In the table, if yes, go to step 20505, otherwise go to step 20504;
  • step 20505 is performed, otherwise step 20504 is performed.
  • the website list white list and the APP application list can be reasonably set by authoritative departments or experts in related fields.
  • Step 20504 Denying access to the website/APP
  • Step 20505 Allow access to the website/APP
  • Step 20506 Reject the user's online request.
  • FIG. 2 is a schematic diagram of a specific processing flow for controlling, by the network side, a user to download an APP application by the network side, as shown in FIG. 5, where the specific processing method includes:
  • Step 20501a determining whether the downloaded new APP application meets the set APP application download condition, and if so, executing step 20502b, otherwise performing step 20503c;
  • step 20502b when the network side receives the request to download a new APP application as a minor user, it is determined whether the new APP application requested to be downloaded satisfies the set APP application download condition, and if yes, step 20502b is performed; If not, step 20503c is performed.
  • the APP application downloading condition may be set according to a category, a use of the APP application, an APP application included in the set APP list, and the like.
  • Step 20502b Download the new APP application and update to the APP application list.
  • the new APP application is downloaded, and the new APP application is updated to an APP application list composed of APP applications that are allowed to be used by the user.
  • Step 20503c Refuse to download the new APP application.
  • FIG. 6 is a schematic structural diagram of a network monitoring device according to an embodiment of the present invention.
  • the network monitoring device includes: a first receiving module 11 and an authentication module 12, Control module 13;
  • the first receiving module 11 is configured to receive user authentication request information sent by the terminal, where the user authentication request information carries user identification information of the terminal;
  • the authentication module 12 is configured to perform user identity authentication according to the user authentication request information, and if the user identity authentication passes, look up the user identity information corresponding to the user identifier information in the setting database, and Determining, according to the sub information in the user identity information, whether the user of the terminal is a service limited user;
  • the control module 13 is configured to provide the user with the set communication service when the user of the terminal is determined to be a service limited user.
  • the first receiving module 11 is configured to: after the terminal needs to connect and/or use the network, and the authentication between the terminal and the base station passes, the terminal passes the base station to the first receiving module 11 Sending user authentication request information carrying the user identification information of the terminal to request the authentication module 12 to authenticate the user of the terminal, and the first receiving module 11 receives the user authentication sent by the terminal.
  • the information is requested to enable the authentication module 12 to perform user identification authentication according to the user authentication request information.
  • the terminal may be a mobile phone, a tablet computer, or the like; the network may be a mobile network; the user identification information of the terminal may be an IMSI number of the SIM card in the terminal, or may be an IMEI of the terminal.
  • the AIR includes information such as an IMSI, a PLMN Identity, and the like of the mobile phone.
  • the authentication module 12 is further configured to: before the first receiving module 11 receives the user authentication request information sent by the terminal, store the user identity information of the terminal and the user identity information of the terminal to Setting a database and binding the user body in the setting database Information and user identification information of the terminal.
  • the authentication module 12 stores the user identity information of the terminal and the user identification information of the terminal in a setting database, and the user identity information and the The user identification information of the terminal is bound to obtain the user identity information in the setting database according to the user identification information of the terminal.
  • the database may be disposed in the authentication module 12 or in the control module 13;
  • the user identity information includes but is not limited to gender, height, age, occupation, ID number, etc.;
  • the age can be expressed by numbers alone or by ID number; for example, the 7th to 14th digits of the ID number are the date of birth, and the date of birth can be known by comparing the date of birth with the current time and date;
  • the occupations include but are not limited to students, workers, civil servants, etc., and the students may be further subdivided into primary school students, middle school students, college students, and the like.
  • the network operator usually stores the user identification information of the mobile phone, such as the IMSI, on the core network side in advance, so as to implement the subsequent user authentication operation performed on the core network side; for example, when the user gives the network operator
  • the network operator stores the IMSI information of the SIM card allocated to the user to the AUC, and determines whether the user is the subscription identifier user when performing user authentication.
  • the authentication module 12 is configured to: perform user identity authentication according to the user authentication request information sent by the terminal, and if the user identity of the terminal is authenticated, the authentication module 12 is in the setting database. Finding user identity information corresponding to the user identity information, determining whether the child information in the user identity information meets a requirement of a service-limited user, and if yes, determining that the user is a service-limited user, otherwise determining The user is not a service limited user.
  • the setting requirement of the service-limited user may be set by the user or the network operator on the network side, and stored in the authentication module 12 or the control module 13; the setting requirement needs to be set according to the user information. For example, when the user information is age, the setting requirement should be set to an age threshold; when the user information is age and occupation, the setting requirement should be set to age Thresholds or occupational categories can also be set as age thresholds and occupational categories.
  • the sub-information may be one or more kinds of information in the user identity information, such as when the user identity information includes age and occupation, the sub-information may be age or occupation, or may be age and occupation. .
  • the setting requirement is set according to the age of the business-restricted user that needs to be controlled; for example, when it is necessary to control the minor, the age less than 18 years old can be used as the business.
  • the setting requirement of the limited user is that if the user age of the terminal bound to the user identification information is less than 18 years old, the user of the terminal may be determined to be a minor, that is, a service limited user.
  • the control module 13 is configured to: when the user of the terminal is determined to be a service-limited user according to the determination result in the authentication module 12, provide the set communication service for the user to implement The effective supervision of the terminal communication service.
  • the communication service includes at least one of the following: a network data service, a voice call service, an information service, an APP application download service, and the like; the providing the set communication service for the user, including: determining a time of the user's communication service request Whether the terminal corresponding to the user identification information uses the communication service, or the terminal corresponding to the user identification information, is allowed to use the communication service, if the communication service is not used.
  • control module 13 may preset the allowed communication service time, store the allowed communication service time into the database, and then bind the terminal's user identification information with the corresponding allowed communication service time.
  • the user corresponding to the user identification information is supervised; of course, the user identity information may be bound to the allowed communication service time; in the prior art, the same SIM card may be used. Switching is used in a mobile phone. If the terminal is bound to allow the terminal to use the communication service time, then the mobile phone communication service may be controlled according to the allowed communication service time corresponding to the current mobile phone of the SIM card, which may not be implemented. The owner of the SIM card uses the mobile phone to effectively supervise the communication service.
  • control module 13 when the communication service is a network data service, the control module 13 is further configured to allow the use of the communication service time corresponding to the user identification information at the time of determining the communication service request of the user. If the terminal corresponding to the user identification information is allowed to use the communication service, determine whether the traffic currently used by the terminal is greater than or equal to the set traffic threshold. If the terminal is greater than or equal to, the terminal is prohibited from using the network data service. Otherwise the terminal is allowed to use network data services.
  • the network data service is a service that provides a data service according to the network, such as accessing a website; when the control module 13 determines that the traffic currently used by the terminal is greater than or equal to a set traffic threshold, the terminal is prohibited.
  • the use of network data services can save traffic and Internet access costs.
  • control module 13 is further configured to: before the determining that the traffic currently used by the terminal is less than a set traffic threshold, before the allowing the terminal to use the network data service normally, determining the location Whether the website accessed by the terminal is in the white list of the set URL, and if not, the terminal is prohibited from accessing the website, otherwise the terminal is allowed to access the website;
  • the terminal before the determining that the traffic currently used by the terminal is less than the set traffic threshold, before the allowing the terminal to use the network data service normally, determining whether the APP application used by the terminal is in the setting APP In the whitelist, if not, the terminal is prohibited from using the APP application, otherwise the terminal is allowed to use the APP application.
  • control module 13 determines that the web address accessed by the terminal is not in the whitelist of the set URL or in the blacklist of the set URL, the terminal is prohibited from accessing the web address; when the control module 13 determines the location When the APP application used by the terminal is not in the set APP whitelist or in the set APP blacklist, the terminal is prohibited from using the APP application; thus, effective supervision of the terminal communication service can be implemented.
  • control module 13 is further configured to: determine that the terminal downloads a new APP application that is not included in the set APP whitelist. And determining whether the new APP application meets the set APP application downloading condition, and if yes, allowing the terminal to download the new APP application, otherwise prohibiting the terminal from downloading the new APP application.
  • the application downloading condition of the APP may be set according to the category and purpose of the APP application, the APP application included in the set APP whitelist, and the like; for example, for a minor, that is, a person under the age of 18, only When the new APP application that needs to be downloaded is a learning class, the download can be performed, for example, an English-language fluency saying, a happy vocabulary, and the like can be downloaded, and a game-like APP application such as Angry Birds is prohibited from being downloaded.
  • the foregoing permission to use the communication service time, the traffic threshold, the URL whitelist and the blacklist, the APP application whitelist and the blacklist, and the APP application download condition, etc. may be set in advance by the control module 13 and stored in the control module 13 In the database; in addition, the information in the database can be updated at any time according to actual conditions.
  • control module 13 includes a second receiving module 131 and an update module 132;
  • the second receiving module 131 is configured to receive an update request for at least one of allowing a communication service time, a traffic threshold, a URL whitelist, and an APP whitelist to be used;
  • the update module 132 is configured to update at least one of the allowed communication service time, the traffic threshold, the URL whitelist, and the APP whitelist according to the update request.
  • the update module 132 when the second receiving module 131 receives an update request for allowing at least one of a communication service time, a traffic threshold, a URL whitelist, and an APP whitelist, the update module 132 is configured according to the The update request updates at least one of the allowed communication service time, the traffic threshold, the URL whitelist, and the APP whitelist to better control the terminal communication service.
  • the first receiving module 11 and the second receiving module 131 may be implemented by an interface or a port, etc.; the authentication module 12, the control module 13, and the update module 132 may be located in a network.
  • Central Processing Unit CPU
  • MPU Microprocessor Unit
  • DSP Digital Signal Processor
  • FPGA Field Programmable Gate Array
  • FPGA Field-Programmable Gate
  • Embodiments of the present invention also describe a computer storage medium storing one or more programs, the one or more programs being executable by one or more processors to implement the following steps:
  • the user When it is determined that the user of the terminal is a service-limited user, the user is provided with the set communication service.
  • the one or more programs when performing the step of providing the user with the set communication service, may also be executed by the one or more processors to implement the following steps:
  • the communication service is a network data service
  • the time for determining the communication service request of the user is after the step of allowing the use of the communication service corresponding to the user identification information
  • the one Or a plurality of programs may be executed by the one or more processors to implement the following steps:
  • the one or more programs may be executed by the one or more processors to implement the following steps. :
  • embodiments of the present invention can be provided as a method, system, or computer program product. Accordingly, the present invention can take the form of a hardware embodiment, a software embodiment, or a combination of software and hardware. Moreover, the invention can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) including computer usable program code.
  • These computer program instructions can also be stored in a bootable computer or other programmable data processing
  • the apparatus is readable in a computer readable memory in a particular manner such that instructions stored in the computer readable memory produce an article of manufacture comprising instruction means implemented in one or more flows and/or block diagrams of the flowchart The function specified in the box or in multiple boxes.
  • These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device.
  • the instructions provide steps for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.
  • the technical solution of the embodiment of the present invention performs user identification authentication on the user of the terminal according to the user authentication request information sent by the terminal, and after the user identification is authenticated, determines the terminal according to the user identity information of the terminal. Whether the user is a service-limited user, and if the user of the terminal is determined to be a service-limited user, the user is provided with the set communication service, that is, the terminal communication service corresponding to the user identification information is controlled,
  • the set communication service content may include: online time control, network traffic usage control, network access object control, etc., thereby realizing unified and effective supervision of the terminal communication service of the service-limited user, and the operation is simple and convenient.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Telephonic Communication Services (AREA)

Abstract

本发明实施例公开了一种终端通信业务的控制方法，包括：接收终端发送的用户鉴权请求信息，所述用户鉴权请求信息中携带有所述终端的用户标识信息；根据所述用户鉴权请求信息进行用户标识鉴权，若用户标识鉴权通过，则在设定数据库中查找与所述用户标识信息对应的用户身份信息，并基于所述用户身份信息中的子信息判断所述终端的用户是否为业务受限用户；确定所述终端的用户为业务受限用户时，为所述用户提供设定的通信业务。本发明实施例同时还公开了一种网络监控装置及计算机存储介质。

Description

一种终端通信业务的控制方法及网络监控装置、存储介质
相关申请的交叉引用
本申请基于申请号为201611074999.X、申请日为2016年11月29日的中国专利申请提出，并要求该中国专利申请的优先权，该中国专利申请的全部内容在此引入本申请作为参考。
技术领域
本发明涉及通信技术，尤其涉及一种终端通信业务的控制方法及网络监控装置、计算机存储介质。
背景技术
随着经济社会和通信网络技术的快速发展，移动终端比如手机、平板电脑等的用户数量越来越多，但是移动终端所带来的问题也引起了人们的重视，而对未成年人带来的影响更是人们关注的重点。许多家长为方便与子女联系和满足子女学习的需要，给未成年的子女购买了手机。虽然手机在一定程度上给这些未成年人提供了便捷服务，但是由于未成年人的安全意识不强、自控能力差，手机也同样容易对未成年人的正常成长和学习产生诸多危害，比如容易使未成年人沉溺于网络，甚至是陷入不良网站而不能自拔。
针对这些问题，现有的技术方案大多是通过家长控制未成年人的手机上网权限进行解决。但是，现有的基于手机端的家长控制系统，基本上仅是在接入家庭网关或者无线网络中时控制上网权限。然而，未成年人的大部分时间都是在学校进行学习和生活，因此手机接入无线网络比较困难。所以，未成年人在学校基本都是使用运营商的流量进行上网。此时，家长 就较难对未成年人的上网行为进行有效的监管；而且，现有技术方案需要家长预先手工配置不同用户名、密码和不同连接的绑定关系，对用户要求较高。
发明内容
有鉴于此，本发明实施例期望提供一种终端通信业务的控制方法及网络监控装置、计算机存储介质，能够对业务受限用户的终端通信业务进行统一有效的监管。
为达到上述目的，本发明的技术方案实现过程如下：
本发明实施例提供了一种终端通信业务的控制方法，所述方法包括：
接收终端发送的用户鉴权请求信息，所述用户鉴权请求信息中携带有所述终端的用户标识信息；
根据所述用户鉴权请求信息进行用户标识鉴权，若用户标识鉴权通过，则在设定数据库中查找与所述用户标识信息对应的用户身份信息，并基于所述用户身份信息中的子信息判断所述终端的用户是否为业务受限用户；
确定所述终端的用户为业务受限用户时，为所述用户提供设定的通信业务。
在一实施例中，所述子信息包括以下信息至少一种：年龄、职业；所述用户标识信息包括国际移动用户识别码(IMSI，International Mobile Subscriber Identification Number)。
在一实施例中，所述为所述用户提供设定的通信业务，包括：
判断用户的通信业务请求的时间是否在所述用户标识信息对应的允许使用通信业务时间内，若不在，则禁止所述用户标识信息对应的终端使用通信业务。
在一实施例中，当所述通信业务为网络数据业务时，所述判断出用户的通信业务请求的时间在所述用户标识信息对应的允许使用通信业务时间 内之后，所述方法还包括：
判断所述终端当前已使用的流量是否大于或等于设定流量阈值，若大于或等于，则禁止所述终端使用网络数据业务。
在一实施例中，所述判断出所述终端当前已使用的流量小于设定流量阈值之后，所述方法还包括：
判断所述终端所访问的网址是否在设定网址白名单内，若不在，则禁止所述终端访问所述网址；
和/或，判断所述终端使用的APP应用是否在设定APP白名单列表内，若不在，则禁止所述终端使用所述APP应用。
在一实施例中，当所述通信业务为下载APP应用时，所述方法还包括：
确定所述终端下载未包含在设定APP白名单列表内的新的APP应用时，判断所述新的APP应用是否满足设置的APP应用下载条件，若不满足，则禁止所述终端下载所述新的APP应用。
在一实施例中，所述方法还包括：
接收针对允许使用通信业务时间、流量阈值、网址白名单、APP白名单列表的至少之一的更新请求；
根据所述更新请求对所述允许使用通信业务时间、所述流量阈值、所述网址白名单、所述APP白名单列表的至少之一进行更新。
本发明实施例提供了一种网络监控装置，所述网络监控装置包括：第一接收模块、鉴权模块、控制模块；其中，
所述第一接收模块，配置为接收终端发送的用户鉴权请求信息，所述用户鉴权请求信息中携带有所述终端的用户标识信息；
所述鉴权模块，配置为根据所述用户鉴权请求信息进行用户标识鉴权，若用户标识鉴权通过，则在设定数据库中查找与所述用户标识信息对应的用户身份信息，并基于所述用户身份信息中的子信息判断所述终端的用户 是否为业务受限用户；
所述控制模块，配置为确定所述终端的用户为业务受限用户时，为所述用户提供设定的通信业务。
在一实施例中，所述子信息包括以下信息至少一种：年龄、职业；所述用户标识信息包括国际移动用户识别码(IMSI)。
在一实施例中，所述控制模块，具体配置为：
判断用户的通信业务请求的时间是否在所述用户标识信息对应的允许使用通信业务时间内，若不在，则禁止所述用户标识信息对应的终端使用通信业务。
在一实施例中，当所述通信业务为网络数据业务时，所述控制模块，还配置为在所述判断出用户的通信业务请求的时间在所述用户标识信息对应的允许使用通信业务时间内之后，判断所述终端当前已使用的流量是否大于或等于设定流量阈值，若大于或等于，则禁止所述终端使用网络数据业务。
在一实施例中，所述控制模块，还配置为在所述判断出所述终端当前已使用的流量小于设定流量阈值之后，判断所述终端所访问的网址是否在设定网址白名单内，若不在，则禁止所述终端访问所述网址；
和/或，在所述判断出所述终端当前已使用的流量小于设定流量阈值之后，判断所述终端使用的APP应用是否在设定APP白名单列表内，若不在，则禁止所述终端使用所述APP应用。
在一实施例中，当所述通信业务为下载APP应用时，所述控制模块，还配置为确定所述终端下载未包含在设定APP白名单列表内的新的APP应用时，判断所述新的APP应用是否满足设置的APP应用下载条件，若不满足，则禁止所述终端下载所述新的APP应用。
在一实施例中，所述控制模块包括第二接收模块、更新模块；其中，
所述第二接收模块，配置为接收针对允许使用通信业务时间、流量阈值、网址白名单、APP白名单列表的至少之一的更新请求；
所述更新模块，配置为根据所述更新请求对所述允许使用通信业务时间、所述流量阈值、所述网址白名单、所述APP白名单列表的至少之一进行更新。
本发明实施例还提供了一种计算机存储介质，所述计算机存储介质中存储有计算机可执行指令，所述计算机可执行指令用于执行本发明实施例所述的终端通信业务的控制方法。
本发明实施例提供的终端通信业务的控制方法及网络监控装置，接收终端发送用户鉴权请求信息，所述用户鉴权请求信息中携带有所述终端的用户标识信息；根据所述用户鉴权请求信息进行用户标识鉴权，若用户标识鉴权通过，则在设定数据库中查找与所述用户标识信息对应的用户身份信息，并基于所述用户身份信息中的子信息判断所述终端的用户是否为业务受限用户；确定所述终端的用户为业务受限用户时，为所述用户提供设定的通信业务。可见，本发明实施例根据终端发送的用户鉴权请求信息对所述终端的用户进行用户标识鉴权，且在用户标识鉴权通过之后，根据所述终端的用户身份信息判断所述终端的用户是否为业务受限用户，若判定所述终端的用户为业务受限用户，则为所述用户提供设定的通信业务，即对与所述用户标识信息对应的终端通信业务进行控制，所设定的通信业务内容可包括：上网时间控制、网络流量用量控制、网络访问对象控制等，从而实现了对业务受限用户的终端通信业务进行统一有效的监管，且操作简单、方便。
本发明实施例的有益效果是：本发明实施例提供的终端通信业务的控制方法及网络监控装置、计算机存储介质，能够对业务受限用户的终端通信业务进行统一有效的监管，即只要当业务受限用户使用运营商的网络或 流量时，便只会给该业务受限用户提供设定的通信业务；对于未成年用户而言，能够将未成年用户的上网行为限制在设定的允许上网时间段、允许访问的网站和APP应用内，以保护未成年人的正常成长和学习；并且，可在网络侧自动统一管理业务受限用户以及设定的通信业务，比如配置或更新业务受限用户的允许上网时间段、流量阈值等，无需家长一一进行预置，使操作简单、方便。
附图说明
图1为本发明实施例终端通信业务的控制方法的实现流程示意图；
图2为本发明实施例中所述终端接入网络侧的系统组成示意图；
图3为本发明实施例终端通信业务的控制方法的具体实现流程示意图；
图4为本发明实施例中所述网络侧对所述手机的用户使用上网业务进行控制的具体处理流程示意图一；
图5为本发明实施例中所述网络侧对所述手机的用户下载APP应用进行控制的具体处理流程示意图二；
图6为本发明实施例网络监控装置的组成结构示意图。
具体实施方式
下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述。
本发明实施例终端通信业务的控制方法的实现流程如图1所示，该方法包括：
步骤101：接收终端发送的用户鉴权请求信息，所述用户鉴权请求信息中携带有所述终端的用户标识信息；
作为一种实施方式，当终端需要连接和/或使用网络、且所述终端与基站相互之间的鉴权通过之后，所述终端通过所述基站向网络侧发送携带有 所述终端的用户标识信息的用户鉴权请求信息，以请求网络侧中的运营商核心网对所述终端的用户进行鉴权，则网络侧接收所述终端发送的用户鉴权请求信息，以根据所述用户鉴权请求信息进行用户标识鉴权。
所述终端可以是手机、平板电脑等；所述网络可以是移动网络；所述终端的用户标识信息可以是所述终端中用户识别模块(Subscriber Identity Module，SIM)即SIM卡的国际移动用户识别码(International Mobile Subscriber Identification Number，IMSI)，也可以是所述终端的国际移动设备标识(International Mobile Equipment Identity，IMEI)。
在步骤101之前，该方法还可包括：存储终端的用户身份信息和所述终端的用户标识信息至设定数据库，并在所述设定数据库中绑定所述用户身份信息与所述终端的用户标识信息。
作为一种实施方式，预先将所述终端的用户身份信息和所述终端的用户标识信息存储至网络侧的设定数据库中，并在所述设定数据库中将所述用户身份信息与所述终端的用户标识信息绑定，以实现根据所述终端的用户标识信息便可在所述设定数据库中获取所述用户身份信息。
这里，所述用户身份信息包括但不限于性别、身高、年龄、职业、身份证号码等；所述年龄既可以单独用数字表示，也可以通过身份证号码表示；比如，身份证号码中的第7位至第14位为出生日期，将该出生日期与当前时间日期进行比对则可获知年龄；所述职业包括但不限于学生、工人、公务员等类别，所述学生还可以进一步细分为小学生、中学生、大学生等。
在现有技术中，网络运营商通常都会预先将手机的终端用户标识信息如IMSI存储在核心网侧，以便实现后续在核心网侧执行的用户鉴权操作；当用户在网络运营商处给手机申请办理SIM卡时，网络运营商会存储分配给用户的SIM卡的IMSI信息至鉴权中心(AUthentication Centre，AUC)中，用以进行用户鉴权时判断用户是否为签约标识用户。
以长期演进(LTE，Long Term Evolution)鉴权为例，所述终端接入网络侧的系统组成示意图，如图2所示；其中，演进分组核心网(Evolved Packet Core，EPC)中的网元包括移动管理单元(Mobility Management Entity，MME)、归属签约用户服务器(Home Subscriber Server，HSS)、AUC、服务网关(Serving Gateway，S-GW)、分组数据网网关(Packet Data Network Gateway，P-GW)、策略和计费规则功能实体(Policy and Charging Rule Functionality，PCRF)等。
当所述终端(User Equipment，UE)发起连接网络请求时，UE会向演进型移动基站(eNodeB，Evolved Node B)发送携带有所述UE的用户标识信息的用户鉴权请求信息；然后，eNodeB将接收到的来自所述UE发送的所述用户鉴权请求信息发送给MME；MME接收到所述eNodeB发送的所述用户鉴权请求信息后，向HSS/AUC发送认证信息请求(Authentication Information Request，AIR)消息，所述AIR消息中携带有所述用户鉴权请求信息，以使HSS/AUC根据所述用户鉴权请求信息进行用户标识鉴权。其中，网络监控模块为本发明实施例中增设的可控制终端接入网络的模块，该网络监控模块配置为当HSS/AUC对用户标识鉴权通过后，对用户身份信息进行鉴权，以根据鉴权结果对终端是否接入网络进行控制。
当所述终端为手机时，所述AIR消息中包含有所述手机的IMSI、公共陆地移动网络身份(Public Land Mobile Network Identity，PLMN Identity)等信息。
这里，可将所述终端的用户标识信息、以及与所述终端的用户标识信息所绑定的所述终端的用户身份信息存储至归属位置寄存器(Home Location Register，HLR)中。
步骤102：根据所述用户鉴权请求信息进行用户标识鉴权，若用户标识鉴权通过，则在设定数据库中查找与所述用户标识信息对应的用户身份信 息，并基于所述用户身份信息中的子信息判断所述终端的用户是否为业务受限用户；
作为一种实施方式，网络侧根据步骤101中终端发送的所述用户鉴权请求信息进行用户标识鉴权，若对所述终端的用户标识鉴权通过，则在设定数据库中查找与所述用户标识信息对应的用户身份信息，判断所述用户身份信息中的子信息是否符合业务受限用户的设定要求，若符合，则判定所述用户为业务受限用户，否则判定所述用户不是业务受限用户。
无论对所述终端的用户标识鉴权是否通过，网络侧都会将所述用户标识鉴权结果反馈给所述终端，即：HSS/AUC根据所述AIR消息进行用户标识鉴权，若对用户标识鉴权通过，即判定所述UE的用户是签约标识用户时，则通过认证信息反馈(Authentication Information Answer，AIA)消息将包含有用户标识鉴权成功通知的鉴权向量发送至MME，以使MME将所述用户标识鉴权成功通知发送给所述UE；若用户标识鉴权失败，即判定所述UE的用户不是签约标识用户时，则通过AIA消息将包含有用户标识鉴权失败通知的鉴权向量发送至MME，以使MME将所述用户标识鉴权失败通知发送给所述UE。
所述业务受限用户的设定要求可由用户或网络运营商在网络侧中进行设置，并存储在AUC或HLR中；所述设定要求需要根据所述用户身份信息进行设置；例如，当所述用户信息为年龄时，所述设定要求应设为年龄阈值；当用户信息为年龄和职业时，所述设定要求应设为年龄阈值或者职业类别，也可设为年龄阈值和职业类别。
这里，所述子信息可以是所述用户身份信息中的一种或多种信息，比如当所述用户身份信息包括年龄和职业时，所述子信息既可以是年龄或者职业，也可以是年龄和职业。当所述子信息为年龄时，所述设定要求根据需要被控制的对象即业务受限用户的年龄进行设置；例如，当需要对未成 年人进行控制时，可将年龄小于18周岁作为业务受限用户的设定要求，只要与所述用户标识信息所绑定的所述终端的用户年龄小于18周岁，则可判定所述终端的用户为未成年人即业务受限用户。
步骤103：确定所述终端的用户为业务受限用户时，为所述用户提供设定的通信业务。
作为一种实施方式，当根据步骤102中的判断结果而确定所述终端的用户为业务受限用户时，为所述用户提供设定的通信业务，以实现对所述终端通信业务的有效监管。
其中，所述通信业务包括以下至少一种：网络数据业务、语音通话业务、信息业务、APP应用下载业务；所述为所述用户提供设定的通信业务，包括：判断用户的通信业务请求的时间是否在所述用户标识信息对应的允许使用通信业务时间内，若不在，则禁止所述用户标识信息对应的终端使用通信业务，否则允许所述用户标识信息对应的终端使用通信业务。
这里，运营商或用户在网络侧可预先设置所述允许使用通信业务时间，并存储所述允许使用通信业务时间至网络侧的数据库中，然后将终端的用户标识信息与对应的允许使用通信业务时间进行绑定，以实现对与所述用户标识信息对应的用户进行监管；当然，也可采用将用户身份信息与所述允许使用通信业务时间进行绑定；对于不同的用户标识信息，可设置不相同的允许使用通信业务时间，也可设置相同的允许使用通信业务时间；在现有技术中，由于同一张SIM卡可在多个手机中进行切换使用，如果将终端与允许该终端使用通信业务时间进行绑定，那么根据该SIM卡当前所在手机对应的允许使用通信业务时间对该手机通信业务进行控制，则可能不能够实现对该SIM卡的拥有者利用该手机进行通信业务的有效监管。
在一实施例中，当所述通信业务为网络数据业务时，在所述判断出用户的通信业务请求的时间在所述用户标识信息对应的允许使用通信业务时 间内，则允许所述用户标识信息对应的终端使用通信业务之前，该方法还包括：
判断所述终端当前已使用的流量是否大于或等于设定流量阈值，若大于或等于，则禁止所述终端使用网络数据业务，否则允许所述终端使用网络数据业务。
所述网络数据业务为依赖网络提供数据服务的业务，如访问网站；当网络侧设备判断出所述终端当前已使用的流量大于或等于设定流量阈值时，则禁止所述终端使用网络数据业务，可以达到节约流量及上网费用的目的。
在一实施例中，在所述判断出所述终端当前已使用的流量小于设定流量阈值，则所述允许所述终端正常使用网络数据业务之前，该方法还包括：
判断所述终端所访问的网址是否在设定网址白名单内，若不在，则禁止所述终端访问所述网址，否则允许所述终端访问所述网址；
和/或，判断所述终端使用的APP应用是否在设定APP白名单列表内，若不在，则禁止所述终端使用所述APP应用，否则允许所述终端使用所述APP应用。
这里，当网络侧判断出所述终端所访问的网址在设定网址黑名单内或不在设定网址白名单内时，禁止所述终端访问所述网址；当网络侧判断出所述终端使用的APP应用在设定APP黑名单列表内或不在设定APP白名单列表内时，禁止所述终端使用所述APP应用；如此，能够实现对所述终端通信业务的有效监管。
另外，当所述通信业务为下载APP应用时，该方法还包括：
确定所述终端下载未包含在所述设定APP白名单列表内的新的APP应用时，判断所述新的APP应用是否满足设置的APP应用下载条件，若满足，则允许所述终端下载所述新的APP应用，否则禁止所述终端下载所述新的 APP应用。
所述APP应用下载条件可根据APP应用的类别、用途、所述设定APP白名单列表中已包含的APP应用等进行设置；例如，对于未成年人即未满18周岁的人，只有当需要下载的新APP应用为学习类时才可进行下载，如可允许下载英语流利说、开心词场等学习类APP应用，禁止下载愤怒的小鸟等游戏类APP应用。
这里，当所述允许所述终端下载所述新的APP应用之后，还可将所述新的APP应用更新至所述设定APP白名单列表。
上述允许使用通信业务时间、流量阈值、网址白名单和黑名单、APP应用白名单列表和黑名单列表以及APP应用下载条件等都可由用户或运营商提前进行设置，并存储在网络侧的数据库中；此外，还可根据实际情况随时对所述数据库中的信息进行更新处理。
在一实施例中，该方法还包括：
接收针对允许使用通信业务时间、流量阈值、网址白名单、APP白名单列表的至少之一的更新请求；
根据所述更新请求对所述允许使用通信业务时间、所述流量阈值、所述网址白名单、所述APP白名单列表的至少之一进行更新。
作为一种实施方式，当接收到针对允许使用通信业务时间、流量阈值、网址白名单、APP白名单列表的至少之一的更新请求时，根据所述更新请求对所述允许使用通信业务时间、所述流量阈值、所述网址白名单、所述APP白名单列表的至少之一进行更新，以更好的对终端通信业务进行控制。
下面将通过一个具体示例对本发明实施例作进一步地的说明，图3为本发明实施例终端通信业务的控制方法的具体实现流程示意图，该实施例以对未成年人的通信业务进行控制为例进行说明，该方法包括：
步骤201：手机向网络侧发起连接网络请求；
作为一种实施方式，当用户在手机上打开网络数据开关、网页或APP应用，并且手机与基站相互之间的鉴权通过之后，手机通过基站向网络侧发起连接网络请求，所述连接网络请求中携带有所述手机的SIM卡的IMSI号。
在步骤201之前，该方法还包括：将用户的年龄与所述手机的SIM卡的IMSI号绑定，并记录至HLR中。
步骤202：网络侧根据所述连接网络请求进行的用户标识鉴权是否通过，若通过，则执行步骤203，否则结束分析；
作为一种实施方式，网络侧中MME接收到所述连接网络请求后，向HSS、AUC发送AIR消息，所述AIR消息中包含有手机的SIM卡的IMSI号、PLMN Identity等信息；HSS/AUC接收到所述AIR消息后，根据已存储的IMSI号信息和接收到的所述IMSI号，检查所述手机的SIM卡的IMSI号是否为已知的签约用户，即进行用户标识鉴权，若用户标识鉴权通过，则执行步骤203，否则结束分析；并且，通过AIA消息将包含鉴权结果的鉴权向量返回给MME。
步骤203：判断手机的用户身份是否为未成年人，若是，则执行步骤205，否则执行步骤204；
作为一种实施方式，网络侧根据接收到的所述手机的SIM卡的IMSI号，从HLR中获取与所述IMSI号绑定的所述手机的用户的年龄，并根据设置的未成年人的年龄阈值判断用户是否为未成年人，即进行用户身份信息鉴权，若是，则执行步骤205，否则执行步骤204。
其中，未成年人的年龄阈值可设置为18岁，当用户的年龄小于18岁时，则该用户为未成年人。
步骤204：网络侧不对所述用户的通信业务进行控制；
当步骤203中判断出所述用户为成年人时，允许所述用户的手机连接 网络，且不对用户的通信业务进行控制。
步骤205：网络侧对所述用户的通信业务进行控制；
作为一种实施方式，网络侧对所述手机的用户的通信业务进行控制，比如根据监护内容监护用户上网的访问内容和时间，维护手机上网权限。其中，监护内容可包括：有效上网时间段、流量限制、网站列表黑白名单、APP应用列表；所述网络侧既可控制用户的手机是否连接网络，也可对监护内容进行定期更新。
当所述通信业务为上网业务时，所述网络侧对所述手机的用户使用上网业务进行控制的具体处理流程，如图4所示，具体处理方法包括：
步骤20501：判断请求上网的时间是否在有效上网时间段，若是，则执行步骤20502，否则执行步骤20506；
作为一种实施方式，当接收到作为未成年人的用户通过手机发送的上网请求后，网络侧首先判断请求上网的时间是否在预置的有效上网时间段内；例如，有效上网时间段预置为日常上课时间、周末和节假日，以用来判断是否允许未成年人接入网络；所述上网请求可以是访问网站或APP应用；当判断出所述请求上网的时间在所述有效上网时间段内时，执行步骤20502，否则执行步骤20506。
步骤20502：判断已使用流量是否超限，若否，则执行步骤20503，否则执行步骤20506；
作为一种实施方式，确定所述请求上网的时间在有效上网时间段内时，继续判断所述手机已用的总流量是否超过预置的流量阈值；其中，所述流量阈值可根据运营商业务中每月流量的百分比作为依据，也可动态设置；当判断出所述手机已用的总流量超过预置的流量阈值时，执行步骤20503，否则执行步骤20506。
步骤20503：判断访问的网站/APP是否在网站列表白名单/APP应用列 表内，若是，则执行步骤20505，否则执行步骤20504；
作为一种实施方式，当判断出所述当前上网时间和流量都满足预置的条件时，则继续判断用户访问的网站是否在允许的网站列表白名单内，或者判断用户访问的APP应用是否在允许的APP应用列表内，若所述用户访问的网站在允许的网站列表白名单内或所述用户访问的APP应用在允许的APP应用列表内，则执行步骤20505，否则执行步骤20504。
这里，所述网站列表白名单和APP应用列表均可以由相关领域的权威部门或专家进行合理的设定。
步骤20504：拒绝访问所述网站/APP；
步骤20505：允许访问所述网站/APP；
步骤20506：拒绝用户的上网请求。
当所述通信业务为下载APP应用时，所述网络侧对所述手机的用户下载APP应用进行控制的具体处理流程示意图二，如图5所示，具体处理方法包括：
步骤20501a：判断下载的新的APP应用是否满足设置的APP应用下载条件，若是，则执行步骤20502b，否则执行步骤20503c；
作为一种实施方式，当网络侧接收到作为未成年用户下载新的APP应用请求时，判断请求下载的所述新的APP应用是否满足设置的APP应用下载条件，若满足，则执行步骤20502b；若不满足，则执行步骤20503c。
这里，所述APP应用下载条件可根据APP应用的类别、用途、所述设定APP列表中已包含的APP应用等进行设置。
步骤20502b：下载所述新的APP应用，并更新至APP应用列表；
作为一种实施方式，下载所述新的APP应用，并将所述新的APP应用更新至由允许用户使用的APP应用组成的APP应用列表中。
步骤20503c：拒绝下载所述新的APP应用。
为实现上述方法，本发明实施例还提供了一种网络监控装置，图6为本发明实施例网络监控装置的组成结构示意图，该网络监控装置包括：第一接收模块11、鉴权模块12、控制模块13；
其中，所述第一接收模块11，配置为接收终端发送的用户鉴权请求信息，所述用户鉴权请求信息中携带有所述终端的用户标识信息；
所述鉴权模块12，配置为根据所述用户鉴权请求信息进行用户标识鉴权，若用户标识鉴权通过，则在设定数据库中查找与所述用户标识信息对应的用户身份信息，并基于所述用户身份信息中的子信息判断所述终端的用户是否为业务受限用户；
所述控制模块13，配置为确定所述终端的用户为业务受限用户时，为所述用户提供设定的通信业务。
所述第一接收模块11，具体配置为：当终端需要连接和/或使用网络、且所述终端与基站相互之间的鉴权通过之后，所述终端通过所述基站向第一接收模块11发送携带有所述终端的用户标识信息的用户鉴权请求信息，以请求鉴权模块12对所述终端的用户进行鉴权，则所述第一接收模块11接收所述终端发送的用户鉴权请求信息，以使所述鉴权模块12根据所述用户鉴权请求信息进行用户标识鉴权。
所述终端可以是手机、平板电脑等；所述网络可以是移动网络；所述终端的用户标识信息可以是所述终端中SIM卡的IMSI号，也可以是所述终端的IMEI。
当所述终端为手机时，所述AIR中包含有所述手机的IMSI、PLMN Identity等信息。
在一实施例中，所述鉴权模块12，还配置为在所述第一接收模块11接收终端发送的用户鉴权请求信息之前，存储终端的用户身份信息和所述终端的用户标识信息至设定数据库，并在所述设定数据库中绑定所述用户身 份信息与所述终端的用户标识信息。
作为一种实施方式，鉴权模块12预先将所述终端的用户身份信息和所述终端的用户标识信息存储至设定数据库，并在所述设定数据库中将所述用户身份信息与所述终端的用户标识信息绑定，以实现根据所述终端的用户标识信息便可在所述设定数据库中获取所述用户身份信息。
所述数据库既可设置在所述鉴权模块12中，也可设置在所述控制模块13中；所述用户身份信息包括但不限于性别、身高、年龄、职业、身份证号码等；所述年龄既可以单独用数字表示，也可以通过身份证号码表示；比如，身份证号码中的第7位至第14位为出生日期，将该出生日期与当前时间日期进行比对则可获知年龄；所述职业包括但不限于学生、工人、公务员等类别，所述学生还可以进一步细分为小学生、中学生、大学生等。
在现有技术中，网络运营商通常都会预先将手机的用户标识信息如IMSI存储在核心网侧，以便实现后续在核心网侧执行的用户鉴权操作；比如，当用户在网络运营商处给手机申请办理SIM卡时，网络运营商会存储分配给用户的SIM卡的IMSI信息至AUC中，用以进行用户鉴权时判断用户是否为签约标识用户。
所述鉴权模块12，具体配置为：根据终端发送的所述用户鉴权请求信息进行用户标识鉴权，若对所述终端的用户标识鉴权通过，鉴权模块12则在设定数据库中查找与所述用户标识信息对应的用户身份信息，判断所述用户身份信息中的子信息是否符合业务受限用户的设定要求，若符合，则判定所述用户为业务受限用户，否则判定所述用户不是业务受限用户。
所述业务受限用户的设定要求可由用户或网络运营商在网络侧进行设置，并存储在所述鉴权模块12或控制模块13中；所述设定要求需要根据所述用户信息进行设置；例如，当所述用户信息为年龄时，所述设定要求应设为年龄阈值；当用户信息为年龄和职业时，所述设定要求应设为年龄 阈值或者职业类别，也可设为年龄阈值和职业类别。
所述子信息可以是所述用户身份信息中的一种或多种信息，比如当所述用户身份信息包括年龄和职业时，所述子信息既可以是年龄或者职业，也可以是年龄和职业。当所述子信息为年龄时，所述设定要求根据需要被控制的对象即业务受限用户的年龄进行设置；例如，当需要对未成年人进行控制时，可将年龄小于18周岁作为业务受限用户的设定要求，只要与所述用户标识信息所绑定的所述终端的用户年龄小于18周岁，则可判定所述终端的用户为未成年人即业务受限用户。
所述控制模块13，具体配置为：当根据所述鉴权模块12中的判断结果而确定所述终端的用户为业务受限用户时，为所述用户提供设定的通信业务，以实现对所述终端通信业务的有效监管。
所述通信业务包括以下至少一种：网络数据业务、语音通话业务、信息业务、APP应用下载业务等；所述为所述用户提供设定的通信业务，包括：判断用户的通信业务请求的时间是否在所述用户标识信息对应的允许使用通信业务时间内，若不在，则禁止所述用户标识信息对应的终端使用通信业务，否则允许所述用户标识信息对应的终端使用通信业务。
这里，所述控制模块13可预先设置所述允许使用通信业务时间，并存储所述允许使用通信业务时间至数据库中，然后将终端的用户标识信息与对应的允许使用通信业务时间进行绑定，以实现对与所述用户标识信息对应的用户进行监管；当然，也可采用将用户身份信息与所述允许使用通信业务时间进行绑定；在现有技术中，由于同一张SIM卡可在多个手机中进行切换使用，如果将终端与允许该终端使用通信业务时间进行绑定，那么根据该SIM卡当前所在手机对应的允许使用通信业务时间对该手机通信业务进行控制，则可能不能够实现对该SIM卡的拥有者利用该手机进行通信业务的有效监管。
在一实施例中，所述通信业务为网络数据业务时，所述控制模块13，还配置为在所述判断出用户的通信业务请求的时间在所述用户标识信息对应的允许使用通信业务时间内，则允许所述用户标识信息对应的终端使用通信业务之前，判断所述终端当前已使用的流量是否大于或等于设定流量阈值，若大于或等于，则禁止所述终端使用网络数据业务，否则允许所述终端使用网络数据业务。
这里，所述网络数据业务为依赖网络提供数据服务的业务，如访问网站；当所述控制模块13判断出所述终端当前已使用的流量大于或等于设定流量阈值时，则禁止所述终端使用网络数据业务，可以达到节约流量及上网费用的目的。
在一实施例中，所述控制模块13，还配置为在所述判断出所述终端当前已使用的流量小于设定流量阈值，则所述允许所述终端正常使用网络数据业务之前，判断所述终端所访问的网址是否在设定网址白名单内，若不在，则禁止所述终端访问所述网址，否则允许所述终端访问所述网址；
和/或，在所述判断出所述终端当前已使用的流量小于设定流量阈值，则所述允许所述终端正常使用网络数据业务之前，判断所述终端使用的APP应用是否在设定APP白名单列表内，若不在，则禁止所述终端使用所述APP应用，否则允许所述终端使用所述APP应用。
当所述控制模块13判断出所述终端所访问的网址不在设定网址白名单内或在设定网址黑名单内时，禁止所述终端访问所述网址；当所述控制模块13判断出所述终端使用的APP应用不在设定APP白名单列表内或在设定APP黑名单列表内时，禁止所述终端使用所述APP应用；如此，能够实现对所述终端通信业务的有效监管。
另外，当所述通信业务为下载APP应用时，所述控制模块13，还配置为确定所述终端下载未包含在所述设定APP白名单列表内的新的APP应用 时，判断所述新的APP应用是否满足设置的APP应用下载条件，若满足，则允许所述终端下载所述新的APP应用，否则禁止所述终端下载所述新的APP应用。
其中，所述APP应用下载条件可根据APP应用的类别、用途、所述设定APP白名单列表中已包含的APP应用等进行设置；例如，对于未成年人即未满18周岁的人，只有当需要下载的新APP应用为学习类时才可进行下载，如可允许下载英语流利说、开心词场等学习类APP应用，而禁止下载愤怒的小鸟等游戏类APP应用。上述允许使用通信业务时间、流量阈值、网址白名单和黑名单、APP应用白名单列表和黑名单列表以及APP应用下载条件等都可由所述控制模块13提前进行设置，并存储在控制模块13的数据库中；此外，还可根据实际情况随时对所述数据库中的信息进行更新处理。
这里，所述控制模块13包括第二接收模块131、更新模块132；其中，
所述第二接收模块131，配置为接收针对允许使用通信业务时间、流量阈值、网址白名单、APP白名单列表的至少之一的更新请求；
所述更新模块132，配置为根据所述更新请求对所述允许使用通信业务时间、所述流量阈值、所述网址白名单、所述APP白名单列表的至少之一进行更新。
作为一种实施方式，当所述第二接收模块131接收到针对允许使用通信业务时间、流量阈值、网址白名单、APP白名单列表的至少之一的更新请求时，所述更新模块132根据所述更新请求对所述允许使用通信业务时间、所述流量阈值、所述网址白名单、所述APP白名单列表的至少之一进行更新，以更好的对终端通信业务进行控制。
在实际应用中，所述第一接收模块11、第二接收模块131可由接口或端口等实现；所述鉴权模块12、控制模块13、更新模块132可由位于网络 监控装置中的中央处理器(CPU，Central Processing Unit)、微处理器(MPU，Microprocessor Unit)、数字信号处理器(DSP，Digital Signal Processor)、或现场可编程门阵列(FPGA，Field－Programmable Gate Array)等实现。
本领域技术人员应当理解，本实施例的网络监控装置中各模块的功能，可参照前述实施例所述的终端通信业务的控制方法的相关描述而理解。
本发明实施例还记载了一种计算机存储介质，所述计算机存储介质存储有一个或者多个程序，所述一个或者多个程序可被一个或者多个处理器执行，以实现以下步骤：
接收终端发送的用户鉴权请求信息，所述用户鉴权请求信息中携带有所述终端的用户标识信息；
根据所述用户鉴权请求信息进行用户标识鉴权，若用户标识鉴权通过，则在设定数据库中查找与所述用户标识信息对应的用户身份信息，并基于所述用户身份信息中的子信息判断所述终端的用户是否为业务受限用户；
确定所述终端的用户为业务受限用户时，为所述用户提供设定的通信业务。
作为一种实施方式，执行为所述用户提供设定的通信业务的步骤时，所述一个或者多个程序还可被所述一个或者多个处理器执行，以实现以下步骤：
判断用户的通信业务请求的时间是否在所述用户标识信息对应的允许使用通信业务时间内，若不在，则禁止所述用户标识信息对应的终端使用通信业务。
作为一种实施方式，执行当所述通信业务为网络数据业务时，所述判断出用户的通信业务请求的时间在所述用户标识信息对应的允许使用通信业务时间内的步骤之后，所述一个或者多个程序还可被所述一个或者多个处理器执行，以实现以下步骤：
判断所述终端当前已使用的流量是否大于或等于设定流量阈值，若大于或等于，则禁止所述终端使用网络数据业务。
作为一种实施方式，执行判断出所述终端当前已使用的流量小于设定流量阈值的步骤之后，所述一个或者多个程序还可被所述一个或者多个处理器执行，以实现以下步骤：
判断所述终端所访问的网址是否在设定网址白名单内，若不在，则禁止所述终端访问所述网址；
和/或，判断所述终端使用的APP应用是否在设定APP白名单列表内，若不在，则禁止所述终端使用所述APP应用。
本领域技术人员应当理解，本实施例的计算机存储介质中各程序的功能，可参照前述终端通信业务的控制方法的相关描述而理解。
本领域内的技术人员应明白，本发明的实施例可提供为方法、系统、或计算机程序产品。因此，本发明可采用硬件实施例、软件实施例、或结合软件和硬件方面的实施例的形式。而且，本发明可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器和光学存储器等)上实施的计算机程序产品的形式。
本发明是参照根据本发明实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理 设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
以上所述，仅为本发明的较佳实施例而已，并非用于限定本发明的保护范围。凡在本发明的精神和范围之内所作的任何修改、等同替换和改进等，均包含在本发明的保护范围之内。
工业实用性
本发明实施例的技术方案本根据终端发送的用户鉴权请求信息对所述终端的用户进行用户标识鉴权，且在用户标识鉴权通过之后，根据所述终端的用户身份信息判断所述终端的用户是否为业务受限用户，若判定所述终端的用户为业务受限用户，则为所述用户提供设定的通信业务，即对与所述用户标识信息对应的终端通信业务进行控制，所设定的通信业务内容可包括：上网时间控制、网络流量用量控制、网络访问对象控制等，从而实现了对业务受限用户的终端通信业务进行统一有效的监管，且操作简单、方便。

Claims (15)

  1. 一种终端通信业务的控制方法，所述方法包括：
    接收终端发送的用户鉴权请求信息，所述用户鉴权请求信息中携带有所述终端的用户标识信息；
    根据所述用户鉴权请求信息进行用户标识鉴权，若用户标识鉴权通过，则在设定数据库中查找与所述用户标识信息对应的用户身份信息，并基于所述用户身份信息中的子信息判断所述终端的用户是否为业务受限用户；
    确定所述终端的用户为业务受限用户时，为所述用户提供设定的通信业务。
  2. 根据权利要求1所述的方法，其中，所述子信息包括以下信息至少一种：年龄、职业；所述用户标识信息包括国际移动用户识别码IMSI。
  3. 根据权利要求1或2所述的方法，其中，所述为所述用户提供设定的通信业务，包括：
    判断用户的通信业务请求的时间是否在所述用户标识信息对应的允许使用通信业务时间内，若不在，则禁止所述用户标识信息对应的终端使用通信业务。
  4. 根据权利要求3所述的方法，其中，当所述通信业务为网络数据业务时，所述判断出用户的通信业务请求的时间在所述用户标识信息对应的允许使用通信业务时间内之后，所述方法还包括：
    判断所述终端当前已使用的流量是否大于或等于设定流量阈值，若大于或等于，则禁止所述终端使用网络数据业务。
  5. 根据权利要求4所述的方法，其中，所述判断出所述终端当前已使用的流量小于设定流量阈值之后，所述方法还包括：
    判断所述终端所访问的网址是否在设定网址白名单内，若不在，则禁止所述终端访问所述网址；
    和/或，判断所述终端使用的APP应用是否在设定APP白名单列表内，若不在，则禁止所述终端使用所述APP应用。
  6. 根据权利要求3所述的方法，其中，当所述通信业务为下载APP应用时，所述方法还包括：
    确定所述终端下载未包含在设定APP白名单列表内的新的APP应用时，判断所述新的APP应用是否满足设置的APP应用下载条件，若不满足，则禁止所述终端下载所述新的APP应用。
  7. 根据权利要求4至6任一项所述的方法，其中，所述方法还包括：
    接收针对允许使用通信业务时间、流量阈值、网址白名单、APP白名单列表的至少之一的更新请求；
    根据所述更新请求对所述允许使用通信业务时间、所述流量阈值、所述网址白名单、所述APP白名单列表的至少之一进行更新。
  8. 一种网络监控装置，所述网络监控装置包括：第一接收模块、鉴权模块、控制模块；其中，
    所述第一接收模块，配置为接收终端发送的用户鉴权请求信息，所述用户鉴权请求信息中携带有所述终端的用户标识信息；
    所述鉴权模块，配置为根据所述用户鉴权请求信息进行用户标识鉴权，若用户标识鉴权通过，则在设定数据库中查找与所述用户标识信息对应的用户身份信息，并基于所述用户身份信息中的子信息判断所述终端的用户是否为业务受限用户；
    所述控制模块，配置为当确定所述终端的用户为业务受限用户时，为所述用户提供设定的通信业务。
  9. 根据权利要求8所述的网络监控装置，其中，所述子信息包括以下信息至少一种：年龄、职业；所述用户标识信息包括IMSI。
  10. 根据权利要求8或9所述的网络监控装置，其中，所述控制模块， 具体配置为：
    判断用户的通信业务请求的时间是否在所述用户标识信息对应的允许使用通信业务时间内，若不在，则禁止所述用户标识信息对应的终端使用通信业务。
  11. 根据权利要求10所述的网络监控装置，其中，当所述通信业务为网络数据业务时，所述控制模块，还配置为在所述判断出用户的通信业务请求的时间在所述用户标识信息对应的允许使用通信业务时间内之后，判断所述终端当前已使用的流量是否大于或等于设定流量阈值，若大于或等于，则禁止所述终端使用网络数据业务。
  12. 根据权利要求11所述的网络监控装置，其中，所述控制模块，还配置为在所述判断出所述终端当前已使用的流量小于设定流量阈值之后，判断所述终端所访问的网址是否在设定网址白名单内，若不在，则禁止所述终端访问所述网址；
    和/或，在所述判断出所述终端当前已使用的流量小于设定流量阈值之后，判断所述终端使用的APP应用是否在设定APP白名单列表内，若不在，则禁止所述终端使用所述APP应用。
  13. 根据权利要求10所述的网络监控装置，其中，当所述通信业务为下载APP应用时，所述控制模块，还配置为确定所述终端下载未包含在设定APP白名单列表内的新的APP应用时，判断所述新的APP应用是否满足设置的APP应用下载条件，若不满足，则禁止所述终端下载所述新的APP应用。
  14. 根据权利要求11至13任一项所述的网络监控装置，其中，所述控制模块包括第二接收模块、更新模块；其中，
    所述第二接收模块，配置为接收针对允许使用通信业务时间、流量阈值、网址白名单、APP白名单列表的至少之一的更新请求；
    所述更新模块，配置为根据所述更新请求对所述允许使用通信业务时间、所述流量阈值、所述网址白名单、所述APP白名单列表的至少之一进行更新。
  15. 一种计算机存储介质，所述计算机存储介质中存储有计算机可执行指令，所述计算机可执行指令用于执行权利要求1至7任一项所述的终端通信业务的控制方法。
PCT/CN2017/085741 2016-11-29 2017-05-24 一种终端通信业务的控制方法及网络监控装置、存储介质 WO2018099016A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201611074999.XA CN108124258A (zh) 2016-11-29 2016-11-29 一种终端通信业务的控制方法及网络监控装置
CN201611074999.X 2016-11-29

Publications (1)

Publication Number Publication Date
WO2018099016A1 true WO2018099016A1 (zh) 2018-06-07

Family

ID=62225880

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/085741 WO2018099016A1 (zh) 2016-11-29 2017-05-24 一种终端通信业务的控制方法及网络监控装置、存储介质

Country Status (2)

Country Link
CN (1) CN108124258A (zh)
WO (1) WO2018099016A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111405541A (zh) * 2019-01-02 2020-07-10 中国移动通信有限公司研究院 一种执行补充业务的方法及装置
CN111770026A (zh) * 2020-06-19 2020-10-13 中国建设银行股份有限公司 一种网络流量控制方法和装置

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108830066A (zh) * 2018-06-20 2018-11-16 平安科技（深圳）有限公司 终端中的应用控制方法和装置及计算机可读存储介质
CN109525575A (zh) * 2018-11-08 2019-03-26 北京首信科技股份有限公司 上网管控的方法和系统
CN109981572A (zh) * 2019-02-20 2019-07-05 博泰雄森（北京）网络科技有限公司 一种基于运营商apn流量牵引方式的上网管控方法及系统
CN112291709B (zh) * 2019-07-09 2023-07-04 中国移动通信集团安徽有限公司 鉴权方法、装置、设备及计算机存储介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2006062272A1 (en) * 2004-12-07 2006-06-15 Electronics And Telecommunications Research Institute Internet access time control method using authentication assertion
CN101399718A (zh) * 2007-09-29 2009-04-01 上海贝尔阿尔卡特股份有限公司 接入网络中控制用户设备接入组播业务的方法和装置
CN102377585A (zh) * 2010-08-10 2012-03-14 深圳市傲天通信有限公司 青少年网络防沉迷系统及其方法
CN104158766A (zh) * 2014-08-15 2014-11-19 卢婷 一种上网控制方法

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7853535B2 (en) * 2006-12-27 2010-12-14 Colella Brian A System for secure internet access for children
CN102088468A (zh) * 2009-12-08 2011-06-08 徐克林 一种手机上网限制的方法
CN105024982A (zh) * 2014-04-29 2015-11-04 中国移动通信集团设计院有限公司 一种网络接入方法、装置和服务器

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2006062272A1 (en) * 2004-12-07 2006-06-15 Electronics And Telecommunications Research Institute Internet access time control method using authentication assertion
CN101399718A (zh) * 2007-09-29 2009-04-01 上海贝尔阿尔卡特股份有限公司 接入网络中控制用户设备接入组播业务的方法和装置
CN102377585A (zh) * 2010-08-10 2012-03-14 深圳市傲天通信有限公司 青少年网络防沉迷系统及其方法
CN104158766A (zh) * 2014-08-15 2014-11-19 卢婷 一种上网控制方法

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111405541A (zh) * 2019-01-02 2020-07-10 中国移动通信有限公司研究院 一种执行补充业务的方法及装置
CN111770026A (zh) * 2020-06-19 2020-10-13 中国建设银行股份有限公司 一种网络流量控制方法和装置
CN111770026B (zh) * 2020-06-19 2022-12-09 中国建设银行股份有限公司 一种网络流量控制方法和装置

Also Published As

Publication number Publication date
CN108124258A (zh) 2018-06-05

Similar Documents

Publication Publication Date Title
WO2018099016A1 (zh) 一种终端通信业务的控制方法及网络监控装置、存储介质
US11271941B2 (en) Device management system
US10021560B2 (en) Method and system for selective and secure interaction of BYOD (bring your own device) with enterprise network through mobile wireless networks
CN104144463B (zh) Wi‑Fi网络接入方法和系统
JP2013528985A (ja) ネットワークにアクセスするためのマシン型通信装置を制御する方法及びシステム
US10070302B2 (en) Internet of things (IoT) delay tolerant wireless network service
US9043928B1 (en) Enabling web page tracking
JP6951445B2 (ja) 緊急番号設定方法、取得方法および装置
CN109561429B (zh) 一种鉴权方法及设备
CN106982430B (zh) 一种基于用户使用习惯的Portal认证方法及系统
CN105681259A (zh) 一种开放授权方法、装置及开放平台
CN105828413A (zh) 一种d2d模式b发现的安全方法、终端和系统
US10291613B1 (en) Mobile device authentication
WO2018024922A1 (es) Sistema y método de control de datos personales de un usuario de redes de telecomunicaciones
CN105812314B (zh) 一种用户登录互联网应用程序的方法和统一认证平台
US10820200B2 (en) Framework for securing device activations
CN107635229A (zh) 一种wifi共享的方法和装置
US11943618B2 (en) Forcing re-authentication of users for accessing online services
US10250700B2 (en) Methods and devices for notifying authorization update
US11129026B1 (en) ESIM switching platform
US10044721B2 (en) Communication device authentication in small cell network
CN106899543B (zh) 一种内容访问控制方法及相关设备
CN113170276A (zh) 用于递送局限于预定义服务区域的专用服务的方法和系统
CN113079505B (zh) 用户认证方法、核心网侧设备及计算机可读存储介质
US20240196217A1 (en) Forcing re-authentication of users for accessing online services

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17876231

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 17876231

Country of ref document: EP

Kind code of ref document: A1