CN102754488B - User access control method, device and system - Google Patents

Abstract

A method, a device and a system for controlling user access relate to the field of communication, realize the deep content detection of targeted user access data, and can effectively control the user access data in real time. The method for controlling the user access comprises the following steps: receiving an access request sent by a user; copying the information content of the access request to a content identification device; and updating the blacklist data or the white list data according to the judgment result of the information content of the access request returned by the content identification device.

Description

User access control method, device and system

technical field

The present invention relates to the communication field, in particular to a user access control method, device and system.

Background technique

In order to ensure the security of the user's access to data, currently in the data business, it is generally necessary to control the data business user's access process with black and white list data (including black list data and white list data). Generally, the black and white list data is provided by a third-party system , the blacklist usually refers to a list of websites that contain illegal content and may pose a threat to users, and the whitelist usually refers to a list of legitimate websites that do not pose a threat to users. When a user visits a website in the blacklist, according to The blacklist data in the blacklist and whitelist data blocks the user's access process.

In the prior art, the control of user access to data is generally realized through the following methods. As shown in Figure 1, the third-party system scans and analyzes Internet website information and extracts and obtains blacklist and whitelist data, and then sends the obtained blacklist and whitelist data to the network administrator, and the network administrator manually synchronizes the obtained blacklist and whitelist data through the WEB interface of the gateway to the gateway. After the gateway refreshes the black and white list data into the memory, it controls user requests according to the black and white lists. In this technical solution, because the content analyzed and scanned by the third-party system is not only the request sent by the user, but countless Internet websites, resulting in redundant black and white list data, which increases the burden on the gateway; after the black and white list data is generated, it needs to The network administrator imports it to the gateway, so the blacklist and whitelist data cannot be updated in time; most third-party systems cannot automatically perform in-depth analysis of the data content, and the misjudgment rate is high.

Contents of the invention

The technical problem to be solved by the embodiments of the present invention is how to effectively control user access to data, reduce manual participation, and improve the interception efficiency of blacklist and whitelist data control.

In order to solve the above technical problems, embodiments of the present invention adopt the following technical solutions:

A method for controlling user access, comprising:

Receive access requests sent by users;

copying the information content of the access request to a content identification device;

The information content of the access request is the information content that can be identified by the content identification device after protocol identification and protocol conversion;

The blacklist data or whitelist data is updated according to the judgment result of the information content of the access request returned by the content recognition device.

A method for controlling user access, comprising:

Receive the information content of the user access request sent by the gateway;

The information content of the access request is the information content that can be identified by the content identification device after gateway protocol identification and protocol conversion;

According to the information content of the access request, obtain a judgment result including blacklist data or whitelist data of the address requested by the access request;

Sending the judging result to the gateway, so that the gateway can update blacklist data or whitelist data according to the judging result.

A gateway comprising:

a receiving unit, configured to receive an access request sent by a user;

a copying unit, configured to copy the information content of the access request to the content identification device,

The information content of the access request is the information content that can be identified by the content identification device after protocol identification and protocol conversion;

An update unit, configured to update blacklist data or whitelist data according to the judgment result of the information content of the access request returned by the content recognition device.

A content recognition device, comprising:

a receiving unit, configured to receive the information content of the user's access request sent by the gateway;

The information content of the access request is the information content that can be identified by the content identification device after gateway protocol identification and protocol conversion;

The first identifying unit is configured to obtain a judgment result including blacklist data or whitelist data of the address requested by the access request according to the information content of the access request;

The first sending unit is configured to send the judgment result to the gateway, so that the gateway can update blacklist data or whitelist data according to the judgment result.

A control system for user access, including: a gateway and a content identification device,

The gateway is used to receive the access request sent by the user; copy the information content of the access request to the content identification device;

The content identification device is used to receive the information content of the user access request sent by the gateway; the information content of the access request is the information content that can be identified by the content identification device after the protocol identification and protocol conversion of the gateway; according to the information content of the access request, obtain a judgment result including blacklist data or whitelist data of the address requested by the access request; send the judgment result to the gateway;

The gateway is further configured to update the blacklist data or whitelist data according to the judgment result of the information content of the access request returned by the content recognition device.

The user access control method of the embodiment of the present invention uses the gateway to judge the black and white list data of the user's access request, and at the same time utilizes the gateway's own protocol identification and protocol conversion functions, and the information content requested by the user is converted into a content identification device through the gateway After the identifiable data is copied to the content recognition device, the targeted in-depth content detection of user access data is realized, and the content recognition device promptly includes the address requested by the access request into the blacklist data or whitelist data for judgment The results are returned to the gateway. Compared with the prior art, which requires the network administrator to manually update the black and white list data, the embodiment of the present invention can update the black and white list data in real time, reducing manual participation, thereby effectively controlling user access to data, and greatly improving the efficiency of black and white list data control. interception efficiency.

Description of drawings

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following will briefly introduce the accompanying drawings that need to be used in the description of the embodiments. Obviously, the accompanying drawings in the following description are only of the present invention. For some embodiments, those of ordinary skill in the art can also obtain other drawings based on these drawings without any creative effort.

FIG. 1 is a schematic diagram of the architecture of a black and white list data control system in the prior art;

FIG. 2 is a schematic diagram of a system architecture of a method for controlling user access in an embodiment of the present invention;

Fig. 3 is one of the flowcharts of the control method of user access in the embodiment of the present invention;

Fig. 4 is the second flow chart of the user access control method in the embodiment of the present invention;

Fig. 5 is the third flowchart of the user access control method in the embodiment of the present invention;

FIG. 6 is a schematic structural diagram of a gateway in an embodiment of the present invention;

FIG. 7 is a schematic structural diagram of a content identification device in an embodiment of the present invention;

FIG. 8 is a schematic structural diagram of a control system for user access in an embodiment of the present invention.

detailed description

Embodiments of the present invention provide a user access control method, device, and system, which realize targeted in-depth content detection of user access data, and can update black and white list data in real time, reducing manual participation, thereby effectively controlling user access. Access data, greatly improving the interception efficiency of black and white list data control.

Embodiment of the present invention is described in detail below in conjunction with accompanying drawing:

Embodiment one

This embodiment provides a method for controlling user access, as shown in Figure 3, the method includes:

Step 101, receiving an access request sent by a user.

Step 102. Copy the information content of the access request to the content identification device; the information content of the access request is the information content that can be identified by the content identification device after protocol identification and protocol conversion. The information content of the access request refers to the information content obtained from the network side according to the user's access request.

The content identification device is a device capable of identifying and analyzing content such as text, pictures, and videos on the network. However, the current existing content recognition devices have relatively single recognition capabilities. For example, they can only recognize data accessed by Hypertext Transfer Protocol (Hypertext Transfer Protocol, referred to as HTTP) web pages. For non-HTTP data such as Wireless Application Protocol (Wireless Application Protocol, referred to as WAP) data , Real Time Streaming Protocol (Real Time Streaming Protocol, referred to as RTSP) data, streaming media transfer protocol (Microsoft Media Server protocol, referred to as MMS) data, etc. cannot be identified, and the scope of analysis and detection is relatively small.

In order to enable the content identification device to perform identification and analysis in a wider range, this embodiment connects the content identification device to a network device that can perform protocol identification and protocol conversion. For example, this network device can be a gateway.

As shown in Figure 2, a gateway is set between the user and the Internet, and the content identification device is connected to the gateway.

The control of user access provided by this embodiment is mainly black and white list control, and this embodiment can control the user's access request through the gateway to control the black and white list data. The black and white list data is stored in the gateway. After the gateway receives the access request sent by the user, it can first judge the access request to determine whether the address requested by the access request is in the existing black list data and white list data. In list data and white list data, the gateway processes the information content of the access request, such as protocol identification and protocol conversion, and then copies it to the content identification device. Here, the copying method may be optical splitting, and the optical splitting to the content identification device means that the gateway copies the same copy of the received information and sends it to the content identification device.

Since the gateway itself has the functions of protocol identification and protocol conversion, and has strong Deep Packet Inspection (DPI) capability, the gateway can convert the information content of various forms of access requests into HTTP data recognizable by the content identification device. At the same time, the content recognition device also realizes the recognition and analysis of various data. Therefore, through the interconnected gateway and the content identification device, it is possible to implement black and white list control on various data types of information content accessed by users.

The address in this embodiment may be a webpage address on the Internet, or a local disk or an address of a computer on a local area network, which is not limited in this embodiment of the present invention.

In this embodiment, the content recognition device bypasses the splitting traffic at the Internet exit of the gateway. By using the DPI capability and protocol conversion function of the gateway, the position of the splitting point shields the protocol adaptation between the content recognition device and each terminal. problem, thus solving the problem that the existing content recognition device has a small recognition range. The content identification device can analyze the information content of user access requests of various data types.

Step 103: Update the black and white data list according to the judgment result of the information content of the access request returned by the content recognition device.

After analyzing the information content of the access request, the content identification device makes a judgment to include the address requested by the access request in the blacklist data or whitelist data, and then sends the judgment result to the gateway. The gateway regularly detects the presence or absence of the content identification device and sends the judgment result, and when it is detected, the gateway updates the black and white list data stored in the gateway according to the judgment result sent by the content identification device.

Of course, the updated black and white data list also includes that there is no data in the original black and white list of the gateway. By receiving the black and white list results analyzed by the content recognition device, the first black and white list data is stored in the gateway, and the next user request Perform black and white list access control.

In the method for controlling user access in this embodiment, by using the gateway's own protocol identification and protocol conversion functions, the information content requested by the user is converted by the gateway into data recognizable by the content identification device, and then copied to the content identification device. Targeted in-depth content detection of user access data, the content recognition device promptly returns the judgment result of the address requested by the access request to the blacklist data or whitelist data to the gateway, compared with the existing technology, the network administrator needs to manually update black and white List data, the embodiment of the present invention can update the black and white list data in real time, reduces manual participation, effectively controls user access to data, and greatly improves the interception efficiency of black and white list data control.

Embodiment two

This embodiment provides a method for controlling user access, as shown in Figure 4, the method includes:

Step 201, the content identification device receives the information content of the user's access request sent by the gateway.

The content identification device is used to conduct in-depth analysis on the information content of the user's access request, such as text, picture, video and other content, and identify illegal content therein. The content identification device can only identify HTTP data, therefore, "the information content of the user's access request received by the content identification device and sent by the gateway" is HTTP data. The information content of the access request is the information content that can be identified by the content identification device after protocol identification and protocol conversion.

Step 202, the content identification device obtains a judgment result including blacklist data or whitelist data of the address requested by the access request according to the information content of the access request;

The content recognition device analyzes the information content of the access request, obtains the analysis result according to the system preset standard, and then judges to include the address requested by the access request in the blacklist data or whitelist data according to the analysis result.

Step 203, the content identification device sends the judgment result to the gateway, so that the gateway can update the blacklist data or whitelist data according to the judgment result.

In the actual application process, the following phenomenon usually occurs: the website in the original blacklist data has no illegal content after improvement, and should be included in the whitelist data; or the website in the original whitelist data has newly added illegal content, etc. Should be blacklisted data. The existence of the above situation makes the black and white list data stored in the gateway inaccurate, which seriously affects the use of users.

In order to avoid the occurrence of the above situation, the content recognition device of this embodiment is also provided with a crawling unit for actively crawling information content according to a pre-established crawling strategy, and the crawled information content is at least blacklist data and whitelist data The information content of the website in . The crawling strategy here refers to the crawling time, frequency, crawling target website, etc. The crawling method here can also be understood as methods such as sampling inspection.

The information content crawled by the crawling unit can also be converted by the gateway first, and then enter the content recognition device for analysis, and obtain the judgment result of including the address of the crawled information content into the blacklist data or whitelist data. The content identification device sends the judgment result to the gateway, and the gateway updates the blacklist data or whitelist data according to the judgment result.

The user access control method of this embodiment uses the gateway to judge the black and white list data of the user's access request, and at the same time utilizes the gateway's own protocol identification and protocol conversion functions, and the information content requested by the user is converted into a content identification device through the gateway. After the identified data is copied to the content recognition device, the targeted in-depth content detection of user access data is realized, and the content recognition device promptly includes the address requested by the access request into the blacklist data or the judgment result of the whitelist data Returning to the gateway, compared with the prior art that requires the network administrator to manually update the black and white list data, the embodiment of the present invention can update the black and white list data in real time, reducing manual participation, thereby effectively controlling user access to data, and greatly improving the interception of black and white list data control efficiency. Further, this embodiment also sets a crawling unit to actively crawl the information content of the websites in the black and white list data in the gateway, avoiding the change of the website attributes in the original black and white list data, but the black and white list data cannot be changed. problem, greatly improving the interception accuracy of the gateway.

Embodiment Three

This embodiment provides a method for controlling user access, as shown in Figure 5, the method includes:

Step 301, the gateway receives the access request sent by the user.

Step 302, the gateway judges whether the address requested by the access request is in the blacklist data or the whitelist data.

In this embodiment, the blacklist and whitelist data are stored in the gateway, and the access requests of users are controlled by the gateway. The blacklist and whitelist data are usually addresses of a series of webpages (UniformResourceLocator, URL for short).

Step 303, if the address is in the white list data, the gateway allows the user's access request.

Step 304, if the address is in the blacklist data, the gateway blocks or warns the user's access request.

For example, if the gateway judges that the address requested by the user belongs to the address in the blacklist data, according to the preset processing method, it will send a warning to the user, prompting the user whether to continue the visit, or directly interrupt the visit.

Step 305, if the gateway judges that the address requested by the access request sent by the user is not in the blacklist data and whitelist data, then the information content of the access request is copied to the content identification device, and the information content of the access request is the protocol identification and protocol conversion. The content of the information that can be identified by the subsequent content identification device.

If the address requested by the access request sent by the user is not in the blacklist data and whitelist data, the gateway converts the information content of the access request into HTTP data recognizable by the content recognition device, and then copies it to the content recognition device.

In the actual application process, the following phenomenon usually occurs: the website in the original blacklist data has no illegal content after improvement, and should be included in the whitelist data; or the website in the original whitelist data has newly added illegal content, etc. Should be blacklisted data. The existence of the above situation makes the black and white list data stored in the gateway inaccurate, which seriously affects the use of users.

In order to avoid the occurrence of the above situation, the content recognition device of this embodiment is also provided with a crawling unit for actively crawling information content according to a pre-established crawling strategy, and the crawled information content is at least blacklist data and whitelist data The information content of the website in . The crawling strategy here refers to the crawling time, frequency, crawling target website, etc.

The information content crawled by the crawling unit is also converted by the gateway first, and then enters the content recognition device for analysis, and the judgment result of including the address of the crawled information content in the blacklist data or whitelist data is obtained. The content identification device sends the judgment result to the gateway, and the gateway updates the blacklist data or whitelist data according to the judgment result.

Step 306, the gateway updates the blacklist data or whitelist data according to the judgment result of the information content of the access request returned by the content recognition device.

In order to realize fast communication between the gateway and the content recognition device, in this embodiment, the gateway and the content recognition device are deployed at the same place and connected with a network cable, or directly integrated together to form a system.

After analyzing the information content of the access request, the content identification device makes a judgment that the address requested by the access request is included in the blacklist data or whitelist data, and then sends the judgment result to the gateway. The judgment result here includes the result of including the address requested by the access request in the blacklist data or whitelist data. The gateway regularly detects the presence or absence of the content identification device and sends the judgment result, and when it is detected, the gateway updates the black and white list data stored in the gateway according to the judgment result sent by the content identification device.

In addition, it should be noted that, in order to ensure the speed of the user's access to the Internet, in this embodiment, the updated blacklist data or whitelist data may only be valid for subsequent access requests sent by the user. That is to say, after the gateway judges that the address requested by the access request sent by the user is not in the blacklist data and whitelist data, the access request is released. Because the analysis and judgment process of the content recognition device will cause a certain delay, it will inevitably bring inconvenience to the user. Therefore, in order to ensure the speed and efficiency of the user's access to the Internet, the above settings can be performed on the gateway.

In practical applications, different user terminals may access the Internet through different gateways. In order to improve equipment utilization and reduce operating costs, several gateways can be connected to the same content recognition device.

The user access control method of the present embodiment uses the gateway to judge the black and white list data of the user's access request. The requested web page is blocked or warned when it is in the black list, and it is released when it is in the white list. At the same time, it uses the protocol identification of the gateway itself With the function of protocol conversion, the information content requested by the user is converted into data recognizable by the content recognition device through the gateway, and then copied to the content recognition device, which realizes targeted content detection of the user's access data, and the content recognition device timely Request the requested address to be included in the blacklist data or the judgment result in the whitelist data to return to the gateway. Compared with the prior art, the network administrator needs to manually update the blacklist and whitelist data. The embodiment of the present invention can update the blacklist and whitelist data in real time, reducing manual participation , so as to effectively control user access to data, and greatly improve the interception efficiency of black and white list data control. This embodiment is also provided with a crawling unit to actively crawl the information content of the websites in the black and white list data in the gateway, avoiding the problem that the website attributes in the original black and white list data change, but the black and white list data cannot be changed. Improved interception accuracy for gateways.

Embodiment Four

This embodiment provides a gateway, as shown in FIG. 6 , including: a receiving unit 10 , a replicating unit 11 and an updating unit 12 .

Wherein, the receiving unit 10 receives the access request sent by the user;

The copying unit 11 is configured to copy the information content of the access request to the content identification device, and the information content of the access request is information content that can be identified by the content identification device after protocol identification and protocol conversion.

The updating unit 12 is configured to update the blacklist data or the whitelist data according to the judgment result of the information content of the access request returned by the content recognition device.

The gateway of this embodiment also includes: a judging unit 13,

A judging unit 13, configured to judge whether the address requested by the access request is in the blacklist data or the whitelist data;

If the address is in the blacklist data, block or warn the user's access request, if the address is in the whitelist data, release the user's access request, if the address is not in the blacklist data and whitelist data, access the requested information The content is copied to a content-aware device.

The judging unit 13 in this embodiment is further configured to: judge whether the address requested by the user's subsequent access request is in the updated blacklist data or whitelist data.

In order to realize fast communication between the gateway and the content recognition device, in this embodiment, the gateway and the content recognition device are deployed at the same place and connected with a network cable, or directly integrated together to form a system.

After analyzing the information content of the access request, the content identification device makes a judgment that the address requested by the access request is included in the blacklist data or whitelist data, and then sends the judgment result to the gateway. The gateway regularly detects the presence or absence of the content identification device and sends the judgment result, and when it is detected, the gateway updates the black and white list data stored in the gateway according to the judgment result sent by the content identification device.

In practical applications, different user terminals may access the Internet through different gateways. In order to improve equipment utilization and reduce operating costs, several gateways can be connected to the same content recognition device.

The gateway in this embodiment has the functions described in the gateways in all the foregoing embodiments, which will not be repeated here.

In the gateway of this embodiment, by judging the black and white list data of the user's access request, and using the protocol identification and protocol conversion functions of the gateway itself, after the information content requested by the user is converted into data recognizable by the content identification device through the gateway, Copying to the content recognition device realizes targeted in-depth content detection of user access data. The content recognition device returns the judgment result of the address requested by the access request to the blacklist data or whitelist data to the gateway in a timely manner. Compared with the prior art, the network administrator needs to manually update the black and white list data. The embodiment of the present invention can update the black and white list data in real time, reducing manual participation, thereby effectively controlling user access to data, and greatly improving the interception efficiency of black and white list data control.

Embodiment five

This embodiment provides a content identification device, as shown in FIG. 7 , including: a receiving unit 21, a first identification unit 22, a first sending unit 23,

Wherein, the receiving unit 21 is used to receive the information content of the user's access request sent by the gateway; the information content of the access request is the information content that can be identified by the content identification device after protocol identification and protocol conversion;

The first identifying unit 22 is configured to obtain a judgment result including blacklist data or whitelist data of the address requested by the access request according to the information content of the access request;

The first sending unit 23 is configured to send the judgment result to the gateway, so that the gateway can update blacklist data or whitelist data according to the judgment result.

The content identification device of this embodiment also includes: a crawling unit 24, a second identification unit 25 and a second sending unit 26,

Among them, the crawling unit 24 is used to actively crawl information content according to a pre-established crawling strategy, and the crawled information content is at least the information content of websites in the blacklist data and whitelist data, where the crawling strategy refers to crawling The crawling time, frequency, crawling target website, etc., the information content crawled by the crawling unit is also converted by the gateway first, and then enters the content recognition device for analysis, and the address of the crawled information content is blacklisted Judgment results of data or whitelist data. The content recognition device sends the judgment result to the gateway, and the gateway updates the blacklist data or whitelist data according to the judgment result;

The second identification unit 25 is configured to obtain a judgment result of including the address of the crawled information content in blacklist data or whitelist data according to the crawled information content;

The second sending unit 26 is configured to send the judgment result to the gateway, so that the gateway can update the blacklist data or whitelist data according to the judgment result.

In order to realize fast communication between the gateway and the content recognition device, in this embodiment, the gateway and the content recognition device are deployed at the same place and connected with a network cable, or directly integrated together to form a system.

After analyzing the information content of the access request, the content identification device makes a judgment that the address requested by the access request is included in the blacklist data or whitelist data, and then sends the judgment result to the gateway. The gateway regularly detects the presence or absence of the content identification device and sends the judgment result, and when it is detected, the gateway updates the black and white list data stored in the gateway according to the judgment result sent by the content identification device.

In practical applications, different user terminals may access the Internet through different gateways. In order to improve equipment utilization and reduce operating costs, several gateways can be connected to the same content recognition device.

The content identification device in this embodiment has the functions described in the content identification device in the third embodiment above, and will not be repeated here.

The content identification device of this embodiment uses the gateway's own protocol identification and protocol conversion functions to convert the information content requested by the user into data recognizable by the content identification device, and then copy it to the content identification device to achieve targeted For the content detection of user access data, the content identification device promptly returns the judgment result of the address requested by the access request in the blacklist data or whitelist data to the gateway. Compared with the prior art, the network administrator needs to manually update the blacklist and whitelist data. The present invention The embodiment can update black and white list data in real time, reducing manual participation, thereby effectively controlling user access to data, and greatly improving the interception efficiency of black and white list data control. This embodiment is also provided with a crawling unit to actively crawl the information content of the websites in the black and white list data in the gateway, avoiding the problem that the website attributes in the original black and white list data change, but the black and white list data cannot be changed. Improved interception accuracy for gateways.

Embodiment six

This embodiment provides a control system for user access, as shown in FIG. 8 , including: a gateway 1 and a content identification device 2, the gateway 1 and the content identification device 2 are connected by a network cable,

Among them, the gateway 1 is used to copy the information content of the access request to the content identification device 2 after judging that the address requested by the access request sent by the user is not in the blacklist data and whitelist data; the information content of the access request is identified through the protocol and the information content that can be identified by the content identification device after protocol conversion;

Since the gateway itself has the functions of protocol identification and protocol conversion, the gateway can convert the information content of various forms of access requests into HTTP data recognizable by the content identification device. In this way, the problem of the narrow recognition range of the existing content recognition device is solved. The content recognition device can analyze the information content of all user access requests.

The content recognition device 2 is used to receive the information content of the user's access request sent by the gateway 1; according to the information content of the access request, obtain a judgment result including blacklist data or whitelist data of the address requested by the access request; and then The judgment result is sent to the gateway 1;

The gateway 1 is also used to update the blacklist data or whitelist data according to the judgment result of the information content of the access request returned by the content recognition device 2 .

The content identification device 2 of this embodiment may further include: a crawling unit, a second identification unit, and a second sending unit,

Among them, the crawling unit is used to actively crawl information content according to a pre-established crawling strategy. The crawled information content is at least the information content of websites in the blacklist data and whitelist data. The crawling strategy here refers to crawling Time, frequency, crawling target website, etc., the information content crawled by the crawling unit is also converted by the gateway first, and then enters the content recognition device for analysis, and the address of the crawled information content is blacklisted. Or the judgment result of the whitelist data. The content recognition device sends the judgment result to the gateway, and the gateway updates the blacklist data or whitelist data according to the judgment result;

The second identification unit is used to obtain a judgment result of including the address of the crawled information content in blacklist data or whitelist data according to the crawled information content;

The second sending unit is configured to send the judgment result to the gateway, so that the gateway can update the blacklist data or whitelist data according to the judgment result.

In order to realize fast communication between the gateway 1 and the content recognition device 2, the present embodiment deploys the gateway 1 and the content recognition device 2 at the same place and connects them with a network cable, or directly integrates the two together to form a system.

After the content identification device 2 analyzes the information content of the access request, it judges that the address requested by the access request is included in the blacklist data or whitelist data, and then sends the judgment result to the gateway 1 . The gateway 1 regularly detects whether the content recognition device has a judgment result and sends it. When it detects the presence of the content recognition device, the gateway 1 updates the black and white list data stored in the gateway 1 according to the judgment result sent by the content recognition device.

In practical applications, different user terminals may access the Internet through different gateways. In order to improve equipment utilization and reduce operating costs, several gateways 1 can be connected to the same content recognition device 2 .

In addition, in this embodiment, the gateway 1 and the content recognition device 2 can also be integrated and used as a device.

The gateway 1 and the content recognition device 2 in this embodiment have the functions of the gateway and the content recognition device in Embodiments 4 and 5, which will not be repeated here.

The user access control system of this embodiment uses the gateway to judge the black and white list data of the user's access request, and at the same time utilizes the gateway's own protocol identification and protocol conversion functions. After the identified data is copied to the content recognition device, the targeted in-depth content detection of user access data is realized, and the content recognition device promptly includes the address requested by the access request into the blacklist data or the judgment result of the whitelist data Returning to the gateway, compared with the prior art that requires the network administrator to manually update the black and white list data, the embodiment of the present invention can update the black and white list data in real time, reducing manual participation, thereby effectively controlling user access to data, and greatly improving the interception of black and white list data control efficiency.

Through the description of the above embodiments, those skilled in the art can clearly understand that the present invention can be realized by means of software plus necessary general-purpose hardware, and of course also by hardware, but in many cases the former is a better embodiment . Based on this understanding, the essence of the technical solution of the present invention or the part that contributes to the prior art can be embodied in the form of a software product, the computer software product is stored in a readable storage medium, and the The storage medium is a non-transitory storage medium, such as a floppy disk, a hard disk, or an optical disk of a computer, and includes several instructions to enable a computer device (which may be a personal computer, a server, or a network device, etc.) to execute the various embodiments described in the present invention. Methods.

The above is only a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Anyone skilled in the art can easily think of changes or substitutions within the technical scope disclosed in the present invention. Should be covered within the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims (11)

1. A control method for user access, comprising: Receive access requests sent by users; Copying the information content of the access request to a content identification device, the content identification device is a device capable of identifying and analyzing content including text, pictures or video on the network; The information content of the access request is the information content that can be identified by the content identification device after protocol identification and protocol conversion, and the information content of the access request refers to the information content obtained from the network side according to the user's access request; updating blacklist data or whitelist data according to the judgment result of the information content of the access request returned by the content recognition device; The judgment result is that the content recognition device analyzes the information content of the access request, obtains the analysis result according to the system preset standard, and then judges whether to include the address requested by the access request in the blacklist data or whitelist according to the obtained analysis result. list data. 2. The method according to claim 1, wherein the judgment result includes a result of including the address requested by the access request in the blacklist data or whitelist data. 3. The method according to claim 1, characterized in that, after receiving the access request sent by the user, before copying the information content of the access request to the content identification device comprises: judging whether the address requested by the access request is in the blacklist data or whitelist data, If the address is in the blacklist data, block or warn the user's access request; If the address is in the whitelist data, release the user's access request; If the address is not in the blacklist data and whitelist data, copy the information content of the access request to the content identification device. 4. A method for controlling user access, comprising: Receive the information content of the user access request sent by the gateway; The information content of the access request is the information content that can be identified by the content identification device after gateway protocol identification and protocol conversion, and the information content of the access request refers to the information content obtained from the network side according to the user's access request, The content identification device is a device capable of identifying and analyzing content including text, pictures or video on the network; According to the information content of the access request, obtain a judgment result including blacklist data or whitelist data of the address requested by the access request; sending the judgment result to the gateway, so that the gateway can update blacklist data or whitelist data according to the judgment result; According to the information content of the access request, obtaining the judgment result including putting the address requested by the access request into blacklist data or whitelist data includes: Analyze the information content of the access request, and obtain the analysis result according to the standard preset by the system, and then judge to include the address requested by the access request into the blacklist data or whitelist data according to the analysis result. 5. The method according to claim 4, further comprising: Crawl information content according to a pre-established crawling strategy, and the crawled information content is at least the information content of websites in the blacklist data or whitelist data; According to the crawled information content, obtaining a judgment result including including the address of the crawled information content in blacklist data or whitelist data; The judgment result is sent to the gateway, so that the gateway updates the blacklist data or whitelist data according to the judgment result. 6. A gateway, characterized in that, comprising: a receiving unit, configured to receive an access request sent by a user; a copying unit, configured to copy the information content of the access request to the content identification device, The information content of the access request is the information content that can be identified by the content identification device after protocol identification and protocol conversion, and the information content of the access request refers to the information content obtained from the network side according to the user's access request, so The content identification device is a device capable of identifying and analyzing content including text, pictures or videos on the network; An update unit, configured to update blacklist data or whitelist data according to the judgment result of the information content of the access request returned by the content recognition device; The judgment result is that the content recognition device analyzes the information content of the access request, obtains the analysis result according to the system preset standard, and then judges whether to include the address requested by the access request in the blacklist data or whitelist according to the obtained analysis result. list data. 7. The gateway according to claim 6, wherein the judgment result includes a result of including the address requested by the access request in the blacklist data or whitelist data. 8. The gateway according to claim 6, further comprising: a judging unit, configured to judge whether the address requested by the access request is in the blacklist data or whitelist data; If the address is in the blacklist data, block or warn the user's access request; If the address is in the whitelist data, release the user's access request; If the address is not in the blacklist data and whitelist data, copy the information content of the access request to the content identification device. 9. A content identification device, characterized in that it comprises: a receiving unit, configured to receive the information content of the user's access request sent by the gateway; The information content of the access request is the information content that can be identified by the content identification device after gateway protocol identification and protocol conversion, and the information content of the access request refers to the information content obtained from the network side according to the user's access request, The content identification device is a device capable of identifying and analyzing content including text, pictures or video on the network; The first identifying unit is configured to obtain a judgment result including blacklist data or whitelist data of the address requested by the access request according to the information content of the access request; A first sending unit, configured to send the judgment result to the gateway, so that the gateway can update blacklist data or whitelist data according to the judgment result; The content identification device is also used to analyze the information content of the access request, and obtain the analysis result according to the system preset standard, and then judge whether to include the address requested by the access request in the blacklist data or whitelist data according to the analysis result . 10. The content identification device of claim 9, further comprising: The crawling unit is used to actively crawl information content according to a pre-established crawling strategy, and the crawled information content is at least the information content of websites in the blacklist data and whitelist data; The second identification unit is used to obtain a judgment result including including the address of the crawled information content in blacklist data or whitelist data according to the crawled information content; The second sending unit is configured to send the judgment result to the gateway, so that the gateway can update blacklist data or whitelist data according to the judgment result. 11. A control system for user access, comprising: a gateway and a content identification device, The gateway is used to receive the access request sent by the user; copy the information content of the access request to the content identification device; The content identification device is used to receive the information content of the user access request sent by the gateway; the information content of the access request is the information content that can be identified by the content identification device after the protocol identification and protocol conversion of the gateway, and the The information content of the access request refers to the information content obtained from the network side according to the user's access request; according to the information content of the access request, obtaining includes blacklist data or whitelist data of the address requested by the access request the judgment result; sending the judgment result to the gateway, the content identification device is a device capable of identifying and analyzing text, pictures or video content on the network; The gateway is further configured to update the blacklist data or whitelist data according to the judgment result of the information content of the access request returned by the content recognition device; The content identification device is also used to analyze the information content of the access request, and obtain the analysis result according to the system preset standard, and then judge whether to include the address requested by the access request in the blacklist data or whitelist data according to the analysis result .