Method for limiting number of users capable of being borne by service through private certificate

Abstract

The invention discloses a method for limiting the number of users capable of being borne by a service through a private certificate, and belongs to the technical field of computer network security and access control, and the method specifically comprises the following steps: S1, generating a private certificate: a certificate generator obtains host information and user demand parameters of service deployment, and carries out symmetric encryption to generate an encrypted private certificate; s2, service deployment and analysis: inputting the encrypted private certificate into a service system, decrypting the certificate by the service system, and analyzing to obtain host information and user demand parameters; initializing a user connection number threshold control module in the service system according to the number of bearable users; s3, user access control: the user terminal initiates a connection request to the service system, and the service system detects the current user connection number in real time and judges whether to access or not; according to the invention, through triple integration of certificate function extension, a dynamic control chain and authority automatic isolation, static authorization of a traditional intercom system is upgraded to a resource sensing type dynamic management and control system.

Description

Technical Field

[0001] This invention belongs to the field of computer network security and access control technology, and relates to a method for limiting the number of users that a private certificate service can support. Background Technology

[0002] In the field of service authorization management, existing technologies generally employ a method where a certificate generator issues standard certificates, the service system loads the certificates, and then indiscriminately opens up user access, allowing user terminals to directly connect to the service without any limit on the number of users. This method not only lacks functionality as the standard certificate is only used for basic identity authentication, but also suffers from host environment decoupling—that is, the certificate is completely decoupled from the deployment host—often leading to the certificate being copied and misused across multiple servers. Furthermore, existing technologies frequently encounter problems such as unlimited user terminal access, causing service overload and crashes.

[0003] Therefore, there is an urgent need to develop a method that integrates host binding, encryption restriction rules, and real-time control. Summary of the Invention

[0004] The purpose of this invention is to solve the problems in existing service authorization management, such as the lack of resource control due to the single function of certificates, the risk of abuse caused by the ability to copy certificates, and the service overload and crash caused by unlimited user access. Based on the technical path of binding encrypted certificates with the host environment, this invention constructs a dynamic quota control system that integrates host binding, encryption restriction rules and real-time control into a closed-loop authorization mechanism.

[0005] The technical solution adopted in this invention provides a method for limiting the number of users a service can support using a private certificate. The key point is that the method specifically includes:

[0006] S1. Generate private certificate: The certificate generator obtains the host information of the service deployment and user requirement parameters, including at least the number of users that can be supported and the certificate validity period. It uses a symmetric key to symmetrically encrypt the above host information and user requirement parameters to generate an encrypted private certificate.

[0007] S2. Service Deployment and Resolution: Input the above encrypted private certificate into the service system. The service system decrypts the certificate using the same symmetric key and resolves it to obtain host information and user requirement parameters. Based on the number of users that can be supported, initialize the user connection threshold control module in the service system.

[0008] S3. User Access Control: When a user terminal initiates a connection request to the service system, the service system monitors the current number of user connections in real time and determines whether the current number of user connections has reached the upper limit. If it has not reached the upper limit, new user terminals are allowed to access; if it has reached the upper limit, new user access is denied.

[0009] Specifically, the aforementioned user requirement parameters also include any one or a combination of service function permissions and geographical area restrictions.

[0010] Furthermore, in step S1, the symmetric encryption uses the AES-256 or the Chinese national standard SM4 algorithm, and the encryption process includes the physical fingerprint information of the service deployment host.

[0011] Furthermore, the specific operation of initializing the user connection count threshold control module in step S2 is as follows: create a user connection count variable in the service memory, set the initial value to 0, and set the parsed number of users that can be carried as the upper limit of the count variable.

[0012] Furthermore, the S2 step also includes the service system verifying whether the parsed host information matches the current operating environment. If they match, initialization is performed; if they do not match, the service is stopped and an alarm is issued.

[0013] Preferably, the above service system periodically executes a certificate validity period verification procedure during operation, and if the certificate expires, it actively stops the access function of the expired user.

[0014] Compared with the prior art, the present invention has the following advantages:

[0015] This invention upgrades the static authorization of traditional intercom systems into a resource-aware dynamic management and control system through the triple integration of certificate function expansion, dynamic control chain and automatic permission isolation. It not only solves the long-standing technical problems of no authentication, no restrictions and no isolation in the industry, but also provides a feasible technical paradigm for communication scenarios with high security requirements. Attached Figure Description

[0016] Figure 1 This is a framework diagram of the method of limiting the number of users a service can support using private certificates, as described in this invention. Detailed Implementation

[0017] Various exemplary embodiments of the present invention will now be described in detail. This detailed description should not be considered as a limitation of the present invention, but rather as a more detailed description of certain aspects, features, and embodiments of the present invention.

[0018] Various modifications and variations can be made to the specific embodiments described in this specification without departing from the scope or spirit of the invention, as will be apparent to those skilled in the art. Other embodiments derived from this specification will also be readily apparent to those skilled in the art. This specification and embodiments are merely exemplary.

[0019] The terms “include,” “including,” “have,” “contain,” etc., used in this article are all open-ended terms, meaning that they include but are not limited to.

[0020] Example

[0021] This embodiment discloses a method for limiting the number of users a service can support using a private certificate, specifically including:

[0022] S1. Generate a private certificate:

[0023] The certificate generator obtains the host information of the service deployment and user requirement parameters, including at least the number of users it can support and the certificate validity period. It then uses a symmetric key to symmetrically encrypt the host information and user requirement parameters to generate an encrypted private certificate.

[0024] User requirement parameters may also include any one or a combination of service function permissions and geographical area restrictions.

[0025] Symmetric encryption uses AES-256 or the Chinese national standard SM4 algorithm, and the encryption process includes the physical fingerprint information of the service deployment host.

[0026] S2, Service Deployment and Resolution:

[0027] The aforementioned encrypted private certificate is input into the service system. The service system decrypts the certificate using the same symmetric key to obtain host information and user requirement parameters. Based on the number of users that can be supported, the service system initializes a user connection threshold control module, which specifically includes:

[0028] Create a user connection count variable in the service memory, set the initial value to 0, and set the number of users that can be supported obtained by parsing as the upper limit of the count variable;

[0029] During service deployment and resolution, the service system verifies whether the host information obtained from the resolution matches the current operating environment. If they match, initialization is performed; otherwise, the service is stopped and an alarm is triggered.

[0030] S3, User Access Control:

[0031] The user terminal initiates a connection request to the service system. The service system monitors the current number of user connections in real time and determines whether the current number of user connections has reached the limit. If it has not reached the limit, the new user terminal is allowed to connect. If it has reached the limit, the new user access is denied.

[0032] In this embodiment, the service system periodically executes a certificate validity period verification procedure during operation. If the certificate expires, it will proactively stop the access function of the expired user.

[0033] Application Examples

[0034] This embodiment will provide an application scenario, such as a factory independently deploying an intercom system on a host machine. Using existing technologies, factory technicians may arbitrarily add the number of terminals and extend the service life.

[0035] The method for limiting the number of users a service can support using the private certificate of this invention specifically includes:

[0036] S1. Generate a private certificate:

[0037] The certificate generator obtains the host information for service deployment, as well as user requirement parameters including at least the number of users it can support and the certificate validity period. In this embodiment, the host information is the repeater hardware fingerprint information including the CPU serial number and the radio frequency module ID. The user requirement parameters specifically include:

[0038] (1) Number of terminals that can be supported: 300;

[0039] (2) The certificate is valid for one year;

[0040] (3) Access is restricted to channel 1;

[0041] Using the national cryptographic algorithm SM4, a private certificate is generated by encrypting the hardware fingerprint and permission parameters, and then embedded into the walkie-talkie terminal firmware.

[0042] S2, Service Deployment and Resolution:

[0043] The repeater decrypts the certificate to obtain the hardware fingerprint, terminal limit (i.e., 300), and permission group.

[0044] The CPU serial number in the certificate is compared with the repeater hardware. If they do not match, such as if the certificate has been copied to other repeaters, an audible and visual alarm is triggered and the system is locked. In this implementation, the comparison result is a match.

[0045] Based on the number of users that the system can support, the user connection threshold control module is initialized in the service system, specifically including:

[0046] Create a user connection count variable in the service memory, set the initial value to 0, and set the number of users that can be supported obtained by parsing to the upper limit of the count variable, that is, the upper limit of the count variable is 300.

[0047] S3, User Access Control:

[0048] When technician A initiates a connection request to the service system, the service system monitors the current number of user connections in real time and determines whether the current number of user connections has reached the limit. If it has not reached the limit, the new user terminal is allowed to access, a channel is allocated, and the counter is incremented by 1; if it has reached the limit, the new user access is rejected, and a busy tone signal is returned.

[0049] In this embodiment, the certificate validity period is checked daily, and terminals that have expired are automatically kicked out of the system.

[0050] The embodiments described above are merely preferred embodiments of the present invention and are not intended to limit the scope of the present invention. Various modifications and improvements made by those skilled in the art to the technical solutions of the present invention without departing from the spirit of the present invention should fall within the protection scope defined by the claims of the present invention.

Claims

1. A method for limiting the number of users a private certificate service can support, characterized in that, The method specifically includes: S1. Generate a private certificate: The certificate generator obtains the host information of the service deployment and user requirement parameters, including at least the number of users that can be supported and the certificate validity period. It uses a symmetric key to symmetrically encrypt the host information and user requirement parameters to generate an encrypted private certificate. S2. Service Deployment and Resolution: The encrypted private certificate is input into the service system. The service system decrypts the certificate using the same symmetric key and resolves it to obtain host information and user requirement parameters. Based on the number of users that can be supported, the user connection threshold control module is initialized in the service system. S3. User Access Control: When a user terminal initiates a connection request to the service system, the service system monitors the current number of user connections in real time and determines whether the current number of user connections has reached the upper limit. If it has not reached the upper limit, new user terminals are allowed to access; if it has reached the upper limit, new user access is denied.

2. The method for limiting the number of users a private certificate service can support according to claim 1, characterized in that, The user requirement parameters also include any one or a combination of service function permissions and geographical area restrictions.

3. The method for limiting the number of users a private certificate service can support according to claim 1, characterized in that, In step S1, symmetric encryption uses either AES-256 or the Chinese national standard SM4 algorithm, and the encryption process includes the physical fingerprint information of the service deployment host.

4. The method for limiting the number of users a private certificate service can support according to claim 1, characterized in that, The specific operation of initializing the user connection count threshold control module in step S2 is as follows: create a user connection count variable in the service memory, set the initial value to 0, and set the parsed number of users that can be carried as the upper limit of the count variable.

5. The method for limiting the number of users a private certificate service can support according to claim 1, characterized in that, Step S2 also includes the service system verifying whether the host information obtained from parsing matches the current operating environment. If they match, initialization is performed; otherwise, the service is stopped and an alarm is issued.

6. The method for limiting the number of users a private certificate service can support according to claim 1, characterized in that, The service system periodically executes a certificate validity verification procedure during operation. If a certificate expires, it will proactively stop the access function of the expired user.

Images