High-concurrency PKI certificate processing method and system

Abstract

The invention is applicable to the technical field of Internet of Things security, and relates to a high-concurrency PKI certificate processing method and system, a client sends a certificate application request to a registration mechanism module, and the registration mechanism module receives the application and generates a transaction identifier; the registration mechanism module calls an AI module to perform risk assessment on the application; the registration mechanism module packages the request content and sends the packaged request content to message-oriented middleware supporting asynchronous distribution, and the AI module analyzes the real-time flow to perform flow limiting judgment; the issuing mechanism module asynchronously pulls message queue data from the message middleware and verifies the message queue data; the AI module executes signing and issuing behavior analysis, and each module in the system records logs and constructs an auditable log chain; the issuing mechanism module transfers the abnormal message into a dead message queue, and the compensation center module processes the dead message queue; and the certificates which are signed and issued successfully / unsuccessfully are returned to the client, and the registration mechanism module archives the transaction. According to the method, the stability, the safety and the auditing performance of the system in a high-concurrency and complex environment are effectively improved.

Description

Technical Field

[0001] This invention belongs to the field of Internet of Things security technology, and in particular relates to a high-concurrency PKI certificate processing method and system. Background Technology

[0002] Existing PKI certificate processing systems generally employ synchronous communication between Registration Authorities (RAs) and Certificate Authorities (CAs). This approach suffers from performance bottlenecks under high concurrency scenarios. Node failures can lead to system blockage or request loss, failing to meet the high availability requirements of industries such as finance, power, and the Internet of Things. Furthermore, traditional PKI systems lack end-to-end transaction tracing capabilities, audit logs are easily tampered with, and there is a lack of systematic anomaly handling and compensation mechanisms, making it difficult to achieve recoverable and verifiable security guarantees.

[0003] Existing solutions have several shortcomings: Because the Registration Authority (RA) and the Issuing Authority (CA) use synchronous communication, the communication link becomes a major bottleneck when clients submit certificate requests concurrently, leading to response time delays and even request blocking, severely impacting system throughput and real-time performance. In the traditional synchronous architecture, if the CA processing node experiences network anomalies or crashes, currently processing certificate requests may be lost or suspended for extended periods, lacking automated fault detection and compensation mechanisms, resulting in low system availability. Furthermore, existing PKI systems fail to establish a unified transaction identifier for each certificate request, leading to inaccurate subsequent logs. The specific processing flow is affected, impacting the effectiveness of auditing, troubleshooting, and backtracking operations. Logs are typically scattered across different modules, lacking a structured anti-tampering mechanism, making them susceptible to human modification or loss, failing to meet the compliance requirements of "auditability and verifiability" in fields such as finance and power. In existing solutions, once issuance fails or processing times out, only manual intervention and retrying by operations and maintenance personnel are possible, lacking intelligent compensation logic and processing priority ranking, resulting in low efficiency and a high probability of errors. Most systems use static resource configuration, lacking the ability to predict certificate application traffic and automatic rate limiting mechanisms, making them prone to service degradation or denial of service under sudden traffic surges. All these reasons lead to low stability, security, and auditability of existing PKI systems.

[0004] Ensuring the stability, security, and auditability of a system under high concurrency and complex environments is a problem that urgently needs to be solved by researchers in this field. Summary of the Invention

[0005] To address the shortcomings of existing technologies, the purpose of this invention is to provide a high-concurrency PKI certificate processing method to solve the problems of low stability, security, and auditability of existing PKI systems under high concurrency and complex environments; in addition, this invention also provides a high-concurrency PKI certificate processing system.

[0006] To solve the above-mentioned technical problems, the present invention adopts the following technical solution:

[0007] In a first aspect, the present invention provides a high-concurrency PKI certificate processing method, comprising the following steps:

[0008] S10. The client sends a certificate application request to the registration authority module, and the registration authority module receives the certificate application request and generates a transaction identifier.

[0009] S20. The registration agency module calls the application anomaly detection model in the AI ​​module to conduct a risk assessment of this application.

[0010] S30. The registration agency module encapsulates the certificate application request content into a structured message object and sends the message object to a message middleware that supports asynchronous distribution. The rate limiting detection model in the AI ​​module analyzes the real-time traffic and makes a rate limiting judgment to determine whether the system should adjust the message sending rate or suspend message delivery.

[0011] S40. The issuing authority module asynchronously pulls message queue data from the message middleware and performs verification;

[0012] S50. The certificate issuance anomaly detection model in the AI ​​module performs certificate issuance behavior analysis, and each module in the system records logs and constructs an auditable log chain.

[0013] S60. The issuing agency module transfers abnormal messages to the dead letter queue. The compensation center module processes the dead letter queue. The compensation module periodically scans the dead letter queue and analyzes the compensation transactions through the AI ​​module. It allocates compensation priorities based on historical success rate, equipment importance, and fault type, and decides whether to automatically compensate.

[0014] S70. Whether the certificate is issued successfully or not, it is returned to the client. The registration authority module archives the transaction, and the audit module updates its status.

[0015] Furthermore, in S10, the parameters of the certificate application request include device identifier, public key information, application time, and purpose type.

[0016] Furthermore, in S20, the input to the application anomaly detection model in the AI ​​module includes the device identifier, public key information, application time, purpose type, and historical application frequency of the device in this application; the risk assessment results include low risk, medium risk, and high risk, where low risk directly proceeds to step S30; medium risk marks the application status as pending verification and enters the manual review process, if approved, proceeds to step S30, if rejected, the process is terminated and feedback is sent to the client; high risk rejects the application and sends a rejection result.

[0017] Furthermore, in S30, the structured message is in JSON or XML format, and the message middleware is Kafka, RabbitMQ, RocketMQ, ActiveMQ, or Pulsar.

[0018] Furthermore, the system obtains the current message sending rate, historical traffic model, and system load indicators from the registration agency module, and uses a time series prediction algorithm to predict the short-term traffic change trend. If the prediction result exceeds the threshold, the system will adjust the message sending rate or suspend message delivery through the rate limiting controller to prevent system overload.

[0019] Furthermore, in S50, the AI ​​module receives signing behavior data in real time, including application IP, device type, public key fingerprint, and frequency. Based on the trained model, it judges whether the signing behavior is abnormal. If the risk score is higher than the threshold, it triggers an audit module reminder or marks the result as pending verification.

[0020] Furthermore, the registration authority module, issuing authority module, message queue, and AI module all record log entries containing transaction IDs, and the audit module aggregates logs using transaction IDs as the primary index to construct a Merkle Tree summary structure.

[0021] Furthermore, in S60, abnormal messages include consumption failure, LDAP write error, certificate issuance error, or timeout.

[0022] Furthermore, the compensation mechanism of the compensation center module includes a dead-letter queue, transaction ID verification, and AI-driven automatic compensation.

[0023] Secondly, the present invention also provides a high-concurrency PKI certificate processing system, comprising:

[0024] The system comprises a registration agency module, an issuing agency module, an AI module, a compensation center module, and an audit module. The registration agency module communicates with the issuing agency module via a message middleware. The registration agency module also communicates with the AI ​​module and the audit module. The issuing agency module also communicates with the AI ​​module, the compensation center module, and the audit module. The AI ​​module also communicates with the audit module. The compensation center module also communicates with the AI ​​module and the audit module.

[0025] Compared with existing technologies, the high-concurrency PKI certificate processing method and system provided by this invention have at least the following advantages:

[0026] Existing PKI systems suffer from low stability, security, and auditability. This invention offers a simple and convenient process. The system employs a message middleware for asynchronous processing and uses a unified transaction ID to trace the entire process from request receipt to issuance. Anomaly recovery is achieved through dead-letter queues and compensation mechanisms, improving fault controllability and system stability. A Merkle Tree is introduced to construct an immutable audit log. Furthermore, an AI module is used for traffic prediction, application anomaly detection, issuance anomaly detection, and compensation scheduling optimization. This effectively improves the stability, security, and auditability of PKI systems in high-concurrency and complex environments, meeting the needs of millions of concurrent devices in industries such as IoT, finance, and power, and possessing broad engineering application value. Attached Figure Description

[0027] To more clearly illustrate the solutions of the present invention, a brief introduction will be given to the drawings used in the description of the embodiments below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0028] Figure 1 A flowchart illustrating a high-concurrency PKI certificate processing method provided in an embodiment of the present invention;

[0029] Figure 2 This is an architecture diagram of a high-concurrency PKI certificate processing system provided in an embodiment of the present invention. Detailed Implementation

[0030] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art. The terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the invention. For example, terms such as “length,” “width,” “upper,” “lower,” “left,” “right,” “front,” “rear,” “vertical,” “horizontal,” “top,” “bottom,” “inner,” and “outer” indicate orientations or positions based on the accompanying drawings and are for ease of description only, and should not be construed as limiting the technical solution. The terms “comprising” and “having,” and any variations thereof, in the specification, claims, and accompanying drawings of this invention, are intended to cover non-exclusive inclusion. The terms “first,” “second,” etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish different objects and not to describe a particular order. In the specification, claims, and accompanying drawings of this invention, when an element is referred to as “fixed to,” “mounted to,” “set on,” or “connected to” another element, it may be directly or indirectly located on that other element. For example, when an element is referred to as “connected to” another element, it may be directly or indirectly connected to that other element. Furthermore, the reference to "embodiment" herein means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of the invention. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0031] This invention provides a high-concurrency PKI certificate processing method, applicable to high-concurrency scenarios such as power, finance, and the Internet of Things, in application environments with high requirements for certificate processing availability, traceability, and fault tolerance. The high-concurrency PKI certificate processing method includes the following steps:

[0032] S10. The client sends a certificate application request to the registry module. The registry module receives the certificate application request and generates a transaction identifier. S20. The registry module calls the application anomaly detection model in the AI ​​module to perform a risk assessment on this application. S30. The registry module encapsulates the certificate application request content into a structured message object and sends the message object to a message middleware that supports asynchronous distribution. The rate limiting detection model in the AI ​​module analyzes the real-time traffic and performs rate limiting judgment to determine whether the system should adjust the message sending rate or suspend message delivery. S40. The issuing authority module asynchronously pulls message queue data from the message middleware and verifies it; S50. The certificate issuance anomaly detection model in the AI ​​module performs issuance behavior analysis, and each module in the system records logs and constructs an auditable log chain; S60. The issuing authority module transfers abnormal messages to a dead-letter queue, the compensation center module processes the dead-letter queue, the compensation module periodically scans the dead-letter queue, and the AI ​​module analyzes the transactions to be compensated, allocating compensation priorities based on historical success rate, device importance, and fault type, and deciding whether to automatically compensate; S70. Certificates that are successfully or unsuccessfully issued are returned to the client, the registration authority module archives the transaction, and the audit module updates its status. This invention effectively improves the stability, security, and auditability of the system in high-concurrency and complex environments.

[0033] To enable those skilled in the art to better understand the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings.

[0034] This invention provides a high-concurrency PKI certificate processing method, applicable to high-concurrency scenarios such as power, finance, and the Internet of Things, in application environments with high requirements for certificate processing availability, traceability, and fault tolerance. Figure 1 and Figure 2 In this embodiment, the high-concurrency PKI certificate processing method includes the following steps:

[0035] S10. The client initiates a certificate application. The client device (such as an electricity meter or terminal controller) sends a certificate application request to the Registration Authority (RA) module, which includes parameters such as device identifier, public key information, application time, and purpose type. The Registration Authority (RA) module receives the application and generates a transaction identifier. It generates a globally unique transaction ID for each application and binds the ID to all subsequent logs and messages of this process.

[0036] S20. The Registration Authority (RA) module calls the application anomaly detection model in the AI ​​module to conduct a risk assessment of this application.

[0037] Specifically, in this embodiment, an AI module is introduced for application anomaly detection, abnormal traffic prediction, issuance behavior analysis, and compensation priority determination, dynamically controlling the manual review, rate limiting module, and compensation scheduling process. The AI ​​module uses a time series prediction algorithm to predict changes in the request rate and provides dynamic adjustment parameters to the rate limiting controller. Model input may include fields such as device information, public key fingerprint, application time, and purpose type of the current application, as well as contextual data such as the historical application frequency of the device.

[0038] The following distinctions are made based on the scoring results thresholds: Normal (Low Risk): Proceed directly to the next step of message encapsulation. Suspicious (Medium Risk): The application status is marked as "Pending Verification," and the manual review process begins. After manual verification by the administrator, if approved, the following message encapsulation steps continue; if rejected, the process terminates, feedback is sent to the client, and the log status is updated. High Risk: The application is directly rejected, the rejection result is reported, the reason for rejection is recorded, the process ends, feedback is sent to the client, and the log status is updated.

[0039] S30, the Registration Authority (RA) module encapsulates the message and submits it to the message middleware. It encapsulates the request content into a structured message object, including the transaction ID, device information, certificate request, etc., and sends the message to the message middleware that supports asynchronous distribution.

[0040] In this embodiment, the message middleware can be Kafka, RabbitMQ, RocketMQ, ActiveMQ, Pulsar, etc., which has persistence capabilities, supports consumption retries and sequential consumption, and the structured messages can be in formats such as JSON and XML.

[0041] Furthermore, in this embodiment, the rate limiting detection model in the AI ​​module analyzes real-time traffic to make rate limiting judgments. It obtains the current message sending rate, historical traffic model and system load indicators from the Registry of Authorities (RA) module, and uses time series prediction algorithms (such as LSTM) to predict the short-term traffic change trend. If the prediction result exceeds the threshold, the system will adjust the message sending rate or suspend message delivery through the rate limiting controller to prevent system overload.

[0042] The S40 Certificate Authority (CA) module asynchronously pulls message queue data from the message middleware and performs operations such as authentication and public key verification. If the processing is successful, a digital certificate is generated and written to the enterprise LDAP directory or database; if the processing fails, the exception is captured and the result is reported.

[0043] In the S50 and AI modules, the certificate issuance anomaly detection model performs certificate issuance behavior analysis. The AI ​​module receives certificate issuance behavior data in real time (such as application IP, device type, public key fingerprint, frequency, etc.) and judges whether the certificate issuance behavior is abnormal based on the trained model. If the risk score is higher than the threshold, an audit reminder can be triggered or the result can be marked as pending verification.

[0044] Furthermore, each module in the system records logs and constructs an auditable log chain. The Registry of Authorities (RA), the Issuing Authority (CA), the message queue, and the AI ​​module all record log entries containing transaction IDs. The audit module aggregates logs using transaction IDs as the primary index and constructs a Merkle Tree summary structure. This summary is periodically written to a chained structure or blockchain storage system to ensure log integrity and immutability.

[0045] S60. The Certificate Authority (CA) module transfers abnormal messages to the dead-letter queue. If the Certificate Authority (CA) module fails to consume, LDAP writes abnormally, certificate issuance is abnormal, or timeout occurs, the Certificate Authority (CA) module will transfer the message to the dead-letter queue (DLQ) and save it as a message to be compensated.

[0046] Furthermore, in this embodiment, the compensation center module handles the dead-letter queue. The compensation center module periodically scans the dead-letter queue, analyzes the transactions to be compensated through the AI ​​module, allocates compensation priorities based on indicators such as historical success rate, equipment importance, and fault type, and decides whether to automatically compensate (resubmit the data to the original queue).

[0047] S70. The final result is written and archived. Successfully issued certificates are returned to the client, and information on failed issuances is also fed back to the client. The Registration Authority (RA) module archives the transaction, and the audit module updates its status.

[0048] In this embodiment, PKI stands for Public Key Infrastructure, a security service system based on public key cryptography technology. It ensures the security of network communication and data transmission through mechanisms such as digital certificate management, key exchange, and authentication. RA stands for Certificate Registrar, primarily used to receive, restrict, and review certificate requests from clients (such as electricity meters and terminal controllers). CA stands for Certificate Authority, primarily used to generate, issue, or revoke certificates. AI stands for Artificial Intelligence, used for traffic prediction, anomaly detection, and compensation scheduling optimization to achieve intelligent system control. DLQ stands for Dead Letter Queue, used to record abnormal issuance records for processing by the compensation center. LDAP stands for Lightweight Directory Access Protocol, an open, neutral, industry-standard application protocol that provides access control and maintains distributed information via the IP protocol, used to store certificate information. LSTM stands for Long Short-Term Memory, a special recurrent neural network architecture used to process and predict important events with very long intervals and delays in time-series data.

[0049] This invention also provides a high-concurrency PKI certificate processing system, combined with Figure 1 and Figure 2 In this embodiment, the high-concurrency PKI certificate processing system includes: a registration authority module, an issuing authority module, an AI module, a compensation center module, and an audit module. The registration authority module communicates with the issuing authority module through a message middleware. The registration authority module also communicates with the AI ​​module and the audit module respectively. The issuing authority module also communicates with the AI ​​module, the compensation center module, and the audit module respectively. The AI ​​module also communicates with the audit module. The compensation center module also communicates with the AI ​​module and the audit module respectively. The client sends a certificate application request to the registry module, which receives the application and generates a transaction identifier. The registry module then calls the application anomaly detection model in the AI ​​module to perform a risk assessment on the application. The registry module encapsulates the request content into a structured message object and sends the message to a message middleware that supports asynchronous distribution. The rate limiting detection model in the AI ​​module analyzes real-time traffic and makes a rate limiting judgment. The issuing authority module asynchronously pulls message queue data from the message middleware and verifies it. The certificate issuance anomaly detection model in the AI ​​module performs issuance behavior analysis. Each module in the system records logs and builds an auditable log chain. The issuing authority module transfers abnormal messages to a dead-letter queue, and the compensation center module processes the dead-letter queue. Certificates that are successfully or unsuccessfully issued are returned to the client. The registry module archives the transaction, and the audit module updates its status.

[0050] Compared with existing technologies, the high-concurrency PKI certificate processing method and system described in the above embodiments have lower stability, security, and auditability. This invention features a simple process and convenient operation. The system uses message middleware for asynchronous processing and achieves full traceability from request reception to issuance through a unified transaction ID. It utilizes dead-letter queues and compensation mechanisms to achieve anomaly recovery, improving fault controllability and system stability. A Merkle Tree is introduced to construct an immutable audit log. Simultaneously, an AI module is used for traffic prediction, application anomaly detection, issuance anomaly detection, and compensation scheduling optimization, effectively improving the stability, security, and auditability of the PKI system in high-concurrency and complex environments. It can meet the needs of millions of concurrent devices accessing scenarios in industries such as IoT, finance, and power, and has broad engineering application value.

[0051] Obviously, the embodiments described above are merely preferred embodiments of the present invention, and not all embodiments. The accompanying drawings illustrate preferred embodiments of the present invention, but do not limit the scope of the patent. The present invention can be implemented in many different forms; rather, these embodiments are provided to provide a more thorough and complete understanding of the disclosure of the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing specific embodiments, or make equivalent substitutions for some of the technical features. Any equivalent structures made using the content of this specification and drawings, directly or indirectly applied to other related technical fields, are similarly within the scope of patent protection of this invention.

Claims

1. A high-concurrency PKI certificate processing method, characterized in that, Includes the following steps: S10. The client sends a certificate application request to the registration authority module, and the registration authority module receives the certificate application request and generates a transaction identifier. S20. The registration agency module calls the application anomaly detection model in the AI ​​module to conduct a risk assessment of this application. S30. The registration agency module encapsulates the certificate application request content into a structured message object and sends the message object to a message middleware that supports asynchronous distribution. The rate limiting detection model in the AI ​​module analyzes the real-time traffic and makes a rate limiting judgment to determine whether the system should adjust the message sending rate or suspend message delivery. S40. The issuing authority module asynchronously pulls message queue data from the message middleware and performs verification; S50. The certificate issuance anomaly detection model in the AI ​​module performs certificate issuance behavior analysis, and each module in the system records logs and constructs an auditable log chain. S60. The issuing agency module transfers abnormal messages to the dead letter queue. The compensation center module processes the dead letter queue. The compensation module periodically scans the dead letter queue and analyzes the compensation transactions through the AI ​​module. It allocates compensation priorities based on historical success rate, equipment importance, and fault type, and decides whether to automatically compensate. S70. Whether the certificate is issued successfully or not, it is returned to the client. The registration authority module archives the transaction, and the audit module updates its status.

2. The high-concurrency PKI certificate processing method according to claim 1, characterized in that, In step S10, the parameters of the certificate application request include device identifier, public key information, application time, and purpose type.

3. The high-concurrency PKI certificate processing method according to claim 1, characterized in that, In step S20, the input to the application anomaly detection model in the AI ​​module includes the device identifier, public key information, application time, purpose type, and historical application frequency of the device for this application. The risk assessment results include low risk, medium risk, and high risk. If the risk is low, the application proceeds directly to step S30. If the risk is medium, the application status is marked as pending verification and the manual review process begins. If the application passes, the process proceeds to step S30. If the application is rejected, the process is terminated and feedback is sent to the client. If the risk is high, the application is rejected and the rejection result is sent back.

4. The high-concurrency PKI certificate processing method according to claim 1, characterized in that, In step S30, the structured message is in JSON or XML format, and the message middleware is Kafka, RabbitMQ, RocketMQ, ActiveMQ, or Pulsar.

5. The high-concurrency PKI certificate processing method according to claim 4, characterized in that, The system obtains the current message sending rate, historical traffic model, and system load indicators from the registration agency module, and uses a time series prediction algorithm to predict the short-term traffic change trend. If the prediction result exceeds the threshold, the system will adjust the message sending rate or suspend message delivery through the rate limiting controller to prevent system overload.

6. The high-concurrency PKI certificate processing method according to claim 1, characterized in that, In S50, the AI ​​module receives signing behavior data in real time, including application IP, device type, public key fingerprint, and frequency. Based on the trained model, it judges whether the signing behavior is abnormal. If the risk score is higher than the threshold, it triggers the audit module to remind or marks the result as pending verification.

7. A high-concurrency PKI certificate processing method according to claim 6, characterized in that, The registration authority module, issuing authority module, message queue, and AI module all record log entries containing transaction IDs. The audit module aggregates logs using transaction IDs as the primary index and constructs a Merkle Tree summary structure.

8. The high-concurrency PKI certificate processing method according to claim 1, characterized in that, In S60, abnormal messages include consumption failure, LDAP write error, certificate issuance error, or timeout.

9. A high-concurrency PKI certificate processing method according to claim 8, characterized in that, The compensation mechanism of the compensation center module includes dead-letter queue, transaction ID verification, and AI-driven automatic compensation.

10. A high-concurrency PKI certificate processing system, characterized in that, include: The module includes a registration authority module, an issuing authority module, an AI module, a compensation center module, and an audit module. The registration agency module communicates with the issuing agency module through a message middleware. The registration agency module also communicates with the AI ​​module and the audit module respectively. The issuing agency module also communicates with the AI ​​module, the compensation center module, and the audit module respectively. The AI ​​module also communicates with the audit module. The compensation center module also communicates with the AI ​​module and the audit module respectively.

Images