Current-limiting protection method and system based on source IP and token bucket mechanism

Abstract

The invention is suitable for the technical field of network security and flow control, and relates to a flow limiting protection method and system based on a source IP and a token bucket mechanism, and the method comprises the steps: a client / device initiates a certificate application or a revocation request; the identity recognition module analyzes the IP and API identity of an application source and outputs a unique identifier; the token bucket management module distributes independent token buckets and manages the token generation rate and the maximum token number; the current limiting decision module performs current limiting decision on the request according to the strategy configuration module, and judges whether the request passes or not according to the state of the token bucket; if the decision is passed, a PKI system interface is called through a PKI interface module, and the PKI system performs certificate application and certificate revocation operations; and if the decision is refused, recording a corresponding record log in the audit linkage module. According to the method, the security and the availability of the PKI system in a high-concurrency and attack scene are effectively improved.

Description

Technical Field

[0001] This invention belongs to the field of network security and traffic control technology, and in particular relates to a rate limiting protection method and system based on source IP and token bucket mechanism. Background Technology

[0002] With the rapid development of the Internet of Things (IoT), smart grids (such as Advanced Metering Infrastructure, AMI), Virtual Private Networks (VPNs), and the Industrial Internet, Public Key Infrastructure (PKI) systems, as core technologies for digital certificate management and identity authentication, play a crucial role in ensuring the security of device communication and the trustworthiness of data. PKI systems provide unique identifiers for devices through certificate application, issuance, and revocation, and are widely used in smart meters, sensors, gateways, VPN clients, and other scenarios. However, with the rapid growth in the number of connected devices (for example, the number of IoT devices is expected to exceed 50 billion by 2025), PKI systems face the challenge of high-concurrency requests, especially during certificate application and revocation operations. They are vulnerable to denial-of-service (DoS) attacks, mass forged requests, or malicious high-frequency requests, leading to system resource exhaustion, service unavailability, or security vulnerabilities.

[0003] In recent years, existing technologies have implemented API request rate limiting through flow control algorithms (such as token bucket and leaky bucket). For example, some cloud service providers use token bucket algorithms in their API gateways to limit request rates. However, these solutions are mostly general interface designs and lack customized optimizations for sensitive operations in PKI systems. Furthermore, existing technologies often rely on a single dimension for identity control (such as IP address or user ID), making it difficult to handle complex scenarios involving forged identities or multi-role devices. Rate limiting strategies are mostly statically configured, lacking dynamic adjustment capabilities to cope with real-time attack patterns. They also lack effective integration with PKI auditing systems, making it difficult to record the source and behavior of rate-limited requests, thus limiting attack tracing and blacklist generation capabilities. These factors contribute to the low security and availability of existing KPI systems. Patent CN113472796B provides a data center portal management method and system that obtains data center portal access information. When the access frequency of one or more IPs to the portal exceeds a preset threshold within a preset time period, an over-frequency alert is generated. The system displays the over-frequency alert or blocks IP addresses with access frequencies exceeding the preset threshold from logging into the portal. This patent also achieves data interaction only through the single dimension of IP address, which has the same drawbacks as existing technologies.

[0004] Therefore, how to improve the security and availability of PKI systems under high concurrency and attack scenarios is an urgent problem to be solved by researchers in this field. Summary of the Invention

[0005] To address the shortcomings of existing technologies, the purpose of this invention is to provide a rate limiting protection method based on source IP and token bucket mechanism, in order to solve the problem of low security and availability of PKI systems in high-concurrency and attack scenarios in existing technologies; in addition, this invention also provides a rate limiting protection system based on source IP and token bucket mechanism.

[0006] To solve the above-mentioned technical problems, the present invention adopts the following technical solution:

[0007] In a first aspect, the present invention provides a rate limiting protection method based on source IP and token bucket mechanism, comprising the following steps:

[0008] S10. The client initiates a certificate application or revocation request;

[0009] S20. The identity recognition module parses the IP and API identity of the application source in S10 and outputs a unique identifier;

[0010] S30, the token bucket management module allocates independent token buckets and manages the token generation rate and maximum number of tokens;

[0011] S40. The rate limiting decision module makes rate limiting decisions on requests based on the policy configuration module and determines whether a request should pass based on the token bucket status.

[0012] S50. If the decision is approved, the PKI system interface is called through the PKI interface module, and the PKI system performs certificate application and revocation operations; if the decision is rejected, the corresponding log is recorded in the audit linkage module.

[0013] Furthermore, it also includes S60: the audit linkage module generates a blacklist through the blacklist generation module to facilitate subsequent rate limiting.

[0014] Furthermore, in step S30, the token bucket state update formula is as follows:

[0015]

[0016] in, Let be the number of tokens available in the token bucket at time t; This represents the maximum capacity of the token bucket. r represents the number of tokens at the time of the last update; r is the token generation rate. The time difference between the current time and the last token update time, in seconds; To obtain the minimum value of the function.

[0017] Furthermore, the formula for dynamically adjusting the token generation speed is as follows:

[0018]

[0019] in, The rate at which tokens are generated is dynamically adjusted; For the frequency of historical requests; Maximum request frequency; For the previous token generation rate; An adjustment coefficient is used to control the rate at which tokens are generated.

[0020] Furthermore, in S40, the formula for the current limiting decision is as follows:

[0021]

[0022] in, To indicate whether request R is allowed to pass, True means pass and False means fail; This represents the number of tokens currently in the token bucket. The number of tokens required to process request R.

[0023] Furthermore, in S60, the formula for the blacklist generation threshold is as follows:

[0024]

[0025] in, This indicates whether to blacklist requests with identity I, with True indicating inclusion and False indicating exclusion; I represents the identity identifier; represents the number of requests made by identity I at time t; and is the blacklist threshold.

[0026] Secondly, the present invention also provides a rate limiting protection system based on source IP and token bucket mechanism, comprising:

[0027] Identity recognition module, token bucket management module, rate limiting decision module, policy configuration module, audit linkage module, PKI interface module;

[0028] The identity recognition module, token bucket management module, rate limiting decision module, and PKI interface module are sequentially connected in communication. The token bucket management module is also connected in communication with the policy configuration module, and the audit linkage module is also connected in communication with the rate limiting decision module.

[0029] Furthermore, it also includes a blacklist generation module, which is communicatively connected to the audit linkage module and the rate limiting decision module, respectively.

[0030] Furthermore, the PKI interface module also communicates with an external PKI system.

[0031] Furthermore, the audit linkage module also communicates with an external audit database.

[0032] The rate limiting protection method and system based on source IP and token bucket mechanism provided by this invention have at least the following advantages compared with the prior art:

[0033] Existing KPI systems suffer from low security and availability. This invention addresses these issues by combining two-factor authentication based on the source IP address and API caller identity, along with an application-layer token bucket algorithm. This provides fine-grained rate limiting protection for certificate application and revocation operations in Public Key Infrastructure (PKI) systems, resolving problems related to high-concurrency requests, denial-of-service (DoS) attacks, and resource exhaustion. This ensures system security and high availability in scenarios such as the Internet of Things (IoT), smart grids (e.g., power AMIs), and virtual private networks (VPNs). Attached Figure Description

[0034] To more clearly illustrate the solution of the present invention, a brief introduction will be given to the drawings used in the description of the embodiments below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0035] Figure 1 A flowchart illustrating a rate limiting protection method based on source IP and token bucket mechanism provided in an embodiment of the present invention;

[0036] Figure 2 This is a schematic diagram of a rate limiting protection system based on source IP and token bucket mechanism, provided for an embodiment of the present invention. Detailed Implementation

[0037] To facilitate understanding of the present invention, a more complete description will be given below with reference to the accompanying drawings. Preferred embodiments of the invention are shown in the drawings. However, the invention can be implemented in many different forms and is not limited to the embodiments described herein. Rather, these embodiments are provided to provide a thorough and complete understanding of the disclosure of the invention.

[0038] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. The terminology used herein in the description of the invention is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention.

[0039] This invention provides a rate limiting protection method based on source IP and token bucket mechanism, applied to the handling of high-concurrency requests and security threats encountered in certificate application and revocation operations in public key infrastructure (PKI) systems. The rate limiting protection method based on source IP and token bucket mechanism includes the following steps:

[0040] S10: The client initiates a certificate application or revocation request; S20: The identity recognition module parses the IP and API identity of the application source in S10 and outputs a unique identifier; S30: The token bucket management module allocates an independent token bucket and manages the token generation rate and maximum number of tokens; S40: The rate limiting decision module makes rate limiting decisions on the request based on the policy configuration module and determines whether the request is approved based on the token bucket status; S50: If the decision is approved, the PKI system interface is called through the PKI interface module, and the PKI system performs certificate application and revocation operations; if the decision is rejected, the corresponding log is recorded in the audit linkage module.

[0041] This invention effectively improves the security and availability of PKI systems under high concurrency and attack scenarios.

[0042] To enable those skilled in the art to better understand the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings.

[0043] This invention provides a rate limiting protection method based on source IP and token bucket mechanism, applied to the handling of high-concurrency requests and security threats faced by certificate application and revocation operations in public key infrastructure (PKI) systems. Figure 1 and Figure 2 In this embodiment, the rate limiting protection method based on source IP and token bucket mechanism includes the following steps:

[0044] S10. The client initiates a certificate application or revocation request.

[0045] S20: The identity recognition module parses the IP and API identity of the application source in S10 and outputs a unique identifier.

[0046] Specifically, in this embodiment, for example, the output is "0.0.0.0_user:web".

[0047] S30. The token bucket management module allocates independent token buckets and manages the token generation rate r and the maximum number of tokens. .

[0048] Specifically, in this embodiment, the number of currently available tokens is calculated to support handling burst traffic (such as high-frequency requests within a short period of time), ensuring that the system maintains a stable rate in high-concurrency scenarios (such as certificate applications and revocations by tens of millions of devices). The token bucket state update formula is as follows:

[0049]

[0050] in, Let be the number of tokens available in the token bucket at time t; This represents the maximum capacity of the token bucket. The number of tokens at the time of the last update; r is the token generation rate, in tokens per second; The time difference between the current time and the last token update time, in seconds; To obtain the minimum value of the function.

[0051] In this embodiment, the maximum capacity of the token bucket There are 100 tokens, and the token generation rate r is 20 tokens / second.

[0052] Furthermore, in this embodiment, the token generation rate is dynamically adjusted according to the actual situation, while ensuring that high-priority devices process the tokens as quickly as possible. The formula for dynamically adjusting the token generation speed is as follows:

[0053]

[0054] in, The rate at which tokens are generated is dynamically adjusted; For the frequency of historical requests; Maximum request frequency; For the previous token generation rate; An adjustment coefficient is used to control the rate at which tokens are generated.

[0055] In this embodiment, the frequency of historical requests 100 requests were made in the past minute.

[0056] S40, the rate limiting decision module makes rate limiting decisions on requests based on the policy configuration module, and determines whether a request is allowed based on the token bucket status, ensuring that system resources are not exhausted by high-frequency requests, preventing DoS attacks, and achieving precise control over certificate application and revocation requests.

[0057] Specifically, in this embodiment, the formula for the rate limiting decision is as follows:

[0058]

[0059] in, To indicate whether request R is allowed to pass, True means pass and False means fail; The number of tokens in the current token bucket is calculated using the formula in step S30; The number of tokens required to process request R.

[0060] In this embodiment, the number of tokens required to process request R The value is 1, meaning that each request consumes 1 token.

[0061] Furthermore, in this embodiment, if the request is approved, that is... Then update the token.

[0062] quantity:

[0063]

[0064] If the response is not met, a rate-limited response (such as HTTP 429 To Many Request) will be returned.

[0065] S50. If the decision is approved, the PKI system interface is called through the PKI interface module, and the PKI system performs certificate application and revocation operations; if the decision is rejected, the corresponding log is recorded in the audit linkage module.

[0066] The S60 audit linkage module generates a blacklist through the blacklist generation module to facilitate subsequent rate limiting. Based on audit data, it identifies malicious high-frequency requests, automatically generates blacklist policies, and blocks subsequent attacks. In practical application scenarios, it can effectively prevent batch requests with forged identities.

[0067] Specifically, in this embodiment, the formula for the blacklist generation threshold is as follows:

[0068]

[0069] in, This indicates whether to blacklist requests from user I. True means include, False means not include; I represents the user identifier; represents the number of requests from user I at time t; and is the blacklist threshold, which can be set according to actual needs.

[0070] In this embodiment, identity identifier I is an IP+API identity.

[0071] This invention also provides a rate limiting system based on source IP and token bucket mechanism, employing the rate limiting method based on source IP and token bucket mechanism described in the above embodiments. The system includes:

[0072] The system comprises an identity recognition module, a token bucket management module, a rate limiting decision module, a policy configuration module, an audit linkage module, a PKI interface module, and a blacklist generation module. These modules are sequentially connected. The token bucket management module also communicates with the policy configuration module. The audit linkage module also communicates with the rate limiting decision module. The blacklist generation module communicates with both the audit linkage module and the rate limiting decision module. The PKI interface module communicates with an external PKI system, and the audit linkage module communicates with an external audit database. The client / device initiates a certificate application. For both request and revocation requests, the identity recognition module parses the IP address and API identity of the request source and outputs a unique identifier. The token bucket management module allocates independent token buckets, manages the token generation rate and the maximum number of tokens, and the rate limiting decision module makes rate limiting decisions on requests based on the policy configuration module. It determines whether a request is approved based on the token bucket status. If the decision is approved, the PKI interface module calls the PKI system interface, and the PKI system performs certificate application and revocation operations. If the decision is rejected, the corresponding log is recorded in the audit linkage module. The audit linkage module generates a blacklist through the blacklist generation module for subsequent rate limiting.

[0073] The rate limiting protection method and system based on source IP and token bucket mechanism described in the above embodiments, compared with the existing technology, has lower security and availability of existing KPI systems. The present invention achieves fine-grained rate limiting protection for certificate application and revocation operations of public key infrastructure (PKI) systems by combining two-factor authentication of source IP address and API call identity, as well as application layer token bucket algorithm, thereby solving the problems of high-concurrency requests, denial-of-service (DoS) attacks and resource exhaustion, and ensuring the security and high availability of the system in scenarios such as Internet of Things (IoT), smart grid (such as power AMI), and virtual private network (VPN). Specifically, by combining the source IP address and API call identity (such as SCEP client ID, EST user credentials) to generate a unique identifier, and allocating an independent token bucket to each identifier, high-precision access control is achieved, accurately distinguishing between legitimate requests and malicious bulk requests (such as forged CSR or CRL requests). At the PKI system application layer, token bucket rate limiting is implemented in units of "certificates / second," optimizing for the semantic characteristics of certificate application and revocation operations, supporting burst traffic handling, and outperforming the coarse-grained control of traditional network layer protection. It supports dynamic adjustment of token generation rate and capacity based on real-time traffic patterns, attack behavior, or business needs, such as reducing the rate of abnormal IPs, ensuring system flexibility and resource allocation efficiency. Integration with the PKI audit system automatically records metadata (IP, API identity, request type, frequency) of rate-limited requests and generates blacklist policies, improving attack tracing and defense capabilities. By preventing resource exhaustion and blocking DoS attacks, it ensures the stability of the PKI system in high-concurrency scenarios (such as requests from tens of millions of IoT devices), applicable to industries such as power AMI, VPN, and IoT, promoting the large-scale deployment of secure communication technologies.

[0074] Obviously, the embodiments described above are merely preferred embodiments of the present invention, and not all embodiments. The accompanying drawings illustrate preferred embodiments of the present invention, but do not limit the scope of the patent. The present invention can be implemented in many different forms; rather, these embodiments are provided to provide a more thorough and complete understanding of the disclosure of the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing specific embodiments, or make equivalent substitutions for some of the technical features. Any equivalent structures made using the content of this specification and drawings, directly or indirectly applied to other related technical fields, are similarly within the scope of patent protection of this invention.

Claims

1. A rate limiting protection method based on source IP and token bucket mechanism, characterized in that, Includes the following steps: S10. The client initiates a certificate application or revocation request; S20. The identity recognition module parses the IP and API identity of the application source in S10 and outputs a unique identifier; S30, the token bucket management module allocates independent token buckets and manages the token generation rate and maximum number of tokens; S40. The rate limiting decision module makes rate limiting decisions on requests based on the policy configuration module and determines whether a request should pass based on the token bucket status. S50. If the decision is approved, the PKI system interface is called through the PKI interface module, and the PKI system performs certificate application and revocation operations; if the decision is rejected, the corresponding log is recorded in the audit linkage module.

2. The rate limiting protection method based on source IP and token bucket mechanism according to claim 1, characterized in that, It also includes S60: The audit linkage module generates a blacklist through the blacklist generation module to facilitate subsequent rate limiting.

3. The rate limiting protection method based on source IP and token bucket mechanism according to claim 1, characterized in that, In step S30, the token bucket state update formula is as follows: ； in, Let be the number of tokens available in the token bucket at time t; This represents the maximum capacity of the token bucket. r represents the number of tokens at the time of the last update; r is the token generation rate. The time difference between the current time and the last token update time, in seconds; To obtain the minimum value of the function.

4. The rate limiting protection method based on source IP and token bucket mechanism according to claim 3, characterized in that, The formula for dynamically adjusting the token generation speed is as follows: ； in, The rate at which tokens are generated is dynamically adjusted; For the frequency of historical requests; Maximum request frequency; For the previous token generation rate; An adjustment coefficient is used to control the rate at which tokens are generated.

5. The rate limiting protection method based on source IP and token bucket mechanism according to claim 1, characterized in that, In S40, the formula for the current limiting decision is as follows: ； in, To indicate whether request R is allowed to pass, True means pass and False means fail; This represents the number of tokens currently in the token bucket. The number of tokens required to process request R.

6. The rate limiting protection method based on source IP and token bucket mechanism according to claim 2, characterized in that, In step S60, the formula for the blacklist generation threshold is as follows: ； in, This indicates whether to blacklist requests with identity I, with True indicating inclusion and False indicating exclusion; I represents the identity identifier; represents the number of requests made by identity I at time t; and is the blacklist threshold.

7. A rate limiting protection system based on source IP and token bucket mechanism, characterized in that, include: Identity recognition module, token bucket management module, rate limiting decision module, policy configuration module, audit linkage module, PKI interface module; The identity recognition module, token bucket management module, rate limiting decision module, and PKI interface module are sequentially connected in communication. The token bucket management module is also connected in communication with the policy configuration module, and the audit linkage module is also connected in communication with the rate limiting decision module.

8. A rate limiting protection system based on source IP and token bucket mechanism according to claim 7, characterized in that, It also includes a blacklist generation module, which is communicatively connected to the audit linkage module and the rate limiting decision module.

9. A rate limiting protection system based on source IP and token bucket mechanism according to claim 7, characterized in that, The PKI interface module also communicates with an external PKI system.

10. A rate limiting protection system based on source IP and token bucket mechanism according to claim 7, characterized in that, The audit linkage module also communicates with an external audit database.

Images