限制一台计算机访问网站
目前，我们在公共互联网上拥有一个 B2B 网站，全世界数以千计的经过身份验证的用户可以从任何地点访问该网站。我们希望每个用户只能从一台计算机访问该网站（出于安全和许可原因）。目前，我们在网站上使用 Java 小程序来获取用户的 MAC 地址，但它具有阻碍性，并且该值可能会被欺骗，因此我们希望放弃这种实现。
将网站的使用限制为单台计算机的最佳方法是什么？这是最好留给安全供应商的事情吗？我们是否需要让用户在他们的计算机上安装证书，或者是否有其他可用的解决方案？任何有关此主题的建议都将受到赞赏。谢谢。
更新：我们想要做的是为网站实现某种设备授权。我想我看到一些银行网站做了这种事情...有人知道可以采取什么方法来完成这样的功能吗？也许是虚拟令牌或其他一些多因素身份验证实现？
We currently have a B2B website available over the public internet that is accessed by thousands of authenticated users worldwide from any location. We would like it so each user can only access the website from one computer (for security and license reasons). We currently use a Java applet on the site that obtains the user's MAC address but it's obstructive and that value can be spoofed so we are looking to move away from this implementation.
What is the best way to limit usage of a website to a single computer? Is this something that's best left to a security vendor, do we need to have users install certificates on their machines or are there other solutions available? Any advise on this topic is appreciated. Thanks.
Update: What we would like to do is implement some kind of device authorization for the website. I thought I saw some banking websites do this kind of thing...does anyone by chance know what approaches can be taken it accomplish such functionality? Perhaps virtual tokens or some other multi-factor authentication implementation?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
不会有您喜欢的解决方案。
根据设计，网络浏览器对所在计算机的访问非常有限。本着“在互联网上没有人知道你是一只狗”的精神，你的一方永远无法了解另一端的太多信息。 IP 地址会受到 NAT 和其他欺骗的影响。 X.509 证书可以完美地从一台计算机移植到另一台计算机。
本质上，整个“网络”的概念模型不包括“计算机”。如果您是服务器，您会获得连接，并且您实际上可以问很少的问题。它们都不等于“给我一个唯一的令牌来识别另一端的计算机”。
There won't be a solution to this that you like.
By design, web browsers have very limited access to the containing computer. In the spirit of 'on the internet no one knows that you are a dog', your side can't ever find out much about the other end. The IP address is subject to NAT and other spoofing. An X.509 certificate is perfectly portable from one computer to another.
Essentially, the conceptual model of the entire 'web' does not include 'computers'. If you are a server, you get a connection, and you can ask it very few questions indeed. None of them amount to 'give me a unique token that identifies a computer on the other end'.