一種離線模式下CRL機(jī)制的改進(jìn)方案

本文分析了幾種主要的CRL 機(jī)制及OCSP 協(xié)議，并提出了一種離線模式下CRL 機(jī)制的改進(jìn)方案——基于P2P 分布式CRL 列表的證書撤消系統(tǒng)，此系統(tǒng)利用CRL 發(fā)布點(diǎn)技術(shù)與重疊發(fā)布增量 CRL 機(jī)制相結(jié)合的理念，在數(shù)據(jù)源上對(duì)傳統(tǒng)CRL 列表發(fā)布機(jī)制進(jìn)行了改進(jìn)。在機(jī)制中運(yùn)用P2P 技術(shù)實(shí)現(xiàn)了CRL 資源的共享，并將傳統(tǒng)的CRL 發(fā)布的C/S 體系結(jié)構(gòu)改進(jìn)成分散化的P2P 結(jié)構(gòu)，使整個(gè)網(wǎng)絡(luò)的信息流量分散化，這不僅降低了系統(tǒng)負(fù)荷而且還發(fā)揮了對(duì)等網(wǎng)中資源版本越多越有利于資源的發(fā)現(xiàn)和共享的特點(diǎn)，提高了用戶查詢CRL 列表的及時(shí)性，加強(qiáng)了CRL 列表的離線性能。經(jīng)實(shí)踐證明，方案具有較好的可行性。
關(guān)鍵詞：證書撤消列表；點(diǎn)對(duì)點(diǎn)技術(shù)；發(fā)布點(diǎn)
Abstract: In this paper we analyses existing CRL schemes and Online Certificate Status Protocol, then we describe an improved scheme of off-line CRLs—a distributed system for certificate revocation, based on peer-to-peer distribution of CRLs,this system has improved traditional CRL scheme in source data by distribution points together with Over-issued
Delta CRLs,Sharing CRLs can be realized in this system by peer-to-peer technology. This scheme has improved traditional client/server scheme to dispersive peer-to-peer scheme, and has dispersed information of the whole network. This scheme not only reduce the load on system but also exert characteristic of peer-to-peer technology, that is it have more resource more resource can be discovered and shared. This scheme has improved the timeless requirements and achieved good off-line functionary. By testing, this scheme has good feasibility.
Key words: CRL ;P2P;Distribution Point