基于P2P网络的Over-Issued CRL机制研究

摘要

目前关于公钥基础设施(public key infrastructure)中证书撤销问题的主要解决方案是使用X.509证书撤销列表(Certificare Revocation List)来定期发布证书状态信息.现有的发布机制存在CRL存储库峰值负荷过重,导致PKI部署成本过高的问题.通过对Over-Issued CRL模型和P2P技术的分析,给出一种基于P2P网络和Over-lssued CRL发布机制,它结合了上述两种技术的优点,有效降低了CRL存储库峰值负荷.%At present,the main solution scheme in public key infrastructure of certificate revocation problem is to use X.509 certificate revocation list. The existing methods have some problems such that peak load on CRL repository is too heavy to deploy a large-scale PKI with reasonable cost. By analyzing Over-Issued CRL model and P2P network, an approach to distribute CRL is given based on the above models. It combines the advantages of above two models, reduces the peak load of CRL repository effectively.