基于pki的证书撤销机制的研究-计算机应用技术专业论文.docxVIP

沈阳航空工业学院硕士学位论文摘要 沈阳航空工业学院硕士学位论文 摘要 公钥基础设旖(PKI)利用数字证书为网络安全交易提供基本保障。由于私钥泄露或 者证书所有者状态改变等原因，证书必须在其失效之前被废除。因此，需要建立一种撤 销证书的查询机制，以维护系统的安全运行。 本文介绍了当前PKI中的四种主要证书撤销机制(iE书撤销列表、在线查询机制、 证书撤销系统、证书撤销树)，并分析了各方案的优缺点，针对具体的PKI系统，给出了 一个选择证书撤销机制的参考方案。 证书撤销列表(cRL)是目前PKI系统中应用最广泛的一种证书撤销机制。基于CRL分 布点的思想，本文提出了一种基于分段的CRL改进方案。该方案缩短了用户查询证书的 响应时间，减少了删除一个到期的证书(或插入一个刚被撤销的证书)时，CRL中其它 撤销证书的平均移动次数。 证书撤销树是一种具有较好应用前景的证书撤销机制。与CRL相比，客户端下载代 价较小，cA和证书撤销库之间的更新少。本文提出了一个基于平衡二叉排序Hash树的 证书撤销解决方案，对于在线查询系统，该方案减少了证书状态查询中平均的比较次数， 降低了证书状态证明的通信成本。试验结果表明方案有效。 关键词： 公钥基础设施；证书；证书撤销列表；证书撤销树 沈阳航空工业学院硕士学位论文Abstract 沈阳航空工业学院硕士学位论文 Abstract PKI utilizes the digital certificate to provide basic guarantee for the network security transaction．Certificate must be revoked before the expiration time because of the private key’S exposure or the changes of the certificate owners’status，SO itS necessary to build an inquiry mechanism to maintain the safe running ofthe system． Four main certificate revocation mechanisms(including CRL，On-line inquiry mechanism，CRS，and CRT)are introduced；then some advantages and disadvantages ofevery scheme are analyzed；at last，a referenced scheme of choosing certificate revocation mechanism is proposed according to the concrete PKI system． CRL is a widespread-used certificate revocation mechanism in present PKI system． Based 011 the CRL distributed point idea,a new CRL scheme based on segment is given．This scheme shortens the user’s inquiry certificate corresponding time，decreases the average move times ofother revoked certificates in CRL when revoking a expiration certificate(or inserting ajust—revoked certificat曲． CRT is a kind of certificate revocation mechanism with brighter application prospect． The renewal between CA and repository is less and the cost of client side download is lower comparing to CRL．A certificate revocation scheme is put forward based on the balance binary tree sorting Hash tree at the end，this scheme reduces the average comparing times in certificate status’inquiry,lowers the