【作者】 郑方伟；

【导师】 黄迪明；

【作者基本信息】 电子科技大学 ， 计算机应用技术， 2002， 硕士

【摘要】 随着Internet以及电子商务的发展，人们对信息安全的需要越来越迫切。基于公钥体制的PKI(Public Key Infrastructure，即公钥基础设施)技术可以为网络上的各种应用提供机密性、完整性、身份鉴别和抗抵赖的安全保障。PKI的核心就是证书，所以对证书进行有效的管理就是PKI的一个首要任务。证书的撤销和验证就是证书管理的重要内容之一。 传统的证书撤销和验证方式是利用CRL(Certificate Revocation List证书撤销列表)，这种方式存在一些弊端，基于CRL的一些新的方式虽然减轻了这些弊端带来的影响，但也无法彻底解决这个问题。在这个背景下，OCSP协议作为CRL方式的补充或替代而提出，它能为用户提供在线证书状态，同时，其请求响应模式也大大减少了网络负载。TongSEC是东方通科技的PKI安全产品，TongOCSP是作者为该项目开发的一个重要组成部分，其目的就是实现OCSP协议，并为用户提供编程接口，解决TongSEC中的证书验证问题，根据协议要求，TongOCSP可以划分为Requestor和Responder两大部份，但在TongOCSP的设计中作者增加了一个RSP程序来处理证书撤销库的管理，TongOCSP即为上述三部分组成。本文详细阐述了这三部分的设计并对实现过程作了具体的描述。更多还原

【Abstract】 Study and Implementation of OCSP and Certificate Revocation in PKI Master: Zheng Fangwei Tutor: Prof. Huang DimingWith the development of Internet and Electronic Commerce, there is a high demand for information security. The PKI technology based on public key can provide Confidentiality, Integrit}\ Authentication and Non_Repudiation for all kinds of Internet Application. Because the kernel of PKI is certificate, so, to manage certificate effectively is a chief task of management of certificate in PKI. the Revocation and Validation of certificate is one of the most important content.The traditional methods of Revocation and Validation of certificate is to use CRL ,but this method has its own weak points. Although some new methods based on CRL can alleviate the bad effect , they can’t do it thoroughly. In this background, the Online Certificate Status Protocol(OCSP) was introduced as a supplement or substitute of CRL. It not only can provide online certificate status,but also can lessen the burden of network. TongSEC is a PKI product of TongTech company, TongOCSP project was developed by me as a important part of TongSEC project. The aim of TongOCSP is to implement the OCSP protocol and to provide Programing Interface For end user. According to the protocol ,TongOCSP Was partitioned to two parts:Resquestor and Responder,but in the design of TongOCSP, I added a RSP program to manage the revoked certificate library, so ,TongOCSP is composed by the three parts mentioned just now. in this paper, I expatiated the design and implementation in detail.更多还原