【摘要】 目前关于公钥基础设施(public key infrastructure)中证书撤销问题的主要解决方案是使用X.509证书撤销列表(CRL)来定期发布证书状态信息;现有的发布机制主要针对提高处理时间,而对存储库性能的优化仍然存在一些问题———CRL存储库峰值负荷过大;通过对增量CRL和Over-Issued CRL模型的分析,给出了一种基于Over-Issued增量CRL机制的证书状态信息发布方法;它结合了上述两种模型的优点,通过改变Over-Issued CRL发布的时间间隔和增量CRL发布窗口大小,有效降低了存储库峰值负荷。更多还原

【Abstract】 At present,the main solution scheme in public key infrastructure of certificate revocation problem is to use X.509 certificate revocation list.Certificate revocation list is mainly used to distribute certificate status information in PKI systems.The existing methods put emphasis mainly on the improvement of processing time,but there are some unsolved problems such as how to optimize the repository performance——peak loads on the CRL repositories is too large.By analyzing the above model,an approach to distribute certificate status information is given based on Over-Issued delta CRL.It includes the advantages of above two models.By adjusting the time interval of the Over-Issued CRL distribution the peak loads on the repositories is reduced effectively.更多还原