一种基于P2P共享下载模式的证书撤销机制

基于增量CRL证书撤销机制,提出了基于P2P共享下载模式的证书撤销机制。在Delta-CRL的发布周期内,CA发布Base-CRL和Delta-CRL,用户除初始化外,其他时刻只需下载Delta-CRL即可。当用户提出请求,通过洪泛机制查询相应节点和资源的信誉度记录,找到最优记录节点,建立P2P连接。然后,将下载的CRL模块在客户端重构以获得完整的CRL。与其他CRL相比,该方法能够有效减少CRL的下载尺寸,真正降低通信载荷以及系统的峰值请求率,提供更为及时的证书撤销信息。

Research on certificate revocation mechanism based on P2P shared download scheme

Based on Delta-CRL, the paper proposes a revocation scheme based P2P shared download mechanism. During the issuing period of Delta-CRL, CA issues Base-CRL and Delta-CRL. Users at the clients only need to download Delta-CRL except for initialization. When a user requires for download through flooding, it inquires the related node’s resource and node credit records. It finds out the right node and creates P2P connection. Thus total CRL will be obtained by reorganization in the clients. Comparing to other CRL schemes, the scheme can efficiently decrease the download size of CRL, lower the traffic load and release the average request frequency of the system. It will provide more timely certificate information.