基于CA缓存的快速公钥基础设施认证

Fast public key infrastructure authentication based on CA caching

公钥基础设施(PKI)通过公钥算法来实现身份认证和密钥交换,但由于其采用集中管理的模式,容易成为网络访问的瓶颈。为了解决PKI存在的效率问题,提出一种缓存认证模式。该模式结合了对称根密钥缓存和公钥证书缓存的优点,并将缓存认证扩展到认证中心(CA)与认证中心之间,以增加缓存信息的复用率。同时,通过引入改进的证书撤销列表(CRL)查询机制,提高CRL查询的效率。性能分析结果表明:与通用的X.509协议相比,CA缓存认证可以有效减少认证过程中的CRL查询及网络通信的次数。该认证模式在缓解PKI瓶颈问题的同时,较好地保证了认证的安全性和完整性。

Public key infrastructures （PKI） achieve authentication and key exchange by utilizing public key cryptography; however, the system＇s centralized models tend to be the bottleneck in the network. To improve PKI efficiency, a caching authentication model was developed. The model takes advantage of symmetric root key caching and public key certificates caching, with the caching authentication extended to among the certification authorities （CA） to increase re-usage of cached information. An improved certificate revocation list （CRL） look-up mechanism is introduced to enhance CRL look-up efficiency. Performance analyses show that, compared with the common X. 509 protocol, the CA caching authentication effectively reduces the CRL .look-up times and network communications in the authentication procedures. The authentication model eases bottlenecks for PKI frameworks, while guaranteeing authentication security and integrity.