Distributed certificate verification method

Abstract

A distributed certificate verification method realized through the following steps, establishing a distributed checking server, configuring CA certificate, CRL address needed to be downloaded and downloading time, configuring system network, the distributed checking server automatically downloading from CA knowledge library and refreshing CRL in predetermined time or based on the time range stipulated in the CRL, in the terminal real application, revising connections for obtaining CRL redirecting them to the distributed checking server, the distributed checking server obtaining the corresponding CRL, the application unit proceeding certificate checking by using the CRL obtained from the distributed checking server.

Description

technical field [0001] The invention relates to a digital certificate authentication method, in particular to a distributed certificate authentication method. It belongs to the field of IT information security. Background technique [0002] With the rapid development of information technology today, network digital security has become an increasingly important and unavoidable network technology topic; PKI technology (public key infrastructure) is the core component of basic network security. In the PKI system, verifying digital The identity of the certificate holder is a very frequently used application in the PKI system, which can identify the user's identity in the network. [0003] The process of the application system verifying the identity of the digital certificate holder is actually verifying the digital certificate and the digital signature of the certificate. The principle and process of verifying the digital signature are described in detail in the PKCS1 and PKCS7...

AI Technical Summary

Problems solved by technology

[0007] 3. Confirm that the certificate serial number of the user certificate is not in the CRL (certificate revocation list) issued by the CA center (digital certificate certification center);

[0009] In the PKI system, the application of certificates is extremely extensive, and each end entity that uses a certificate has the need to verify the validity of the certificate. For end entities in the same local area network, the network between the public knowledge base of the CA The traffic is undoubtedly relatively large. If there is not enough bandwidth between a local area network and the public network, it will greatly affect the response speed of the application system and reduce system performance; moreover, for those who have strict requirements on network security and confidentiality General office PCs are not allowed to connect to the Internet, such as government internal networks, public security networks and other local area networks, which makes it difficult to deploy PKI systems on these local area networks

Images