摘要： 针对粤港两地政策法规未完全规范，以及两地数字证书认证机构(CA)在认证业务声明和证书策略两方面存在差异的问题，分析目前跨域公钥基础设施信任架构，提出一种针对当前两地政策法规未完全规范情况下的跨境认证解决方案。采用签名中转以及证书信任列表技术，构建两地CA互认支撑平台。实践结果证明，该方案适合于点对点的CA互认，为建设中国与上合组织、东盟、澳大利亚等国家和区域的跨境认证奠定了基础。
关键词:
证书策略,
跨境认证,
信任模型,
证书信任列表,
公钥密码学标准,
轻量级目录访问协议
Abstract: Comparing the differences of Guangdong’s Certification Authority(CA) and Hong Kong’s CA in Certificate Practice Statement(CPS) and Certificate Policy(CP), this paper analyses the current cross-domain Public Key Infrastructure(PKI) trust framework, resolves the problem about mutual authentication in the case of the policies and regulations of the two places not fully standardized by transferring the digital signature, and realizes the cross-border authentication by using Certificate Trust List(CTL) trust model. As practice shows, the scheme is suitable for mutual recognition of point-to-point CA and lays the foundations for the mutual authentication between China and other countries or areas such as Shanghai Cooperation Organization, Association of Southeast Asian Nations and Australia.
Key words:
certificate policy,
cross-border authentication,
trust model,
Certificate Trust List(CTL),
public-key cryptography standard,
lightweight directory access protocol
中图分类号:
王娟, 龙云. 粤港跨境数字证书认证技术研究[J]. 计算机工程, 2013, 39(3): 316-320.
WANG Juan, LONG Yun. Study on Digital Certificate Authentication Technology for Guangdong and Hong Kong Cross-border[J]. Computer Engineering, 2013, 39(3): 316-320.