Abstract: The cerhficate revocation mechanism is the key to the reliability 0f PKI. Aiming at two important elements influencing thevalidity of CRL, this article puts forward two methods: CRL caching service to reduce the global traffic caused by CRL verification; and CRLgrouping to cut down the size of CRL. Examples are given to explain how the haproved CRL mechanism works.

摘要： 证书撤销机制是影响PKI服务可靠度的关键因素之一。针对制约CRL机制有效性的两个要素，提出了两种改进方案：CRL缓存服务用于降低证书验证所引起的全局流量；CRL分组用于减小CRL的长度。并以一些实例说明了改进后的CRL机制的工作过程。

关键词: 公开密钥管理框架, X．509, 证书, 证书撤销, 证书撤销列表, 证书撤销列表分组

CLC Number: 

• TN918.1