国家标准《PKI互操作性评估准则》提出了用于PKI服务系统和PKI应用系统的互操作性评估模型和互操作能力等级评估标准. 然而,如何使用该标准来设计和实现PKI互操作性检测工具、确定系统的互操作能力等级,仍存在不少问题. 本文总结了PKI互操作性检测工具(尤其对于PKI应用系统)的设计和实现中存在的问题,并提出了解决方案.
Interoperability problem has become one of the main obstacles to PKI deployment and usage. China has drafted the national standard PKI Interoperability Evaluation Criteria to evaluate the interoperability levels of PKI systems and PKI applications. However, there are still difficulties in design and implementation of an evaluation tool by following the national standard, especially in PKI applications. We analyze the problems in the design and implementation of PKI interoperability evaluation tool and propose the solutions to these problems.
[1] Cooper D, Santesson S, Farrell S W, et al. Internet X. 509 public key infrastructure certificate and certificate revocation list (CRL) profile [S]. RFC 5280. 2008.
[2] Myers M, Ankney R, Malpani A, et al. X. 509 internet public key infrastructure online certificate status protocol [S]. RFC 2560. 1999.
[3] Chokhani S, Ford W,Sabett R, et al. Internet X. 509 public key infrastructure certificate policy and certification practices framework [S]. RFC 3647. 2003.
[4] Polk W, Housley R, Bassham L. Algorithms and identifiers for the internet X. 509 public key infrastructure certificate and certificate revocation list (CRL) profile [S]. RFC 3279. 2002.
[5] Burr W, Dodson D, Nazario N, et al. Minimum interoperability specification for PKI components, version 1 [S]. 1998.
[6] Doyle P, Hanna S. Analysis of June 2003 survey on obstacles to PKI deployment and usage[S].2003.
[7] 荆继武, 马存庆, 林璟锵,等. 信息安全技术 公钥基础设施 PKI 互操作性评估准则 [S]. 2011.
