A performance study of over-issuing delta-CRLS with distribution points

Abstract

Digital certificates have been used to prove the identities of entities. Due to different constraints, they are only valid within a specific time. Confronting many threats is an important reason why their validities must be terminated sooner than assigned. Therefore, a certificate revocation is essential. We present a new method of issuing certificate revocation lists (CRLs) by overissuing delta-CRL with distribution points. The combination of over-issuing segmented CRLs and delta-CRLs is used to distribute CRL segments over several directories. The results from the comparative analyzes show that the proposed certificate revocation method can significantly improve the system performance such as spreading out the request rate, and reducing the size of certification revocation information and the average network usage. It also highlights inefficiencies of the traditional method of distributing certificate status information using CRLs.