基于代理的隐私CA模型

身份证明是可信计算的基本特征，针对隐私CA可能成为证明过程的性能瓶颈且不存在合适的商业模型的问题，提出了一种基于代理的隐私CA模型，通过代理代替隐私CA签发身份证明证书和引入有效性证书，能有效降低隐私CA负载，提供更强的隐私保护能力，增强隐私CA的安全性，并在此基础上提出了对涉及的3类公钥证书进行撤销的有效方法。

Agents Based Model of Privacy Certification Authority

Users of trusted computing platform want their privacy preserved while communicating with one another. That is, the communication partners can only establish that the other end uses a genu-ine trusted platform module but not which particular one. Privacy CA was adopted by the trusted computing group in TPM Specification V1.1 to solve the problem by issuing Attestation Identity Cre-dentials for platforms. But Privacy CA may be the bottleneck of the authentication process and has no proper commercial model, because it must be concerned in every authentication of all platforms and be fully trusted by all other parties. In this paper a Privacy CA based on agents is presented. By authorizing agents to issue Attestation Identity Credentials, the new scheme can decrease the load of Privacy CA efficiently, provide better privacy and enhance the security of Privacy CA. Revocation mechanisms of public key credentials in the new scheme are also covered.