Risk-based decision-making for public key infrastructures using fuzzy logic

Abstract

Public key infrastructures (PKIs) are complex systems that are responsible for giving users enough information to make reasonable trust judgments about one another. The validation of public keys is hence of great importance. In general, validation of public keys is achieved by public-key certificates. However, in some circumstances certificates have to be revoked. Certificate revocation is generally achieved using Certificate Revocation Lists (CRLs) but the use of CRLs implicitly entails the risk of trusting a certificate that is not included in the list. This can be because the actual status of the certificate is unknown to the CA, or because the CRL is not updated. In this context, in this article we propose a fuzzy risk-based decision making system to assist any network user to make easier its decision-making process when using CRLs.