JP2001305955A - Device and method for signing document - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an electronic signature to a data prepared by arbitrary application program. SOLUTION: When an electronic data prepared by an application 10 is inputted, a signature data producing part 20 adds a signature value and a signature certificate for certifying the signature value to the inputted electronic data and outputs it as an electric signature data. Information necessary for the electronic signature data including the signature certificate are stored in a certificate management part 30 beforehand, the signature value is created based on the stored information; and then the signature data creation part 20 adds the signature value and signature certificate to the electronic data. The electronic signature data with the added signature value and signature certificate is sent to a signature data verification part 40 and the signature value is verified by using the signature certificate added to the electronic data.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a document signing apparatus and a document signing method for digitally signing electronic data, and more particularly to a document signature for digitally signing electronic data created by an application program having no electronic signature function. The present invention relates to an apparatus and a document signing method.

[0002]

2. Description of the Related Art Conventionally, it is very effective to use a digital signature technique to detect data falsification and confirm the origin.

[0003]

However, since there are very few application programs that can apply a digital signature to created electronic data, it is necessary to use the digital signature technology even though it is effective. Often can not.

[0004] Therefore, for example, when approval is required for a document, the document is printed and sealed, and ledger management is performed, even though the document is created electronically. Has been done.

[0005] Such an action involves saving electronic data for editing and a printed document, and has a problem that the document must be double-managed.

[0006] In addition, when the electronic data for editing is deleted, if the document needs to be revised later, there is a problem that the electronic data must be newly created.

SUMMARY OF THE INVENTION The present invention has been made in view of the above-mentioned problems of the prior art, and provides a document signing method and a document signing method capable of applying a digital signature to data created by an arbitrary application program. It is intended to provide a device.

[0008]

According to the present invention, there is provided a document signing apparatus for digitally signing electronic data created by an arbitrary application program. Signature data generating means for generating digital signature data by giving a signature value to data; and storing information necessary for generating the digital signature data in advance, and adding the information to the electronic data based on the stored information. Certificate management means for generating a signature value to be generated, and signature data verification means for verifying the digital signature data generated by the signature data generation means, wherein the signature data generation means Electronic signature data is generated by adding the signature value generated by the means to the electronic data.

Further, the certificate management means stores in advance a signature certificate for certifying the signature value, and the signature data generation means attaches the signature certificate to the electronic data together with the signature value. It is characterized by the following.

Further, the signature data verifying means verifies the digital signature data using the signature certificate.

Further, the signature data verification means extracts the electronic data from the electronic signature data, outputs the electronic data to a corresponding application program, and activates the application program.

A document signing method for electronically signing electronic data created by an arbitrary application program, wherein a signature value is generated using signature information on a signature stored in advance, and the signature information and the signature value are generated. Is attached to the electronic data, and the signature value is verified using the signature information.

[0013] The electronic data having the signature value verified is output to a corresponding application program and the application program is started.

(Operation) In the present invention configured as described above, when electronic data such as a document created by an arbitrary application program is input, signature data is generated by the signature data generation means. A value and a signature certificate for certifying the signature value are added and output as electronic signature data. Here, information necessary for generating the digital signature data including the signature certificate is stored in the certificate management unit in advance, and a signature value is generated based on the stored information. , A signature value and a signature certificate are added to the electronic data.

The digital signature data to which the signature value and the signature certificate are assigned is sent to signature data verification means, and the signature value is verified using the signature certificate assigned to the electronic data.

As described above, with respect to electronic data created and stored by an arbitrary application program,
By adding a digital signature using a digital certificate,
An electronic signature function can be used even in an application program having no electronic signature function.

[0017]

Embodiments of the present invention will be described below with reference to the drawings.

(First Embodiment) FIG. 1 is a block diagram showing a first embodiment of the document signing apparatus of the present invention.

In this embodiment, as shown in FIG. 1, an application 10 for creating electronic data such as a document, and a signature data for generating electronic signature data by adding signature data to the electronic data created by the application 10. A generation unit 20, a certificate management unit 30 that stores information necessary for generating digital signature data and generates a signature value to be added to data generated by the application 10, and a signature data generation unit 20. And a signature data verification unit 40 for verifying the generated digital signature data. The data generated by the application 10 and the information stored in the certificate management unit 30 and the certificate management unit 3
Signature data generation unit 2 using the signature value generated at 0
At 0, digital signature data is generated.

The signature data generation unit 20 stores a data input unit 22 to which data created by the application 10 is input, and stores the data input through the data input unit 22 in the certificate management unit 30. Signature generation unit 21 for generating electronic signature data by adding the generated information and the signature value generated by certificate management unit 30, and signature data output for outputting the electronic signature data generated by signature generation unit 21 A part 23 is provided.

The certificate management unit 30 includes a certificate storage unit 32 storing a signature key required for generating a signature value, a signature certificate for certifying a signature, and other certificates. And a cryptographic processing unit 31 that generates a signature value using the signature key stored in the certificate storage unit 32. The signature key is stored together with the corresponding certificate, and the signature certificate for certifying the signature is stored so as to be distinguished from other certificates. The signature key may be stored as the signature key itself, or may be information that exists only in the encryption processing unit 31 and identifies the encryption key that cannot be extracted. Further, the signature key may be stored in a secure place of the encryption processing unit 31 in some cases.

The signature data verification unit 40 includes a signature data input unit 41 to which the digital signature data generated by the signature data generation unit 20 is input, and an electronic signature input through the signature data input unit 41. The data is analyzed, the validity of the electronic signature is verified, and if it is valid, the electronic signature data is extracted from the electronic signature data. And a data output unit 43 for outputting the data.

Hereinafter, a document signing method using the document signing device configured as described above will be described.

First, processing for generating and outputting digital signature data will be described.

FIG. 2 is a flowchart for explaining the process of generating and outputting digital signature data in the document signing device shown in FIG.

The electronic data created by the application 10 is transmitted to the signature data generator 20 by the data input unit 22.
(Step S1), first, the electronic data input to the signature data generation unit 20 is supplied to the certificate management unit 30 (step S2).

When the electronic data is supplied to the certificate management unit 30, the encryption processing unit 31 in the certificate management unit 30
A signature key and a signature certificate stored in the certificate storage unit 32,
In addition, another certificate required to verify the validity of the signature certificate is obtained (step S3). In addition,
In this embodiment, since the user uses only one signature value, only one signature key is stored in the certificate storage unit 32.

Next, the cryptographic processing unit 31 generates a signature value using the signature key obtained from the certificate storage unit 32 (step S4).

When the signature value is generated by the cryptographic processing unit 31, the generated signature value, the signature certificate acquired from the certificate storage unit 32, and other certificates are transmitted to the signature data generation unit 2.
0 (step S5).

When the signature value, signature certificate, and other certificates are supplied to the signature data generation unit 20, the signature generation unit 21 in the signature data generation unit 20 adds the electronic data created by the application 10 to the signature data. The signature value, the signature certificate, and other certificates are added to generate digital signature data (step S6).

The digital signature data generated by the signature generation unit 21 is output from the signature data output unit 23 (Step S7).

By the above-described series of processing, it becomes possible to apply an electronic signature to electronic data created by an application having no electronic signature function and to output the electronic data.

Next, a process for using the digital signature data output from the signature data generation unit 20 will be described.

FIG. 3 is a flowchart for explaining the verification processing of the digital signature data in the document signature apparatus shown in FIG.

When the digital signature data output from the signature data generation unit 20 is input to the signature data verification unit 40 via the signature data input unit 41 (step S11), the signature verification unit 42 in the signature data verification unit 40 In, the digital signature data input via the signature data input unit 41 is decomposed. (Step S12).

Next, the signature verification unit 42 verifies the validity of the signature value added to the digital signature data with reference to the signature certificate (step S13).

If the signature certificate is not a self-signed certificate, it is necessary to verify the signature certificate. The signature certificate is verified using the signature certificate and other necessary certificates (step S14).

Here, only when the necessary certificate is not included in the electronic signature data and when the certificate storage unit 32 is usable, another certificate is used to verify the signature certificate. It is obtained from the document storage unit 32.

Thereafter, the electronic data extracted from the electronic signature data when it is decomposed by the signature detecting unit 42 is output via the data output unit 43 (step S15).

By the above-described series of processes, an application having no electronic signature function can operate electronic data with an electronic signature.

(Second Embodiment) FIG. 4 is a block diagram showing a second embodiment of the document signing apparatus according to the present invention, and shows an embodiment accompanied by process activation.

As shown in FIG. 4, the present embodiment differs from the embodiment shown in FIG. 1 only in that a process starting unit 44 is provided.

The process activating unit 44 stores arbitrary data,
It stores the association of the application for operating the data, and starts the application,
The processing includes providing the electronic data output via the data output unit 43 or the information indicating the electronic data output destination to an application to be activated.

The document signing method according to the present embodiment will be described below. The processing when generating and outputting digital signature data is the same as that described in the first embodiment. Is omitted.

FIG. 5 is a flowchart for explaining the verification processing of the digital signature data in the document signature apparatus shown in FIG.

When the digital signature data output from the signature data generation unit 20 is input to the signature data verification unit 140 via the signature data input unit 41 (step S21), the signature verification unit 42 in the signature data verification unit 140 In, the digital signature data input via the signature data input unit 41 is decomposed. (Step S22).

Next, the validity of the signature value added to the electronic signature data is verified in the signature verification unit 42 with reference to the signature certificate (step S23).

If the signature certificate is not a self-signed certificate, it is necessary to verify the signature certificate. The signature certificate is verified using the signature certificate and other necessary certificates (step S24).

Here, if the required certificate is not included in the digital signature data and the certificate storage unit 32 is usable, another certificate is used to verify the signature certificate. It is obtained from the document storage unit 32.

Next, the data extracted from the digital signature data when disassembled by the signature detection unit 42 is transmitted via the data output unit 43 to a temporary data storage location managed by the OS or the like. Is output (step S25).

Thereafter, under the control of the process start unit 44, an application corresponding to the electronic data output via the data output unit 43 is started together with information indicating the storage location of the data (step S26).

After the application is started, the application reads the electronic data and operates.

(Third Embodiment) FIG. 6 is a block diagram showing a third embodiment of the document signing apparatus according to the present invention, in which a signature certificate and a signature key used for signature are specified. Is shown.

In this embodiment, since a plurality of signature keys and corresponding signature certificates are stored in the certificate storage unit 32, it is necessary to obtain signature information for designating the signature keys from the application 10.

As shown in FIG. 6, the present embodiment differs from the embodiment shown in FIG. 1 in that signature information is input in addition to the data input to the signature data generation unit 20 via the data input unit 22. Only differ. Here, the signature information is
This is key information used when the digital signature data is generated by the signature data generation device 30 and information for identifying the signature certificate.

In the certificate storage unit 32, a certificate is stored so that the signature certificate can be identified using the signature information.

The document signing method according to the present embodiment will be described below, but the verification processing of the digital signature data is the same as that described in the first embodiment, and a description thereof will be omitted.

FIG. 7 is a flow chart for explaining processing when digital signature data is generated and output by the document signature device shown in FIG.

When the electronic data created by the application 10 and the signature information for designating the signature are input to the signature data generator 20 via the data input unit 22 (step S31), first, the signature data is generated. Part 20
The electronic data and signature information input to the certificate management unit 3
0 (step S32).

When the data and the signature information are supplied to the certificate management unit 30, the encryption processing unit 31 in the certificate management unit 30 sends the signature key, the signature certificate, and the signature stored in the certificate storage unit 32. From other certificates required for verifying the validity of the certificate, a signature key and a signature certificate corresponding to the signature information and another certificate are obtained (step S33).

Next, the cryptographic processing unit 31 generates a signature value using the signature key obtained from the certificate storage unit 32 (step S34).

When the signature value is generated by the cryptographic processing unit 31, the generated signature value, the signature certificate acquired from the certificate storage unit 32, and other certificates are transmitted to the signature data generation unit 2.
0 (step S35).

When the signature value, the signature certificate, and other certificates are supplied to the signature data generation unit 20, the signature generation unit 21 in the signature data generation unit 20 converts the electronic data created by the application 10 into The digital signature data is generated by adding the signature value, the signature certificate, and other certificates (step S36).

The digital signature data generated by the signature generation unit 21 is output from the signature data output unit 23 (Step S37).

By the series of processes described above, it becomes possible to apply an electronic signature to electronic data created by an application having no electronic signature function and output the electronic data.

In the present embodiment, when a plurality of signature keys and signature certificates are stored in the certificate storage unit 32, different signature keys and signature certificates are used for each purpose of electronic signature. It is possible to do.

(Other Embodiments) As another embodiment, there is an embodiment in which the certificate management unit is converted to the function included in the platform.

When the platform for implementing the present invention has a device or a function corresponding to the certificate management unit 30 shown in FIG. 1, the function provided by the platform can be converted and used as the certificate management unit 30. If this is the case, it is possible to share a certificate and a signature key with a certificate using application other than the present invention.

[0069]

Since the present invention is configured as described above, an electronic signature function can be used for an application program having no electronic signature function for electronic data created by itself. This is applicable to all applications for creating or inputting data and the data. For example,
It can be applied to an executable load module file.

[Brief description of the drawings]

FIG. 1 is a block diagram showing a first embodiment of a document signature device according to the present invention.

FIG. 2 is a flowchart illustrating a process of generating and outputting digital signature data in the document signature device shown in FIG. 1;

FIG. 3 is a flowchart for explaining a process of verifying digital signature data in the document signature device shown in FIG. 1;

FIG. 4 is a block diagram showing a second embodiment of the document signature device of the present invention.

FIG. 5 is a flowchart illustrating a process of verifying digital signature data in the document signature device shown in FIG. 4;

FIG. 6 is a block diagram showing a third embodiment of the document signature device of the present invention.

FIG. 7 is a flowchart for explaining processing of generating and outputting digital signature data in the document signature device shown in FIG. 6;

[Explanation of symbols]

 Reference Signs List 10 application 20 signature data generation unit 21 signature generation unit 22 data input unit 23 signature data output unit 30 certificate management unit 31 encryption processing unit 32 certificate storage unit 40, 140 signature data verification unit 41 signature data input unit 42 signature verification unit 43 Data output unit 44 Process start unit

Claims (6)

[Claims] 1. A document signing device for electronically signing electronic data created by an arbitrary application program, wherein the electronic data is input and a signature value is added to the electronic data to generate electronic signature data. Signature data generating means, certificate management means for preliminarily storing information necessary for generating the digital signature data, and generating a signature value given to the electronic data based on the stored information; Signature data verification means for verifying the digital signature data generated by the data generation means, wherein the signature data generation means adds the signature value generated by the certificate management means to the electronic data A document signing device characterized by generating electronic signature data by using the method. 2. The document signing device according to claim 1, wherein the certificate management unit stores a signature certificate for certifying the signature value in advance, and the signature data generation unit stores the signature certificate together with the signature value. A document signature device, wherein the signature certificate is added to the electronic data. 3. The document signature apparatus according to claim 2, wherein the signature data verification unit verifies the electronic signature data using the signature certificate. 4. The document signature device according to claim 1, wherein the signature data verification unit extracts the electronic data from the electronic signature data, and converts the electronic data into a corresponding application program. A document signature device that outputs the document program and activates the application program. 5. A document signing method for electronically signing electronic data created by an arbitrary application program, wherein a signature value is generated using signature information on a signature stored in advance, and the signature information and the signature value are generated. A signature value is added to the electronic data, and a signature value is verified using the signature information. 6. The document signature method according to claim 5, wherein the electronic data whose signature value has been verified is output to a corresponding application program and the application program is started. Method.