JP2007104022A - Time stamp verification system, time stamp verification station apparatus, and time stamp verification method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a system or the like capable of eliminating the need for a client apparatus to take a measure for time stamp verification such as storage of verification information in advance and preventing an electronic signature and a time stamp acquired in the past from being not verifiable. <P>SOLUTION: The client apparatus 200 extracts an electronic certificate associated with an electronic signature and/or an electronic certificate associated with a time stamp applied to verification object data issued by an authentication agency apparatus 500 to generate a verification information issue request. A time stamp verification station apparatus 100 transmits an electronic certificate associated with the collated electronic signature and/or an electronic certificate associated with the collated time stamp, an electronic certificate of the authentication agency apparatus 500 existing in an authentication path of the electronic certificates above, and a verification information issue acknowledgement including expired electronic certificate and time stamp to the client apparatus 200. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to a time stamp verification system, a time stamp verification station apparatus, and a time stamp verification method.

  Conventionally, there are the following two methods for verifying an electronic signature or a time stamp attached to electronic data at an arbitrary time point.

(Method 1)
When acquiring an electronic signature and a time stamp, first, an electronic signature and a time stamp are assigned to the verification target data, and an electronic certificate related to the electronic signature and the time stamp is stored. Then, the digital certificate of the certificate authority existing in the certification path of the digital certificate related to the digital signature and the time stamp is stored. After the next day (after the revocation information is updated), the user saves the revocation information of the electronic certificate and the time stamp, and adds a time stamp to the revocation information acquired at that time.

The procedure at the time of verification in Method 1 is to first verify the electronic signature and time stamp using the following three types of information stored in advance.
1) An electronic certificate related to an electronic signature and a time stamp 2) An electronic certificate of a certificate authority existing in a certification path of an electronic signature related to the electronic signature and the time stamp 3) Revocation information of the electronic certificate and the time stamp The revocation information is information indicating that the electronic certificate and the TSA (Time-Stamping Authority) certificate were valid when the electronic signature and time stamp were given. In addition, a type stamp is issued when revocation information is acquired.

  Then, at the time of verification, the time stamp when the revocation information is acquired is verified, and the validity of the information 1 to 3 used for the verification is verified and the verification result is shown.

(Method 2)
When an electronic signature and a time stamp are added to electronic data and then verified, first, the verification authority is requested to verify the electronic signature and the time stamp. The verification station determines whether or not verification is possible within the server device, executes verification if verification is possible, and requests verification from the stamp issuer device if verification is not possible. Then, the verification result data is returned to the client from the verification station (see Patent Document 1).

JP 2005-20651 A

  When verifying an electronic signature or time stamp attached to electronic data at an arbitrary time point, it will be possible to confirm through the storage period that the electronic signature is in the same state as when the electronic signature was made. It is necessary to take measures in advance. For example, the date and time when the electronic signature was made can be specified, and the following information is acquired within the validity period of the electronic certificate related to the electronic signature and before it has expired, and a time stamp is attached to the information. There is a need for a method for storing the information in a state where it is possible to confirm the date and time when the information was acquired and that no change has been made.

  However, in the method 1 described above, if the user has all the necessary three pieces of stored information, the validity of the information used for the verification can be proved together with the verification result. However, the acquired information is cumbersome to manage. In addition, since it is said that the revocation information needs to be obtained after the next day of the electronic signature or time stamp, there are many cases where omission and storage omission occur. For this reason, there is a problem that if any information has an acquisition failure, the electronic signature or the time stamp cannot be verified.

  On the other hand, the method 2 described above has a problem that the client can acquire only the verification result, and cannot fully demonstrate the validity of the information used for the verification. Further, there is a problem that the reliability of the verification authority cannot be completely proved, and when the verification authority no longer exists, the electronic signature and the time stamp cannot be verified.

  In addition, it is necessary to prepare an Internet connection environment for this information and collect information via the Internet, and there is a concern that customer information may leak out in environments that handle particularly important customer data such as financial institutions and insurance companies. It had been. That is, since both conventional methods 1 and 2 perform information communication via the Internet, it is necessary to install a router or a firewall in order to prevent entry into the company network, and communication data passes through the Internet network. Therefore, there is a problem that the possibility of information leakage cannot be denied. Therefore, there is a problem that it is difficult to use strict information for confidential management.

  The present invention has been made in view of the above problems, and by providing the above information at the time of verification, it is not necessary to take such measures in advance, and electronic signatures and time stamps acquired in the past can be verified. To provide a time stamp verification system, a time stamp verification authority apparatus, and a time stamp verification method capable of preventing electronic information from being lost and verifying an electronic signature and giving / verifying a time stamp without worrying about leakage of customer information. It is intended.

  In order to solve the above-described problems and achieve the object, the present invention provides a time stamp configured by connecting a time stamp verification authority device, a client device, and a certificate authority device through a network so that they can communicate with each other. In the verification system, the client device is included in an electronic certificate related to an electronic signature issued by the certificate authority device and / or an electronic certificate related to a time stamp for the verification target data, or an electronic certificate of the target A verification information issuance request creating means for creating a verification information issuance request including a verification information list including an institution key identifier and a CRL distribution point, and the verification information issuance request created by the verification information issuance request creation means is the time A verification information issuance request transmission means for transmitting to the stamp verification authority apparatus, the time stamp verification authority apparatus, A verification information issue request receiving means for receiving the verification information issue request from the client device, and an electronic certificate relating to the electronic signature corresponding to the verification information issue request received by the verification information issue request receiving means, and / or The electronic certificate related to the time stamp, the electronic certificate of the certificate authority device existing in the certification path of the electronic certificate, and the revocation information of the electronic certificate and the time stamp are stored in the time stamp verification authority device. The verification information file to be managed is collated to check whether it exists, and if it does not exist, the corresponding certificate authority device is collated, and the electronic certificate related to the digital signature collated by the collating unit and / or Or the electronic certificate related to the time stamp, the electronic certificate of the certificate authority device present in the certification path of the electronic certificate, and the above Digital certificates and the verification information issuing response including the revocation information of the time stamp, comprising the, the verification information issuing response means for transmitting to said client device.

  Further, the present invention provides the time stamp verification system, wherein the time stamp verification authority device includes the electronic certificate related to the electronic signature and / or the electronic certificate related to the time stamp and the authentication of the electronic certificate. Information collection for periodically collecting the electronic certificate of the certificate authority device existing in the path and the revocation information of the electronic certificate and the time stamp from the certificate authority device and storing them in the information file for verification Means.

  The time stamp verification system may further include a time stamp authority device connected to the time stamp verification authority device via the network, and the time stamp verification authority device may include the verification information. Time stamp acquisition means for acquiring a time stamp from the time stamp authority device for individual or whole information transmitted by the issue response means, and the verification information issue response means is the time stamp acquisition means. The acquired time stamp is also transmitted to the client device together.

  In the time stamp verification system according to the present invention, the network connecting the client device and the time stamp verification station device is a dedicated line or a non-Internet communication network.

  Further, the present invention is a time stamp verification authority apparatus in a time stamp verification system configured by connecting a time stamp verification authority apparatus, a client apparatus, and a certificate authority apparatus through a network, An electronic certificate related to an electronic signature issued by the certificate authority device and / or an electronic certificate related to a time stamp, or an authority key identifier and a CRL included in the target electronic certificate from the client device to the verification target data A verification information issue request receiving means for receiving a verification information issue request including a verification information list including distribution points; and an electronic certificate relating to the electronic signature corresponding to the verification information issue request received by the verification information issue request receiving means Certificate and / or electronic certificate related to the above time stamp and certification path of the electronic certificate Check whether the certificate authority device's existing electronic certificate and the revocation information of the electronic certificate and the time stamp exist in the verification information file managed by the time stamp verification authority device. Verification means for verifying the corresponding certificate authority device, the electronic certificate related to the electronic signature and / or the electronic certificate related to the time stamp verified by the verification means, and the authentication path of the electronic certificate And a verification information issuance response means for transmitting a verification information issuance response including the electronic certificate and the revocation information of the time stamp to the client device. Features.

  Further, the present invention provides the time stamp verification authority apparatus, wherein the electronic certificate related to the electronic signature and / or the electronic certificate related to the time stamp and the certificate authority present in the certification path of the electronic certificate. Further comprising information collecting means for periodically collecting the electronic certificate of the device and the revocation information of the electronic certificate and the time stamp from the certificate authority device and storing the information in the verification information file. It is characterized by.

  The present invention further includes a time stamp acquisition means for acquiring a time stamp from the time stamp authority apparatus for each or all pieces of information transmitted by the verification information issue response means in the time stamp verification authority apparatus. And the verification information issue response means transmits the time stamp acquired by the time stamp acquisition means together to the client device.

  The present invention also relates to a time stamp verification method using a time stamp verification system configured by connecting a time stamp verification authority device, a client device, and a certificate authority device through a network so that they can communicate with each other. In the client device, for the verification target data, the electronic certificate related to the electronic signature issued by the certificate authority device and / or the electronic certificate related to the time stamp, or the authority key identifier included in the target electronic certificate and A verification information issuance request creation step for creating a verification information issuance request including a verification information list including a CRL distribution point; and, in the client device, the verification information issuance request created in the verification information issuance request creation step is the time A verification information issuance request transmission step to be transmitted to the stamp verification authority device; In the time stamp verification authority apparatus, the verification information issue request receiving step for receiving the verification information issue request from the client apparatus; and in the time stamp verification authority apparatus, the verification information received in the verification information issue request reception step. The electronic certificate related to the electronic signature corresponding to the issue request and / or the electronic certificate related to the time stamp, the electronic certificate of the certification authority device existing in the certification path of the electronic certificate, and the electronic certificate And a verification step for verifying whether or not the revocation information of the time stamp exists in a verification information file managed by the time stamp verification authority device, and in the case where it does not exist, the corresponding authentication authority device is verified, and the time In the stamp verification authority device, the electronic signature related to the verification performed in the verification step Including a sub-certificate and / or an electronic certificate related to the time stamp, an electronic certificate of the certificate authority device existing in a certification path of the electronic certificate, and the revocation information of the electronic certificate and the time stamp A verification information issue response step of transmitting a verification information issue response to the client device.

  Further, the present invention provides the time stamp verification method, wherein the time stamp verification authority apparatus uses the electronic certificate related to the electronic signature and / or the electronic certificate related to the time stamp and the authentication of the electronic certificate. Information collection for periodically collecting the electronic certificate of the certificate authority device existing in the path and the revocation information of the electronic certificate and the time stamp from the certificate authority device and storing them in the information file for verification The method further includes a step.

  In the time stamp verification method, the present invention acquires a time stamp from the time stamp authority device for each or all of the information transmitted in the verification information issue response step in the time stamp verification authority device. The verification information issuance response step further includes transmitting the time stamp acquired in the time stamp acquisition step to the client device.

  In the time stamp verification method, the present invention is characterized in that the network connecting the client device and the time stamp verification station device is a dedicated line or a non-Internet communication network.

  As described above in detail, according to the present invention, an electronic certificate related to an electronic signature issued by the certificate authority device 500 and / or an electronic certificate related to a time stamp for the verification target data from the client device is stored from the storage device. Extract, create a verification information issue request, send it to the time stamp verification authority device, and receive a verification information issue response from the time stamp verification authority device. By providing the verification information at the time of verification, the client device side A time stamp verification system, a time stamp verification authority device, and a time stamp verification method that eliminate the need to take measures such as storing verification information in advance and prevent a digital signature or time stamp acquired in the past from being unable to be verified. Can be provided. In addition, it is possible to verify an electronic signature and attach / verify a time stamp without worrying about leakage of customer information.

  In addition, since the verification method described in Patent Document 1 can only acquire verification result data created by the server device, it can completely indicate the validity of the information used for verification, whether the verification result is reliable. In addition, it is impossible to prove completely whether the verification authority itself can be trusted. On the other hand, according to the present invention, instead of returning verification result data as a response, as the information required for verification, each certificate authority provides an electronic certificate and revocation information publicly issued. Of course, signature verification and time stamp verification performed using this information will give reliable results. Furthermore, in the present invention, since the time stamp for performing the existence proof and non-falsification proof of the information can be given, the information becomes more reliable.

  In addition, according to the present invention, the time stamp verification authority apparatus periodically collects and stores electronic certificates and revocation information in advance, so that in the future, the client apparatus will be required to request past electronic certificates and revocation information. A time stamp verification system, a time stamp verification station apparatus, and a time stamp verification method can be provided.

  According to the present invention, the network connecting the client device and the time stamp verification station device uses a dedicated line or a non-Internet communication network, so the client device acquires and verifies the time stamp without connecting to the Internet. A time stamp verification system, a time stamp verification authority apparatus, and a time stamp verification method can be provided.

  Embodiments of a time stamp verification system, a time stamp verification station apparatus, and a time stamp verification method according to the present invention will be described below in detail with reference to the drawings. Note that the present invention is not limited to the embodiments.

[Outline of this system]
Hereinafter, an outline of the system will be described, and then the configuration and processing of the system will be described in detail. FIG. 1 is a block diagram showing an example of the overall configuration of the present system, and conceptually shows only the portion related to the present invention in the system configuration.

  The system schematically includes a time stamp verification authority device 100 that performs verification of time stamp information, a client device 200 that manages data to be verified, a time stamp authority device 400 that issues a time stamp, and an electronic certificate. Is connected to a certificate authority device 500 that issues a certificate via the network 300.

  This system generally has the following basic features: First, the client device 200 extracts, from the storage device, an electronic certificate related to an electronic signature issued by the certificate authority device 500 and / or an electronic certificate related to a time stamp for the verification target data, and creates a verification information issue request. (Step S1).

  Here, FIG. 6 is a diagram showing an example of the data content of the electronic certificate related to the time stamp. As shown in FIG. 6, the electronic certificate related to the time stamp has a unique version, serial number, issuer (certificate authority), validity period, subject, subject key identifier, key information (public key), and certification authority, for example. And a data item consisting of a certificate authority key identifier for identification, a certificate revocation list (CRL) distribution point (such as a URL), and a signature of the issuing certificate authority.

  FIG. 7 is a diagram illustrating an example of data contents of an electronic certificate related to an electronic signature. As shown in FIG. 7, an electronic certificate related to an electronic signature includes, for example, a version, a serial number, an issuer (certificate authority), a validity period, a subject, key information (public key), an authentication key identifier, a CRL distribution point, And a data item including a signature of the issuing certificate authority.

  Returning to FIG. 1 again, the client apparatus 200 extracts the “institution key identifier” and the “CRL distribution point” included in the electronic certificate in the verification target data, creates a verification information list, and creates the verification information list. A verification information issuance request may be created (step S1).

  Then, the client device 200 transmits the created verification information issue request to the time stamp verification authority device 100 (step S1). Here, FIG. 9 is a diagram illustrating a verification information issuance request transmitted by the client device 200. As an example, when an electronic certificate related to a time stamp and an electronic certificate related to an electronic signature are transmitted as requests by HTTP communication. Is shown.

  Returning to FIG. 1 again, the time stamp verification authority apparatus 100 receives a verification information issue request from the client apparatus 200 (step S2).

  Then, the time stamp verification authority device 100 includes the electronic certificate related to the electronic signature corresponding to the verification information issue request and / or the electronic certificate related to the time stamp, and the certificate authority device 500 present in the certification path of the electronic certificate. The digital certificate and the revocation information of the electronic certificate and the time stamp are checked whether they exist in the verification information file managed by the time stamp verification authority device 100, and if not, the network is connected to the corresponding certificate authority device 500. Verification is performed via 300 (step S3).

  Here, FIG. 8 is a diagram illustrating an example of data contents of the revocation information. As shown in FIG. 8, the revocation information includes, for example, an issuer (certificate authority), a valid start date, a next scheduled update date, an institution key identifier, and a revocation date data item corresponding to the serial number. .

  Referring back to FIG. 1 again, the time stamp verification authority apparatus 100 includes the electronic certificate related to the verified electronic signature and / or the electronic certificate related to the time stamp and the certificate authority apparatus present in the certification path of the electronic certificate. A verification information issuance response including the electronic certificate 500 and the revocation information of the electronic certificate and the time stamp is transmitted to the client device 200 (step S4).

  Here, the time stamp verification authority device 100 acquires a time stamp from the time stamp authority device 400 for each or all pieces of information transmitted in the verification information issue response, and combines the acquired time stamp with the client device. 200 may be transmitted.

  Here, FIG. 10 is a diagram showing a verification information issue response transmitted by the time stamp verification authority device 100, and shows a case where verification information is received by HTTP communication as an example.

  Returning to FIG. 1 again, the client device 200 receives a verification information issue response from the time stamp verification authority device 100 (step S5), and receives verification information (that is, an electronic certificate related to the electronic signature in the verification information issue response and / or Alternatively, verification is executed based on the electronic certificate related to the time stamp, the electronic certificate of the certificate authority device 500 existing in the certification path of the electronic certificate, and the revocation information of the electronic certificate and the time stamp (step S6). ) And output the verification result in a desired format (step S7).

  In addition, the time stamp verification authority apparatus 100 periodically receives from the certificate authority apparatus 500 an electronic certificate related to an electronic signature and / or an electronic certificate related to a time stamp, and a certificate authority existing in the certification path of the electronic certificate. The electronic certificate of the device 500 and the revocation information of the electronic certificate and the time stamp may be collected and stored in the verification information file.

  As shown in FIG. 11, the network 300 connecting the time stamp verification station device 100 and the client device 200 may be a dedicated line or a non-Internet communication network.

[System configuration]
Hereinafter, the configuration of the present system for realizing such basic features will be described.

[System Configuration-Time Stamp Verification Authority Device 100]
First, the configuration of the time stamp verification station device 100 will be described.
FIG. 2 is a block diagram showing an example of the configuration of the time stamp verification station apparatus 100 to which the present invention is applied, and conceptually shows only the portion related to the present invention in the configuration. In FIG. 2, a time stamp verification station device 100 is schematically a communication device such as a control unit 102 such as a CPU that controls the entire time stamp verification station device 100 and a communication line (see FIG. (Not shown), the communication control interface unit 104 connected to the input device 112 and the output device 114, the input / output interface unit 108 connected to the output device 114, the clock generator 110 for generating the system clock, and various tables, files, databases, The storage unit 106 stores (the verification information file 106a and the certificate authority list file 106b), and these units are communicably connected via an arbitrary communication path. Further, the time stamp verification station device 100 is communicably connected to the network 300 via a communication device and a wired or wireless communication line.

  The storage unit 106 is a storage unit such as a fixed disk device, and stores various programs, tables, files, databases, web page files, and the like used for various processes and website provision.

  Among the components of the storage unit 106, the verification information file 106a is verification information storage means for storing information such as various electronic certificates for verification and revocation information. As described above, the various types of electronic certificate data, revocation information data, and information related to them collected by the time stamp verification authority device 100 from the certificate authority device 500 are shown in FIG. The information files 106a are stored in association with each other.

  The certificate authority list file 106b is a certificate authority list storage unit that stores information related to a list of certificate authority apparatuses 500 that issue electronic certificates. The information stored in the certificate authority list file 106b correlates the authority key identifier, which is identification information for uniquely identifying the certificate authority device 500, attribute information regarding various attributes of the certificate authority device 500, and the like. It is configured.

  In FIG. 2, the communication control interface unit 104 performs communication control between the time stamp verification station device 100 and the network 300 (or a communication device such as a router). That is, the communication control interface unit 104 has a function of communicating data with other terminals via a communication line.

  In FIG. 2, the input / output interface unit 108 controls the input device 112 and the output device 114. Here, as the output device 114, a speaker can be used in addition to a monitor (including a home television). As the input device 112, a keyboard, a mouse, a barcode reader, a scanner, a barcode reader, a scanner, a microphone, and the like can be used. The output device 114 can also realize a pointing device function in cooperation with the input device 112 such as a mouse.

  In FIG. 2, the control unit 102 has an internal memory for storing a control program such as an OS, a program that defines various processing procedures, and necessary data. Information processing for executing The control unit 102 includes a verification information issue request receiving unit 102a, a collation unit 102b, a verification information issue response unit 102c, an information collection unit 102d, and a time stamp acquisition unit 102e in terms of functional concept.

  Among these, the verification information issue request receiving unit 102 a is a verification information issue request receiving unit that receives a verification information issue request from the client device 200.

  The collation unit 102b also includes an electronic certificate related to an electronic signature and / or an electronic certificate related to a time stamp corresponding to the verification information issue request received by the verification information issue request receiving unit 102a, and authentication of the electronic certificate. When the electronic certificate of the certificate authority device 500 existing in the path and the revocation information of the electronic certificate and the time stamp are present in the verification information file 106a managed by the time stamp verification authority device 100, the verification is performed. Is a verification means for verifying the corresponding certificate authority device 500.

  Further, the verification information issue response unit 102c includes the electronic certificate related to the electronic signature and / or the electronic certificate related to the time stamp that has been verified by the verification unit 102b, and the certification authority device that exists in the certification path of the electronic certificate It is a verification information issue response means for transmitting a verification information issue response including 500 electronic certificates and revocation information of the electronic certificate and time stamp to the client device 200.

  The information collection unit 102d also includes an electronic certificate related to an electronic signature and / or an electronic certificate related to a time stamp, an electronic certificate of the certificate authority device 500 present in the certification path of the electronic certificate, and an electronic certificate. And time stamp revocation information is periodically collected from the certificate authority device 500 and stored in the verification information file 106a.

  The time stamp acquisition unit 102e is a time stamp acquisition unit that acquires a time stamp from the time stamp authority device 400 for individual or entire information transmitted by the verification information issue response unit 102c.

  Details of processing performed by each of these units will be described later.

[System Configuration-Client Device 200]
Next, the configuration of the client device 200 will be described. FIG. 3 is a block diagram showing an example of the configuration of the client device 200 to which the present invention is applied, and conceptually shows only the portion related to the present invention in the configuration. As shown in FIG. 3, the client device 200 generally includes a control unit 210, a ROM 220, an HD 230, a RAM 240, an input device 250, an output device 260, an input / output control interface unit 270, and a communication control interface unit 280. These units are connected via a bus so that data communication is possible.

  The control unit 210 of the client device 200 includes a control device that executes various programs (for example, a Web browser 211, an electronic mailer 212, and other various application programs 213). Among these, the Web browser 211 basically performs display control (browsing processing) that interprets Web data and displays it on a monitor 261 described later. Further, the web browser 211 may be plugged in with various software such as a stream player having a function of receiving, displaying, and feedbacking a stream video. Further, the electronic mailer 212 performs transmission / reception of electronic mail in accordance with a predetermined communication protocol (for example, Simple Mail Transfer Protocol (SMTP) or Post Office Protocol version 3 (POP3)).

As the input device 250, a keyboard, a mouse, a barcode reader, a scanner, a barcode reader, a scanner, a microphone, and the like can be used. A monitor 261 described later also realizes a pointing device function in cooperation with the mouse.
As the output device 260, a monitor (including a home television) 261 and a printer 262 are provided. In addition, as the output device 260, a speaker or the like can be used. The output device 260 is an output unit that outputs information received via the communication control interface unit 280.

  Further, the communication control interface unit 280 performs communication control between the client device 200 and the network 300 (or a communication device such as a router). The communication control interface unit 280 is a receiving unit that receives information transmitted from the time stamp verification station apparatus 100.

  The client device 200 configured as described above is connected to the network 300 via a communication line with a communication device such as a modem, TA, router, etc., and is timed according to a predetermined communication protocol (for example, TCP / IP Internet protocol). The stamp verification authority apparatus 100 can be accessed.

[System Configuration-Network 300]
Next, the configuration of the network 300 will be described. The network 300 has a function of connecting the time stamp verification station device 100 and the client device 200 to each other, and is, for example, the Internet, a public telephone network, a dedicated line, or the like.

[System Configuration-Time Stamp Authority 400, Certificate Authority 500]
Next, configurations of the time stamp authority device 400 and the certificate authority device 500 will be described. The time stamp authority device 400 is connected to the time stamp verification authority device 100, the client device 200, and the certificate authority device 500 via the network 300, and has a function of issuing a time stamp in response to a request from an external device.

  The certificate authority device 500 is connected to the time stamp verification authority device 100, the client device 200, and the time stamp authority device 400 via the network 300, and issues and stores an electronic certificate in response to a request from an external device. It has a function to send an electronic certificate.

  Here, the time stamp authority device 400 and the certificate authority device 500 may be configured as a WEB server, an ASP server, or the like, and the hardware configuration thereof is generally an information processing device such as a commercially available workstation or personal computer and its You may comprise by an attached apparatus. In addition, each function of the time stamp authority device 400 and the certificate authority device 500 described below includes a CPU, a disk device, a memory device, an input device, and an output device in the hardware configuration of the time stamp authority device 400 and the certificate authority device 500. It is realized by a communication control device and the like and a program for controlling them.

[System processing]
Next, an example of the processing of the system according to the present embodiment configured as described above will be described in detail with reference to FIGS.

[Processing in Client Device 200]
Next, details of processing in the client apparatus 200 as the present method performed using the present system configured as described above will be described with reference to FIG. FIG. 4 is a flowchart illustrating an example of processing in the client device 200 of the system according to the present embodiment.

  First, the client device 200 extracts the verification target data stored in the HD 230 by the processing of the control unit 210 (step SA-1).

  Then, the client device 200 determines whether or not the verification target data has a time stamp by the processing of the control unit 210 (step SA-2), and if there is, the electronic certificate related to the time stamp is determined from the verification target data. Extract (step SA-3).

  Then, the client device 200 determines whether or not the verification target data has an electronic signature by the processing of the control unit 210 (step SA-4). If there is, the client device 200 determines the electronic certificate related to the electronic signature from the verification target data. Extract (step SA-5).

  Then, the client device 200 determines whether or not a verification information list is necessary by the processing of the control unit 210 (step SA-6). When the verification information list is necessary, that is, when the verification information issuance request includes the verification information list instead of the electronic certificate, the client device 200 performs steps SA-3 and SA- by the processing of the control unit 210. The “institution key identifier” and “CRL distribution point” included in the electronic certificate extracted in step 4 are extracted to create a verification information list (step SA-7).

  Then, the client device 200 performs the processing of the control unit 210 so that the electronic certificate related to the electronic signature and / or the electronic certificate related to the time stamp extracted in Step SA-3 and Step SA-4, or Step SA- A verification information issue request including the verification information list created in step 7 is created (step SA-8).

  Then, the client device 200 transmits the verification information issuance request created in step SA-8 to the time stamp verification authority device 100 by the processing of the control unit 210 and the communication control interface (step SA-9).

  Then, the client device 200 receives a verification information issue response from the time stamp verification authority device 100 by the processing of the control unit 210 and the communication control interface (step SA-10).

  Then, the client device 200 performs verification processing in the verification information issue response received from the time stamp verification authority device 100 by the processing of the control unit 210, that is, an electronic certificate related to the electronic signature corresponding to the verification information issue request, and Analyzing the electronic certificate related to the time stamp, the electronic certificate of the certificate authority device 500 existing in the certification path of the electronic certificate, and the revocation information of the electronic certificate and the time stamp, and obtaining the desired result The data is output in a format (step SA-11).

  Then, the client device 200 performs verification using the verification information received from the time stamp verification authority device 100 by the processing of the control unit 210 (step SA-12).

  Then, the client device 200 outputs the verification result to the output device 260 in a desired format by the processing of the control unit 210 (step SA-13).

  This completes the processing in the client device 200.

[Processing in Time Stamp Verification Authority Device 100]
Next, details of processing in the time stamp verification station apparatus 100 will be described with reference to FIG. FIG. 5 is a flowchart showing an example of processing in the time stamp verification station apparatus 100 of the system according to the present embodiment.

  First, the time stamp verification authority device 100 periodically receives the electronic certificate related to the electronic signature from the certification authority device 500, triggered by the time notified by the clock generation unit 110 or the like by the processing of the information collection unit 102d. The electronic certificate related to the time stamp, the electronic certificate of the certificate authority device 500 existing in the certification path of the electronic certificate, and the revocation information of the electronic certificate and the time stamp are collected and stored in the verification information file 106a. Store (step SB-1). Further, the time stamp verification station device 100 acquires time stamps from the time stamp station device 400 for each or all of the collected information by processing of the time stamp acquisition unit 102e, and associates them with the verification information file 106a. Store (step SB-1).

  Then, the time stamp verification authority device 100 receives a verification information issue request from the client device 200 by the processing of the verification information issue request receiving unit 102a (step SB-2).

  Then, the time stamp verification authority apparatus 100 performs the processing of the verification unit 102b, and the electronic certificate related to the electronic signature corresponding to the verification information issue request and / or the electronic certificate related to the time stamp and the authentication path of the electronic certificate. The digital certificate of the certificate authority device 500 existing in the certificate authority and the revocation information of the electronic certificate and the time stamp exist in the verification information file 106a managed by the time stamp verification authority device 100 (step SB-3). If it exists, the collated information is extracted as verification information, and the corresponding time stamp acquired in step SB-1 is extracted (step SB-4). On the other hand, if the certificate authority device 500 does not exist, the corresponding certificate authority device 500 is verified via the network 300, and information verified by the certificate authority device 500 is extracted as verification information (step SB-5).

  Then, the time stamp verification station device 100 acquires time stamps from the time stamp station device 400 for individual or whole information transmitted in the verification information issue response by the processing of the time stamp acquisition unit 102e, and verifies the information. The file 106a is stored in association with it (step SB-6).

  Then, the time stamp verification authority apparatus 100 sends a verification information issuance response to the client along with the time stamp acquired in step SB-1 and / or step SB-6 by the processing of the verification information issuance response unit 102c. It transmits to the apparatus 200 (step SB-7).

  This completes the processing in the time stamp verification station device 100.

[Other embodiments]
Although the embodiments of the present invention have been described so far, the present invention can be applied to various different embodiments in addition to the above-described embodiments within the scope of the technical idea described in the claims. May be implemented. For example, the time stamp verification authority apparatus 100 performs the chain verification on the electronic certificate or the revocation information at step SB-7 in FIG. 5 and confirms the validity of the verification information, and then the necessary verification result information. May be returned to the client apparatus 200 as a verification information issue response.

  Further, in request / response communication transmitted / received between the time stamp verification station device 100 and the client device 200, SSL (Secure Sockets Layer) communication is used to prevent impersonation, tampering of communication data, wiretapping of communication data, and the like. Technology may be used.

  In addition, among the processes described in the embodiment, all or part of the processes described as being performed automatically can be performed manually, or all of the processes described as being performed manually are performed. Alternatively, a part can be automatically performed by a known method.

  In addition, the processing procedures, control procedures, specific names, information including parameters such as various registration data and search conditions, screen examples, and database configurations shown in the above documents and drawings, unless otherwise specified. It can be changed arbitrarily.

  In addition, regarding the time stamp verification station apparatus 100, each illustrated component is functionally conceptual and does not necessarily need to be physically configured as illustrated. For example, all or any part of the processing functions provided in the time stamp verification authority apparatus 100, particularly the processing functions performed by the control unit, are interpreted and executed by a CPU (Central Processing Unit) and the CPU. It can be realized by a program, or can be realized as hardware by wired logic. The program is recorded on a recording medium to be described later, and is mechanically read by the time stamp verification authority device 100 as necessary.

  Various databases (verification information file 106a and certificate authority list file 106b) stored in the storage unit 106 are storage means such as a memory device such as RAM and ROM, a fixed disk device such as a hard disk, a flexible disk, and an optical disk. Yes, it stores various programs, tables, files, databases, web page files, etc. used for various processes and website provision.

  The time stamp verification station apparatus 100 connects a peripheral device such as a printer, a monitor, and an image scanner to an information processing apparatus such as an information processing terminal such as a known personal computer or workstation, and the information processing apparatus of the present invention You may implement | achieve by mounting the software (a program, data, etc. are included) which implement | achieves a method.

  Further, the specific form of distribution / integration of the time stamp verification authority apparatus 100 or the like is not limited to that shown in the specification and drawings, and all or a part thereof is functional in arbitrary units according to various loads. Alternatively, it can be physically distributed and integrated (for example, grid computing). For example, each database may be independently configured as an independent database device, and a part of the processing may be realized by using CGI (Common Gateway Interface).

  In addition, the client device 200 includes a printer, a monitor, an information processing device such as a known personal computer, workstation, home game device, Internet TV, PHS terminal, portable terminal, mobile communication terminal, or PDA. It may be realized by connecting a peripheral device such as an image scanner as necessary and mounting software (including programs, data, etc.) that realizes a web information browsing function and an e-mail function in the information processing apparatus. .

  The control unit 210 of the client apparatus 200 can be realized entirely or arbitrarily by a CPU and a program interpreted and executed by the CPU. That is, a computer program for giving instructions to the CPU and performing various processes in cooperation with an OS (Operating System) is recorded in the ROM or HD. This computer program is executed by being loaded into the RAM, and constitutes a control unit in cooperation with the CPU.

  However, this computer program may be recorded in an application program server connected to the client apparatus 200 via an arbitrary network, and may be downloaded in whole or in part as necessary. Alternatively, all or any part of each control unit can be realized as hardware such as wired logic.

  The program according to the present invention can also be stored in a computer-readable recording medium. Here, the “recording medium” is an arbitrary “portable physical medium” such as a flexible disk, a magneto-optical disk, a ROM, an EPROM, an EEPROM, a CD-ROM, an MO, and a DVD, and is incorporated in various computer systems. Such as a communication line or a carrier wave in the case of transmitting a program via any “fixed physical medium” such as ROM, RAM, HD, or a network represented by LAN, WAN, or the Internet. It shall include a “communication medium” that holds the program.

  The “program” is a data processing method described in an arbitrary language or description method, and may be in any format such as source code or binary code. The “program” is not necessarily limited to a single configuration, but is distributed in the form of a plurality of modules and libraries, or in cooperation with a separate program represented by an OS (Operating System). Including those that achieve the function. Note that a well-known configuration and procedure can be used for a specific configuration for reading a recording medium, a reading procedure, an installation procedure after reading, and the like in each device described in the embodiment.

  The network 300 has a function of connecting the time stamp verification authority device 100 and the client device 200 to each other. For example, the Internet, an intranet, a LAN (including both wired / wireless), a VAN, PC communication network, public telephone network (including both analog / digital), leased line network (including both analog / digital), CATV network, IMT client device 2000 system, GSM system or PDC / PDC- It may include any of P-type mobile circuit switching network / portable packet switching network, wireless paging network, local wireless network such as Bluetooth, PHS network, satellite communication network such as CS, BS or ISDB. Good. That is, this system can transmit and receive various data via any network regardless of wired or wireless.

  As described above, the time stamp verification system, the time stamp verification authority apparatus and the time stamp verification method according to the present invention can be widely implemented in many industrial fields, in particular, electronic authentication and time stamp authentication fields. It is extremely useful for improving the proof of electronic data such as documents.

It is a block diagram which shows an example of the whole structure of this system. It is a block diagram which shows an example of a structure of the time stamp verification authority apparatus 100 with which this invention is applied. It is a block diagram which shows an example of a structure of the client apparatus 200 to which this invention is applied. It is a flowchart which shows an example of the process in the client apparatus 200 of this system in this embodiment. It is a flowchart which shows an example of the process in the time stamp verification authority apparatus 100 of this system in this embodiment. It is a figure which shows an example of the data content of the electronic certificate which concerns on a time stamp. It is a figure which shows an example of the data content of the electronic certificate which concerns on an electronic signature. It is a figure which shows an example of the data content of revocation information. 4 is a diagram illustrating a verification information issue request transmitted by a client device 200. FIG. It is a figure which shows the verification information issue response transmitted by the time stamp verification authority apparatus. FIG. 2 is a block diagram showing an example in which the network 300 connecting the time stamp verification station device 100 and the client device 200 is a dedicated line or a non-Internet communication network in the overall configuration of this system.

Explanation of symbols

100 Time stamp verification station equipment
102 Control unit
102a Verification information issue request receiving part
102b Verification unit
102c Verification information issue response part
102d Information collection unit
102e Time stamp acquisition unit
104 Communication control interface unit
106 Storage unit
106a Information file for verification
106b Certificate Authority list file
108 Input / output interface
110 Clock generator
112 Input device
114 Output device 200 Client device
210 Control unit
211 Web browser
212 electronic mailer
213 Various application programs
220 ROM
230 HD
240 RAM
250 input device
260 Output device
261 monitor
262 Printer 270 Input / output control interface unit 280 Communication control interface unit 300 Network 400 Time stamp station device 500 Certificate station device

Claims (11)

A time stamp verification system configured by connecting a time stamp verification authority device, a client device, and a certificate authority device through a network so that they can communicate with each other,
The client device
Verification including the electronic certificate related to the electronic signature issued by the certificate authority device and / or the electronic certificate related to the time stamp for the verification target data, or the authority key identifier and the CRL distribution point included in the target electronic certificate A verification information issuance request creation means for creating a verification information issuance request including an information list;
Verification information issue request transmission means for transmitting the verification information issue request created by the verification information issue request creation means to the time stamp verification authority device;
With
The time stamp verification authority apparatus is
Verification information issue request receiving means for receiving the verification information issue request from the client device;
An electronic certificate related to the electronic signature and / or an electronic certificate related to the time stamp corresponding to the verification information issue request received by the verification information issue request receiving means, and present in the certification path of the electronic certificate The electronic certificate of the certificate authority device and the revocation information of the electronic certificate and the time stamp are checked whether they exist in the verification information file managed by the time stamp verification authority device. Verification means for verifying the certificate authority device;
The electronic certificate related to the electronic signature and / or the electronic certificate related to the time stamp that has been verified by the verification means, the electronic certificate of the certification authority device that exists in the certification path of the electronic certificate, and A verification information issue response means for transmitting a verification information issue response including the electronic certificate and the revocation information of the time stamp to the client device;
A time stamp verification system characterized by comprising: The time stamp verification system according to claim 1,
The time stamp verification authority apparatus is
The electronic certificate related to the electronic signature and / or the electronic certificate related to the time stamp, the electronic certificate of the certification authority device existing in the certification path of the electronic certificate, the electronic certificate, and the time Information collection means for periodically collecting the revocation information of the stamp from the certificate authority device and storing it in the verification information file;
A time stamp verification system characterized by further comprising: The time stamp verification system according to claim 1 or 2,
Further comprising a time stamp authority apparatus connected to the time stamp verification authority apparatus and the network via the network;
The time stamp verification authority apparatus is
Time stamp acquisition means for acquiring a time stamp from the time stamp station apparatus for individual or whole information transmitted by the verification information issue response means,
Further comprising
The verification information issuance response means transmits the time stamp acquired by the time stamp acquisition means together to the client device;
Time stamp verification system characterized by In the time stamp verification system according to any one of claims 1 to 3,
The time stamp verification system, wherein the network connecting the client device and the time stamp verification station device is a dedicated line or a non-Internet communication network. A time stamp verification authority device in a time stamp verification system configured to connect a time stamp verification authority device, a client device, and a certificate authority device through a network,
An electronic certificate related to an electronic signature issued by the certificate authority device and / or an electronic certificate related to a time stamp, or an authority key identifier and a CRL included in the target electronic certificate from the client device to the verification target data A verification information issue request receiving means for receiving a verification information issue request including a verification information list including distribution points;
An electronic certificate related to the electronic signature and / or an electronic certificate related to the time stamp corresponding to the verification information issue request received by the verification information issue request receiving means, and present in the certification path of the electronic certificate The electronic certificate of the certificate authority device and the revocation information of the electronic certificate and the time stamp are checked whether they exist in the verification information file managed by the time stamp verification authority device. Verification means for verifying the certificate authority device;
The electronic certificate related to the electronic signature and / or the electronic certificate related to the time stamp that has been verified by the verification means, the electronic certificate of the certification authority device that exists in the certification path of the electronic certificate, and A verification information issue response means for transmitting a verification information issue response including the electronic certificate and the revocation information of the time stamp to the client device;
A time stamp verification station apparatus comprising: In the time stamp verification authority apparatus according to claim 5,
The electronic certificate related to the electronic signature and / or the electronic certificate related to the time stamp, the electronic certificate of the certification authority device existing in the certification path of the electronic certificate, the electronic certificate, and the time Information collection means for periodically collecting the revocation information of the stamp from the certificate authority device and storing it in the verification information file;
A time stamp verification station apparatus further comprising: In the time stamp verification authority apparatus according to claim 5 or 6,
Time stamp acquisition means for acquiring a time stamp from a time stamp station apparatus for individual or whole information transmitted by the verification information issue response means,
Further comprising
The verification information issuance response means transmits the time stamp acquired by the time stamp acquisition means together to the client device;
A time stamp verification station apparatus characterized by the above. A time stamp verification method using a time stamp verification system configured to connect a time stamp verification authority device, a client device, and a certificate authority device through a network,
In the client device, for the verification target data, the electronic certificate related to the electronic signature issued by the certificate authority device and / or the electronic certificate related to the time stamp, or the authority key identifier and the CRL included in the target electronic certificate A verification information issue request creation step for creating a verification information issue request including a verification information list including distribution points;
In the client device, a verification information issue request transmission step for transmitting the verification information issue request created in the verification information issue request creation step to the time stamp verification authority device;
In the time stamp verification authority device, a verification information issue request receiving step for receiving the verification information issue request from the client device;
In the time stamp verification authority apparatus, the electronic certificate related to the electronic signature and / or the electronic certificate related to the time stamp corresponding to the verification information issue request received in the verification information issue request receiving step, and the electronic certificate The electronic certificate of the certificate authority device present in the certification path of the certificate is compared with the revocation information of the electronic certificate and the time stamp in the verification information file managed by the time stamp verification authority device. A collation step for collating the corresponding certificate authority device if it does not exist;
In the time stamp verification authority apparatus, the electronic certificate related to the electronic signature and / or the electronic certificate related to the time stamp that has been verified in the verification step, and the certification authority present in the certification path of the electronic certificate A verification information issuance response step of transmitting a verification information issuance response including the electronic certificate of the device and the revocation information of the electronic certificate and the time stamp to the client device;
A time stamp verification method comprising: The time stamp verification method according to claim 8,
In the time stamp verification authority device, the electronic certificate related to the electronic signature and / or the electronic certificate related to the time stamp, and the electronic certificate of the certificate authority device present in the certification path of the electronic certificate, The information collection step of periodically collecting the revocation information of the electronic certificate and the time stamp from the certificate authority device and storing the information in the verification information file;
The time stamp verification method further comprising: The time stamp verification method according to claim 8 or 9,
In the time stamp verification authority apparatus, for each or all information transmitted in the verification information issue response step, a time stamp acquisition step for acquiring a time stamp from the time stamp authority apparatus,
Further including
The verification information issue response step includes transmitting the time stamp acquired in the time stamp acquisition step to the client device together;
A time stamp verification method characterized by The time stamp verification method according to any one of claims 8 to 10,
The time stamp verification method, wherein the network connecting the client device and the time stamp verification station device is a dedicated line or a non-Internet communication network.

Images