JP4501848B2 - Signature processing device - Google Patents

Description

  The present invention relates to a signature processing apparatus, and more particularly to a signature processing apparatus that generates an electronic signature.

  In recent years, electronic signatures that detect tampering of electronic documents and prove the creator have been used as techniques to replace conventional handwritten signatures and seals. In addition, a time stamp is used as a technique for proving the confirmation time of an electronic document.

  In the time stamping process, for example, a data transmission side (user) generates a hash value of an electronic document, transmits the hash value to a time server that is a third party, and registers the data on the time server side. This is performed by a procedure of sending a receipt indicating that data has been registered from the time server side to the user (for example, Patent Document 1).

Japanese Patent Application Laid-Open No. 2003-259542 discloses a mail selection unit that classifies a received electronic mail as signed and forwarded based on a predetermined condition and a non-signed forwarded mail as well as an electronic mail that the mail selection means is to sign. A time stamp means for issuing a digital certificate that is digitally signed by adding time information to electronic information consisting of a one-way function value of electronic data, and an e-mail that is not signed by the e-mail selecting means is transferred and signed There is disclosed a time stamp mail server system comprising: a mail transfer means for transferring an e-mail as a time stamped e-mail with a digital certificate issued by the time stamp means.
JP 2004-304338 A JP 2004-104596 A

  However, with the technique described in Patent Document 2, the e-mail can be set only to be transferred as it is or to a digital certificate that is digitally signed with time information added by a time stamp assigning means. When a user gives an electronic signature, the user may want to adjust the security level according to the content. In addition, in order for a personal user to use a time stamp, it is necessary to obtain a time stamp from a TSA (Time-Stamping Authority), etc. Since it is charged, it is necessary to efficiently obtain a time stamp.

  The present invention has been made in view of the above circumstances, and an object thereof is to provide a technique for flexibly setting an electronic signature to be attached to an electronic document such as an electronic mail.

According to the present invention,
An electronic document acquisition unit for acquiring an electronic document;
A signature generation unit for generating an electronic signature of the electronic document;
A time stamp acquisition unit for acquiring a time stamp to be given to the electronic document;
An instruction receiving unit that receives an instruction to give an electronic signature to the electronic document acquired by the electronic document acquiring unit;
A storage unit for storing a security policy for giving an electronic signature;
When the instruction receiving unit receives an instruction to give an electronic signature, a process for generating an electronic signature in the signature generating unit or a time stamp in the time stamp acquiring unit is acquired according to a security policy stored in the storage unit A signature processing unit for processing,
A transmission processing unit that transmits the electronic document to another terminal via a network;
Including
The time stamp acquisition unit can acquire a time stamp in a long-term signature format,
The signature processing unit causes the time stamp acquisition unit to perform processing for acquiring a time stamp of the long-term signature format in accordance with a security policy stored in the storage unit,
When the signature processing unit causes the time stamp acquisition unit to perform processing for acquiring a time stamp of a long-term signature format, the transmission processing unit before the time stamp acquisition unit acquires a time stamp of the long-term signature format The electronic document is transmitted to another terminal with at least an electronic signature or a normal time stamp, and after the time stamp acquisition unit acquires the time stamp of the long-term signature format, A signature processing apparatus is provided that allows the electronic document to be retransmitted to the other terminal with the time stamp added .

  Accordingly, by appropriately setting the security policy, the time stamp acquisition process can be performed together with the electronic signature generation process. In addition, flexibility can be increased because stepwise settings can be made according to the security policy. The security policy can be set for each apparatus, but can be set according to the type of electronic document, for example. When an electronic document is transmitted as an electronic mail, a security policy can be set for each transmission destination. The signature processing apparatus can include an encryption processing unit, and can add an electronic signature or a time stamp to the encrypted electronic document.

  As a result, the electronic document can be verified over a long period of time.

  As a result, even when a long-term signature that takes a long time to generate is added to an electronic document, necessary information can be quickly transmitted to a transmission partner, and an electronic document that can be verified over a long period of time is transmitted. be able to.

  It should be noted that any combination of the above-described constituent elements and a conversion of the expression of the present invention between a method, an apparatus, a system, a recording medium, a computer program, etc. are also effective as an aspect of the present invention. For example, the configuration of the signature processing apparatus can be realized by a program such as a mailer.

  According to the present invention, an electronic signature to be attached to an electronic document such as an electronic mail can be set flexibly.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. In all the drawings, the same reference numerals are given to the same components, and the description will be omitted as appropriate. In the present embodiment, a case where the signature processing apparatus is an electronic mail processing apparatus that transmits and receives electronic mail will be described as an example.

FIG. 1 is a block diagram illustrating a configuration of a signature processing apparatus according to the present embodiment.
The signature processing apparatus 100 includes an electronic document acquisition unit 102, a transmission processing unit (signature processing unit) 104, an encryption processing unit 105, a signature generation unit 106, a time stamp acquisition unit 108, a communication control unit 110, a setting storage unit 112, data A storage unit 114 and an instruction receiving unit 116 are included.

  Each component of the signature processing apparatus 100 shown in FIG. 1 is not a hardware unit configuration but a functional unit block. Each component of the signature processing apparatus 100 is centered on an arbitrary computer CPU, memory, a program that implements the components shown in the figure loaded in the memory, a storage unit such as a hard disk for storing the program, and a network connection interface. It is realized by any combination of hardware and software. It will be understood by those skilled in the art that there are various modifications to the implementation method and apparatus.

  The electronic document acquisition unit 102 acquires an electronic document to which an electronic signature is to be assigned. The electronic document acquisition unit 102 may have, for example, a scanner function, and can read a paper medium document and generate an electronic document. The electronic document acquisition unit 102 can also acquire an electronic document from another terminal via a network or the like, or can acquire an electronic document stored in an electronic medium or the like. In the present embodiment, the electronic document can be image data.

  The communication control unit 110 controls communication performed between the signature processing apparatus 100 and another terminal via the network 200. The network 200 is the Internet, a LAN, or the like. The communication control unit 110 is connected to a TSA (Time-Stamping Authority) 202 via the network 200.

  The transmission processing unit 104 generates an e-mail. In the present embodiment, the transmission processing unit 104 generates an e-mail with the electronic document acquired by the electronic document acquisition unit 102 as an attached file. In addition, the transmission processing unit 104 performs a signature process for the email to be transmitted.

  The data storage unit 114 stores the electronic document acquired by the electronic document acquisition unit 102 and the electronic mail generated by the transmission processing unit 104. The encryption processing unit 105 encrypts the electronic document. The encryption processing unit 105 can perform encryption based on PKI (Public Key Infrastructure). The signature generation unit 106 generates an electronic signature for the electronic document.

  The time stamp acquisition unit 108 acquires a time stamp from the TSA 202 via the network 200. The user of the signature processing apparatus 100 performs user registration with the TSA 202 in advance and acquires an account. At the time of time stamp acquisition, the time stamp acquisition unit 108 requests the TSA 202 to issue a time stamp after login authentication using a previously acquired account.

  In the present embodiment, the time stamp acquisition unit 108 acquires a time stamp as follows. First, the time stamp acquisition unit 108 calculates a hash value of the electronic signature generated by the signature generation unit 106. The time stamp acquisition unit 108 performs the login authentication to the TSA 202 and transmits a hash value to request time stamp issuance. Here, the TSA 202 can issue a time stamp by a simple protocol (RFC3161) method, for example. The TSA 202 adds accurate time information to the hash value transmitted from the signature processing apparatus 100 to generate a time stamp. The TSA 202 transmits the generated time stamp to the signature processing apparatus 100.

  Further, the time stamp acquisition unit 108 can also acquire a time stamp in the long-term signature format. A long-term signature is an electronic signature that can be verified over a long period of time. Even if it is valid at the time of signing, the signature cannot be verified if the certificate has expired or the certificate has been revoked when verification is performed after a long period of time. An example of a long-term signature format corresponding to the electronic document law is specified in IEEE RFC3126 (Electronic Signature Formats for Long term Electronic Signatures). In such a long-term signature format, first, an electronic signature is added to an electronic document, a time stamp is added, and a certificate revocation list (CRL) is further added. Thereafter, a time stamp called an archive time stamp is further given.

  The transmission processing unit 104 associates the electronic signature generated by the signature generation unit 106 or the time stamp acquired by the time stamp acquisition unit 108 with the corresponding electronic document. Note that the time stamp acquisition unit 108 can associate the acquired time stamp with the electronic signature, or include the time stamp in the electronic signature. In this state, the transmission processing unit 104 can associate with the electronic document.

  The instruction receiving unit 116 receives various instructions from the user. For example, the instruction receiving unit 116 receives an instruction to give an electronic signature to the electronic document acquired by the electronic document acquisition unit 102. The instruction receiving unit 116 can also receive an instruction to encrypt an electronic document acquired by the electronic document acquisition unit 102.

  The setting storage unit 112 stores a setting of a security policy for giving an electronic signature in the signature processing performed by the transmission processing unit 104.

FIG. 2 is a diagram illustrating an example of an internal configuration of the setting storage unit 112.
The setting storage unit 112 includes a current setting column, a security level column, a processing column, a confirmation necessity column, and a signature mail transmission column. Here, an example in which the processing of the signature processing apparatus 100 is set collectively will be described. In another example, the security level can be set according to the destination or according to the type of electronic mail transmitted by the transmission processing unit 104. When setting the security level according to the destination, the setting storage unit 112 can be, for example, an address book or a telephone book.

  In FIG. 2, in the current setting column, a flag is set for the currently set security level among a plurality of security levels. The security level includes “low”, “medium” and “high”. Here, when the security level is “low”, the processing is “normal signature”. When the security level is “medium”, the process is “signature + time stamp”. When the security level is “high”, the process is “long-term signature”.

  When the process is “signature + time stamp” or “long-term signature”, “necessary” or “unnecessary” is set in the confirmation necessity column. By setting the confirmation necessity column to “necessary”, it is possible to confirm with the user every time processing for obtaining a time stamp is performed, and to obtain the time stamp when confirmed. When the time stamp is acquired, the user may be charged according to the number of time stamps issued from the TSA 202. In this way, the user can select acquisition of the time stamp as necessary. On the other hand, if it is not necessary for the user to confirm each time, the time stamp can be automatically acquired by setting the confirmation necessity column to “unnecessary”. Thereby, a user's effort can be saved.

  Further, when the process is “long-term signature”, “required” or “unnecessary” is set in the mail transmission field at the time of signature. Long-term signatures take time to be generated because it takes time to obtain a revocation list. If a long-term signature is set, sending an e-mail will be delayed if the long-term signature format is waiting. For this reason, if a long-term signature is set, an e-mail is sent to the destination at the stage where an electronic signature is given or the time stamp of the first stage is acquired, and a revocation list is acquired, It is also possible to acquire a time stamp and send the e-mail again to the destination when the long-term signature format is ready. By setting the email transmission field at the time of signing as “necessary”, it is possible to send an e-mail before the time stamp in the long-term signature format is acquired. By setting the email transmission field at the time of signing to "unnecessary", sending is not performed until the format of the long-term signature is completed, and an e-mail is sent to the destination when the format of the long-term signature is ready Can do. In addition, it can be set to inquire the user every time whether or not to send an e-mail before the format of the long-term signature is completed.

  Returning to FIG. 1, the transmission processing unit 104 confirms the security policy with reference to the setting storage unit 112 when the instruction receiving unit 116 receives an instruction to give an electronic signature to an electronic document together with an instruction to send an e-mail from the user. To do. The transmission processing unit 104 causes the signature generation unit 106 and the time stamp acquisition unit 108 to perform signature generation processing and time stamp acquisition processing according to the security policy set in the setting storage unit 112, respectively. Next, the transmission processing unit 104 performs processing for giving the electronic signature generated by the signature generation unit 106 to the electronic document or processing for giving the time stamp acquired by the time stamp acquisition unit 108 to the electronic document. In addition, when the instruction receiving unit 116 receives an instruction for encrypting an electronic document from the user, the transmission processing unit 104 causes the encryption processing unit 105 to perform an electronic document encryption process. In this case, the transmission processing unit 104 gives an electronic signature or a time stamp to the encrypted electronic document.

  The transmission processing unit 104 transmits the electronic mail that has been subjected to the signature processing to a predetermined destination via the communication control unit 110.

FIG. 3 is a flowchart showing a processing procedure of the signature processing apparatus 100 according to the present embodiment.
When the electronic document acquisition unit 102 acquires an electronic document (YES in S100) and there is an instruction for an electronic signature (YES in S102), the transmission processing unit 104 causes the signature generation unit 106 to generate an electronic signature (S104). The transmission processing unit 104 confirms the security policy with reference to the setting storage unit 112 (S106). When the security level is set to low (YES in S106), the transmission processing unit 104 transmits an e-mail attached with the electronic signature generated by the signature generation unit 106 to another terminal via the communication control unit 110. (S114).

  In step S106, if the security level is not low (NO in S106), the transmission processing unit 104 causes the time stamp acquisition unit 108 to acquire a time stamp (S108). Subsequently, the transmission processing unit 104 determines whether or not the security level is medium (S110). When the security level is medium (YES in S110), the transmission processing unit 104 transmits an e-mail attached with an electronic signature with a time stamp to another terminal via the communication control unit 110 (S114).

  In step S110, when the security level is not medium (NO in S110), the transmission processing unit 104 causes the time stamp acquisition unit 108 to acquire a time stamp of the long-term signature format (S112). At this time, the transmission processing unit 104 refers to the setting storage unit 112, and attaches an electronic signature with a time stamp if the setting for transmitting an e-mail before the long-term signature format is stored is stored. An e-mail is transmitted to another terminal (not shown). Thereafter, when the time stamp acquisition unit 108 acquires the long-term format time stamp, the transmission processing unit 104 transmits an e-mail to which the long-term format time stamp has been added to another terminal (S114).

  As mentioned above, although embodiment of this invention was described with reference to drawings, these are the illustrations of this invention, Various structures other than the above are also employable.

  The signature processing apparatus 100 can be a network multifunction device that integrates a facsimile, a printer, a copy, a scanner function, and the like. Here, the network multifunction peripheral is, for example, a network facsimile apparatus or an MFP (Multi Functional Peripheral).

  In the above embodiment, the case where the signature processing apparatus 100 is an e-mail processing apparatus has been described as an example. However, the signature processing apparatus 100 is not limited to an electronic document transmitted by e-mail, but the signature processing apparatus 100. The same processing can also be performed on an electronic document stored in the inside. Further, the signature processing apparatus 100 may be configured not to have an e-mail transmission function.

It is a block diagram which shows the structure of the signature processing apparatus in embodiment of this invention. It is a block diagram which shows an example of an internal structure of a setting memory | storage part. It is a flowchart which shows the process sequence of the signature processing apparatus in embodiment of this invention.

Explanation of symbols

100 Signature processing apparatus 102 Electronic document acquisition unit 104 Transmission processing unit 105 Encryption processing unit 106 Signature generation unit 108 Time stamp acquisition unit 110 Communication control unit 112 Setting storage unit 114 Data storage unit 116 Instruction reception unit 200 Network 202 TSA

Claims (2)

An electronic document acquisition unit for acquiring an electronic document;
A signature generation unit for generating an electronic signature of the electronic document;
A time stamp acquisition unit for acquiring a time stamp to be given to the electronic document;
An instruction receiving unit that receives an instruction to give an electronic signature to the electronic document acquired by the electronic document acquiring unit;
A storage unit for storing a security policy for giving an electronic signature;
When the instruction receiving unit receives an instruction to give an electronic signature, a process for generating an electronic signature in the signature generating unit or a time stamp in the time stamp acquiring unit is acquired according to a security policy stored in the storage unit A signature processing unit for processing,
A transmission processing unit that transmits the electronic document to another terminal via a network;
Including
The time stamp acquisition unit can acquire a time stamp in a long-term signature format,
The signature processing unit causes the time stamp acquisition unit to perform processing for acquiring a time stamp of the long-term signature format in accordance with a security policy stored in the storage unit,
When the signature processing unit causes the time stamp acquisition unit to perform processing for acquiring a time stamp of a long-term signature format, the transmission processing unit before the time stamp acquisition unit acquires a time stamp of the long-term signature format The electronic document is transmitted to another terminal with at least an electronic signature or a normal time stamp, and after the time stamp acquisition unit acquires the time stamp of the long-term signature format, A signature processing apparatus for retransmitting the electronic document to the other terminal with a time stamp of Computer
Electronic document acquisition means for acquiring an electronic document;
Signature generation means for generating an electronic signature of an electronic document;
Time stamp acquisition means for acquiring a time stamp to be given to an electronic document;
Instruction accepting means for accepting an instruction to give an electronic signature to the electronic document obtained by the electronic document obtaining means;
Storage means for storing a security policy for providing an electronic signature;
When the instruction receiving unit receives an instruction to give an electronic signature, a process for generating an electronic signature in the signature generating unit or a time stamp in the time stamp acquiring unit is acquired according to a security policy stored in the storage unit Signature processing means for processing,
Transmission processing means for transmitting the electronic document to another terminal via a network;
To function as,
The time stamp acquisition means can acquire a time stamp in a long-term signature format,
The signature processing means causes the time stamp acquisition means to perform processing for acquiring a time stamp of the long-term signature format in accordance with a security policy stored in the storage means,
In the case where the signature processing means causes the time stamp acquisition means to perform processing for acquiring a time stamp of a long-term signature format, the transmission processing means before the time stamp acquisition means acquires a time stamp of the long-term signature format. The electronic document is transmitted to another terminal with at least an electronic signature or a normal time stamp added thereto, and the long-term signature format is acquired after the time-stamp acquisition unit acquires the time stamp of the long-term signature format. A signature processing program for retransmitting the electronic document to the other terminal with a time stamp of

Images