JP2001044988A - Method and system for accessing to different signature engines in common and storage medium stored with access program to different signature engiens in common - Google Patents

Abstract

PROBLEM TO BE SOLVED: To discriminatingly use signature engines and multiple signature algorithm with ease and to easily add a new signature engine or new signature algorithm to an existent system in such a case without affecting a higher-order application. SOLUTION: A secret key management table which manages pieces of secret key information is generated (S1). Signature engine dependency information depending upon a signature engine is registered and managed (S2). A request to access a signature engine is accepted (S3). A specified key name is obtained (S4). Information needed for signature generation or key couple generation corresponding to the key name is obtained from the secret key management table (S5). An arbitrary signature engine is requested to generate a key couple or signature (S6).

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a common access method and system for a plurality of different signature engines and a storage medium storing a common access program for a plurality of different signature engines. Of an electronic signature using a signature engine and a key pair of a private key / public key in an information processing system having an electronic signature engine for creating an electronic signature using public key cryptography for the digest of The present invention relates to a common access method and system for a plurality of different signature engines, and a storage medium storing a common access program for a plurality of different signature engines.

[0002]

2. Description of the Related Art First, a flow of generating a digital signature and a signature engine will be described. As shown in FIG. 11, an electronic signature using a public key cryptosystem usually converts target data to be signed into a hash function and converts the data into hash data. It is generated by performing generation processing. The hash function includes algorithms such as SHA-1 and MD5.
The digital signature algorithm includes ES which is a public key cryptosystem.
IGN and RSA are well known. Here, the secret key used for the electronic signature is very important information as information for identifying the signer. Therefore, a system using the electronic signature securely manages the secret key and generates the electronic signature. For this reason, a group of functions necessary for these are often prepared as a dedicated device independent of the system. This dedicated device is generally called a signature engine, and its mounting method varies depending on the device.

For example, as shown in FIG. 11, hash algorithm and signature generation process can use a plurality of algorithms, can hold and use a plurality of secret keys, or use signature engine B in FIG. Some devices do not have a hash processing unit and are premised on input of hashed data. Next, generation of an electronic signature using the signature engine will be described.

In general, when a digital signature is generated in a system that requires the use of a plurality of signature algorithms or the use of a plurality of signature engines, a signature to the signature engine is generated according to the flow shown in FIG. Step 10) First, in an application for which signature generation is to be performed, data to be signed, a secret key used for signature generation, a hash algorithm, and what to use for a signature algorithm are determined as information necessary for signature generation.

Step 11) Select a signature engine in which a secret key used for signature generation is stored. Step 12) For the selected signature engine, it is determined whether or not hashing of the data to be signed is necessary. If necessary, the process proceeds to step 13; otherwise, the process proceeds to step 14.

Step 13) If necessary, the input data is hashed. Step 14) According to the signature generation request method dependent on the signature engine selected in step 11, step 10
Based on the information determined in (1), signature generation request information for designating the hash algorithm, the signature algorithm, and the storage destination information of the secret key to the signature engine is generated. Step 1
When 3 is performed, it is unnecessary to specify a hash algorithm.

Step 15) The information generated in step 14 and the data to be signed or the hash value of the data to be signed is sent to the signature engine via the access module, and signature data as a signature generation result is received from the signature engine. Here, the access module is, for example, driver software for controlling the signature engine.

[0008]

However, in a conventional signature generation process using a signature engine, a higher-level application requesting signature generation uses a signature engine storing a secret key used for signature generation and its storage location. The signature key, confirms that the secret key is applicable to the signature algorithm, determines whether hashing of the data to be signed, which is input data, is necessary, and sorts the signature generation process according to the type of signature engine. There is a need to do. Therefore, in a system in which a plurality of signature algorithms, a plurality of secret keys, or a plurality of signature engines are properly used depending on the application, a process of requesting the signature engine to generate an electronic signature becomes complicated.

The present invention has been made in view of the above points, and makes it possible to easily use a plurality of signature engines and a plurality of signature algorithms, add a new signature engine to an existing system, or add a new signature engine to an existing system. A common access method and system for a plurality of different signature engines and a common system for a plurality of different signature engines that can be easily added without affecting a higher-level application even when a new signature algorithm is added. It is an object of the present invention to provide a storage medium storing a simple access program.

[0010]

FIG. 1 is a diagram for explaining the principle of the present invention. The present invention (claim 1) provides an electronic signature generation method using a signature engine in an information processing system having an electronic signature engine for creating an electronic signature using a public key encryption technique for a plaintext or a plaintext digest. In a common access method for a plurality of different signature engines for generating a key pair of a secret key / public key, a secret key management table for managing a plurality of secret key information is created (step 1). Registers and manages the dependent signature engine dependent information (step 2), receives an access request to the signature engine (step 3), obtains the specified key name (step 4),
Information necessary for key pair generation or signature creation corresponding to the key name is obtained from the secret key management table (step 5), and a key pair generation process or signature generation process is requested to an arbitrary signature engine (step 5). 6).

According to the present invention (claim 2), a signature engine type associated with a key name, a key storage location, a signature algorithm, a hash Acquires the information required for generating the signature of the algorithm, acquires the access module type corresponding to the acquired signature engine type information and the necessity information of the hashing of the input data from the signature engine dependent information. The hash data and key storage location of the data to be signed by the hash algorithm obtained from the secret management table and the key storage location, and the signature algorithm information, if the hashing is unnecessary, the signature target data, the key storage location, the signature algorithm and the hash Algorithm information to the signature engine via the selected access module Given, a signature generation request.

According to the present invention (claim 3), when a key pair is generated, a key name specified by a user is obtained, and a signature engine type and a key storage location associated with the key name are obtained from a secret key management table. , Obtaining information required for generating a key pair of a signature algorithm and a key parameter, obtaining access module type information corresponding to the obtained signature engine type from signature engine dependent information, and obtaining a key storage location, a signature algorithm, and a key parameter. The request is sent to the signature engine via the selected access module to request generation of a key pair, and the signature engine generates the requested key pair.

According to the present invention (claim 4), for a key name specified by a user, a signature engine type in which a secret key corresponding to the key name is stored, a key storage location, and a secret key are applied. The signature algorithm, key parameter information including the key length, and a hash algorithm type for hashing the signature target data at the time of signature generation are stored in the secret key management table.

FIG. 2 is a diagram showing the principle of the present invention. The present invention (claim 5) provides a method for generating an electronic signature using a signature engine in an information processing system having an electronic signature engine for creating an electronic signature using a public key encryption technique for a plaintext or a digest of the plaintext. And a common access system for a plurality of different signature engines for generating a key pair of a secret key / public key, wherein an arbitrary number of signature engines can manage a plurality of secret keys and use a plurality of digital signature algorithms. An electronic signature engine 200, a secret key management table creation unit 110 that creates a secret key management table 150 that manages a plurality of pieces of secret key information, and a signature that registers and manages signature engine dependent information that is information dependent on the signature engine. An engine-dependent information registration unit 130 and a section that receives an access request to the signature engine 200 and obtains a specified key name Engine access request receiving means 120
Secret key information reference means 140 for obtaining secret key information corresponding to a key name from the secret key management table 150 and information necessary for signature creation; and key pair generation processing or signature generation for an arbitrary signature engine. And a signature engine access control means 160 for requesting processing.

According to the present invention (claim 10), in the secret key information reference means 140, the secret key management table 150
Means for acquiring information necessary for generating a signature of a signature engine type, a key storage location, a signature algorithm, and a hash algorithm associated with the key name as information necessary for creating a signature corresponding to the key name; The engine access control means 160 obtains, from the signature engine dependent information, the access module type corresponding to the obtained signature engine type information and the necessity of hashing the input data from the signature engine dependent information. If the hash data and key storage location of the data to be signed by the hash algorithm obtained from the management table 150 and the key storage location and the signature algorithm information need not be hashed,
It has means for sending the signature target data, the key storage location, the signature algorithm and the hash algorithm information to the signature engine via the selected access module, and requesting signature generation.

According to the present invention (claim 11), a means for acquiring a key name designated by a user and a secret key management table 150 are provided.
Means for acquiring information required for generating a key pair of a signature engine type, a key storage location, a signature algorithm, and a key parameter associated with a key name, and an access module type information corresponding to the acquired signature engine type. A key pair generation requesting unit having means for obtaining the key storage location, signature algorithm, and key parameter via the selected access module to the signature engine, and requesting key pair generation; And generates the requested key pair in the signature engine.

According to the present invention (claim 8), in the secret key management table 150, the key name specified by the user is
A signature engine type in which a secret key corresponding to the key name is stored, a key storage location, a signature algorithm to which the secret key is applied, key parameter information including a key length, and a hash of the signature target data when the signature is generated. And a hash algorithm type to be converted.

The present invention (claim 9) provides an electronic information processing system having an electronic signature engine for creating a digital signature using a public key encryption technique for a plaintext or a plaintext digest. A storage medium storing a common access program for a plurality of different signature engines for generating a signature and for generating a key pair of a secret key / public key, wherein a secret key management table for managing a plurality of secret key information is stored. Registers and manages a secret key management table creation process to be created and signature engine dependent information that is information dependent on an arbitrary number of digital signature engines capable of managing a plurality of private keys and using a plurality of digital signature algorithms. A signature engine-dependent information registration process and a signature engine that accepts a request for access to the signature engine and acquires the specified key name Access request reception process, a secret key information reference process for obtaining secret key information corresponding to a key name from a secret key management table, and information necessary for signature creation, and a key pair generation process or an arbitrary signature engine. And a signature engine access control process for requesting a signature generation process.

According to a tenth aspect of the present invention, in the secret key information reference process, information necessary for creating a signature corresponding to the key name is stored in the secret key management table as a signature engine type associated with the key name. A key storage location, a signature algorithm, and a process for acquiring information necessary for generating a signature of a hash algorithm. In the signature engine access control process, the access module type corresponding to the acquired signature engine type information and the hashing of the input data are performed. The process of acquiring the necessity information from the signature engine-dependent information, and, if hashing is necessary, hashing the hash data and key storage location of the data to be signed by the hash algorithm acquired from the secret management table, and the signature algorithm information. If encryption is not required, the data to be signed, key storage , And a signature algorithm and the hash algorithm information, send via the access module selected to the signature engine, having a process of performing a signature generation request.

The present invention (claim 11) provides a process for acquiring a key name designated by a user, a signature engine type, a key storage location, a signature algorithm, and a key parameter associated with the key name from a secret key management table. A process for obtaining information required for generating a key pair of the above, a process for obtaining access module type information corresponding to the obtained signature engine type from signature engine dependent information, and a key storage location, a signature algorithm, and a key parameter are selected. A key pair generation request process having a process of sending to the signature engine via the access module and requesting a key pair generation.

According to the present invention (claim 12), for a key name specified by a user, a signature engine type in which a secret key corresponding to the key name is stored, a key storage location, and a secret key are applied. A secret key management table that holds a signature algorithm to be executed, key parameter information including a key length, and a hash algorithm type for hashing data to be signed at the time of signature generation.

As described above, according to the present invention, by setting the secret key management table at the time of initial setting, the upper-level application specifies only the key name of the secret key used for signature generation, and performs the signature processing for any signature engine. It becomes possible to determine information necessary for a request for generation or key pair generation. Also, by registering the signature engine dependent information, the information dependent on the signature engine is hidden in the secret key control unit,
The upper application can access the signature engine without being aware of the type of the signature engine.

Further, by the key pair generation processing, information on all the secret keys used by the system is centrally managed regardless of the storage destination of the secret key, the signature algorithm, etc., and the generation of each secret key and its secret The information required to generate a signature using a key is
The key name can be obtained as key information. Also, when a secret key used for signature generation is generated, a key pair generation request to an arbitrary signature engine can be made only by specifying only the key name of the secret key to be generated by the upper application.

When a higher-level application requests a signature engine to perform a signature generation process, a signature key storage location, a signature algorithm, a type of a signature engine to be used, and a process corresponding to the signature engine are performed. A signature generation request to the signature engine can be made only by designating the key name and the data to be signed without being conscious of the request method.

[0025]

FIG. 3 shows an access system configuration according to the present invention. As shown in the figure, a secret key control unit 100 for centrally managing a plurality of secret keys and controlling access to a plurality of signature engines is provided. The secret key used for signature generation can be sent to the secret key control unit 100 without being aware of the storage destination, the applicability of the secret key in the storage destination to the signature algorithm, and the determination of the necessity of hashing the input data. A signature generation request to an arbitrary signature engine can be made only by specifying the name.

The secret key control unit 100 sends a signature engine (A200 or B30)
0), a signature engine access request receiving unit 120 for receiving an access request, and a secret for managing information required for signature generation, such as a storage destination and a signature algorithm, for each of a plurality of secret keys used by the system. A key management table 150, a secret key management table creation unit 110 for generating the key management table 150, and a secret key information reference unit 140 for obtaining information required for generating a corresponding signature from the secret key management table 150 using a key name as key information A signature engine dependent information registration unit 130 for registering information dependent on the signature engine in advance, and an actual processing request via the access modules 170 and 180 to the signature engine storing the secret key. It comprises a signature engine access control unit 160.

Next, the operation of the present invention will be described. At first,
As a pre-process necessary to realize signature generation, a secret key management table 150 for centrally managing secret key information
A description will be given of the setting of information and the setting of information depending on the signature engine, and a key pair generation process for preparing a secret key used for signature generation.

1. FIG. 4 is a diagram for explaining the flow of processing when a key pair is generated in the present invention, and FIG. 5 shows an example of a secret key management table of the present invention. First, the operation at the time of system initialization will be described. (1) Setting of the private key management table 150 (step 1
01): At the time of system initialization, as shown in FIG.
For each of a plurality of secret keys used by the host application 400, a key name, a signature engine type in which the secret key corresponding to the key name is stored, key storage location information indicating a storage location therein, a signature to be applied Creates a secret key management table 150 for managing algorithm information, hash algorithm information for hashing data to be signed before signature generation processing, and key parameter information required for key pair generation such as key length. It is created using the unit 110.

Here, the signature engine type is an identifier for distinguishing the type of the signature engine, and the correspondence between the signature engine and this identifier is information which is fixedly held as a system. These pieces of information are information required when requesting the signature engine to generate a key pair or a signature. By setting information on all secret keys used by the higher-level application 400 in this table, the higher-level application 400 Only by designating the key name of the secret key used for signature generation, it becomes possible to determine information necessary for requesting signature generation or key pair generation for an arbitrary signature engine.

(2) Registration of signature engine-dependent information (step 102): At the time of initial setting of the system, information that depends on each signature engine used by the system is used as input data when requesting a signature generation. Information as to whether or not the data needs to be hashed and an access module type for accessing the signature engine are registered in the secret key control unit 100 in advance. This allows
The information depending on the signature engine is hidden in the secret key control unit 100, and the host application 400 can access the signature engine without being aware of the type of the signature engine. Here, the access module type is an identifier for distinguishing the type of the access module, and the correspondence between the access module and the identifier is information that is fixedly held as a system.

2. Next, an operation at the time of generating a key pair will be described. (1) Request of key pair generation by upper application 400 (step 103): After the above-mentioned initial setting of the system is completed, upper application 400 requests secret key control unit 150 to generate a key pair used for signature generation. . At this time, the higher-level application 400 determines which key pair is to be generated by the secret key management table 15 created earlier.
It is designated using the key name from the secret keys registered in 0.

(2) Signature Engine Access Request Accepting Process (Step 104): A request for a key pair generation from the host application 400 to the signature engine is received by using the signature engine access request receiving unit 120, and the key for which the generation request is requested Get name information. (3) Private key information reference processing (step 105): private key management using the private key information reference unit 140 in order to obtain information necessary for generating a key pair corresponding to the key name specified by the higher-level application 400 The table 150 is accessed, and the corresponding signature engine type, key storage location, signature algorithm, and key parameter information are acquired using the key name acquired in (2) as key information. As a result, only the key name is specified from the host application 400, and it becomes possible to prepare information necessary for requesting the signature engine to generate a key pair.

(4) Key pair generation request processing to the signature engine (step 106): The signature engine access control unit 10 requests the signature engine to perform key pair generation processing based on the information acquired in (3).
0, the type of access module to the signature engine corresponding to the signature engine type obtained in (3) is obtained from the signature engine dependent information, and the key storage location obtained in (3) is obtained through the access module. Requests the signature engine to generate a key pair using the signature algorithm and key parameter information. By this processing, a secret key corresponding to the key name designated by the upper application 400 is generated /
The access module to the signature engine to be stored is automatically selected, and it is possible to execute a key pair generation request according to the key pair generation request method in each signature engine.

(5) Key Pair Generation Processing (Step 10)
7): Based on the request of (4), key pair generation processing corresponding to the specified key parameter and signature algorithm is performed in the signature engine, and the secret key is stored in the specified storage location. By using the above processing and functions, regardless of the storage location of the secret key, the signature algorithm, etc., the information of all the secret keys used by the system is centrally managed,
Information necessary for generating each secret key and for generating a signature using the secret key can be obtained with the key name as key information. Further, according to the present invention, even when a secret key used for signature generation is generated, a key pair generation request to an arbitrary signature engine can be made by simply specifying only the key name of the secret key that the upper application 400 wants to generate. .

3. Next, a flow of a signature generation process using the secret key generated above will be described. FIG. 6 is a diagram for explaining the flow of the signature generation process according to the present invention. First, the operation at the time of signature generation processing will be described. (1) Signature generation request from upper application 400 (step 201): upper application 400
Is used when the signature generation is needed.
For 0, a signature generation request is made by designating the data to be signed and the key name used for the signature.

(2) Signature generation request reception processing (step 202): A request for signature generation from the host application 400 to the signature engine is received by using the signature engine access request reception unit 120, and the data to be signed and the signature are received. The key name information of the secret key to be used is obtained. (3) Private key information reference processing (step 203): The private key information reference unit 140 is used to obtain information necessary for generating a signature using a private key corresponding to the key name specified by the higher-level application 400. The private key management table 150 is accessed, and the corresponding signature engine type, key storage location, signature algorithm, and hash algorithm information are acquired using the key name acquired in (2) as key information. As a result, only the key name is specified from the upper-level application 400, and it becomes possible to prepare information necessary for requesting the signature engine to generate a signature.

(4) Signature generation request processing to the signature engine (step 204): The signature engine access control unit 160 is used to request the signature engine to generate a signature based on the information obtained in (3). Then, the access module type to the signature engine corresponding to the signature engine type obtained in (3) and the hashing necessity information of the data to be signed are obtained from the signature engine dependent information. If it is necessary for the selected signature access module to hash the data to be signed, the signature target data as input data is hashed by the hash algorithm acquired in (3). A request for signature generation is made to the signature engine by inputting the hash data, the key storage location and the information of the signature algorithm, and if hashing of the data to be signed is unnecessary,
A signature generation request is made to the signature engine by inputting the key storage location, the signature algorithm, and the hash algorithm information acquired in (3). By this processing, an access module to the signature engine storing the secret key corresponding to the key name designated by the higher-level application 400 is automatically selected, and signature generation for each signature engine such as necessity of hashing of input data is performed. It is possible to execute a signature generation request according to the request method.

(5) Signature generation processing (step 20)
5): In the signature engine, based on the request of (4),
The signature generation process is performed using the secret key in the designated key storage location, and the signature data is returned. By using the above processing and functions, the upper application 400
When requesting a signature generation process from the signature engine, the key name and signature can be obtained without being aware of the storage location of the secret key, the signature algorithm, the type of the signature engine to be used, and the processing request method according to the signature engine. A signature generation request to the signature engine can be made only by specifying the target data.

[0039]

Embodiments of the present invention will be described below with reference to the drawings. In this embodiment, the flow of a signature generation process using a signature engine will be described with reference to FIGS. FIG. 7 is a diagram for explaining the pre-processing of generating an electronic signature according to one embodiment of the present invention, and FIG. 8 shows a setting example of a secret key management table according to one embodiment of the present invention.

1. At system execution setting (1) Setting of private key management table (step 30)
1): At the time of system initialization, a secret key management table 150 as shown in the example of FIG. 8 is created, and for all the secret keys used in the system, key pair generation to the signature engine is performed. Register the information required for a signature generation request. Creation of such a table can be realized using, for example, a file editing function. FIG. 8 shows that, for example, a secret key having a key name of “KeyA” is stored in a location “# 3” of “signature engine A” 200,
The signature algorithm to be applied is “ESIGN”, and information such as “SHA-1” is used as the hashing algorithm of the signature target data at the time of signature generation and the key length is “120 bytes” is registered. This information is
It is determined in advance as a system policy at the beginning of the system.

(2) Registration of signature engine-dependent information (step 302): FIG. 9 shows an example of setting signature engine-dependent information according to one embodiment of the present invention. At the time of system initialization, a signature engine dependent information table 161 as shown in the example of FIG. 9 is created in the signature engine access control unit 160, and the signature engine used by the system is dependent on the signature engine. It registers the necessity of hashing the input data, which is the information to be performed, and the access module type information for accessing the signature engine. Creation of such a table can be realized using, for example, a file editing function. FIG. 9 shows that, for example, the “signature engine A” 200 indicates that the necessity of hashing of the input data is “no”, and the access module used when accessing the signature engine is “access module A”. Is meant to be used. These pieces of information are obtained by examining the specifications of the signature engine used in advance at the initial stage of the system.

2. Key pair generation request (1) Key pair generation request by upper application 400 (step 303): After the above-mentioned initial setting of the system is completed, the upper application issues a key pair generation process for signature generation to secret key control unit 100. Request by specifying the key name. In this embodiment, the upper application 40
Description will be made on the assumption that 0 requests generation of a key corresponding to the key name of “KeyA”.

(2) Signature Engine Access Request Accepting Process (Step 304): A key pair generation request to the signature engine is received from the host application 400, and it is recognized that the generation request target is the key name “KeyA”.
The reception of a request from the upper application 400 can be realized, for example, using a data communication function, and the analysis of the request content and the acquisition of key name information can be realized, for example, using a data analysis function. .

(3) Private Key Information Reference Processing (Step 3)
05): “K” specified by the host application 400
In order to obtain information required to generate a key pair corresponding to “KeyA”, the file of the private key management table 150 is accessed, and as information corresponding to “KeyA”, the signature engine type is “Signature engine A”. If the key storage location is "#
3 ", the signature algorithm is" ESIGN ", and the key length of the secret key is" 40 bytes "as a key parameter.
Get the information that is. Private key management table 15
The access to the file 0 can be realized using, for example, a file access function, and the acquisition of information corresponding to “KeyA” can be realized, for example, using a data search function.

(4) Key pair generation request processing to the signature engine (step 306): In order to request the signature engine to perform key pair generation processing, first, the signature engine type is obtained from the signature engine dependence information table 161 set at the time of initialization. The information of “access module A” which is the access module type corresponding to “signature engine A” is acquired. Thereafter, via this “access module A”, the key storage location “# 3” obtained in (3) and the signature algorithm “ES
IGN ", key parameter information" secret key length = 40 bytes "
Is sent to the “signature engine A” and a request for key pair generation is made. Acquisition of the access module type information from the signature engine dependent information table 161 can be realized, for example, using a data search function, and generation of input data to the access module can be realized, for example, using a data assembly function. is there. The transmission of the key pair generation request data to the signature engine is realized using, for example, a data communication function.

(5) Key Pair Generation Processing (Step 30)
7): “Signature engine A” 20 based on the request of (4)
In the case of “0”, the key pair “the key length of the secret key is 40 bytes” is generated by Kao applicable to “ESIGN”, and the generated secret key is stored in “# 3”. By the above processing, the upper-level application 400 can set the secret key management information used for signature generation and generate the secret key based on the information without being aware of the signature engine type, the signature algorithm, and the like.

3. At the time of signature generation processing Next, an example of the signature generation processing in the present invention will be described. FIG. 10 is a diagram for explaining the signature generation processing according to one embodiment of the present invention. (1) Signature generation request by upper application 400 (step 401): upper application 400
When the need to generate a signature arises, the secret key control unit 10
For 0, a signature generation request is made by designating the data to be signed and the key name of the secret key used for the signature. In the present embodiment, a description will be given on the assumption that the higher-level application 400 has issued a signature generation request by designating a secret key corresponding to the key name of “KeyA” as a secret key used for signature generation.

(2) Signature Generation Request Accepting Process (Step 402): A request for signature generation is received from the host application 400 to the signature engine, and the key name information of the signature target data and the private key used for the signature is “KeyA”. Recognize that. The reception of the request from the higher-level application 400 can be realized using, for example, a data communication function. The analysis of the request content and the acquisition of the key name information can be realized using, for example, a data analysis function. is there.

(3) Private Key Information Reference Processing (Step 4)
03): In order to obtain information necessary for generating a key pair corresponding to “KeyA” specified by the higher-level application 400, a file in the secret key management table is accessed, and the signature engine is used as information corresponding to “KeyA”. The type is “signature engine A” and the key storage location is “#
3 ", the signature algorithm is" ESIGN ", and the hash algorithm is" SHA-1 ". Access to the file in the secret key management table 150 can be realized, for example, using a file access function, and acquisition of information corresponding to “KeyA” can be realized, for example, using a data search function.

(4) Signature generation request processing to the signature engine (step 404): In order to request the signature engine to perform the signature generation processing, first, the signature engine type is obtained from the signature engine dependence information table 161 set at the time of initializing the system. The access module type “access module A” corresponding to the “signature engine A” and the information “no” indicating whether the input data needs to be hashed are obtained.
It is confirmed that the necessity of the hashing of the input data is “No”, and thereby the hashing process of the input data is not performed, and the key storage location “ # 3 ”and the signature algorithm“ ESIG
N ", information of a hash algorithm" SHA-1 ",
The signature target data is sent to "Signature Engine A",
Request signature generation. Signature engine dependent information table 1
Acquisition of the access module type information and the input data hashing necessity information from the input data 61 can be realized by using, for example, a data search function. The generation of input data to the access module can be realized using, for example, a data assembling function, and the transmission of key pair generation request data to the signature engine is performed using, for example, a data communication function. Is realized. If the necessity of hashing the input data is “necessary”,
For example, hash processing can be performed using a hash function implemented by software.

(5) Signature generation processing (step 40)
5): Based on the request of (4), “Signature engine A” 20
0, the data to be signed is hashed using a designated hash algorithm “SHA-1”, and the hash value is “ESI” using the secret key stored in “# 3”.
A signature is generated by encryption using a "GN" signature algorithm.

According to the above processing, when the higher-level application requests the signature engine to perform the signature generation processing, the key name and the data to be signed are simply specified in the private key management table 150, and any signature engine is designated. A request for signature generation becomes possible. Although the above embodiment has been described based on the configuration of FIG. 3, the secret key management table creating unit 110, the signature engine access request receiving unit 120, the signature engine dependent information registration unit 130, the secret key information reference unit 14
0. A secret key control unit 100 having a signature engine access control unit 160 is constructed as a program, and a disk device connected to a computer used as the secret key control unit, a floppy disk, a portable storage medium such as a CD-ROM, etc. The present invention can be easily realized by storing the information in a storage device and installing it when implementing the present invention.

It should be noted that the present invention is not limited to the above-described embodiments, and various modifications and applications are possible within the scope of the claims.

[0054]

As described above, according to the present invention, the upper-level application does not need to be aware of the type of the signature engine to be accessed for generating the signature, the storage location of the secret key, the signature algorithm, and the like. The unified interface of only target data makes it possible to request an arbitrary signature engine to generate a digital signature, so that multiple signature engines and multiple signature algorithms can be easily used properly Of course,
When a new signature engine or a new signature algorithm is added to an existing system, the addition can be easily performed without affecting a higher-level application.

[Brief description of the drawings]

FIG. 1 is a diagram for explaining the principle of the present invention.

FIG. 2 is a principle configuration diagram of the present invention.

FIG. 3 is a configuration diagram of an access system according to the present invention.

FIG. 4 is a diagram for explaining a flow of processing when generating a key pair in the present invention.

FIG. 5 is an example of a secret key management table of the present invention.

FIG. 6 is a diagram illustrating a flow of a signature generation process according to the present invention.

FIG. 7 is a diagram for explaining preprocessing for signature generation according to an embodiment of the present invention.

FIG. 8 is a setting example of a secret key management table according to an embodiment of the present invention.

FIG. 9 is a setting example of signature engine-dependent information according to an embodiment of the present invention.

FIG. 10 is a diagram illustrating a signature generation process according to an embodiment of the present invention.

FIG. 11 is a diagram showing a flow of digital signature generation and a configuration of a signature engine.

FIG. 12 is a diagram illustrating a flow of a conventional signature generation request processing to a signature engine.

[Explanation of symbols]

Reference Signs List 100 secret key control unit 110 secret key management table creation unit, secret key management table creation unit 120 signature engine access request receiving unit, signature engine access request reception unit 130 signature engine dependent information registration unit, signature engine dependent information registration unit 140 secret key Information reference means, secret key information reference section 150 Private key management table 160 Signature engine access control means, signature engine access control section 161 Signature engine dependent information 170 Signature access module A 180 Signature access module B 200 Signature engine, signature engine A 210 hash Processing unit 220 Signature generation unit 230 Private key storage unit 240 Key pair generation unit 300 Signature engine B 320 Signature generation unit 330 Private key storage unit 340 Key pair generation unit 400 Host application

Claims (12)

[Claims] 1. An information processing system having an electronic signature engine for creating an electronic signature using a public key encryption technique for a plaintext or a plaintext digest, generating an electronic signature using a signature engine and a secret key. / Create a private key management table that manages multiple private key information in a common access method for multiple different signature engines that generate key pairs of public keys, and register signature engine dependent information depending on the signature engine Receiving an access request to the signature engine, acquiring a designated key name, and acquiring information required for generating a key pair corresponding to the key name or creating a signature from the secret key management table. A plurality of different signature engines requesting a key pair generation process or a signature generation process from an arbitrary signature engine Common access method for. 2. The signature generation of a signature engine type, a key storage location, a signature algorithm, and a hash algorithm associated with the key name as information necessary for creating a signature corresponding to the key name from the secret key management table. The required information is obtained from the signature engine dependent information, and the access module type corresponding to the obtained signature engine type information and the necessity of hashing the input data are obtained from the signature engine dependent information. If the hash data and key storage location of the data to be signed by the hash algorithm obtained from the secret management table and the key storage location and the signature algorithm information are not required, the data to be signed, the key storage location, the signature algorithm and the hash algorithm The information is passed through the selected access module to the signature The common access method for a plurality of different signature engines according to claim 1, wherein the signature engine is sent to the engine and a signature generation request is made. 3. When generating the key pair, a key name specified by a user is obtained, and a signature engine type, a key storage location, a signature algorithm, and a signature engine associated with the key name are obtained from the secret key management table.
Obtaining information required for generating a key pair of a key parameter; obtaining access module type information corresponding to the obtained signature engine type from the signature engine-dependent information; the key storage location, the signature algorithm, and the key parameter 2. A common access to a plurality of different signature engines according to claim 1, wherein the request is sent to the signature engine via the selected access module to request generation of a key pair, and the signature engine generates the requested key pair. Method. 4. For the key name specified by the user, a signature engine type in which a secret key corresponding to the key name is stored, a key storage location, and a signature algorithm to which the secret key is applied. 4. The method according to claim 2, wherein key parameter information including a key length and a hash algorithm type for hashing the data to be signed at the time of signature generation are stored in the secret key management table. Common access method. 5. A method for generating an electronic signature using a signature engine in an information processing system having an electronic signature engine for creating an electronic signature using a public key encryption technique for a plaintext or a plaintext digest, and a secret key A common access system for a plurality of different signature engines for generating a key pair of a public key, and an arbitrary number of digital signature engines capable of managing a plurality of private keys and using a plurality of digital signature algorithms. A secret key management table creating means for creating a secret key management table for managing a plurality of secret key information; a signature engine dependent information registering means for registering and managing signature engine dependent information that is information dependent on the signature engine; A signature engine access request receiving means for receiving an access request to the signature engine and acquiring a specified key name; Secret key information corresponding to the key name from the secret key management table and secret key information reference means for obtaining information necessary for signature creation; and a key pair generation process or a signature generation process for an arbitrary signature engine. A common access system for a plurality of different signature engines, comprising a requesting signature engine access control means. 6. The secret key information reference means, as information necessary for creating a signature corresponding to the key name from the secret key management table, a signature engine type associated with the key name, a key storage location, Means for acquiring information required for signature generation of a signature algorithm and a hash algorithm, wherein the signature engine access control means determines whether an access module type corresponding to the obtained signature engine type information and hashing of input data are necessary. Means for obtaining information from the signature engine-dependent information; and, if hashing is necessary, hashing the hash data and key storage location of the data to be signed by the hash algorithm obtained from the secret management table, and the signature algorithm information. If the signature is unnecessary, the data to be signed, the key storage location, and the signature algorithm and 6. The common access system for a plurality of different signature engines according to claim 5, further comprising means for sending the signature engine and the hash algorithm information to the signature engine via the selected access module, and requesting a signature generation. 7. A means for acquiring a key name specified by a user, a signature engine type, a key storage location, a signature algorithm, and a signature engine associated with the key name from the secret key management table.
Means for obtaining information necessary for key pair generation of key parameters; means for obtaining access module type information corresponding to the obtained signature engine type from the signature engine dependent information; and the key storage location, the signature algorithm, And a means for sending the key parameter to the signature engine via the selected access module, and a means for requesting the generation of a key pair. 6. A common access system for generating a plurality of different signature engines according to claim 5. 8. The secret key management table includes: for the key name specified by the user, a signature engine type in which a secret key corresponding to the key name is stored;
8. A key storage location, a signature algorithm to which a secret key is applied, key parameter information including a key length, and a hash algorithm type for hashing signature target data at the time of signature generation. Common access system for several different signature engines. 9. A method for generating an electronic signature using a signature engine in an information processing system having an electronic signature engine for creating an electronic signature using a public key encryption technique for a plaintext or a plaintext digest, and a secret key A storage medium storing a common access program for a plurality of different signature engines for generating a key pair of a public key, and creating a secret key management table for managing a plurality of secret key information A signature engine dependent information registration process for registering and managing a process and signature engine dependent information that is information dependent on an arbitrary number of electronic signature engines capable of managing a plurality of private keys and using a plurality of digital signature algorithms. A signature engine access request for receiving an access request to the signature engine and acquiring a designated key name A reception process, a secret key information corresponding to the key name from the secret key management table, and a secret key information reference process for acquiring information necessary for signature creation, and a key pair generation process for an arbitrary signature engine, A storage medium storing a common access program for a plurality of different signature engines, comprising a signature engine access control process for requesting a signature generation process. 10. The secret key information reference process includes, as information necessary for creating a signature corresponding to the key name, a signature engine type associated with the key name, a key storage location, A signature algorithm, a process for acquiring information required for generating a signature of a hash algorithm, wherein the signature engine access control process comprises: determining whether an access module type corresponding to the acquired signature engine type information and hashing of input data are required. A process of obtaining information from signature engine-dependent information; and, if hashing is required, hashing the hash data and key storage location of the data to be signed by the hash algorithm obtained from the secret management table, and the signature algorithm information. Is not required, the data to be signed, the key storage location, 10. A common access program for a plurality of different signature engines according to claim 9, further comprising a process of sending signature algorithm and hash algorithm information to the signature engine via a selected access module and requesting a signature generation. Storage medium. 11. A process for obtaining a key name specified by a user, a signature engine type, a key storage location, a signature algorithm, and a signature engine associated with the key name from the secret key management table.
A process of acquiring information necessary for key pair generation of a key parameter; a process of acquiring access module type information corresponding to the acquired signature engine type from the signature engine dependent information; a key storage location; the signature algorithm; And transmitting the key parameter to the signature engine via the selected access module, and requesting a key pair generation. 10. The common key generation process according to claim 9, further comprising: Storage medium storing various access programs. 12. For the key name specified by the user, a signature engine type in which a secret key corresponding to the key name is stored, a key storage location, and a signature algorithm to which the secret key is applied. 11. A process using the secret key management table for holding key parameter information including a key length and a hash algorithm type for hashing data to be signed at the time of signature generation.
1. A storage medium storing a common access program for a plurality of different signature engines according to 1.