JP2003244137A - Method of verifying electronic signature - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To enable an accepting means to permanently verify an authentication certificate without being restricted by the expiration date of the authentication certificate by a creating means. <P>SOLUTION: A creating means 1 creates a document A including an electronic document 3 and an electronic signature 31 having a creator authentication certificate 311 (1), and issues a request to a certification authority 5 to certificate a fact that the electronic signature of the document A was done (2). The certification authority 5 verifies whether or not the authentication certificate 311 is valid at the time point of the certification using a PKI 6 (3) and (4); issues and sends a digital receipt 4 of the certification authority 5 including an authentication certificate 411 and a certification fact 42 having a verified result 422 to the creating means 1 (5). The creating means 1 creates a document B corresponding to an integrated combination of the document A and the digital receipt 4 (6), and sends the document B to an accepting means 2 (7). The accepting means 2 verifies the validity of the digital receipt 4 using the PKI 6 if the valid date is within the valid duration of he authentication certificate 411 (8) and (9); and if the valid date is out of the valid duration, verifies the electronic signature by the verification (10) and (11) using the certification authority 5. <P>COPYRIGHT: (C)2003,JPO

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention verifies whether or not an electronic certificate with a digital signature created by a creating means is valid at the time of signature by an authentication certificate of the creating means that has made an electronic signature. The present invention relates to a method for verifying an electronic signature that includes facts in notarized facts and can prevent the validity confirmation of an electronic signature after the expiration date of an authentication certificate of a creation means from being lost.

[0002]

2. Description of the Related Art As a conventional technique, when the creating means creates an electronic document with an electronic signature, and the electronic signature and the authentication certificate used when the creating means makes the electronic signature are attached to the document, There is a method for verifying the validity of the authentication certificate used when the electronic signature and the creating means make an electronic signature for each document on the receiving means side of the electronic document with the electronic signature.

[0003]

However, conventionally, even if the receiving means tries to verify the authentication certificate used for the digital signature in order to verify the digital signature, only the information at the present time is obtained, and the digital signature is obtained. There is no way to know if it was valid at. Therefore, there is a problem that the validity of the electronic signature cannot be verified after the expiration date of the authentication certificate. The present invention has been devised in view of the above problems, and adds validity information of an authentication certificate that is not bound to the expiration date of the authentication certificate on the creating means side to the authentication means on the receiving means side. The purpose of the present invention is to provide a method of verifying a digital signature that can be verified permanently and that can be verified by a common processing procedure that does not depend on notarized facts.

[0004]

In order to solve the above-mentioned problems, in the method of verifying an electronic signature according to the invention of claim 1, the creating means is a document of an electronic document with an electronic signature including an authentication certificate of the creator. Step (1), the creating means requests the notarization of the fact that the electronic signature of the document has been made to the notary office (2), the notary authority makes the certification certificate of the creator valid at the time of notarization. Step (3) (4) of verifying whether or not it is using PKI (Public Key Infrastructure), the notary authority asks whether or not the authentication certificate of the creator is valid at the time of notarization.
Issuing a digital receipt, which is an electronic document with a digital signature including a certification certificate of the notary authority that describes the notarization fact, having a verification result verified by using KI (public key infrastructure), and creating it Steps to send to the means
(5), the creating means adds a digital receipt to the document to create an integrated document (6), the creating means sends the document to the receiving means (7),
If the receiving means validates the validity of the digital receipt within the validity period of the certification certificate of the notary authority, using the PKI (Public Key Infrastructure) step (8) (9), if it is outside the validity period It is characterized in that the electronic signature is verified by the steps (10) and (11) of verifying using a notary authority.

Further, in the method of verifying an electronic signature according to the invention of claim 2, the creating means creates a document of an electronic document with an electronic signature including the creator's authentication certificate (1), the creating means comprises: Requesting notarization of the fact that the electronic signature on the document has been made from the notary office (2), the notary office checks whether the certification certificate of the creator is valid at the time of notarization.
Verification using KI (Public Key Infrastructure) (3) (4),
The notarization authority's authentication certificate that describes the notarization fact, which has the verification result of whether the creator's authentication certificate is valid at the time of notarization using PKI (public key infrastructure). Step (5) of issuing a digital receipt that is an electronic document with an electronic signature to the creating means, and sending the digital receipt to the creating means, the creating means sends the digital receipt issued by the notary office to the receiving means. A step (6) of recording in a referenceable recording means, a step (7) of the recording means notifying the creating means of a URL capable of specifying the stored digital receipt, and the creating means having the URL in the document.
(8) to add a document to create an integrated document, and the creating means sends the document to the receiving means (9)
The receiving means sends the URL included in the document and added to the document by the creating means to the recording means (10), the receiving means extracts the digital receipt indicated by the URL from the recording means. (11) Steps for the receiving means to verify the validity of the digital receipt using PKI (Public Key Infrastructure) if it is within the validity period of the certification certificate of the Notary Authority (12) (13), outside the validity period If so, the digital signature is verified by the steps (14) and (15) of verifying using a notary authority.

Further, in the method of verifying an electronic signature according to the third aspect of the present invention, the creating means creates a document of an electronic document with an electronic signature including the creator's authentication certificate. Requesting notarization of the fact that the electronic signature on the document has been made from the notary office (2), the notary office checks whether the certification certificate of the creator is valid at the time of notarization.
Verification using KI (Public Key Infrastructure) (3) (4),
The notarization authority's authentication certificate that describes the notarization fact, which has the verification result of whether the creator's authentication certificate is valid at the time of notarization using PKI (public key infrastructure). Issuing a digital receipt, which is an electronic document with an electronic signature including, and recording it in a recording means that can be referred to by the receiving means (5), the recording means notifies the notary office of the URL that can identify the digital receipt. Steps to do
(6) Step in which the notary office notifies the creating means of the URL for identifying the stored digital receipt (7), and the creating means adds the URL to the document to create an integrated document (8) ), The creating means sends the document to the receiving means (9), the receiving means 2 sends the URL included in the document and added to the document by the creating means to the recording means (10), The receiving means extracts the digital receipt indicated by the URL from the recording means (11), and if the receiving means has the validity of the digital receipt within the validity period of the certification certificate of the notary authority, the PKI
Steps (12) (13) for verification using (Public Key Infrastructure), and steps (14) for verification using the CA if it is outside the valid period
The feature of (15) is that the electronic signature is verified.

[0007]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS A first embodiment of a digital signature verification method according to the present invention will be described with reference to FIGS. FIG. 1 relates to a first embodiment of a method for verifying an electronic signature according to the present invention, which is performed based on the following procedure (step). Step (1) is a step in which the creating unit 1 creates the document A of the electronic document 3 with the electronic signature 31 including the authentication certificate 311 of the creator who intends to send the receiving unit 2. The creating means 1 is, for example, a personal computer of a document creator,
The receiving means 2 is, for example, the personal computer of the personal computer of the document creator that receives the documents and data. Step (2) is
This is a step in which the creating means 1 sends the document A to the notarization office 5 and requests the date and time when the document with the electronic signature, which is the notarization of the fact, has been created. In steps (3) and (4), the notary authority 5 determines whether or not the authentication certificate 311 of the creator is valid at the time of notarization, which is the server PKI (public key infrastructure) 6
(3) is the step of sending from the public certificate authority 5 to the PKI (public key infrastructure) 6 in this step, and (4) is the opposite. Step (5) is notary 5
Of the notarization bureau 5 which has the notarization fact 42, which has the verification result 422 verified by using the PKI (public key infrastructure) 6 as to whether or not the authentication certificate 311 of the creator is valid at the time of notarization. This is a step of issuing a digital receipt 4 which is an electronic document with an electronic signature 41 including an authentication certificate 411 to the creating means 1 and sending it to the creating means 1. Step (6)
Is a step in which the creating means 1 adds the digital receipt 4 to the document A to create an integrated document B.
In (7), the creating means 1 sends the document B to the receiving means 2, and in steps (8) and (9), the receiving means 2 verifies the validity of the digital receipt 4 by an authentication certificate of the notary authority 5. If it is within the valid period of 411, it is a step of verifying using PKI (public key infrastructure) 6, of which (8) is transmission from the receiving means 2 to PKI (public key infrastructure) 6 in the step,
(9) is the opposite. Steps (10) and (11) are the steps of verifying by using the notary bureau 5 if it is out of the valid period. Among them, (10) is the step of sending from the receiving means 2 to the notary bureau 5 in the step (11 ) Is the opposite. With the configuration of the steps as described above, the receiving means 2 side can verify the signature fact without using the authentication certificate.
Also, it is not necessary to contact the notary authority 5 for verification of the electronic signature within the expiration date of the authentication certificate issued by the notary authority 5, and if the authentication certificate issued by the notary authority 5 expires, go to the notary authority 5. By inquiring, the electronic signature can be verified. In the authentication certificate 311 of the creator, an expiration date including a start date and an end date and time is set. Since the validity of the authentication certificate 311 is guaranteed only within this expiration date, the authentication certificate must be valid when the electronic signature is made, but the receiving means cannot know this. Absent. Therefore, in the notary authority 5, when the fact of the electronic signature is notarized, the validity of the authentication certificate 311 is also checked and is described in the notarized fact. It becomes possible to know the effectiveness. The electronic document 3 is a document recorded as digital information on an electronic recording medium, and requires verification of an electronic signature after a considerable period of time, for example, several years, such as a contract, law, or notification. , And other similar documents and data are input by a predetermined means.
The electronic signature 31 is data added to guarantee the validity of electronic information such as a message or a document, and uses a secret key of a public key cryptosystem to ensure the integrity of the electronic document (message). This is a technology that guarantees that the electronic document is signed with a private key and the signature result is attached. Then, the person who receives the electronic document can check whether the electronic document has been tampered with by using the public key paired with the private key to return the signature data to the electronic document. The notary authority 5 is of course not limited to an institution that aims to perform notarization that performs the same function as the notary system, but is not necessarily limited to this, and is not directly regulated by the law. , Institutions that perform notarization by specific organizations or groups are also included. Furthermore, the digital receipt 4 is an electronic document in which the fact that the notary authority 5 certifies has been electronically signed by the notary authority 5, and the issuance of the digital receipt 4 requires the electronic document that describes the fact to be certified. It is created and digitally signed with the private key of the notary authority 5, which is a general work of creating an electronic document with an electronic signature. Further, the contents of the fact to be proved, which is an electronic document to be signed, are changed depending on the contents of the fact to be confirmed and the proof means. In addition, the PKI (Public Key Infrastructure, Public Key I
nfrastmcture) 6 is an authentication system that uses a digital signature based on public key cryptography. The PKI 6 is a broad concept that refers to the overall infrastructure required to realize an application using the public key cryptosystem. Further, the verification of the electronic signature is performed by the signer from the PKI (public key infrastructure) 6, for example, by obtaining the public key of the public notary office 5, and the receiving means verifies the electronic signature using the public key. All the actions necessary for verification of proof are the PKI6.
Is not done by.

Next, a second embodiment of the electronic signature verification method according to the present invention will be described with reference to FIG. The second embodiment is a procedure of adding only the URL 32 of the digital receipt 4, and the disclosure of the digital receipt 4 is made by the creating means 1. Instead of sending the digital receipt 4 itself directly, it can be referred to a place where it can be referred to. This is a method of verifying an electronic signature which is stored and notified only of the URL 32. In the second embodiment, the steps (1) to (5) are the first
The description is omitted because it has the same configuration as the embodiment of
It is composed of steps (1) to (5) and steps (6) to (15) below. Step (6)
Is a step in which the creating means 1 records the digital receipt 4 issued by the notary authority 5 in the recording means 7 of another server which the receiving means 2 can refer to. Step (7)
Is a step of notifying the creating means of the URL 32 that can specify the digital receipt 4 stored in the recording means 7.
In step (8), the creating means 1 adds the URL 3 to the document A.
This is a step of adding 2 to create an integrated document C. Step (9) is a step in which the creating means 1 sends the document C to the receiving means 2. In the step (10), the receiving means 2 is included in the document C, the document A in the creating means 1
Is a step of sending the URL 32 added to the recording means 7 to the recording means 7, and a step (11) is a step of the receiving means 2 taking out the digital receipt 4 indicated by the URL 32 from the recording means 7. Steps (12) and (13) are for receiving means 2
Is within the validity period of the certification certificate of the notary authority 5, the digital signature of the digital receipt 4 included in the document B is
This is a step of verifying using the KI (public key infrastructure) 6 and verifying the electronic signature only with the verification result of the verification by the PKI 6, of which (12) is the sending from the receiving means 2 to the PKI 6 in the step, ( 13) is the opposite. In the steps (14) and (15), if the validity of the certification certificate of the notary authority is out of the valid period, the validity of the digital receipt 4 included in the document B is inquired to the notary authority 5 to verify the validity of the digital signature. This is a verification step, of which (15) is the sending from the receiving means 2 to the notary bureau 5 in the step, (14)
Is the opposite. Then, in the second embodiment, the electronic signature is verified by the above steps. The URL
The (Uniform Resource Identifiers) 32 is a type of addressing method for identifying an object on the Internet, and includes URL and the like used for identifying a resource on the Web. The URL 32 generally has a much smaller data amount than the digital receipt 4 itself. As described above, in the second embodiment, the creating means 1
Is configured to store the digital receipt 4 in the recording means 7.

A third embodiment of the electronic signature verification method according to the present invention will be described with reference to FIG. In the third embodiment, only the URL 32 of the digital receipt 4 is added, and the digital receipt 4 is disclosed by the notary authority 5. In the second embodiment, the creating means stores the digital receipt 4 in the recording means.
In the third embodiment, the notary bureau 5 itself provides the storing means and the reference information (URL 32) for the recording means of the digital receipt 4 to the creating means. In the third embodiment, (1)-
The description of the procedure (4) is omitted because it has the same configuration as that of the first embodiment, but the procedure (step) of (1) to (4) above is omitted.
And the following steps (5) to (15). In step (5), the notary authority 5 determines whether or not the certification certificate 311 of the creator is valid at the time of notarization.
A digital receipt 4 that is an electronic document with an electronic signature 41 including a certification certificate 411 of the notary authority 5 that describes the notarized fact 42 and has a verification result 422 verified using (public key infrastructure) 6.
Is issued and is recorded in the recording means 7 which can be referred to by the receiving means 2. The step (6) is a step in which the recording means 7 notifies the notary authority 5 of the URL 32 that can identify the digital receipt 4. Step (7)
Is a step of notifying the creating means 1 of the URL 32 that can identify the digital receipt 4 stored by the notary authority 5.
In step (8), the creating means 1 adds the URL to the document A.
This is a step of adding 32 to create an integrated document C. Step (9) is a step in which the creating means 1 sends the document C to the receiving means 2. Step (10) is a step in which the receiving means 2 sends the URL 32 included in the document C and added to the document A in the creating means 1 to the recording means 7. In step (11), the receiving means 2 causes the recording means 7 to display the digital receipt 4 indicated by the URL 32.
Is the step of taking out. Steps (12) and (13) are steps in which the receiving means 2 verifies the validity of the digital receipt 4 using the PKI (public key infrastructure) 6 if it is within the validity period of the certification certificate of the notary authority, Of these, (12) is the sending from the receiving means 2 to the PKI6 in the step, (13)
Is the opposite. Steps (14) and (15) are steps in which the receiving means 2 verifies the validity of the digital receipt 4 by using the notary certification authority 5 if it is outside the validity period of the certification certificate of the notary certification authority. Among these, (14) Is the sending from the receiving means 2 to the notary bureau 5 in the step, and (15) is the opposite. And the third
In the embodiment, the electronic signature is verified by the above steps.

[0010]

As described above, the present invention has the following effects. (1) According to the invention of claim 1, in the creating means, a digital receipt is added to the electronic document with the electronic signature to create an integrated document, and this document is sent to the receiving means. In the receiving means, the validity information of the authentication certificate, that is, the validity of the authentication certificate in the creating means at the time of signature by the CA is irrespective of the expiration date of the authentication certificate of the creating means that has performed the electronic signature. Since the digital receipt is added with the verification result, the validity of the electronic signature at the time of signature can be verified irrespective of whether it is within the expiration date or not. (2) Further, according to the invention of claim 1, since the electronic signature of the digital receipt is verified by using PKI (public key infrastructure) or a public certificate authority, when the receiving means verifies the electronic signature, , It is possible to perform permanent verification by ignoring the expiration date of the authentication certificate of the creation method. Furthermore, the verification process can be performed by a common processing procedure that does not depend on the type of notarized fact. (3) Further, according to the invention of claim 1, the processing amount required for the verification of the electronic document with the electronic signature in the receiving means can be reduced. Furthermore, it is possible to realize verification of notarized facts of different types by a unified procedure.

(4) According to the second aspect of the present invention, the digital receipt itself is not directly sent, but the digital receipt is stored in a referable place and only the URL is notified. In general, since the URL has a much smaller data amount than the digital receipt itself, the receiving means adds the URL to the electronic document with the electronic signature (see document A in FIG. 2) to form an integrated electronic document (document C in FIG. 2). The cost of receiving and storing the
The cost can be reduced as compared to the processing procedure of adding a digital receipt to an electronic document with an electronic signature (see document A in FIG. 1) and handling an integrated electronic document (see document B in FIG. 1) in the first invention. (5) According to the invention of claim 2, in the creating means, an electronic document with an electronic signature is added with a URL that can be referred to by the receiving means side of the digital receipt to create an integrated document, and this document is created. Send to the receiving means. In the receiving means, the validity information of the authentication certificate, that is, the validity of the authentication certificate in the creating means at the time of signature by the CA is irrespective of the expiration date of the authentication certificate of the creating means that has performed the electronic signature. Since the digital receipt is added with the verification result, the validity of the electronic signature at the time of signature can be verified irrespective of whether it is within the expiration date or not. (6) Further, according to the invention of claim 2, since the electronic signature of the digital receipt is verified by using PKI (Public Key Infrastructure) or notary authority, when the receiving means verifies the electronic signature, , It is possible to perform permanent verification by ignoring the expiration date of the authentication certificate of the creation method. (7) According to the invention of claim 2, the verification process can be implemented by a common processing procedure that does not depend on the type of notarized fact. Furthermore, it is possible to realize verification of notarized facts of different types by a unified procedure.

(8) According to the invention of claim 3, since the notarization office itself directly records the digital receipt in the recording means, and the receiving means directly refers to the recording means, the creating means has the electronic signature. When creating and sending an integrated electronic document (see Document C in FIG. 3) by adding a URL to an electronic document, an electronic document with an electronic signature (see Document A in FIG. 2) and a UR
Only L needs to be handled, and the cost of processing in the creating means can be reduced as compared with the processing procedure for handling the digital receipt itself in the invention of claim 1 and the invention of claim 2. (9) According to the invention of claim 3, in the creating means, an electronic document with an electronic signature is added with a URL that can be referred to by the receiving means side of the digital receipt to create an integrated document, and this document is created. Send to the receiving means. In the receiving means, the validity information of the authentication certificate, that is, the validity of the authentication certificate in the creating means at the time of signature by the CA is irrespective of the expiration date of the authentication certificate of the creating means that has performed the electronic signature. Since the digital receipt is added with the verification result, the validity of the electronic signature at the time of signature can be verified irrespective of whether it is within the expiration date or not. (10) Further, according to the invention of claim 3, since the electronic signature of the digital receipt is verified by using PKI (Public Key Infrastructure) or a public certificate authority, when the receiving means verifies the electronic signature, , It is possible to perform permanent verification by ignoring the expiration date of the authentication certificate of the creation method. (11) According to the invention of claim 3, the verification process can be implemented by a common processing procedure that does not depend on the type of notarized fact. Furthermore, it is possible to realize verification of notarized facts of different types by a unified procedure.

[Brief description of drawings]

FIG. 1 is a schematic diagram of a first embodiment of the present invention.

FIG. 2 is a schematic diagram of a second embodiment of the present invention.

FIG. 3 is a schematic diagram of a third embodiment of the present invention.

[Explanation of symbols]

A, B, C documents 1 making means 2 Receiving means 3 electronic documents 31 Digital signature of creator 32 URL 311 Author's authentication certificate 4 Digital receipt 41 Electronic signature of notary office 411 Certificate of Certification of Notary Office 42 Notarized facts 422 Verification result of the authentication certificate of the creator 5 Notary Office 6 PKI (Public Key Infrastructure) 7 Recording means

Claims (3)

[Claims] 1. A step (1) in which the creating means creates a document of an electronic document with an electronic signature including an authentication certificate of the creator, and the creating means provides a notarization of the fact that the electronic signature related to the document has been made. Step (2) of requesting the certificate from the certification authority to verify whether the certification certificate of the creator is valid at the time of notarization using PKI (public key infrastructure) (3) (4), The notarization authority's authentication certificate that describes the notarization fact, which has the verification result of whether the creator's authentication certificate is valid at the time of notarization using PKI (public key infrastructure). Step (5) of issuing a digital receipt that is an electronic document with a digital signature to the creating means and sending it to the creating means, the creating means adds a digital receipt to the document to create an integrated document. Creating step (6), the creating means Step of sending to the receiving means
(7) Steps for the receiving means to verify the validity of the digital receipt using PKI (Public Key Infrastructure) if it is within the valid period of the certification certificate of the notary authority (8) (9), outside the valid period If it is, a method of verifying an electronic signature is characterized in that the electronic signature is verified by the steps (10) and (11) of verifying using a notary authority. 2. A step (1) in which the creating means creates a document of an electronic document with an electronic signature including the creator's authentication certificate.
A step of requesting the notary of the fact that the electronic signature of the document has been made by the producing means to the notary authority (2), the notary authority deciding whether or not the certification certificate of the creator is valid at the time of notarization, Steps (3) (4) to verify using PKI (Public Key Infrastructure), the notary authority uses PKI (Public Key Infrastructure) to check whether the creator's authentication certificate is valid at the time of notarization. Step (5) of issuing a digital receipt, which is an electronic document with an electronic signature including the certification certificate of the notary bureau stating the notary facts and having the verification result verified by A step (6) in which the creating means records the digital receipt issued by the notary authority in a recording means that can be referred to by the receiving means, and the recording means notifies the creating means of a URL by which the stored digital receipt can be specified. Step (7), Step (8) in which the creating unit adds the URL to the document to create an integrated document, and Step in which the creating unit sends the document to the receiving unit
(9), a step of sending the URL included in the document and added to the document by the creating means to the recording means (1)
0), the receiving means retrieves the digital receipt indicated by the URL from the recording means (11), if the receiving means has the validity of the digital receipt within the validity period of the certification certificate of the notary authority. The verification of the electronic signature is performed by the steps (12) and (13) of verifying using PKI (public key infrastructure), and the steps (14) and (15) of verifying using a notary authority if it is outside the valid period. Characteristic digital signature verification method. 3. A step (1) in which the creating means creates a document of an electronic document with a digital signature including an authentication certificate of the creator.
A step of requesting the notary of the fact that the electronic signature of the document has been made by the producing means to the notary authority (2), the notary authority deciding whether or not the certification certificate of the creator is valid at the time of notarization, Steps (3) (4) to verify using PKI (Public Key Infrastructure), the notary authority uses PKI (Public Key Infrastructure) to check whether the creator's authentication certificate is valid at the time of notarization. Issuing a digital receipt, which is an electronic document with an electronic signature including the certification certificate of the notary authority that states the notarization facts and has the verification result verified by the above, and recording this in a recording means that can be referred to by the receiving means (5 ), A step in which the recording means notifies the notary authority of the URL with which the digital receipt can be specified (6), the UR with which the notary authority can specify the stored digital receipt
Step (7) of notifying L to the creating means, Step of creating the document by adding the URL to the document (8), Step of sending the document to the receiving means (9)
A step of sending the URL included in the document and added to the document by the creating means to the recording means (1)
0), the receiving means retrieves the digital receipt indicated by the URL from the recording means (11), if the receiving means has the validity of the digital receipt within the validity period of the certification certificate of the notary authority. Steps (12) (13) for verification using PKI (Public Key Infrastructure), and steps (1) for verification using a notary authority if the period is not valid
4) A method for verifying an electronic signature, characterized in that the electronic signature is verified according to (15).