JP2005051636A - Method, apparatus and computer program for supporting signature verification, and recording medium - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To support the verification of an electronic signature with an electronic certificate by issuing the electronic certificate of an authentication station that has no mutual authentication relation by operability identical to that exhibited when the authentication station has a mutual authentication relation. <P>SOLUTION: A user device 1 continuously performs a step for applying to an authorization and authentication station 4 for the issuing of an electronic certificate about a public key 1, 002 corresponding to a private key 1, 001 used in an electronic signature 1, 201, and a step for transferring an electronic certificate 4, 100 issued from the authorization and authentication station 4 to a bank server 3. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to a signature verification support method, apparatus, computer program, and recording medium for verifying an electronic signature attached to an electronic document.

  In recent communications, electronic authentication is performed in which an electronic document is attached with an electronic signature and transmitted, and the electronic signature is verified on the receiving side, so-called identity verification.

Explaining in detail, for example, an electronic document that Mr. A wishes to open a bank account, an electronic signature generated with Mr. A's private key, and an electronic certificate for which the certified certificate authority certifies the public key corresponding to the private key When Mr. A's computer sends the certificate to the bank server, the bank server verifies the electronic signature with the public key extracted from the electronic certificate, that is, opens the bank account of Mr. A when the identity is confirmed. Similar techniques are described in Patent Documents 1 and 2 below.
JP 2003-30358 A JP 2002-366748 A

  By the way, even if a certificate authority that is not a certified certificate authority, for example, an electronic certificate of a public certificate authority, is sent to the bank server, the certificate authority certificate and revocation information file are only sent to the administrative agency and the certificate authority. Since it is provided, the bank server cannot verify the validity of the transmitted electronic certificate. Therefore, Mr. A's computer must first apply for the issuance of an electronic certificate from an authorized certificate authority.

  Mr. A operates the computer to access the accredited certificate authority and applies for the issuance of an electronic certificate. When the electronic certificate is issued, Mr. A operates the computer to access the bank server this time. Send an electronic certificate issued by the station. This makes it possible to open a bank account. With this method, Mr. A is forced to perform complicated computer operations, such as an operation for a certified certificate authority and an operation for a bank server.

  In addition, by issuing mutual certification, that is, by issuing a mutual certification certificate of a certification authority that is not a certified certification authority (that is, by issuing a mutual certification certificate of a public personal certification authority) There should be a mechanism that enables the server to verify digital certificates issued by certificate authorities that are not accredited certificate authorities, but this mutual authentication mechanism is not permitted for private use. Similarly, the validity verification of certificates issued by public personal certificate authorities has not been opened to the private sector.

  Accordingly, the present invention has been made in view of the above-described conventional problems, and its purpose is to issue an electronic certificate of a certificate authority that is not in a mutual authentication relationship with the same operability as in a mutual authentication relationship. Another object of the present invention is to provide a signature verification support method, apparatus, computer program, and recording medium that support the verification of an electronic signature using the electronic certificate.

  In order to solve the above-described conventional problems, the present invention of claim 1 is directed to at least a second computer when an electronic certificate issued by a first certificate authority is required by a first computer for verifying an electronic signature. Applying to the first certificate authority for issuing an electronic certificate for a public key used for the electronic signature or corresponding to a private key used for the electronic signature; The signature verification support method is characterized in that the second computer continuously executes the step of transferring the electronic certificate issued from the first certificate authority to the first computer.

  According to the present invention of claim 1, the step of applying to the first certificate authority for issuance of an electronic certificate for a public key used for an electronic signature or corresponding to a private key used, Since the second computer continuously executes the step of transferring the electronic certificate issued from the certificate authority to the first computer, the electronic certificate of the certificate authority that is not in the relationship of mutual authentication is related to the mutual authentication relationship. The digital certificate can be issued with the same operability as in the above, and the verification of the electronic signature can be supported by the electronic certificate.

  The present invention of claim 2 is a signature verification support method performed by at least a second computer when an electronic certificate issued by a first certificate authority is required on the first computer for verifying an electronic signature. The first certificate authority for the public key included in the electronic certificate issued by the second certificate authority corresponding to the private key used or used for the electronic signature and not the first certificate authority Applying to the first certificate authority for issuance of an electronic certificate of the first certificate, and transferring the electronic certificate issued from the first certificate authority to the first computer. A signature verification support method characterized in that is executed continuously.

  According to the present invention of claim 2, the public key included in the electronic certificate issued by the second certificate authority corresponding to the private key used or used for the electronic signature and not the first certificate authority A step of applying to the first certificate authority for issuance of an electronic certificate of the first certificate authority and a step of transferring the electronic certificate issued from the first certificate authority to the first computer; Because the computer of the system runs continuously, the certificate authority's digital certificate that is not in the mutual authentication relationship is issued with the same operability as in the mutual authentication relationship, and the digital signature is verified by the digital certificate. Can help.

  According to a third aspect of the present invention, the electronic certificate issued by the first certificate authority is deleted by the second computer when verification of the electronic signature is no longer necessary in the first computer. The signature verification support method according to claim 1 or 2 is used as a solution means.

  According to the present invention of claim 3, when the verification of the electronic signature is no longer necessary in the first computer, the second computer deletes the electronic certificate issued from the first certificate authority. It is possible to prevent the remaining electronic certificate from being reused. Moreover, the management of the electronic certificate becomes unnecessary.

  According to the present invention of claim 4, the first computer inquires of the first certificate authority about the validity of the transferred electronic certificate, and the first certificate authority checks the validity of the electronic certificate. The signature verification support method according to any one of claims 1 to 3 is used as a solution means.

  According to the present invention of claim 4, the first computer inquires the first certificate authority about the validity of the transferred electronic certificate, and the first certificate authority answers the validity of the electronic certificate. It is possible to prevent a revoked electronic certificate from being reused.

  According to the present invention of claim 5, when the electronic certificate issued by the first certificate authority is required by the first computer for verifying the electronic signature, the first certificate authority issues the electronic certificate. A signature verification support method for supporting verification of an electronic signature by performing an electronic certificate issued by a second certificate authority that is not the first certificate authority and a private key used or used for the electronic signature When an electronic certificate issuance application form with an electronic signature for applying to issue an electronic certificate for a public key corresponding to is transmitted from a second computer that is not the first computer, the first authentication A step in which the station attempts to verify the electronic signature with the public key included in the transmitted electronic certificate, and the first certificate authority is included in the electronic certificate issuance application form when the electronic signature can be verified. To the key There the solutions with the signature verification support method characterized by comprising the steps of generating an electronic certificate issued to the second computer of.

  According to the present invention of claim 5, an electronic certificate issued by a second certificate authority that is not the first certificate authority and an electronic certificate for a public key used for or used for an electronic signature When an electronic certificate issuance application form with an electronic signature for applying for issuance is transmitted from a second computer that is not the first computer, the first certificate authority has received the verification of the electronic signature A step of trying with the public key included in the electronic certificate, and when the electronic signature is verified, the first certificate authority generates an electronic certificate for the public key included in the electronic certificate issuance application Issuing a digital certificate of a certificate authority that is not in a mutual authentication relationship with the same operability as in a mutual authentication relationship, and supporting the verification of the electronic signature with the digital certificate. It can be.

  According to the present invention of claim 6, when the electronic certificate issued by the first certificate authority is required by the first computer for verifying the electronic signature, the first certificate authority issues the electronic certificate. A signature verification support method for supporting verification of an electronic signature by performing a second authentication that includes a public key corresponding to a private key used or used for the electronic signature and is not the first certificate authority An electronic certificate issuance application form with an electronic signature for applying for issuance of an electronic certificate issued by a station and a public key included in the electronic certificate is received from a second computer that is not the first computer When sent, the first certificate authority tries to verify the electronic signature with the public key included in the transmitted electronic certificate, and the first certificate authority when the electronic signature can be verified. Is The solutions have a signature verification support method characterized by comprising the steps of generating an electronic certificate issued to the second computer for Hirakikagi.

  According to the present invention of claim 6, an electronic certificate that includes a public key corresponding to a private key used or used for an electronic signature and issued by a second certificate authority that is not the first certificate authority, and the electronic certificate When an electronic certificate issuance application with an electronic signature for applying to issue an electronic certificate for a public key included in a certificate is transmitted from a second computer that is not the first computer, the first certificate authority Attempting to verify the electronic signature with the public key included in the transmitted electronic certificate, and when the electronic signature can be verified, the first certificate authority generates an electronic certificate for the public key. And issuing a digital certificate of a certificate authority that is not in a mutual authentication relationship with the same operability as in a mutual authentication relationship, and using the digital certificate It is possible to support the testimony.

  According to the present invention of claim 7, the first certificate authority tries to verify the authenticity of the transmitted electronic certificate with the public key of the second certificate authority, and when the verification is successful, the electronic certificate 7. A signature verification support method according to claim 6, wherein the certificate is generated and issued.

  According to the present invention of claim 7, the first certificate authority tries to verify the authenticity of the electronic certificate transmitted with the public key of the second certificate authority, and when the verification is successful, the electronic certificate Therefore, only when the authenticity of the transmitted electronic certificate can be verified, the electronic certificate can be issued.

  In the present invention of claim 8, the first certificate authority inquires of the second certificate authority whether the transmitted electronic certificate is valid, and indicates that the electronic certificate is valid. 8. The signature verification support method according to claim 6 or 7, wherein the electronic certificate is generated and issued when the information is transmitted from the second certificate authority.

  According to the present invention of claim 8, the first certificate authority inquires the second certificate authority about the validity of the transmitted electronic certificate, and information indicating that the electronic certificate is valid Since the electronic certificate is generated and issued when it is transmitted from the second certificate authority, it is possible to issue its own electronic certificate only when the transmitted electronic certificate is valid.

  According to a ninth aspect of the present invention, there is provided a signature verification support apparatus which is a second computer used when an electronic certificate issued by a first certificate authority is required by a first computer for verifying an electronic signature. Applying to the first certificate authority for issuance of an electronic certificate for a public key used for the electronic signature or corresponding to a secret key used from the first certificate authority; The step of transferring the issued electronic certificate to the first computer is continuously executed as a solution means.

  According to the present invention of claim 9, applying to the first certificate authority to issue an electronic certificate for a public key used for an electronic signature or corresponding to a private key used for the electronic signature; Since the step of transferring the electronic certificate issued from the certificate authority to the first computer is continuously executed, an operation equivalent to the case where the electronic certificate of the certificate authority not in the mutual authentication relationship is in the mutual authentication relationship The digital certificate can be issued and the verification of the electronic signature can be supported by the electronic certificate.

  According to a tenth aspect of the present invention, there is provided a signature verification support apparatus which is a second computer used when an electronic certificate issued by a first certificate authority is required by a first computer for verifying an electronic signature. The first key for the public key included in the electronic certificate issued by the second certificate authority corresponding to the private key used or used for the electronic signature and not the first certificate authority. The steps of applying to the first certificate authority for issuance of an electronic certificate of the certificate authority, and transferring the electronic certificate issued from the first certificate authority to the first computer are continuously performed. A signature verification support apparatus characterized by executing is used as a solution means.

  According to the tenth aspect of the present invention, the public key corresponding to the private key used or used for the electronic signature and included in the electronic certificate issued by the second certification authority that is not the first certification authority The steps of applying to the first certificate authority to issue an electronic certificate of the first certificate authority and transferring the electronic certificate issued from the first certificate authority to the first computer are continuously performed. Therefore, the certificate authority's digital certificate that is not in the mutual authentication relationship can be issued with the same operability as in the mutual authentication relationship, and the verification of the digital signature can be supported by the digital certificate. .

  The present invention of claim 11 is a signature verification support apparatus which is a first certificate authority which issues a necessary electronic certificate on a first computer for verifying an electronic signature, wherein the first authentication An electronic certificate with an electronic signature for applying to issue an electronic certificate for an electronic certificate issued by a second certification authority that is not a local authority and a public key corresponding to the private key used or used for the electronic signature When the issuance application is transmitted from a second computer that is not the first computer, the verification of the electronic signature is attempted with the public key included in the transmitted electronic certificate, and the verification of the electronic signature is performed Generating a digital certificate for the public key included in the digital certificate issuance application and issuing the digital certificate to the second computer when it is completed The solution means have a location.

  According to the present invention of claim 11, an electronic certificate issued by a second certificate authority that is not the first certificate authority and an electronic certificate for a public key used for or used for an electronic signature When an electronic certificate issuance application form with an electronic signature for applying for issuance is transmitted from a second computer that is not the first computer, verification of the electronic signature is included in the transmitted electronic certificate Since the step of trying with the public key and the step of generating an electronic certificate for the public key included in the electronic certificate issuance application and issuing it to the second computer when the electronic signature can be verified are performed. It is possible to issue an electronic certificate of a certificate authority that is not in an authentication relationship with the same operability as in a mutual authentication relationship, and to support verification of an electronic signature with the electronic certificate.

Further, the present invention of claim 12 is a signature verification support apparatus that is a first certificate authority that issues a necessary electronic certificate in a first computer that performs verification of an electronic signature,
An electronic certificate that includes a public key that is used in the electronic signature or that corresponds to the private key that is used and that is issued by a second certificate authority that is not the first certificate authority, and a public key that is included in the electronic certificate When an electronic certificate issuance application with an electronic signature for applying to issue an electronic certificate is transmitted from a second computer that is not the first computer, verification of the electronic signature is performed. And a step of trying with a public key included in the certificate and a step of generating an electronic certificate for the public key and issuing it to the second computer when the electronic signature can be verified. A verification support apparatus is used as a solution means.

  According to the present invention of claim 12, an electronic certificate including a public key corresponding to a secret key used or used for an electronic signature and issued by a second certificate authority that is not the first certificate authority and the electronic certificate When an electronic certificate issuance application with an electronic signature for applying to issue an electronic certificate for a public key included in the certificate is transmitted from a second computer that is not the first computer, the electronic signature is verified. A public key included in the transmitted electronic certificate and a step of generating an electronic certificate for the public key and issuing it to the second computer when the electronic signature can be verified. Therefore, it is possible to issue an electronic certificate of a certificate authority that is not in a mutual authentication relationship with the same operability as in the case of a mutual authentication relationship, and to support verification of an electronic signature using the electronic certificate. That.

  The invention according to claim 13 is a solving means comprising a computer program for causing a computer to execute the signature verification support method according to any one of claims 1 to 8.

  According to the thirteenth aspect of the present invention, it is possible to improve the distribution by the computer program that causes the computer to execute the signature verification support method.

  The invention according to claim 14 is a solving means comprising a recording medium storing a computer program for causing a computer to execute the signature verification support method according to any one of claims 1 to 8.

  According to the fourteenth aspect of the present invention, it is possible to improve the distribution by a recording medium storing a computer program that causes a computer to execute the signature verification support method.

  According to the present invention, the step of applying to the first certificate authority for the issuance of an electronic certificate for the public key used for the electronic signature or corresponding to the secret key used, and issuance from the first certificate authority The step of transferring the received electronic certificate to the first computer is executed continuously, so that an electronic certificate of a certificate authority that is not in a mutual authentication relationship is issued with the same operability as in a mutual authentication relationship. The electronic certificate can be supported by the electronic certificate.

  Further, according to the present invention, an electronic certificate including a public key corresponding to a private key used or used for an electronic signature and issued by a second certification authority that is not the first certification authority, and the electronic certificate When an electronic certificate issuance application form with an electronic signature for applying for the issuance of an electronic certificate for a public key included in is sent from a second computer that is not the first computer, the electronic signature is verified. Performing a step of trying with the public key included in the transmitted electronic certificate and a step of generating an electronic certificate for the public key and issuing it to the second computer when the electronic signature can be verified. An electronic certificate of a certificate authority that is not in a mutual authentication relationship can be issued with operability equivalent to that in a mutual authentication relationship, and verification of an electronic signature can be supported by the electronic certificate.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

  FIG. 1 is a diagram showing the configuration of a computer system to which the present invention is applied.

  A user device 1, a public personal certificate authority 2, a bank server 3, and a certified certificate authority 4 are connected to the Internet. The user device 1 is Mr. A's computer who wants to open a bank account, and corresponds to the second computer and signature support device of the present invention. The Public Personal Certification Authority 2 is a computer system composed of a computer operated by the administrative agency of the prefecture where Mr. A lives and a computer provided at the window of the municipality. A card slot is provided. The public personal certificate authority 2 corresponds to the second certificate authority of the present invention. The bank server 3 is a computer operated by a bank where Mr. A intends to open a bank account, and corresponds to the first computer of the present invention. The authorized certificate authority 4 is a computer that performs public key authentication for verifying the identity of banking business, and is not in a mutual authentication relationship with the public personal certificate authority 2. This authorized certificate authority 4 corresponds to the first certificate authority and signature support apparatus of the present invention.

  Although the public personal certificate authority 2 and the certified certificate authority 4 are not in a mutual authentication relationship, the present embodiment realizes operability equivalent to that in a mutual authentication relationship.

  1 will be described in more detail. Dedicated lines (not shown) are provided between the public personal certificate authority 2 and the authorized certificate authority 4 and between the bank server 3 and the authorized certificate authority 4, respectively.

  The user device 1 is provided with a card slot (not shown) in which Mr. A's personal authentication card 1A can be mounted. The user device 1 includes a data input / output unit 11 for transferring data to the personal authentication card 1A, an electronic document generation unit 12 for generating an electronic document or the like for opening a bank account, and a display for displaying the electronic document or the like. Means 13, input means 14 that is a keyboard or the like for Mr. A to input the contents of the electronic document to the user apparatus 1, communication means 15 that communicates with the Internet, and control means 16 that controls these means. .

  The personal authentication card 1A includes data input / output means 11 and data input / output means 101 for exchanging data to / from data input / output means 209 of the public personal certificate authority 2 to be described later, electronic signature generation means 102 for generating an electronic signature, , The electronic certificate storage means 103 for storing the electronic certificate, the user key pair generation means 104 for generating the private key 1001 and the public key 1002 of Mr. A, and the key pair (1001, 1002) of Mr. A. User key pair storage means 105 and control means 106 for controlling these means are provided.

  The public personal certificate authority 2 generates a data input / output means 21 for exchanging data with respect to the data input / output means 101 of the personal authentication card 1A, etc., and a secret key 2001 and a public key 2002 for the public personal certificate authority 2 A certificate authority key pair generating unit 22, a certificate authority key pair storage unit 23 for storing the key pair (2001, 2002) of the public personal certificate authority 2, and an electronic certificate including (certifying) A's public key 1002 An electronic certificate issuing means 24 for generating 1100 and the like, an electronic certificate database 25 for storing an electronic certificate 1100 including (certifying) A's public key 1002, and a public key of the public personal certificate authority 2 The public key providing means 26 for providing the certified certificate authority 4 or the like, and the electronic certificate validity information for providing the certified certificate authority 4 or the like information indicating validity or invalidity of the electronic certificate issued by the public personal certificate authority 2 Offer It includes a stage 27, a communication unit 28 for communicating with the Internet, and a control unit 29 for controlling these means.

  The bank server 3 includes a certificate authority public key storage unit 31 that stores the public key of the certified certificate authority 4, an electronic certificate authenticity verification unit 32 that verifies the authenticity of the electronic certificate issued by the certified certificate authority 4, and User electronic signature verification means 33 for verifying the electronic signature of Mr. A, etc., electronic certificate validity determination means 34 for determining the validity of the electronic certificate issued by the authorized certificate authority 4, and for opening a bank account Electronic document processing means 35 for processing the electronic document, communication means 36 for communicating with the Internet, and control means 37 for controlling these means.

  The certified certification authority 4 includes a certification authority key pair generation unit 401 that generates a private key 4001 and a public key 4002 of the certification certification authority 4, a certification authority key pair storage unit 402 that stores a key pair of the certification certification authority 4, and A An electronic certificate issuing means 403 for issuing an electronic certificate 4100 including Mr. public key 1002, an electronic certificate database 404 storing an electronic certificate 4100 including Mr. A public key 1002, and the certification authority 4 The public key providing means 405 for providing the public key 4002 to the bank server 3 and the like, and the electronic certificate validity information for providing the bank server 3 and the like information indicating validity or invalidity of the electronic certificate issued by the authorized certificate authority 4 Providing means 406, certificate authority public key storage means 407 for storing public key 2002 of public personal certificate authority 2, and verification of authenticity of an electronic certificate issued by public personal certificate authority 2 Electronic certificate authenticity verification means 408, user electronic signature verification means 409 for verifying the electronic signature of Mr. A, etc., and an electronic certificate for determining the validity of the electronic certificate issued by the public personal certificate authority 2 It includes a validity determination unit 410, a communication unit 411 that communicates with the Internet, and a control unit 412 that controls these units.

  Next, the operation of this embodiment will be described.

  2 and 3 are sequence diagrams showing the operation of the present embodiment.

[Application and issue of Mr. A's electronic certificate 1100]
The user key pair generation unit 104 of the personal authentication card 1A generates a secret key 1001 and a public key 1002, and the user key pair storage unit 105 stores this key pair. Mr. A brings personal authentication card 1A to the municipal office and applies for the issuance of an electronic certificate by showing Mr. A's address, name, date of birth and gender (basic 4 information) in a resident's card. When the personal authentication card 1A is attached to the public personal certificate authority 2 and the public personal certificate authority 2 is operated by a staff member, the data input / output means 101 and the data input / output means 21 are transferred from the user key pair storage means 105. Then, the public key 1002 is transferred to the electronic certificate issuing means 24 (S1). The electronic certificate issuing unit 24 generates an electronic certificate 1100 that includes (certifies) the public key 1002 of Mr. A and the basic four information, and the electronic certificate database 25 stores the electronic certificate 1100. The electronic certificate 1100 is transferred to the electronic certificate storage unit 103 via the data input / output unit 21 and the data input / output unit 101 (S3), and the electronic certificate storage unit 103 stores the electronic certificate 1100.

  At this time, the public key 2002 of the public personal certificate authority 2 generated in the self-signed certificate format is transferred and held in the personal authentication card 1A. The personal authentication card 1A storing the electronic certificate 1100 and the like in this way is returned to Mr. A by strict means such as handing or limited mail.

  When the electronic certificate 1100 is revoked and invalidated, it is written in the electronic certificate revocation list and managed by the electronic certificate database 25. The same process is performed for individuals other than Mr. A.

[Provision of Public Key 4002 from Authorized Certification Authority 4 to Bank Server 3]
Each time the certified certificate authority 4 needs to newly generate or update a public key, the certificate authority key pair generation unit 401 generates the secret key 4001 and the public key 4002 of the certified certificate authority 4, and uses this key pair as the certificate authority key. The pair storage means 402 stores it. Then, the public key providing unit 405 reads the public key 4002 and provides it to the bank server 3 via the communication unit 411 and the dedicated line (S5). The certificate authority public key storage unit 31 stores the public key 4002 received by the communication unit 36 of the bank server 3. The public key 4002 may be delivered by strict means such as personal delivery or limited mail. A closed network such as a VPN (Virtual Private Network) may be used instead of the dedicated line.

[Provision of Public Key 2002 from Public Personal Certification Authority 2 to Accredited Certification Authority 4]
Each time the public personal certificate authority 2 needs to newly generate or update a public key, the certificate authority key pair generation unit 22 generates a private key 2001 and a public key 2002 of the public personal certificate authority 2, and this key pair. Is stored in the certificate authority key pair storage means 23. Then, the public key providing unit 26 reads out the public key 2002 and provides it to the authorized certification authority 4 through the communication unit 28 and the dedicated line (S7). Then, the certificate authority public key storage unit 407 stores the public key 2002 received by the communication unit 411 of the certified certificate authority 4. The public key 2002 may be delivered by strict means such as personal delivery or limited mail. A closed network such as a VPN (Virtual Private Network) may be used instead of the dedicated line.

[Preparation for opening a bank account]
When Mr. A attaches the personal authentication card 1A to the card slot of the user apparatus 1 (FIG. 2: S9) and operates the input means 14, the communication means 15 is connected to the communication means 36 via the Internet. The control means 37 transmits display data such as a bank guidance and a link button to the account opening page to the control means 16 via the communication means 36, the Internet and the communication means 15 and displays them on the display means 13 (FIG. 3: S11). .

  When the link button to the account opening page is clicked by Mr. A's operation, a template 3100 for inputting contents such as designation of an account type is transmitted from the bank server 3 to the user apparatus 1 (FIG. 3: S13). ), An account opening page is displayed by the template 3100. The electronic document generation unit 12 generates an account opening application form 1200 that is an electronic document in which contents such as designation of an account type are added to the template 3100 in response to an operation on the input unit 14 by Mr. A. Subsequently, the electronic signature generation unit 102 of the personal authentication card 1A generates an electronic signature 1201 using the private key 1001 of the user key pair storage unit 105 based on the account opening application form 1200.

[Application and issuance of electronic certificates to authorized certificate authority 4]
Next, an account opening execution button is displayed on the account opening page, and when the button is clicked, the electronic document generation means 12 is an electronic document for applying to issue an electronic certificate for the public key 1002. An electronic certificate issuance application form 1300 (including the public key 1002) is generated. Subsequently, the electronic signature generation unit 102 of the personal authentication card 1A generates an electronic signature 1301 using the private key 1001 of the user key pair storage unit 105 based on the electronic certificate issuance application form 1300.

  Next, the control unit 16 acquires the electronic certificate 1100 from the electronic certificate storage unit 103 via the control unit 106, the data input / output unit 101, and the data input / output unit 11. The control unit 16 transmits the electronic certificate 1100, the electronic certificate issuance application 1300, and the electronic signature 1301 to the authorized certificate authority 4 via the communication unit 15 and the Internet (S15).

  The authorized certificate authority 4 determines whether or not an electronic certificate issued by the public personal certificate authority 2 is transmitted (FIG. 2: S17). If the electronic certificate is not transmitted, error processing (for example, a request for a required electronic document) is performed. In this case, which is the transmission of the electronic certificate, the electronic certificate authenticity verification unit 408 includes a certificate authority. An attempt is made to verify the authenticity of the electronic certificate 1100 using the public key 2002 read from the public key storage unit 407 (FIG. 3: S19).

  When the authenticity of the electronic certificate 1100 cannot be verified, error processing similar to that described above is performed. When the authenticity of the electronic certificate 1100 can be verified, the user electronic signature verification unit 409 adds the electronic certificate 1100 to the electronic certificate 1100. An attempt is made to verify the electronic signature 1301 using the included public key 1002 (FIG. 3: S21).

  When the electronic signature 1301 cannot be verified, error processing similar to that described above is performed. On the other hand, when the electronic signature 1301 is verified, the electronic certificate validity determination unit 410 determines that the electronic certificate 1100 is valid. It makes an inquiry to the public personal certificate authority 2 as to whether it is invalid (S23).

  In the public personal certificate authority 2, the electronic certificate validity information providing unit 27 determines whether the electronic certificate 1100 is valid or invalid, and sends information indicating validity or invalidity corresponding to the determination result via the communication unit 28 and the Internet. To the certified certificate authority 4 (S25). In addition, this information may be provided for each inquiry, or information during the period may be provided at a regular time. In the latter case, the accreditation authority 4 records the accreditation information and uses it as necessary.

  The electronic certificate validity determination unit 410 determines whether the electronic certificate 1100 is valid or invalid based on the provided information indicating validity or invalidity.

  When the electronic certificate 1100 is invalid, error processing similar to that described above is performed. When the electronic certificate 1100 is valid, the electronic certificate issuing unit 403 includes the public key 1002 (certification The electronic certificate 4100 is generated, and the certificate authority public key storage unit 407 stores the electronic certificate 4100. Then, the electronic certificate issuing unit 403 issues the electronic certificate 4100 to the user device 1 via the communication unit 411 and the Internet (S27).

  Note that the expiration date of the electronic certificate 4100 is a relatively short time sufficient for the completion of identity verification when a bank account is opened, for example, until 24 hours have passed, and the expiration date is recorded in the electronic certificate 4100. And is also stored in the electronic certificate database 404.

[Application for opening a bank account and subsequent processing]
The control means 16 of the user apparatus 1 transmits the electronic certificate 4100, the account opening application form 1200, and the electronic signature 1201 to the bank server 3 via the communication means 15 and the Internet (S29).

  The bank server 3 determines whether or not an electronic certificate issued by the authorized certificate authority 4 is transmitted (FIG. 2: S31). If the electronic certificate is not transmitted, error processing (for example, a request for a required electronic document) is performed. In this case, which is the transmission of the electronic certificate, the electronic certificate authenticity verification unit 32 uses the certificate authority. An attempt is made to verify the authenticity of the electronic certificate 4100 using the public key 4002 read from the public key storage unit 31 (FIG. 3: S33). When the authenticity of the electronic certificate 4100 cannot be verified, error processing similar to that described above is performed. When the authenticity of the electronic certificate 4100 can be verified, the user electronic signature verification unit 33 adds the electronic certificate 4100 to the electronic certificate 4100. An attempt is made to verify the electronic signature 1201 using the included public key 4002 (FIG. 3: S35).

  If the electronic signature 1201 cannot be verified, error processing similar to that described above is performed. On the other hand, if the electronic signature 1201 is verified, the electronic certificate validity determination unit 34 determines that the electronic certificate 4100 is valid. Whether or not it is invalid is inquired to the certification authority 4 (FIG. 2: S37).

  In the authorized certificate authority 4, the electronic certificate validity information providing unit 406 provides information indicating validity or invalidity of the electronic certificate 4100 to the bank server 3 via the communication unit communication unit 411 and the Internet (FIG. 2: S39). . In addition, this information may be provided for each inquiry, or information during the period may be provided at a regular time. In the latter case, the bank server 3 records the information and uses it as necessary.

  The electronic certificate validity determination unit 34 determines whether the electronic certificate 4100 is valid or invalid based on information indicating validity or invalidity.

  When the electronic certificate 4100 is invalid, error processing similar to that described above is performed, whereas when the electronic certificate 4100 is valid, the electronic document processing means 35 performs account opening processing and is incomplete. If there is no account, an account opening acceptance notification is transmitted to the user apparatus 1 (S41).

  In the user apparatus 1, the display means 13 displays a notice of acceptance of account opening, and the control means 16 deletes the electronic certificate 4100 that is no longer necessary (S43).

  The validity determination for the electronic certificate 4100 performed by the bank server 3 may not be performed if the authorized certificate authority 4 shortens the validity period of the electronic certificate 4100 sufficiently.

  In the above, the user apparatus 1 has applied for the issuance of the electronic certificate 4100, which is the electronic certificate for the public key 1002 issued by the public personal certificate authority 2, to the authorized certificate authority 4. However, the public key does not have to be the public key 1002 as long as it is a public key corresponding to the private key used for the electronic signature verified by the bank server 3, and is generated temporarily when the account is opened, for example. It may be a public key. The public key is included in the electronic certificate issuance application, and the transmitted authorized certificate authority 4 may perform the same process as described above for the public key.

  As described above, according to the present embodiment, the bank server 3 that is the first computer that verifies the electronic signature 1201 needs the electronic certificate issued by the authorized certificate authority 4 that is the first certificate authority. At least the user apparatus 1 (signature support apparatus), which is the second computer, issues a digital certificate for the public key 1002 corresponding to the private key 1001 used for the electronic signature 1201 to the first certificate authority. A step of applying to the authorized certificate authority 4 that is the first certificate authority, and a step of transferring the electronic certificate 4100 issued from the authorized certificate authority 4 that is the first certificate authority to the bank server 3 that is the first computer. Since the user apparatus 1 that is the second computer executes the signature verification support method continuously executed, the electronic certificate of the certificate authority that is not in the mutual authentication relationship is equivalent to that in the mutual authentication relationship. Have you issued by the operability, it is possible to support the verification of the electronic signature by the electronic certificate.

  A user who is at least the second computer when the electronic certificate issued by the authorized certificate authority 4 as the first certificate authority is required by the bank server 3 as the first computer for verifying the electronic signature 1201. The electronic certificate 1100 issued by the public personal certificate authority 2, which corresponds to the private key 1001 used for the electronic signature 1201 and is the second certificate authority that is not the first certificate authority, is issued by the apparatus 1 (signature support apparatus). A step of applying to the authorized certificate authority 4 as the first certificate authority for issuance of an electronic certificate of the first certificate authority for the public key 1002 included in the certificate, and the authorized certificate authority 4 as the first certificate authority The signature verification support method is executed in which the user device 1 as the second computer continuously executes the step of transferring the electronic certificate 4100 issued by the user to the bank server 3 as the first computer. , I asked to issued by the equivalent of operability and when there is an electronic certificate of no relationship of mutual authentication certificate authority to mutual authentication relationship, it is possible to support the verification of the electronic signature by the electronic certificate. In addition, since an electronic certificate issuance for the existing public key 1002 is requested, management for generating a new public key (key pair) or deleting it when it becomes unnecessary is not necessary.

  In addition, when the electronic signature verification is no longer necessary at the bank server 3 as the first computer, the user device 1 as the second computer is issued from the authorized certificate authority 4 as the first certificate authority. Since the electronic certificate 4100 is deleted, it is possible to prevent the electronic certificate 4100 remaining without being deleted from being reused. Also, management of the electronic certificate 4100 is not necessary.

  Further, the bank server 3 as the first computer inquires the authorized certificate authority 4 as the first certificate authority about the validity of the transferred electronic certificate 4100, and the authorized certificate authority 4 as the first certificate authority Since the validity of the electronic certificate is answered, it is possible to prevent the electronic certificate 4100 that has expired or expired due to an address change or the like from being reused.

  In addition, the certified certificate authority 4 (signature support apparatus), which is the first certificate authority, includes a public key 1002 corresponding to the private key 1001 used for the electronic signature 1201 and is not the first certificate authority (4). And an electronic certificate issuing application 1300 with an electronic signature 1301 for applying to issue an electronic certificate 4100 for the electronic certificate 1100 issued by the second certificate authority (2) and the public key 1002 included in the electronic certificate 1100. Is transmitted from the second computer (1) that is not the first computer (3), the first certificate authority (4) includes the verification of the electronic signature 1301 in the transmitted electronic certificate 1100. The first certificate authority (4) generates an electronic certificate 4100 for the public key 1002 when the public key 1002 is verified and the electronic signature 1301 is verified. And issuing a digital certificate of a certificate authority that is not in a mutual authentication relationship with the same operability as that in a mutual authentication relationship. Verification of an electronic signature can be supported by an electronic certificate.

  Also, the first certificate authority (4) attempts to verify the authenticity of the electronic certificate 1100 transmitted with the public key 2002 of the second certificate authority (2), and when the verification is successful, the electronic certificate 4100 Therefore, only when the authenticity of the transmitted electronic certificate can be verified, the electronic certificate can be issued.

  In addition, the second certificate authority (2) inquires of the second certificate authority (2) whether the electronic certificate 1100 transmitted by the first certificate authority (4) is valid, and information indicating that the electronic certificate 1100 is valid is the first information. Since the electronic certificate 4100 is generated and issued when transmitted from the second certificate authority (2), the electronic certificate can be issued only when the transmitted electronic certificate is valid.

  Note that for any of the user device 1, the public personal certification authority 2, the bank server 3, and the authorized certification authority 4, computer programs for executing the processing are semiconductor memory, magnetic disk, optical disk, magneto-optical disk, magnetic tape. It can be stored in a computer-readable recording medium such as the above, or transmitted through a communication network such as the Internet and widely distributed. Therefore, a terminal which is a general-purpose terminal can be used as the user apparatus 1 by having the above function by a computer program transmitted to the terminal.

  Note that the user device 1 may generate the electronic signature 1201 after receiving the electronic certificate 4100 from the authorized certificate authority 4.

It is a figure which shows the structure of the computer system to which this invention is applied. It is a sequence diagram which shows the effect | action of this Embodiment. It is another sequence diagram which shows the effect | action of this Embodiment.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 ... User apparatus 1A ... Personal authentication card 2 ... Public personal certificate authority 3 ... Bank server 4 ... Authorized certification authority 11 ... Data input / output means 12 ... Electronic document generation means 13 ... Display means 14 ... Input means 15 ... Communication means DESCRIPTION OF SYMBOLS 16 ... Control means 21 ... Data input / output means 22 ... Certificate authority key pair generation means 23 ... Certificate authority key pair storage means 24 ... Electronic certificate issue means 25 ... Electronic certificate database 26 ... Public key provision means 27 ... Electronic certificate Validity information providing means 28 ... communication means 29 ... control means 31 ... certificate authority public key storage means 32 ... digital certificate authenticity verification means 33 ... user electronic signature verification means 34 ... electronic certificate validity determination means 35 ... electronic Document processing means 36 ... communication means 37 ... control means 101 ... data input / output means 102 ... digital signature generation means 103 ... digital certificate storage means 104 ... user key pair Generating means 105 ... user key pair storage means 106 ... control means 209 ... data input / output means 401 ... certificate authority key pair generation means 402 ... certificate authority key pair storage means 403 ... electronic certificate issuing means 404 ... electronic certificate database 405 ... public key providing means 406 ... digital certificate validity information providing means 407 ... certificate authority public key storage means 408 ... digital certificate authenticity verification means 409 ... user electronic signature verification means 410 ... electronic certificate validity determination means 411 ... Communication means 411 ... Communication means Communication means 412 ... Control means 1001 ... Secret key 1002 ... Public key 1100 ... Electronic certificate 1200 ... Account opening application form 1201 ... Electronic signature 1300 ... Electronic certificate issuance application form 1301 ... Electronic signature 2001 ... Secret key 2002 ... Public key 3100 ... Template 4001 ... Secret key 4002 ... Public Key 4100 ... electronic certificate

Claims (14)

A signature verification support method that is performed by at least a second computer when an electronic certificate issued by a first certificate authority is required by a first computer that performs verification of an electronic signature,
Applying to the first certificate authority for issuance of an electronic certificate for a public key used in the electronic signature or corresponding to the private key used, and the electronic certificate issued from the first certificate authority A signature verification support method, wherein the second computer continuously executes the step of transferring a certificate to the first computer. A signature verification support method that is performed by at least a second computer when an electronic certificate issued by a first certificate authority is required by a first computer that performs verification of an electronic signature,
The electronic certificate of the first certification authority for the public key corresponding to the private key used or used for the electronic signature and included in an electronic certificate issued by a second certification authority that is not the first certification authority The second computer continuously comprises applying to the first certificate authority for certificate issuance and transferring the electronic certificate issued from the first certificate authority to the first computer. The signature verification support method is characterized by being executed. 3. The electronic certificate issued by the first certificate authority is deleted by the second computer when verification of the electronic signature is no longer necessary in the first computer. The signature verification support method described. The first computer inquires of the first certificate authority about the validity of the transferred electronic certificate, and the first certificate authority answers the validity of the electronic certificate. 4. The signature verification support method according to any one of items 3 to 3. When the electronic certificate issued by the first certificate authority is required by the first computer that verifies the electronic signature, the first certificate authority supports the verification of the electronic signature by issuing the electronic certificate. A signature verification support method,
An electronic for applying to issue an electronic certificate for an electronic certificate issued by a second certificate authority other than the first certificate authority and a public key corresponding to the private key used or used for the electronic signature When a signed electronic certificate issuance application is transmitted from a second computer that is not the first computer, the first certificate authority includes the verification of the electronic signature in the transmitted electronic certificate. A step of trying with a public key, and a step of generating an electronic certificate for the public key included in the electronic certificate issuance application by the first certificate authority when the electronic signature is verified and issuing the electronic certificate to the second computer And a signature verification support method. When the electronic certificate issued by the first certificate authority is required by the first computer that verifies the electronic signature, the first certificate authority supports the verification of the electronic signature by issuing the electronic certificate. A signature verification support method,
An electronic certificate that includes a public key that is used in the electronic signature or that corresponds to the private key that is used and that is issued by a second certificate authority that is not the first certificate authority, and a public key that is included in the electronic certificate When an electronic certificate issuance application with an electronic signature for applying to issue an electronic certificate is transmitted from a second computer that is not the first computer, the first certificate authority verifies the electronic signature. And the first certificate authority generates an electronic certificate for the public key when the electronic signature is verified, and the second computer And a step of issuing the signature verification support method. The first certificate authority attempts to verify the authenticity of the transmitted electronic certificate with the public key of the second certificate authority, and generates and issues an electronic certificate when the verification is successful. The signature verification support method according to claim 6. The first certificate authority inquires of the second certificate authority whether the transmitted electronic certificate is valid, and information indicating that the electronic certificate is valid is transmitted from the second certificate authority. 8. The signature verification support method according to claim 6, wherein an electronic certificate is generated and issued when the signature is issued. A signature verification support apparatus, which is a second computer used when an electronic certificate issued by a first certificate authority is required by a first computer that performs verification of an electronic signature,
Applying to the first certificate authority for issuance of an electronic certificate for a public key used in the electronic signature or corresponding to the private key used, and the electronic certificate issued from the first certificate authority A signature verification support apparatus that continuously executes a step of transferring a certificate to the first computer. A signature verification support apparatus, which is a second computer used when an electronic certificate issued by a first certificate authority is required by a first computer that performs verification of an electronic signature,
The electronic certificate of the first certification authority for the public key corresponding to the private key used or used for the electronic signature and included in an electronic certificate issued by a second certification authority that is not the first certification authority Continuously executing a step of applying to the first certificate authority for issuing a certificate and a step of transferring an electronic certificate issued from the first certificate authority to the first computer. A signature verification support apparatus. A signature verification support apparatus that is a first certificate authority that issues a necessary electronic certificate on a first computer that performs verification of an electronic signature,
An electronic for applying to issue an electronic certificate for an electronic certificate issued by a second certificate authority other than the first certificate authority and a public key corresponding to the private key used or used for the electronic signature When a signed electronic certificate issuance application is transmitted from a second computer that is not the first computer, the verification of the electronic signature is attempted with the public key included in the transmitted electronic certificate; And a step of generating an electronic certificate for the public key included in the electronic certificate issuance application and issuing the electronic certificate to the second computer when the electronic signature can be verified. . A signature verification support apparatus that is a first certificate authority that issues a necessary electronic certificate on a first computer that performs verification of an electronic signature,
An electronic certificate that includes a public key that is used in the electronic signature or that corresponds to the private key that is used and that is issued by a second certificate authority that is not the first certificate authority, and a public key that is included in the electronic certificate When an electronic certificate issuance application with an electronic signature for applying to issue an electronic certificate is transmitted from a second computer that is not the first computer, verification of the electronic signature is performed. And a step of trying with a public key included in the certificate and a step of generating an electronic certificate for the public key and issuing it to the second computer when the electronic signature can be verified. Verification support device. A computer program for causing a computer to execute the signature verification support method according to claim 1. A recording medium storing a computer program that causes a computer to execute the signature verification support method according to claim 1.

Images