JP2005328198A - Program, computer, and data processing method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a program for allowing validity of signature data attached to data to be certified to be verified with high reliability, and to provide a computer and a data processing method. <P>SOLUTION: A client unit C1 generates count data CD whose value is increased for every generation of signature data in a secure state and attaches the count data CD and the signature data to document data DD. A client unit C2 compares a count whose invalidity is designated with the count data CD to verify the validity of the signature data. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to a program, a computer, and a data processing method for verifying the validity of signed data to be certified.

For example, the client device may generate document data or the like in response to a user operation, add signature data indicating its validity to the document data, and transmit the document data to another client device.
In such a client device, the signature data is generated based on the secret key data stored in the client device.
By the way, when the client device is stolen or the like, an unauthorized user who has stolen can generate signature data based on the secret key data stored in the client device, so that a legitimate user of the client device can be obtained. Can be spoofed.
In order to prevent such a situation, for example, when a client device is stolen, the server device that issued the public key is notified by designating the time at which the client device was stolen. After the designated time, valid period data indicating that the public key certificate data is invalid is issued in association with the public key certificate data.

  The verification side of the signature data verifies the validity of the signature data based on the generation time data indicating the generation time of the signature data included in the signature data to be verified and the valid time data received from the server device. To do.

JP 2001-57552 A

  By the way, in the conventional system described above, there is a problem that the validity of the signature data cannot be correctly verified if the timer value indicated by the timer in the client device serving as a reference for the generation time data is set illegally.

  The present invention solves the above-described problems of the prior art and achieves the above-described object, and a program and a computer that can verify the validity of signature data attached to data to be certified with high reliability And it aims at providing a data processing method.

  In order to solve the above-described problems of the prior art and achieve the above-described object, the program of the first invention is a program for causing a computer to execute processing, and each time generating signature data related to data to be certified, A first procedure for updating count data in a secure manner in the computer in either direction of increase or decrease; and the signature for the data to be certified and the count data updated in the first procedure A second procedure for generating data, and a third procedure for adding the count data updated in the first procedure and the signature data generated in the second procedure to the certified data. Let it run.

The operation of the program of the first invention is as follows.
First, the computer executes the program of the first invention.
Then, each time the computer generates signature data related to the data to be certified according to the first procedure, the count data is updated in a secure state in the computer in either one of the increasing and decreasing directions.
Next, the computer generates the signature data for the certified data and the count data updated in the first procedure according to a second procedure.
Next, the computer adds the count data updated in the first procedure and the signature data generated in the second procedure to the certified data according to a third procedure.

  A computer according to a second aspect of the invention includes a memory for storing a program, a counter for updating count data in a secure state in one direction of increasing or decreasing each time signature data relating to data to be certified is generated, and the memory An execution circuit for generating the signature data for the certified data and the count data of the counter according to the program read from the execution data, and adding the count data and the signature data to the certified data .

The operation of the computer of the second invention is as follows.
The execution circuit of the computer of the second invention reads the program of the second invention from the memory and executes it.
The counter updates the count data in a secure state in either direction of increasing or decreasing each time the execution circuit generates signature data related to the data to be certified.
Then, the execution circuit generates the signature data for the certified data and the count data of the counter according to the program, and adds the count data and the signature data to the certified data.

  A data processing method according to a third aspect of the present invention is a data processing method executed by a computer, wherein each time signature data relating to data to be certified is generated, the count data is increased or decreased in either direction. A first step of updating the signature data, a second step of generating the signature data for the certified data and the count data updated in the first step, and updating in the first step And a third step of adding the count data and the signature data generated in the second step to the data to be certified.

  According to a fourth aspect of the invention, there is provided a first procedure for verifying whether or not signature data added to data to be certified and indicating the validity of the data to be certified is generated based on predetermined key data; Increased each time the signature data is generated at the generation source of the signature data added to the data to be certified, provided that the signature data is determined to be generated based on the key data in the first procedure. The computer is caused to execute a second procedure for determining the validity of the signature data based on the count data updated to one of the decreases and the count data of the signature data to be invalidated.

The operation of the program of the fourth invention is as follows.
The computer executes the program of the fourth invention.
Then, according to the first procedure, the computer verifies whether or not the signature data added to the data to be certified and indicating the validity of the data to be certified is generated based on the key data defined in advance.
Next, on the condition that the computer determines that the signature data is generated based on the key data in the first procedure according to the second procedure, the computer adds the signature data to the certified data. The validity of the signature data is judged based on the count data updated to either increase or decrease each time the signature data is generated at the generation source and the count data of the signature data to be invalidated. .

  According to a fifth aspect of the present invention, there is provided a computer based on a key memory in which a memory for storing a program and signature data added to the data to be certified and indicating the validity of the data to be certified are prescribed in accordance with the program read from the memory. The signature data is generated at the generation source of the signature data that is added to the certified data on the condition that the signature data is generated based on the key data. And an execution circuit that determines the validity of the signature data based on the count data updated to either increase or decrease each time and the count data of the signature data to be invalidated.

The operation of the computer of the fifth invention is as follows.
First, the execution circuit reads a program from the memory and executes it.
Next, the execution circuit verifies whether signature data added to the data to be certified and indicating the validity of the data to be certified is generated based on the key data defined in advance according to the program.
Then, the execution circuit adds to the data to be certified and generates the signature data at the generation source of the signature data on the condition that the signature data is generated based on the key data according to the program. The validity of the signature data is determined based on the count data updated to either increase or decrease each time the count is performed and the count data of the signature data to be invalidated.

  A data processing method according to a sixth aspect of the present invention is a data processing method executed by a computer, wherein signature data added to the data to be certified and indicating the validity of the data to be certified is generated based on the pre-defined key data. A first step of verifying whether or not the signature data is generated on the condition that the signature data has been generated based on the key data in the first step. First, the validity of the signature data is determined based on the count data that is updated to either increase or decrease each time the signature data is generated and the count data of the signature data to be invalidated. 2 steps.

  According to a seventh aspect of the present invention, there is provided a data processing method in which a first computer and a second computer communicate with each other, and each time the first computer generates signature data relating to data to be certified, the count data A first step of updating the computer in a secure state in either one of an increase or a decrease, and the first computer updates the certified data and the count data updated in the first step. A second step of generating the signature data with respect to the data to be certified, the count data updated in the first step by the first computer, and the signature data generated in the second step. And a third step of transmitting to the second computer, and the second computer is added to the certified data received in the third step. A fourth step of verifying whether the signature data is generated based on key data defined in advance; and the second computer, wherein the signature data is based on the key data in the fourth step. Fifth step of determining the validity of the signature data based on the count data added to the certified data and the count data of the signature data to be invalidated on the condition that it has been generated And have.

  A program according to an eighth invention is a program for causing a computer to execute processing, and proves the validity of data indicated by a timer that measures time in a secure state in the computer to a predetermined proof source outside the computer. A first procedure for receiving proof data indicating the result of the proof, a second procedure for obtaining time data indicated by the timer when signature data relating to the proof data is generated, and the proof data And the time data acquired in the second procedure, a third procedure for generating the signature data, the certification data received in the first procedure, and the certificate acquired in the second procedure Causing the computer to execute a fourth procedure of adding time data and the signature data generated in the third procedure to the data to be certified.

The operation of the program of the eighth invention is as follows.
First, the computer executes the program of the eighth invention.
Then, according to the first procedure of the program, the computer causes a predetermined proof source outside the computer to prove the validity of the time indicated by the timer that performs timekeeping in a secure state in the computer. Proof data indicating the result of is received.
Next, the time data indicated by the timer is acquired when the computer generates signature data related to the data to be certified according to the second procedure.
Next, the computer generates the signature data for the certified data and the time data acquired in the second procedure according to a third procedure.
Next, according to a fourth procedure, the proof data received by the first procedure, the time data obtained by the second procedure, and the signature data generated by the third procedure by the computer Are added to the data to be certified.

  According to a ninth aspect of the invention, there is provided a program for verifying whether or not signature data added to data to be certified is generated based on key data defined in advance, and secures the signature data generation source. A second procedure for verifying the proof data indicating the validity of the time data indicated by the timer that counts the time in the state; determining that the signature data is generated based on the key data in the first procedure; and Based on the fact that the certification data is determined to be valid in the second procedure, based on the time data added to the certification data and the time data indicating when to invalidate the signature data, Causing the computer to execute a third procedure for determining the validity of the signature data.

The operation of the program of the ninth invention is as follows.
First, the computer executes the program of the ninth invention.
Then, according to the first procedure, the computer verifies whether or not the signature data added to the data to be certified is generated based on the key data defined in advance.
Next, the computer verifies the proof data indicating the validity of the time data indicated by the timer that measures the time in a secure state at the signature data generation source according to the second procedure.
Next, the computer determines that the signature data is generated based on the key data in the first procedure according to a third procedure, and the proof data is valid in the second procedure. On the condition that it is determined, the validity of the signature data is determined based on the time data added to the data to be certified and the time data indicating the time to invalidate the signature data.

  According to the present invention, it is possible to provide a program, a computer, and a data processing method that make it possible to appropriately verify the validity of signature data attached to data to be certified.

Hereinafter, a communication system according to an embodiment of the present invention will be described.
<First Embodiment>
Hereinafter, a first embodiment of the present invention will be described.
[Correspondence with Configuration of the Present Invention]
First, the correspondence between the components of the present embodiment and the components of the present invention will be described.
In the present embodiment, the application program AP corresponds to the programs of the first and second inventions.
Here, step ST15 shown in FIG. 6 corresponds to the first and second procedures of the first invention, and the first and second steps of the third invention.
Step ST18 shown in FIG. 6 corresponds to the third procedure of the first invention and the third step of the third invention.
2 corresponds to the memory of the second invention, the CPU 45 corresponds to the execution circuit of the second invention, and the counter 58 shown in FIG. 4 corresponds to the counter of the second invention. .
In the present invention, the document data DD corresponds to the data to be certified of the present invention.

In the present embodiment, the operating system OS corresponds to the programs of the fourth and fifth inventions.
Here, step ST35 shown in FIG. 8 corresponds to the first procedure of the fourth invention and the first step of the sixth invention.
Steps ST39 to ST43 shown in FIG. 8 correspond to the second procedure of the fourth invention and the second step of the sixth invention.
The memory 43 shown in FIG. 2 corresponds to the memory of the fifth invention, and the CPU 45 corresponds to the execution circuit of the fifth invention.
The CPU 45 corresponds to the computer of the present invention.

FIG. 1 is an overall configuration diagram of a communication system 1 according to the first embodiment of the present invention.
As illustrated in FIG. 1, the communication system 1 includes, for example, client devices C1 and C2, a document distribution server 10, a certification authority (CA) 12, and an invalid list distribution server 14.
In the present embodiment, communication among the client devices C 1 and C 2, the document distribution server 10, the certification authority 12 and the invalid list distribution server 14 is performed via the network 9.
In the present embodiment, two client devices are illustrated, but the number of client devices is arbitrary.

[Certification body 12]
The certification authority 12 issues secret key data Kpri1, Kpri2 (Kpri) to the security chips SC of the client devices C1 and C2, and provides them in a secure state.
Further, the certification authority 12 issues public key certification data Cert1, Cert2 (Cert) corresponding to each of the secret key data Kpri1, Kpri2.

[Invalid list distribution server 14]
The invalid list distribution server 14 receives the identification data KpubID of the public key data Kpub corresponding to the secret key data Kpri used to generate the invalid signature data SD from the client devices C1 and C2, and the signature data immediately before invalidation. The invalidity notification data RN including the count data CD when the SD is generated is received.
Then, the invalid list distribution server 14 updates the invalid list data RLIST based on the invalid notification data RN.
The invalid list data RLIST indicates the invalid target identification data KpubID and the count data CD in association with each other.

Hereinafter, the client device C1 will be described.
The client device C2 has the same configuration as the client device C1.
The client devices C1 and C2 are communication devices such as personal computers, PDAs (Personal Digital Assistants), and mobile phones.
[Client device C1]
FIG. 2 is a configuration diagram of the client device C1 shown in FIG.
As shown in FIG. 2, the client device C1 includes, for example, an interface 42, a memory 43, a security chip SC, a CPU 45, a display 46, and an operation unit 47, which are connected via a data line 40.

The interface 42 transmits and receives data and requests to and from the client device C2 via the network 9.
The memory 43 stores a program BIOS (Basic Input / Output System), a loader program Loader, an operating system OS (Operating System), and an application program AP.
As the application program AP, a program PRG_C that comprehensively controls the operation of the client device C1, a document creation program W_AP, and a document browsing program R_AP are provided.

The CPU 45 reads various programs stored in the memory 43 and realizes a predetermined software environment.
For example, as shown in FIG. 3, the CPU 45 causes the program BIOS to operate on hardware such as the CPU 45 and the security chip SC.
Further, the CPU 45 operates a loader program Loader on the program BIOS, and starts the operating system OS based on the loader program Loader.
The CPU 45 operates the application program AP on the operating system OS.
The CPU 45 comprehensively controls processing shown in an operation example to be described later of the client device C1.
The control by the CPU 45 will be described in association with an operation example described later.
In this embodiment, the CPU 45, as will be described later, as shown in FIG. 5, the hash data HD of the document data DD, the count data CD when the signature data SD is generated, the signature data SD, and the public key certificate data Cert. Are added to the document data DD and transmitted to the document distribution server 10.

  The security chip SC is a tamper-resistant circuit. When an attack (external read of internal data, an attack that sets the input frequency or input voltage outside the predetermined range) is applied to the circuit from the outside, malfunction or internal data This is a circuit configured not to cause leakage.

The display 46 displays a screen corresponding to the display signal from the CPU 45.
The operation unit 47 is an operation means such as a keyboard or a mouse, and outputs an operation signal corresponding to a user operation to the CPU 45.

FIG. 4 is a configuration diagram of the security chip SC shown in FIG.
As shown in FIG. 4, the security chip SC includes, for example, an input / output circuit (I / O) 51, a key generation circuit 52, a hash circuit 53, a random number generation circuit 54, a signature / encryption circuit 55, a memory 56, a processor 57, and A counter 58 is provided, and these are connected via a data line 50.

The input / output circuit 51 is connected to the data line 40 shown in FIG. 2 and performs data input / output between the inside and the outside of the security chip SC.
The key generation circuit 52 generates various key data related to security based on the random number generated by the random number generation circuit 54, for example.
The hash circuit 53 generates hash data.
The random number generation circuit 54 generates (generates) a random number.
The signature / encryption circuit 55 performs encryption and decryption using key data, and performs generation of encrypted data, decryption of encrypted data, generation of signature data, and verification of signature data.
The memory 56 stores the secret key data Kpri1 of the security chip SC.
Further, the memory 56 stores activation program verification data PHD generated when the server device S1 is activated.
Further, the memory 56 stores log data LOG indicating the history of the identification data KpubID of the public key data of the signature data SD and the count data CD when the signature key data SD is generated.
The memory 56 stores public key certificate data Cert1.

The processor 57 controls the overall operation of the security chip SC according to the control from the CPU 45 shown in FIG.
The counter 58 increases (increments) the count value by “1” every time the signature / encryption circuit 55 creates signature data.
The counter 58 may decrement (decrement) the count value by “1” each time the signature / encryption circuit 55 creates signature data.
Since the counter 58 is built in the security chip SC, the count value is updated in a secure state, and the user cannot adjust the count value.

Hereinafter, an operation example of the client device C1 will be described.
[First operation example]
Hereinafter, an operation example when the client apparatus C generates the document data DD will be described.
FIG. 6 is a flowchart for explaining the operation example.
Step ST11:
The CPU 45 of the client device C1 shown in FIG. 2 generates document data DD based on the operation signal input from the operation unit 47 in accordance with the document creation program W_AP.
Step ST12:
The CPU 45 generates hash data HD of the document data DD generated in step ST11 according to the document creation program W_AP, and outputs this to the security chip SC.
Specifically, the hash data HD is output from the document creation program W_AP to the security chip SC via the operating system OS.
The document creation program W_AP provides (outputs) the hash data HD to the operating system OS and instructs the generation of the signature data SD.

Step ST13
The processor 57 of the security chip SC reads count data CD indicating the counter value of the counter 58 in accordance with an instruction (program PRG_C) from the CPU 45.
Step ST14:
The processor 57 concatenates the hash data HD input at step ST12 and the count data CD read at step ST13 to generate data HD + CD.
Step ST15:
The signature / encryption circuit 55 of the security chip SC generates the signature data SD of the data HD + CD generated in step ST14 based on the secret key data Kpri1 read from the memory 56.
Then, the counter 58 increases the count value of the count data CD by “1”.
Step ST16:
The processor 57 of the security chip SC updates the log data LOG stored in the memory 56 based on the signature data SD and the count data CD at the time of generation.
The user periodically backs up the log data stored in the memory 56 and records it on a recording medium external to the client device C1.

Step ST17:
The processor 57 outputs the data CD + HD generated in step ST14, the signature data SD generated in step ST15, and the public key certificate data Cert1 read from the memory 56 to the CPU 45 via the input / output circuit 51.
Step ST18:
In accordance with the document creation program W_AP, the CPU 45 adds the data CD + HD, signature data SD, and public key certificate data Cert1 input in step ST17 to the document data DD generated in step ST11.
Step ST19:
The CPU 45 transmits the document data DD to which the data CD + HD and the like are added at step ST18 to the document distribution server 10 shown in FIG.
For example, in response to a request from the client apparatus C2, the document distribution server 10 transmits the document data DD to which the data CD + HD and the like are added in step ST18 to the client apparatus C2.

[Second operation example]
Hereinafter, an operation example in the case where the client device C1 is stolen or the like and a valid user instructs the invalid list distribution server 14 to invalidate the signature data will be described.
FIG. 7 is a flowchart for explaining the operation example.
Step ST21:
When the client device C1 is stolen or the like, a legitimate user operates a predetermined computer, and the computer, as shown in FIG. 1, based on log data LOG stored in an external recording medium from the client device C1 in the past. In addition, invalid notification data RN including identification data KpubID of public key data Kpub and count data CD of the latest signature data SD indicated by log data LOG is generated.
Step ST22:
The computer transmits the invalidity notification data RN generated in step ST21 to the invalidity list distribution server 14 shown in FIG.

Step ST23:
The invalid list distribution server 14 updates the invalid list data RLIST based on the invalidity notification data RN received in step ST22.
Step ST24:
The invalid list distribution server 14 publishes invalid list data RLIST.
Client devices including the client devices C1 and C2 receive the invalid list RLIST from the invalid list distribution server 14.

[Third operation example]
Hereinafter, an operation example when the document data DD is received will be described.
In the following description, a case where the client device C2 receives the document data DD generated by the client device C1 according to the procedure described in the first operation example will be described.
FIG. 8 is a flowchart for explaining the operation example.
Step ST31:
The CPU 45 accesses the invalid list distribution server 14 according to the operating system OS, receives the invalid list data RLIST, and writes it in the memory 43.
For example, the CPU 45 receives the invalid list data RLIST from the invalid list distribution server 14 every time the validity of the signature data SD is verified.
Step ST32:
The CPU 45 receives the document data DD from the document distribution server 10 according to the document browsing program R_AP.
As described with reference to FIG. 5 in the first operation example, the document data DD includes data CD + HD obtained by concatenating count data CD and hash data HD, signature data SD of data CD + HD, and public key certificate. Data Cert1 is added.

Step ST33:
In accordance with the operating system OS, the CPU 45 verifies the validity of the public key certificate data Cert1 added to the document data DD received in step ST32 by accessing the certification authority 12, for example.
Step ST34:
When determining that the public key certificate data Cert1 is valid, the CPU 45 proceeds to step ST35, and otherwise proceeds to step ST43.

Step ST35:
In accordance with the operating system OS, the CPU 45 generates the signature data SD added to the document data DD received in step ST32 based on the private key data Kpri1 corresponding to the public key data Kpub1 included in the public key certificate data Cert1. The signature / encryption circuit 55 of the security chip SC shown in FIG. 4 is verified.
Step ST36:
If the CPU 45 determines that the signature data SD is generated based on the secret key data Kpri1 according to the operating system OS, the CPU 45 proceeds to step ST37, otherwise proceeds to step ST43.

Step ST37:
The CPU 45 determines whether or not an item corresponding to the identification data KpubID of the public key data Kpub1 included in the public key certificate data Cert1 exists in the invalid list data RLIST received in step ST31.
Step ST38:
If the CPU 45 determines that it exists in step ST37, it proceeds to step ST39, and if it determines that it does not exist, it proceeds to step ST43.

Step ST39:
The CPU 45 acquires the count data CD added to the document data DD received in step ST32 as a signature count value in accordance with the operating system OS.
Step ST40:
The CPU 45 acquires the count data CD associated with the identification data KpubID in the invalid list data RLIST as the invalid count value according to the operating system OS.

Step ST41:
In accordance with the operating system OS, the CPU 45 determines whether or not the signature count value acquired in step ST39 is larger than the invalid count value acquired in step ST40. Then, it progresses to step ST42.
Step ST42:
The CPU 45 determines that the document data DD is legitimate generated before the client device C1 is stolen, and uses it according to the document browsing program R_AP.
Step ST43:
The CPU 45 determines that the document data DD is an illegal one generated after the client device C1 is stolen, and prohibits its use by the document browsing program R_AP.

[Fourth operation example]
Hereinafter, an example of the overall operation of the communication system 1 will be described.
FIG. 9 is a flowchart for explaining the operation example.
For example, the client device C1 transmits the document data DD to which the data CD (1) + HD, signature data SD, and public key certificate data Cert1 are added to the document distribution server 10 (step ST51).
Further, the client apparatus C2 receives the invalid list data RLIST from the invalid list distribution server 14 (step ST52). At this time, the invalid list data RLIST does not include the identification data KpubID of the public key data Kpub1 used for verifying the signature data SD.
Further, the client device C2 receives the document data DD to which the data CD (1) + HD, signature data SD, and public key certificate data Cert1 are added from the document distribution server 10 (step ST53).
Next, since the identification data KpubID is not included in the invalid list data RLIST received in step ST52, the client apparatus C2 determines that the document data DD received in step ST53 is valid (step ST54).

Thereafter, when the client device C1 is stolen (step ST55), the legitimate user of the client device C1 uses the identification data KpubID of the public key data Kpub1 and the latest data indicated by the log data LOG based on the backed up log data LOG. The invalidity notification data RN including the count data CD (1) of the signature data SD is transmitted to the invalid list distribution server 14 (step ST56).
The invalid list distribution server 14 updates the invalid list data RLIST to invalid list data RLIST (CD (1)) based on the received invalid notification data RN.
Then, the client device C2 receives the invalid list data RLIST (CD (1)) from the invalid list distribution server 14 (step ST57). At this time, the invalid list data RLIST (CD (1)) includes the identification data KpubID of the public key data Kpub1 used for verification of the signature data SD.
Further, the client device C1 distributes the document data DD to which, for example, the data CD (2) + HD, the signature data SD, and the public key certificate data Cert1 are added in response to an instruction of an unauthorized user who has stolen the document. It transmits to the server 10 (step ST58).
Here, the count data CD (2) has a larger value than the count data CD (1) of the signature data SD.
Then, the client device C2 receives the document data DD to which the data CD (2) + HD, signature data SD, and public key certificate data Cert1 are added from the document distribution server 10 (step ST59).
Next, since the identification data KpubID is included in the invalid list data RLIST (CD (1)) received in step ST57, the client apparatus C2 includes the count data CD (1) in the invalid list data RLIST, The count data CD (2) added to the document data DD is compared, and since the count data CD (2) is larger, it is determined that the document data DD received in step ST59 is invalid (step ST60).

As described above, in the communication system 1, as shown in FIGS. 2 and 4, each time the signature data SD is generated in the counter 58 provided in the security chip SC in the client device C1, the count data CD is generated. Is updated (increased by “1”). The count data CD is added to the document data DD together with the signature data SD.
Therefore, according to the communication system 1, even if the client device C1 is stolen, an unauthorized user cannot adjust the counter 58, and the count data CD added to the document data created by the unauthorized user is the signature data SD. Will be updated appropriately according to the generation of.
Therefore, as described above, the client device C2 on the verification side can determine the legitimacy of the document data DD with high reliability based on the count data CD.

Second Embodiment
FIG. 10 is an overall configuration diagram of a communication system 101 according to the second embodiment of this invention.
As shown in FIG. 10, the communication system 101 includes, for example, client devices C1a and C2a, a document distribution server 10, a certification authority (CA) 12, an invalid list distribution server 14a, and a time certification server 16.
In FIG. 10, the document distribution server 10 and the certification authority 12 are the same as those described in the first embodiment.

In the present embodiment, the application program APa corresponds to the program of the eighth invention.
Here, step ST70 shown in FIG. 15 corresponds to the first procedure of the eighth invention, ST73 corresponds to the second procedure of the eighth invention, and ST75 corresponds to the third procedure of the eighth invention. Correspondingly, ST77 corresponds to the fourth procedure of the eighth invention.

In the present embodiment, the operating system OSa corresponds to the program of the ninth invention.
Here, step ST95 shown in FIG. 17 corresponds to the first procedure of the ninth invention.
Step ST99 shown in FIG. 17 corresponds to the second procedure of the ninth invention, and ST100 to ST103 correspond to the third procedure of the ninth invention.

[Invalid list distribution server 14a]
The invalid list delivery server 14 makes the identification data KpubID of the public key data Kpub corresponding to the secret key data Kpri used to generate the signature data SDa to be invalidated and the time when the signature data SDa is invalidated from the client devices C1a and C2a. The invalidity notification data RNa including the invalid time data TIME indicating the data is received.
Then, the invalid list distribution server 14a updates the invalid list data RLITa based on the invalid notification data RNa.
The invalid list data RLITa shows identification data KpubID to be invalidated and invalid data TIME in association with each other.

[Time Proof Server 16]
The time certification server 16 receives from the client devices C1a and C2a a time certification request including the time data TIME indicated by the timers included in these security chips, and generates time certification data T_Cert indicating that the data TIME has been certified at that time. This is transmitted to the client devices C1a and C2a.
The time certification data T_Cert includes difference time data indicating a difference time between the internal time in the time certification server 16 and the time data TIME.

Hereinafter, the client device C1a will be described.
The client device C2a has the same configuration as the client device C1.
[Client device C1a]
FIG. 11 is a configuration diagram of the client apparatus C1a illustrated in FIG.
As illustrated in FIG. 11, the client device C1a includes, for example, an interface 42, a memory 43, a security chip SCa, a CPU 45a, a display 46, and an operation unit 47, which are connected via a data line 40.
In FIG. 11, the components given the same reference numerals as those in FIG. 2 are the same as those described in the first embodiment.
The memory 43 stores the application program APa.
As the application program APa, there are provided a program PRG_Ca, a document creation program W_APa, and a document browsing program R_APa for comprehensively controlling the operation of the client device C1a.

The CPU 45a reads various programs stored in the memory 43 and realizes a predetermined software environment.
For example, as illustrated in FIG. 12, the CPU 45a operates the program BIOS on hardware such as the CPU 45a and the security chip SCa.
Further, the CPU 45a operates a loader program Loader on the program BIOS, and starts the operating system OSa based on the loader program Loader.
Further, the CPU 45a operates the application program APa on the operating system OSa.
The CPU 45 comprehensively controls processing shown in an operation example described later of the client device C1a.
The control by the CPU 45a will be described in association with an operation example described later.
In this embodiment, the CPU 45a, as will be described later, as shown in FIG. 14, the hash data HD of the document data DD, the time data TIME when the signature data SDa is generated, the signature data SDa, and the public key certificate data Cert. The time certification data T_Cert is added to the document data DD and transmitted to the document distribution server 10.

  The security chip SCa is a tamper-resistant circuit, and when an attack (an illegal read of internal data, an attack that sets an input frequency or an input voltage outside a predetermined range) is applied to the circuit from the outside, malfunction or internal data This is a circuit configured not to cause leakage.

FIG. 13 is a configuration diagram of the security chip SCa shown in FIG.
In FIG. 13, the constituent elements having the same reference numerals as those in FIG. 4 are the same as those described in the first embodiment.
As shown in FIG. 13, the security chip SCa includes, for example, an input / output circuit 51, a key generation circuit 52, a hash circuit 53, a random number generation circuit 54, a signature / encryption circuit 55, a memory 56, a processor 57a, and a timer 59. These are connected via the data line 50.

The processor 57a controls the operation of the security chip SCa in accordance with the control from the CPU 45a shown in FIG.
The timer 59 measures time. Since the timer 59 is built in the security chip SCa, the timer 59 performs timing in a secure state and cannot be set by the user of the client device C1a.

Hereinafter, an operation example of the client device C1a will be described.
[First operation example]
Hereinafter, an operation example when the client apparatus C1a generates the document data DD will be described.
FIG. 15 is a flowchart for explaining the operation example.
Step ST70:
The CPU 45a of the client device C1a shown in FIG. 11 sends a time certification request including the time data TIME indicated by the timer 59 in the security chip SCa shown in FIG. Send to server 16.
Then, the CPU 45 a writes the time certification data T_Cert received from the time certification server 16 in the memory 43 in response to the time certification request.
As described above, the time certification data T_Cert includes difference time data indicating the difference time between the internal time in the time certification server 16 and the time data TIME.
Step ST71:
The CPU 45a of the client device C1a shown in FIG. 11 generates document data DD based on the operation signal input from the operation unit 47 in accordance with the document creation program W_APa.
Step ST72:
The CPU 45a generates hash data HD of the document data DD generated in step ST71 according to the document creation program W_APa, and outputs this to the security chip SCa.
The document creation program W_APa provides (outputs) the hash data HD to the operating system OSa and instructs generation of the signature data SD.

Step ST73
The processor 57a of the security chip SCa acquires the time data TIME indicated by the timer 59 when the signature data SD is generated in step ST7 in accordance with an instruction (program PRG_Ca) from the CPU 45a.
Step ST74:
The processor 57 concatenates the hash data HD input in step ST72 and the time data TIME acquired in step ST73 to generate data HD + TIME.
Step ST75:
The signature / encryption circuit 55 of the security chip SCa generates the signature data SDa of the data HD + TIME generated in step ST74 based on the secret key data Kpri1 read from the memory 56.
Step ST76:
The processor 57 outputs the data TIME + HD generated in step ST74, the signature data SDa generated in step ST75, and the public key certificate data Cert1 read from the memory 56 to the CPU 45a via the input / output circuit 51.
Step ST77:
In accordance with the document creation program W_AP, the CPU 45a generates the data TIME + HD, the signature data SDa and the public key certificate data Cert1 input in step ST76, and the time certification data T_Cert acquired in step ST70, the document data DD generated in step ST71. Append to
Step ST78:
The CPU 45a transmits the document data DD to which the data TIME + HD and the like are added in step ST77 to the document distribution server 10 shown in FIG.
For example, in response to a request from the client device C2, the document distribution server 10 transmits the document data DD to which the data TIME + HD and the like are added in step ST78 to the client device C2a.

[Second operation example]
Hereinafter, an operation example when the client device C1a is stolen or the like and a valid user instructs the invalid list distribution server 14a to invalidate the signature data will be described.
FIG. 16 is a flowchart for explaining the operation example.
Step ST81:
When the client device C1a is stolen or the like, a legitimate user operates a predetermined computer other than the client device C1a, and the public key data Kpub corresponding to the secret key data Kpri used to generate the signature data SDa to be invalidated Invalidity notification data RNa including identification data KpubID and invalid time data TIME indicating the stolen time is generated.
Step ST82:
The computer transmits the invalidity notification data RNa generated in step ST81 to the invalidity list distribution server 14a shown in FIG.

Step ST83:
The invalid list distribution server 14a updates the invalid list data RLITa based on the invalid notification data RNa received in step ST82.
Step ST84:
The invalid list distribution server 14a publishes invalid list data RLITa.
Client devices including the client devices C1a and C2a receive the invalid list RLITa from the invalid list distribution server 14a.

[Third operation example]
Hereinafter, an operation example when the document data DD is received will be described.
In the following description, a case where the client device C2a receives the document data DD generated by the client device C1a according to the procedure described in the first operation example will be described.
FIG. 17 is a flowchart for explaining the operation example.
Step ST91:
The CPU 45 a accesses the invalid list distribution server 14 a according to the operating system OSa, receives the invalid list data RLITa described above, and writes it in the memory 43.
For example, the CPU 45a receives invalid list data RRISTa from the invalid list distribution server 14a every time the validity of the signature data SDa is verified.
Step ST92:
The CPU 45a receives the document data DD from the document distribution server 10 according to the document browsing program R_APa.
As described with reference to FIG. 14 in the first operation example, the document data DD includes data TIME + HD obtained by concatenating the hour data TIME and the hash data HD, signature data SDa of the data TIME + HD, and public key certificate data. Cert1 and time certification data T_CerT are added.

Step ST93:
In accordance with the operating system OSa, the CPU 45a verifies the validity of the public key certificate data Cert1 added to the document data DD received in step ST92, for example, by accessing the certification authority 12.
Step ST94:
If the CPU 45a determines that the public key certificate data Cert1 is valid, the process proceeds to step ST95. If not, the process proceeds to step ST103.

Step ST95:
In accordance with the operating system OSa, the CPU 45a generates the signature data SDa added to the document data DD received in step ST92 based on the private key data Kpri1 corresponding to the public key data Kpub1 included in the public key certificate data Cert1. The signature / encryption circuit 55 of the security chip SCa shown in FIG. 13 is verified.
Step ST96:
If the CPU 45a determines that the signature data SDa is generated based on the secret key data Kpri1 in accordance with the operating system OSa, the CPU 45a proceeds to step ST97, otherwise proceeds to step ST103.

Step ST97:
The CPU 45a determines whether or not an item corresponding to the identification data KpubID of the public key data Kpub1 included in the public key certificate data Cert1 exists in the invalid list data RLITa received in step ST91.
Step ST98:
If CPU 45a determines that it exists in step ST97, it proceeds to step ST99, and if it determines that it does not exist, it proceeds to step ST103.

Step ST99:
In accordance with the operating system OSa, the CPU 45a verifies the validity of the time certification data T_Cert added to the document data DD received in step ST92, and determines that the time certification data T_Cert added to the document data DD is valid. Signature time data indicating the signature time is generated based on the difference time data included in the time certification data T_Cert.
Step ST100:
The CPU 45a acquires the invalid time data TIME associated with the identification data KpubID in the invalid list data RLITa according to the operating system OSa.

Step ST101:
The CPU 45a determines whether or not the time indicated by the signature time data acquired in step ST99 is later than the time indicated by the invalid time data TIME acquired in step ST100 according to the operating system OSa. If it is determined that it is not large, the process proceeds to step ST102s.
Step ST102:
The CPU 45a determines that the document data DD is legitimate generated before the client device C1a is stolen, and uses it in accordance with the document browsing program R_APa.
Step ST103:
The CPU 45a determines that the document data DD is an illegal one generated after the client device C1a is stolen, and prohibits its use by the document browsing program R_APa.

[Fourth operation example]
Hereinafter, an example of the overall operation of the communication system 101 will be described.
FIG. 18 is a flowchart for explaining the operation example.
For example, the client device C1a transmits the document data DD to which the data TIME (1) + HD, signature data SDa, public key certificate data Cert1, and time certification data T_Cert are added to the document distribution server 10 (step ST201).
Further, the client device C2a receives the invalid list data RLITa from the invalid list distribution server 14a (step ST202). At this time, the invalid list data RLIST does not include the identification data KpubID of the public key data Kpub1 used for verification of the signature data SDa.
Further, the client apparatus C2a receives the document data DD to which the data TIME (1) + HD, signature data SDa, public key certificate data Cert1, and time certification data T_Cert are added from the document distribution server 10 (step ST203). .
Next, the client apparatus C2a determines that the document data DD received in step ST203 is valid because the identification data KpubID is not included in the invalid list data RLITa received in step ST202 (step ST204).

After that, when the client device C1a is stolen (step ST205), invalid notification data including invalid time data TIME indicating the time when the legitimate user of the client device C1a was stolen and identification data KpubID of the public key data Kpub1. The RNa is transmitted to the invalid list distribution server 14a (step ST206).
The invalid list distribution server 14a updates the invalid list data RLITa based on the received invalid notification data RNa to generate invalid list data RRISTa (RTIME (2)).
Then, the client device C2a receives the invalid list data RLITa (RTIME (2)) from the invalid list distribution server 14a (step ST207). At this time, the invalid list data RLITa (rTIME (2)) includes the identification data KpubID of the public key data Kpub1 used for verification of the signature data SDa.
Further, the client device C1a, for example, a document to which data TIME (3) + HD, signature data SDa, public key certificate data Cert1, and time certification data T_Cert are added in response to an instruction from an unauthorized user who has been stolen. Data DD is transmitted to document distribution server 10 (step ST208).
Here, the time data TIME (3) is later than the invalid time data TIME (2).
Then, the client device C2a receives the document data DD to which the data TIME (3) + HD, the signature data SDa, the public key certificate data Cert1, and the time certification data T_Cert are added from the document distribution server 10 (step ST209). .
Next, since the identification data KpubID is included in the invalid list data RLITa (RTIME (2)) received in step ST205, the client device C2a includes the invalid time data TIME (2) in the invalid list data RLITa. The time data TIME (3) added to the document data DD is compared, and the time data TIME (3) is slower, so it is determined that the document data DD received in step ST209 is invalid (step ST210). .

As described above, in the communication system 101, as shown in FIG. 13, the client device C1a acquires the time data TIME indicating the time when the signature data SDa was generated from the timer 59 provided in the security chip SCa. , It is added to the document data DD together with the signature data SDa.
Therefore, according to the communication system 101, even when the client device C1a is stolen, an unauthorized user cannot adjust the timer 59, and the time data TIME added to the document data created by the unauthorized user is the timer 59. The generation time of the signature data SDa with reference to is accurately shown.
Further, since the signing client device C2a adjusts the time data TIME based on the time certification data T_Cert, the generation time of the signature data SDa based on the timer in the time certification server 16 can be specified. Signature data SDa having a later generation time can be appropriately invalidated.
Therefore, according to the communication system 101, the verification client device C2a can determine the validity of the document data DD with high reliability.

<Third Embodiment>
In the present embodiment, when the CPUs 45 and 45a of the client devices C1 and C1a are activated by turning on the power of the client devices C1 and C1a, the BIOS, the loader loader, and the operating system OS that are activated on the client devices C1 and C1a. , OSa and application program AP, APa generates operating environment data PHD including hash data.
The CPUs 45 and 45a transmit the document data DD with operating environment data PHD added thereto.
The client devices C2 and C2a on the verification side use the document data DD based on the BIOS, the loader Loader, the operating system OS, OSa, and the hash data of the application programs AP and APa previously obtained from the vendor in the verification of FIGS. The operating environment data PHD added to is verified. Then, the client devices C2 and C2a determine that the document data DD is valid on the condition that it is determined that they match in the verification.
As a result, the client apparatuses C2 and C2a are provided with an operating environment in which the client apparatuses C1 and C1a appropriately perform the processes of FIGS. 6 and 15, that is, an operation for properly generating the count data CD and the time data TIME. You can verify that you have the environment.
Thereby, the reliability of the communication systems 1 and 101 can be further improved.

The present invention is not limited to the embodiment described above.
In the embodiment described above, the document data DD is exemplified as the proof data of the present invention, but the proof data of the present invention may be other content data such as an e-mail.

  The present invention can be applied to a system for verifying the validity of signed data to be certified.

FIG. 1 is an overall configuration diagram of a communication system according to a first embodiment of this invention. FIG. 2 is a block diagram of the client device shown in FIG. FIG. 3 is a diagram for explaining a software (operation) environment realized by the CPU shown in FIG. FIG. 4 is a configuration diagram of the security chip shown in FIG. FIG. 5 is a diagram for explaining data that the client apparatus shown in FIG. 2 transmits to the document distribution server together with the document data. FIG. 6 is a flowchart for explaining an operation example when the client apparatus shown in FIG. 2 generates document data. FIG. 7 is a flowchart for explaining an operation example when the client apparatus shown in FIG. 2 requests the invalid list distribution server to invalidate the signature data. FIG. 8 is a flowchart for explaining an operation example when the client device shown in FIG. 2 verifies the document data. FIG. 9 is a flowchart for explaining an example of the overall operation of the client apparatus shown in FIG. FIG. 10 is an overall configuration diagram of a communication system according to the second embodiment of this invention. FIG. 11 is a block diagram of the client device shown in FIG. FIG. 12 is a diagram for explaining a software (operation) environment realized by the CPU shown in FIG. FIG. 13 is a configuration diagram of the security chip shown in FIG. FIG. 14 is a diagram for explaining data that the client apparatus shown in FIG. 11 transmits to the document distribution server together with the document data. FIG. 15 is a flowchart for explaining an operation example when the client apparatus shown in FIG. 11 generates document data. FIG. 16 is a flowchart for explaining an operation example when the client apparatus shown in FIG. 11 requests the invalid list distribution server to invalidate the signature data. FIG. 17 is a flowchart for explaining an operation example when the client device shown in FIG. 11 verifies the document data. FIG. 18 is a flowchart for explaining an example of the overall operation of the client apparatus shown in FIG.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 1,101 ... Communication system, 10 ... Document delivery server, 12 ... Certification body, 14, 14a ... Invalid list delivery server, 16 ... Time certification server, C1, C2, C1a, C2a ... Client device, 42 ... Interface, 43 ... Memory, 45, 45a ... CPU, 46 ... Display, 47 ... Operation unit, SC. SCa ... security chip, 51 ... input / output circuit, 52 ... key generation circuit, 53 ... hash circuit, 54 ... random number generation circuit, 55 ... signature / encryption circuit, 56 ... memory, 57, 57a ... processor, 58 ... counter

Claims (16)

A program for causing a computer to execute processing,
A first procedure for updating the count data in a secure manner in the computer in one direction of increasing or decreasing each time signature data relating to the data to be certified is generated;
A second procedure for generating the signature data for the certified data and the count data updated in the first procedure;
A program for causing the computer to execute a third procedure for adding the count data updated in the first procedure and the signature data generated in the second procedure to the certified data. A fourth procedure for generating hash data of the proved data;
The second procedure generates the signature data for the hash data and the count data generated in the fourth procedure,
The third procedure adds the hash data generated in the fourth procedure, the count data updated in the first procedure, and the signature data generated in the second procedure to the certified data. The program according to claim 1. The log data indicating the history of the count data updated in the first procedure is stored, and the log data is output to the outside of the computer in response to a backup instruction. program. A sixth procedure for generating operating environment data including hash data of the BIOS, loader, operating system, and application program started on the computer when the computer is started;
The program according to claim 1, wherein the third procedure further adds the operating environment data generated in the sixth procedure to the certified data. A memory for storing the program;
A counter that updates the count data in a secure state in either direction of increment or decrement each time signature data related to the data to be certified is generated;
An execution circuit that generates the signature data for the certified data and the count data of the counter according to the program read from the memory, and adds the count data and the signature data to the certified data; Having a computer. A data processing method executed by a computer,
A first step of updating the count data in a secure manner in the computer in one direction of increasing or decreasing each time signature data related to the data to be certified is generated;
A second step of generating the signature data for the certified data and the count data updated in the first step;
A data processing method comprising: a third step of adding the count data updated in the first step and the signature data generated in the second step to the certified data. A first procedure for verifying whether signature data added to the data to be certified and indicating the validity of the data to be certified has been generated based on key data defined in advance;
Increased each time the signature data is generated at the source of the signature data added to the data to be certified, provided that it is determined that the signature data is generated based on the key data in the first procedure. Alternatively, a program for causing a computer to execute a second procedure for determining validity of the signature data based on count data updated to one of the decrease and count data of signature data to be invalidated. The program according to claim 7, further comprising: a third procedure for determining that the certified data is valid on the condition that the signature data is determined to be valid in the second procedure. A fourth procedure of receiving invalid list data indicating the identification data of the signature data to be invalidated and the count data in association with each other;
In the second procedure, when an item of identification data associated with the certified data exists in the invalid list data, the count data associated with the identification data in the invalid list data; The program according to claim 7, wherein the validity of the signature data is determined by comparing the count data added to the certified data. The program according to claim 9, wherein the fourth procedure receives the invalid list data each time the validity of the signature data is verified in the first procedure, or periodically. A fifth procedure for verifying the validity of each hash data of the BIOS, loader, operating system, and application program that is added to the data to be certified and started on the computer that generates the signature data; In addition,
The program according to claim 7, wherein the second procedure is executed on condition that the validity is verified in the fifth procedure. A memory for storing the program;
In accordance with the program read from the memory, it is verified whether signature data added to the data to be certified and indicating the validity of the data to be certified is generated based on pre-defined key data. A count that is added to the data to be certified and updated to either increase or decrease each time the signature data is generated at the generation source of the signature data on the condition that it has been generated based on the key data A computer having an execution circuit that determines the validity of the signature data based on the data and count data of the signature data to be invalidated. A data processing method executed by a computer,
A first step of verifying whether or not signature data added to the data to be certified and indicating the validity of the data to be certified is generated based on key data defined in advance;
Increased each time the signature data is generated at the source of the signature data that is added to the data to be certified, provided that the signature data is determined to be generated based on the key data in the first step. A data processing method comprising: a second step of determining validity of the signature data based on count data updated to one of the decrease and count data of signature data to be invalidated. A data processing method in which a first computer and a second computer communicate with each other,
A first step of updating the count data in a secure state in the computer in one direction of either incrementing or decrementing each time the first computer generates signature data relating to the data to be certified;
A second step in which the first computer generates the signature data for the certified data and the count data updated in the first step;
A third step in which the first computer adds the count data updated in the first step and the signature data generated in the second step to the certified data and transmits the data to the second computer. When,
A fourth step in which the second computer verifies whether or not the signature data added to the data to be certified received in the third step is generated based on predetermined key data;
On the condition that the second computer determines that the signature data is generated based on the key data in the fourth step, the count data added to the certified data, and the invalidation target And a fifth step of determining the validity of the signature data based on the count data of the signature data. A program for causing a computer to execute processing,
A first procedure for causing a predetermined proof source external to the computer to prove the validity of the time indicated by a timer that counts time in a secure state in the computer, and receiving proof data indicating the result of the proof,
A second procedure for obtaining time data indicated by the timer when generating signature data related to the certified data;
A third procedure for generating the signature data for the proved data and the time data acquired in the second procedure;
A fourth procedure for adding the certification data received in the first procedure, the time data obtained in the second procedure, and the signature data generated in the third procedure to the certified data A program for causing the computer to execute. A first procedure for verifying whether or not the signature data added to the data to be certified is generated based on key data defined in advance;
A second procedure for verifying the proof data indicating the validity of the time data indicated by the timer that measures time in a secure state at the generation source of the signature data;
It is added to the data to be certified on condition that it is determined that the signature data is generated based on the key data in the first procedure and that the certification data is valid in the second procedure. A program that causes the computer to execute a third procedure for determining the validity of the signature data based on the time data that has been set and time data that indicates when the signature data is invalidated.

Images