JP2006165888A - Time authentication automatic acquisition method of electronic file and communication terminal equipment equipped with time authentication automatic acquisition function - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a method and device for indirectly receiving the time authentication of a plurality of files by receiving time zone authentication in a summarized form without respectively receiving time authentication. <P>SOLUTION: This time authentication automatic acquisition method comprises: a first step for registering and storing the hash value of a file being the object of authentication in a hash value list for time zone authentication until a preliminarily set acceptance end time comes; a second step for transmitting the hash value of a hash value list for time zone authentication to a time authentication institute when the acceptance end time comes, and for registering an authentication token received in response to this and the hash value list for time zone authentication in the system; and a third step for registering the hash value of the authentication token in a new hash value list for time zone authentication for receiving the time band authentication the next, and for specifying the acceptance start time of the new hash value list for time zone authentication. Those first to third steps are repeatedly executed so that the time zone authentication for the plurality of files is executed. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to a method capable of automatically acquiring time authentication acquisition by a time authentication organization for an electronic file created by a computer or the like, and capable of easily detecting falsification of the electronic file, and a communication terminal device capable of implementing this method.

  In recent years, paperless electronic files have been developed in government offices and offices, and electronic files such as electronic books and electronic medical records are managed by communication terminal devices. However, such an electronic file can be easily altered. Therefore, in order to ensure its authenticity, once the electronic file is recorded, a hardware method using a recording device that uses a medium that can never be modified or read and write the file using different heads, Alternatively, a software method is used by attaching the creator's electronic signature to the electronic file.

  However, the above-mentioned hardware method has poor cost performance, and the above-mentioned software method is not only a proof that the creator who has an electronic certificate has created an electronic file, but also a proof of when the electronic file was created. Therefore, it is easy for the creator to alter the electronic file.

  Therefore, in recent years, time authentication of electronic files using a time authentication authority has been adopted.

That is, in this method, when an electronic file created by a creator of an electronic file on a personal computer or the like is registered in the system, the time certification authority receives the hash value of the electronic file and performs an electronic signature on the hash value. At that time, the electronic file can be proved.
US Pat. No. 5,136,646

  However, even when such time authentication is performed, only the time authentication is proved for each electronic file with an electronic signature, and when there are a plurality of electronic files, they are collected in time-series aggregate units. However, it is difficult to confirm the fact when a specific file is intentionally deleted among a plurality of electronic files.

  Therefore, recently, a service as shown in US Pat. No. 5,136,646 has been used, and each of a plurality of electronic files is hashed with a hash function, and each hash value is further hashed hierarchically. Since the integrated hash value is calculated, if the content of the specific file is falsified or intentionally missing, the value of the integrated hash value will fluctuate. Or intentional omission can be prevented.

  However, in the technique of the above-mentioned Patent Document 1, even if the contents of a specific file can be falsified and intentional omission can be prevented, it is only performed by the service provider that the time-authenticated electronic file is not missing. However, there is no way for a third party to verify this in a simple way.

  In addition, in order to prove that the content of the specific file has not been altered or lost, the service provider can integrate the hash value at regular intervals such as weekly when the specific file has been sent to the service provider. Although there is a method of providing the integrated hash value of newspaper publication, it is difficult for ordinary people to verify whether the proof is accurate.

  Furthermore, when the time authentication is performed for each electronic file by the time authentication authority, the number of times of authentication increases and the cost is increased.

  In view of such circumstances, the present applicant calculates a hash value for each file to be authenticated in place of the method of acquiring time authentication for each individual file in the previous PCT / JP2004 / 006405, We have proposed a method and system for easily detecting falsification and omission of a plurality of predetermined files by calculating a hash value list and obtaining time authentication for the hash value list.

  An object of the present invention is to propose a method for further improving and extending the invention according to such an application and a communication terminal device for executing the method.

  In order to achieve the above object, according to the first aspect of the present invention, a hash value of a file to be authenticated is used as a time zone authentication hash value until a preset reception end time is reached. The first step of registering and storing in the list (file storage step) and the reception end time, the hash value of the hash value list for time zone authentication is transmitted to the time certification authority, and the authentication token received in response thereto And a second step for registering the hash value list for time zone authentication in the system (acquisition end time acquisition step), and a hash value of the authentication token for a new time zone authentication for the next time zone authentication. A third step of registering in the hash value list and specifying a reception start time of a new time zone authentication hash value list (reception start time acquisition step), Repeated by the row of the three-step, and performing row time zone authentication for a plurality of files.

  In the third step, the hash value of the authentication token of the time zone authentication hash value list is registered in a new time zone authentication hash value list for receiving next time zone authentication. As long as the authentication token can be associated with the authentication token, for example, a hash value extracted from the authentication token, a hash value generated from the authentication token file, or the like can be used.

  This time authentication acquisition method is executed by processing of a program as a system such as a personal computer. In the time authentication acquisition program, for example, a file stored in a predetermined folder is set as an authentication target. It can be accepted as a file to be received and used as a system to prove the time zone registered in the system.

  Here, in claim 2, the hash value list for time zone authentication that is time-authenticated by the method of claim 1 is a file that is subject to time authentication, an individual folder or an individual archive file together with the authentication token. To be saved as.

  In addition, the second invention proposed at the same time can be used as a simple time authentication method using electronic data, which cannot be proved to be registered in the system, but can be changed to a conventional fixed date.

  That is, in the third aspect of the present invention, when an arbitrary file is selected, the hash value of the file is transmitted to the time certification authority, the authentication token is received, and the authentication token is received. Step of registering and saving as a start time authentication token in the hash value list for time zone authentication, selecting a file to be authenticated, registering the hash value in the hash value list for time zone authentication and storing When the time authentication command is received, the entire hash value of the hash value list for time zone authentication is transmitted to the time authentication authority, the authentication token is received, and the received authentication talk is authenticated A token recording start time authentication token, a time zone authentication hash value list, and a step of recording in the system. .

  Further, in claim 4, the hash value list for time zone authentication time-authenticated by the method of claim 3 includes the intermediate file to be authenticated and the first authentication for each time zone authentication hash value list. Along with the token and the last authentication token, it is stored as a separate folder or archive file.

  Furthermore, Claim 5 which is the third present invention proposed at the same time provides a communication terminal device having a function capable of implementing the time authentication method according to the first and second present inventions.

  Here, the communication terminal apparatus is connected to a time authentication organization through a communication network, and executes the time authentication automatic acquisition means, the hash value list creation means, the control means, and the method according to any one of claims 1 to 4. And at least storage means for storing a control program for executing the time authentication method according to any one of claims 1 to 4, wherein the control means executes the control program. It has a function.

  Such a communication terminal device can be easily realized by providing a personal computer with a communication function.

  According to claim 1 of the present invention, the reception period reception time zone from the reception start time to the reception end time is defined, and at the reception end time, the hash value of the time zone authentication hash value list is transmitted to the time authentication organization. The authentication token is received, and the hash value of the authentication token that has received the time authentication is registered to prepare a new hash value list for time zone authentication. Therefore, in such a configuration, a certain reception end time coincides with the next reception start time, the time zone authentication hash value list can be used at any time, and the hash value of the file to be authenticated In principle, it is always registered in only one of the time zone authentication hash value lists, so that the continuity of the authentication operation of the system is guaranteed, and each reception target period for each file to be authenticated It can be proved by specifying whether it was accepted during the reception time zone.

  In addition, since the entire time zone authentication hash value list is time-authenticated, not only the hash values of individual files to be authenticated but also their order are stored in an unchangeable manner. Of course, the fraudulent act can be detected only by changing the registration order of the file in the system.

  Further, when compared with the case where time authentication is performed for each file, the number of times of time authentication can be reduced, thereby reducing costs.

  According to claim 2, the time-authentication hash value list that has been time-authenticated is stored in a separate folder or as a separate archive file together with the time-authenticated file and the authentication token. Therefore, it is easy to manage authentication tokens, hash value lists, and target files.

  According to claim 3, the reception start time and the reception end time in the reception time zone can be specified by the authentication token of an arbitrary file and the authentication token of the hash value list for time zone authentication. Therefore, if the user operates the system when necessary and receives time zone authentication for a plurality of files, the user can at least make them date-proven materials. It can be used as a simple electronic certification method that can replace the date.

  Furthermore, since the intermediate file and the time zone authentication hash value list, and the authentication token and the time zone authentication hash value list are stored together, handling at the time of verification and the like is facilitated.

  The communication terminal apparatus according to the fifth aspect has a communication function in a personal computer, and can simply implement the first and second aspects of the present invention simply by installing a necessary control program.

  Embodiments of the present invention will be described below.

  1 and 2 are schematic explanatory views of the first method of the present invention.

  In the method of the present invention, until the preset reception end time is reached, the first step of registering and storing the hash value of the file to be authenticated in the hash value list for time zone authentication (file accumulation) Step) and the reception end time, the hash value of the time zone authentication hash value list existing at that time is transmitted to the time certification authority 2, and the received authentication token and the time zone authentication hash value list And a new time zone authentication hash value for receiving the next time zone authentication for the hash value of the authentication token received from the time certification authority 2. A third step (registration start time acquisition step) for registering in the list and specifying the reception start time of the new hash value list for time zone authentication. Repeated by the row of performing first to third steps of al is performed row time zone authentication for a plurality of files.

  The hash value here is a value generated by applying a well-known one-way function based on an algorithm such as MD-5 to the target file, and has a tendency to be widely distributed within a predetermined bit length range. It is the value. Therefore, the target file and its hash value do not strictly correspond one-to-one and are many-to-one, but may be regarded as a one-to-one correspondence. In the present invention, it is not always necessary to use a hash value as long as the value can be regarded as a one-to-one correspondence with the target file.

  The hash value list for time zone authentication may exist only in the system memory until the hash value is calculated. In this case, the hash value list is written in a predetermined file format when the hash value is calculated. It is.

  Further, as a hash value of the authentication token registered in the time zone authentication hash value list, it is desirable to use a hash value extracted from the authentication token file (that is, transmitted to the time certification authority), As another configuration, a hash value that is newly calculated from an authentication token file and that identifies the authentication token can be used. In the example illustrated in FIGS. 1 and 2, a configuration in which a hash value of an authentication token registered in the time zone authentication hash value list is extracted from an authentication token file is illustrated.

  Such a time authentication acquisition method is incorporated in a personal computer or the like as a time zone authentication system, and is executed by processing of a program. In the program, for example, a file stored in a predetermined reception folder (not shown) can be accepted as a file to be authenticated and used as a system for proving the time zone registered in the system. Further, instead of using such a reception folder, a configuration is possible in which a pointer for specifying a file to be authenticated is received from another program.

  In the method of the present invention, in order to register in the hash value list for time zone authentication, the timing for calculating the hash value from the file subject to authentication may be immediately after the file is stored in the reception folder. As another configuration, only the file acceptance order is determined and saved, and during the acceptance period, as a background process according to the system load, the hash value of each file is calculated and the acceptance end time is reached After confirming that the hash values of all the files are registered in the time zone authentication hash value list, the hash values in the time zone authentication hash value list may be transmitted to the time certification authority.

  Also, setting data such as reception end time is registered in a setting file (not shown) or a registry, etc., and a time authentication command generation step that periodically notifies the reception end time by an interrupt or the like is executed. By doing so, the system can surely know the arrival of the reception end time.

  The reception end time may be set at midnight every day in a practical usage form, but is not limited thereto, and is set so that the designated time arrives every few hours or every few days. do it.

  According to such a configuration, the reception time zone starting at the reception start time and ending at the reception end time is specified, and the hash value of the hash value list for time zone authentication for the reception time zone is set as the reception end time. The authentication token is transmitted to the certificate authority and received, and the hash value of the authentication token that has received the time authentication is registered to prepare a new hash value list for time zone authentication.

  Therefore, a certain reception end time coincides with the next reception start time, and the hash value list for time zone authentication can be used at any time, and the hash value of the file to be authenticated is in principle time. Since it is always registered in only one of the hash value lists for band authentication, the continuity of the authentication operation of the system is guaranteed, and in which reception time period each file to be authenticated was received Can be identified and proved.

The above configuration will be described in more detail with reference to FIGS.
That is, in such a method of the present invention, at the time of the first time authentication (time T1), an arbitrary file X can be used as the first file as the first file for creating the time zone authentication hash value list. Then, the hash value of the file is calculated and transmitted to the time authentication authority 2, and the time token is received by receiving the authentication token (T1, HASH-1). If the system setting file is used as the arbitrary file X, modification of the setting data can be detected, so that it is considered that the reliability of the system is increased.

After such first time authentication is performed, a time zone authentication hash value list Y is prepared, and the hash value (HASH-) of the authentication token (T1, HASH-1) that has received the first time authentication at the top thereof is prepared. 1) is registered, and an arbitrary file X and an authentication token (T1, HASH-1) are registered in the system.
The authentication token (T1, HASH-1) and the time zone authentication hash value list Y are related to each other by the common hash value HASH-1 including the hash value of the first file and the authentication time information. Since the relationship is guaranteed, the first reception start time to the system is specified.

  Then, after the reception start time T1, until the reception end time T2, the file accumulation step described above is executed, and the files A, B,... G to be authenticated are stored in the reception folder. Are registered in the system, and the hash values (HASH-A, B... G) are sequentially registered and accumulated in the time zone authentication hash value list Y in the order of acceptance.

Next, when the reception end time T2 is reached, a reception end time acquisition step is executed.
That is, all the hash values HASH-A, HASH-B, and HASH-G of the files A, B, and G received during the reception time period from the reception start time T1 to the reception end time T2 are registered. The entire hash value of the hash value list stored in the hash value list Y for time zone authentication transmitted is transmitted to the time certification authority 2, and the received authentication token (T2, HASH-2) is received. The hash value list Y for time zone authentication is associated with and registered in the system.

  Here, the authentication token (T2, HASH-2) received at this time includes the time information of the reception end time T2 that commanded the authentication, but the hash value is again obtained from each of the files A, B,. Is calculated, it is possible to reversely specify the time zone authentication hash value list Y in which the file is registered, and start accepting the reception time zone corresponding to the specified time zone authentication hash value list Y The correctness of the time T1 and the reception end time T2 can be proved to the third party by the authentication tokens (T1, HASH-1) and (T2, HASH-2).

  In addition, since the time authentication is performed for the entire time zone authentication hash value list Y, not only the hash values HASH-A and HASH-B • HASH-G of the files A, B ·· G but also the order thereof are changed. Detecting fraudulent actions even if the order of saving files A, B, G is falsified, as well as falsification and deletion of files A, B, G Can do. So

  Then, the hash value HASH-2 of the authentication token (T2, HASH-2) received from the time certification authority 2 is also registered in a new time zone authentication hash value list Z for receiving next time zone authentication. . As a result, the reception start time T2 for the new time zone authentication hash value list Z is specified, which always matches the reception end time T2 for the previous time zone authentication hash value list Y. Therefore, the continuity of the authentication operation of the system is guaranteed.

  The above three steps are repeated, and the file accumulation step is performed for the next files H to M to be authenticated. When the reception end time T3 is reached, the hash values in which the hash values of these files are registered When the time zone authentication of the list is received and this is completed, the same processing is further repeated.

  Note that the time authentication tokens acquired by the authentication server of the time authentication authority 2 are all encrypted by the private key held by the time authentication authority 2 and can be decrypted only by the public key distributed by the time authentication authority 2. That is, the system that executes the method of the present invention internally holds the public key in advance.

FIG. 3 is a flowchart (101 to 108) showing the basic operation for implementing the method of the present invention using a computer.
FIG. 4 illustrates another embodiment of the first method according to the present invention. In this example, the time zone authentication hash value lists Y2 and Y3 that have been time zone authenticated are the reception end times. Are stored as T1 and T2 folders together with the above-described authentication tokens (T1, HASH-1) and (T2, HASH-2), which show the contents of the T1 and T2 folders. . The arrows in the figure relate to the hash value generation source and the registration destination. For example, the first hash value HASH-1 of the time zone authentication hash value lists Y1 and Z1 stored in the T2 and T3 folders ', HASH-2' is a hash value HASH-1 ', HASH- generated from a file of authentication tokens (T1, HASH-1), (T2, HASH-2) stored in the setting folder or T2 folder. Note that the configuration is 2 ', which is different from the previous embodiment.

  In addition, the T2 folder, the T3 folder, and the like in this example may be compressed as archive files V and W, respectively.

  In this example, the initial setting file X in the setting folder is used for time authentication at the time T1. However, the present invention is not limited to this, and an arbitrary file can be used. A method is also conceivable in which a hash value list that has already existed at the time of application of the method of the invention and in which hash values of files desired to be authenticated are registered is used in place of the initial setting file X. .

  Next, the second method of the present invention will be described below.

  FIG. 5 shows a second method of the present invention, and FIG. 6 is a flowchart (201 to 210) showing this procedure.

  According to the method of the present invention, when an arbitrary file is selected as the head file, the hash value of the head file is transmitted to the time certification authority 2, the authentication token is received, and the authentication token is used as the reception start time authentication token. A step of registering and storing in the hash value list for time zone authentication, selecting a file to be authenticated, registering and storing the hash value in the hash value list for time zone authentication, and time When the authentication command is received, the entire hash value of the hash value list for time zone authentication is sent to the time certificate authority, the authentication token is received, and the received authentication token is used as the reception end time authentication token. A time authentication token, a time zone authentication hash value list, and a step of recording in the system.

  FIG. 5 shows the time change of the contents of the folder U in which each related file is stored in this method.

  That is, as an initial setting, as shown in FIG. 5A, when the user operates the system and selects an arbitrary top file X stored in the folder U, the system authenticates the hash value HASH-1 for the time authentication. Send to the organization 2 to receive time authentication, and use the time authentication token as a reception start time authentication token (T1, HASH-1), and register the authenticated hash value in the time zone authentication hash value list Y2 in the folder To do.

  Then, as shown in FIGS. 5B to 5D, when the files A, B,.. G to be authenticated are stored in the folder by the user, the respective hash values for which the hash values are to be registered are registered. Registered in the folder in the value list, as shown in FIGS. 5B to 5D, any file A to G is selected, and the hash values are stored as files A, B,. Are sequentially registered in the time zone authentication hash value list Y2.

  Next, when a time authentication command is received from the user, as shown in FIG. 5 (c), the hash value HASH2 of the time zone authentication hash value list Y2 is transmitted to the time authentication authority 2, and authentication is performed for the initial setting. The time authentication is collectively received together with the received hash value, the authentication token (T2, HASH-2) is received, and the received authentication token (T2, HASH-2) is received. The reception end time authentication token (T2, HASH-2) ), The reception start time authentication token (T1, HASH-1) and the time zone authentication hash value list Y2 are registered in the filter as the reception end time authentication token.

  Thus, according to the second method of the present invention, the authentication token (T1, HASH-1) of an arbitrary file X and the authentication token (T2, HASH-2) of the hash value list Y2 for time zone authentication, The reception start time T1 and the reception end time T2 in the reception time zone can be specified, and the correctness can be claimed to a third party. Therefore, if the user operates the system when necessary and has received time zone authentication for a plurality of files A, B,... G, at least those can be used as date-proven materials. It can be used as a simple electronic certification method that can replace the conventional fixed date. The user can operate the system when necessary and can receive time authentication for a desired file. If such a time authentication is received, it can be stored at least as a document with a proven date, It can be used instead of the conventional fixed date.

That is, in the above-described method of the present invention, the same authentication token that specifies the time zone authentication hash value list, the authentication target file, the reception start time, and the reception end time, obtained in one span from the reception start time to the reception end time. The data is stored in a folder, and the data in the folder is an archive file.
FIG. 7 is a block diagram showing a schematic configuration of the communication terminal apparatus of the present invention.
The apparatus 1 is connected to a time authentication organization 2 through a communication network N, and includes a time authentication automatic acquisition means 10, a hash value list creation means 11, a control means 12, and a method according to any one of claims 1 to 4. And storage means 13 storing a control program for execution. The control means 10 has a function of executing the time authentication method according to any one of claims 1 to 4 by reading out and executing the control program from the storage means 13.

FIG. 8 shows a binary P (executable format file) of a program P for executing the method of the present invention and its electronic signature file IDF, which includes a hash value HASH-P of the binary P.
Although it is desirable for this program P to prevent modification by a third party or a user, since the electronic signature file IDF is attached and distributed, the modification can be easily detected.

It is a schematic explanatory drawing of the 1st method of this invention. It is a schematic explanatory drawing which shows the relationship between the electronic file in 1st this invention method, and time authentication. It is a flowchart which shows the basic operation | movement in the 1st method of this invention. In 1st invention, it is explanatory drawing in the case of preserve | saving a time authentication token as a folder and an archive file. It is a schematic explanatory drawing of the 2nd method of this invention. It is a flowchart which shows the basic operation | movement in the 2nd method of this invention. It is a figure which shows an example of schematic structure of the communication terminal device of this invention. A binary (execution format file) of a program for executing the method of the present invention and an electronic signature file thereof.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Communication terminal device 10 Time authentication automatic acquisition means 11 Hash value list preparation means 12 Control means 13 Storage means 2 Time authentication organization N Communication network

Claims (5)

A first step of registering and storing a hash value of a file to be authenticated in a time zone authentication hash value list until a preset reception end time is reached;
When the reception end time comes, the hash value of the time zone authentication hash value list is transmitted to the time certification authority, and the received authentication token and the time zone authentication hash value list are registered in the system. And the steps
A hash value of the authentication token is registered in a new time zone authentication hash value list for receiving next time zone authentication, and a reception start time of the new time zone authentication hash value list is specified. With steps,
A time authentication automatic acquisition method for an electronic file, characterized in that time zone authentication is performed for a plurality of files by repeatedly performing the first to third steps. In claim 1,
The hash value list for time zone authentication that has been time zone authenticated by the method of claim 1 is stored in an individual folder together with the authentication token that specifies a file to be authenticated, a reception start time, and a reception end time. A method for automatically acquiring time certification for electronic files that is stored as a separate archive file. When an arbitrary file is selected, the hash value of the file is sent to the time certification authority, the authentication token is received, and the authentication token is used as the reception start time authentication token in the time zone authentication hash value list. A step of saving the registration;
Selecting files to be authenticated, registering their hash values in the above-mentioned time zone authentication hash value list, and accumulating;
When the time authentication command is received, the entire hash value of the above time zone authentication hash value list is transmitted to the time authentication authority, the authentication token is received, and the received authentication token is used as the reception end time authentication token. An electronic file time authentication automatic acquisition method comprising: a step of recording in the system together with the reception start time authentication token and the time zone authentication hash value list. In claim 3,
The hash value list for time zone authentication that has been time zone authenticated by the method of claim 3 includes, for each time zone authentication hash value list, a file to be authenticated, the reception start authentication token, and the reception end authentication token. In addition, an electronic file time authentication automatic acquisition method that is stored in an individual folder or as an individual archive file. Connected to a time certification authority via a communication network,
A time authentication automatic acquisition unit, a hash value list creation unit, a control unit, and a storage unit storing at least a control program for executing the method of any one of claims 1 to 4;
The said control means is a communication terminal device provided with the function to execute the said control program and to perform the time authentication method as described in any one of Claims 1-4.

Images