JP2006166354A - Method, device and program for preparing electronic signature validity certification data, and method, device and program for confirming justice of electronic signature validity certification data, and method, device and program for confirming electronic signature validity - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a method for preparing electronic signature validity certification data by which the validity of an electronic signature on an electronic document can be appropriately confirmed. <P>SOLUTION: The method for preparing the electronic signature validity certification data showing that the validity of an electronic signature on an electronic document is confirmed comprises: a certification target acquiring step of acquiring the electronic signature and a first public key certificate for the electronic signature; a public key certificate confirming step of confirming validity of the first public key certificate acquired in the certification target acquiring step; a first hash value calculating step of calculating a hash value for the electronic signature and the first public key certificate; a first electronic signature preparation step of preparing an electronic signature for the hash value; and a preservation step of defining data containing at least the hash value and the electronic signature for the hash value as electronic signature validity certification data, and preserving, in a predetermined storage region, the electronic signature validity certification data. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to a method for generating electronic signature validity proof data, a method for confirming the validity of electronic signature validity proof data, a method for confirming the validity of electronic signature, a digital signature validity proof data generation device, a digital signature validity proof data valid The present invention relates to a validity confirmation device, a digital signature validity confirmation device, a digital signature validity certification data generation program, a digital signature validity certification data validity confirmation program, and a digital signature validity confirmation program. Electronic signature validity proof data generation method, electronic signature validity proof data validity verification method, electronic signature validity confirmation method, electronic signature validity proof data generation device, electronic signature validity proof data validity Authenticity confirmation device, electronic signature validity confirmation device, electronic signature validity proof data generation program, electronic signature validity proof data validity confirmation program Lamb, and an electronic signature validation program.

  With the development of network technology, electronic documents are routinely exchanged over a network. However, the exchange of electronic documents via a network involves a risk that a forged document or the like can be transmitted by a malicious person impersonating the person. Therefore, an electronic signature is used to prove the validity of the sender or creator of the electronic document.

However, there are cases where the authenticity of the sender of the document cannot be completely proved even by the electronic signature. That is, when an encryption key or an encryption algorithm is leaked, even a third party can perform the same electronic signature as the principal. Such risks increase with time. Therefore, it is not desirable from the viewpoint of ensuring security to continuously use the same encryption key and encryption algorithm over a long period of time.
JP 2003-134109 A JP 2003-263518 A

  However, there is a problem that it is very difficult to prove the validity of the electronic signature after the encryption key or the encryption algorithm is changed. Therefore, when an electronic document with an electronic signature must be stored for a long period of time, such as when legally obligated to store it, for example, a complicated request to periodically extend the validity of the electronic signature is required. Procedures are required. On the other hand, when there are a large number of electronic documents that are not used for a long time, these electronic documents are not always accessible recording media such as HDD (Hard Disk Drive), but are inexpensive and large capacity such as DVD (Digital Versatile Disk). There is a request to store in a recording medium. However, storage using a portable recording medium complicates the procedure for periodically extending validity.

  The technique described in Patent Document 1 relates to a system for verifying the validity of a public key certificate, and does not enable long-term guarantee of the validity of an electronic signature to be solved by the present invention. . If it is verified that the public key certificate is valid at a certain point, and the private key corresponding to the public key has been leaked, the electronic signature can still be forged. Therefore, it is not effective for the problem to be solved by the present invention.

  Further, the technique described in Patent Document 2 needs to send the document data itself to the center, and there is a problem that it is difficult to apply to highly confidential document data.

  The present invention has been made in view of the above points, and it is possible to appropriately verify the validity of an electronic signature of an electronic document. Validity confirmation method, electronic signature validity confirmation method, electronic signature validity certification data generation apparatus, electronic signature validity certification data validity confirmation apparatus, electronic signature validity confirmation apparatus, electronic signature validity certification data generation program, electronic It is an object of the present invention to provide a signature validity certification data validity confirmation program and an electronic signature validity confirmation program.

  In order to solve the above problem, the present invention provides a method for generating electronic signature validity certification data indicating that the validity of an electronic signature of an electronic document has been confirmed, as described in claim 1. A certification object acquisition procedure for acquiring the electronic signature and a first public key certificate for the electronic signature, and a public key for confirming the validity of the first public key certificate acquired in the certification object acquisition procedure A certificate confirmation procedure; a first hash value calculation procedure for calculating a hash value for the electronic signature and the first public key certificate; and a first electronic signature generation procedure for generating an electronic signature for the hash value; And storing data including at least the hash value and an electronic signature for the hash value as the electronic signature validity proof data, and storing the electronic signature validity proof data in a predetermined storage area And having a forward.

  According to such a method for generating electronic signature validity proof data, it is possible to generate electronic signature validity proof data that allows the validity of the electronic signature to be confirmed at a later date.

  In order to solve the above-mentioned problem, the present invention provides an electronic signature validity generated by the electronic signature validity proof data generation method according to any one of claims 1 to 4, as described in claim 5. A method for confirming the validity of electronic signature validity proof data for confirming validity of the proof data, the electronic signature validity proof data obtaining procedure for obtaining the electronic signature validity proof data, and the electronic signature validity A presence check procedure for checking whether or not the electronic signature validity certificate data acquired in the certificate data acquisition procedure exists in the predetermined storage area.

  According to such a method for confirming the validity of the electronic signature validity proof data, the validity of the electronic signature validity proof data can be confirmed. Therefore, the validity of the electronic signature can be confirmed based on the electronic signature validity certification data whose validity has been confirmed.

  In order to solve the above-mentioned problem, the present invention provides an electronic signature validity certificate generated by the electronic signature validity proof data generation method according to any one of claims 1 to 4, as described in claim 9. An electronic signature validity checking method for checking the validity of an electronic signature of the electronic document based on property verification data, wherein a hash value for the electronic signature of the electronic document and the first public key certificate is calculated. A second hash value calculation procedure, a hash value calculated in the first hash value calculation procedure, included in the digital signature validity certification data, and calculated in the second hash value calculation procedure And a determination procedure for determining the validity of the electronic signature of the electronic document by comparing the hash value.

  According to such an electronic signature validity checking method, it is possible to check the validity of the electronic signature of the electronic document based on the electronic signature validity certification data.

  Further, in order to solve the above-mentioned problem, the present invention executes an electronic certificate validity proof data generation apparatus for executing the electronic signature validity proof data generation method, or executes the electronic signature validity proof data generation method in a computer. An electronic proof validity proof data generation program may be used.

  In order to solve the above problems, the present invention provides an electronic signature validity certification data validity confirmation device that executes a validity confirmation method of the electronic signature validity certification data, or the validity of the electronic signature validity certification data. It is good also as a digital signature validity proof data correctness confirmation program for making a computer perform the property confirmation method.

  In order to solve the above problems, the present invention provides an electronic signature validity checking apparatus that executes the electronic signature validity checking method, or an electronic signature validity checking for causing a computer to execute the electronic signature validity checking method. It may be a program.

  According to the present invention, an electronic signature validity proof data generation method, electronic signature validity proof data validity confirmation method, and electronic signature validity confirmation that can appropriately confirm the validity of an electronic signature of an electronic document. Method, electronic signature validity proof data generation apparatus, electronic signature validity proof data validity confirmation apparatus, electronic signature validity confirmation apparatus, electronic signature validity proof data generation program, electronic signature validity proof data validity confirmation program, and An electronic signature validity checking program can be provided.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. FIG. 1 is a diagram illustrating a configuration example of an effectiveness confirmation system according to an embodiment of the present invention. In the validity confirmation system 1 of FIG. 1, the validity confirmation authority 10, the authentication authority 20, and the client device 30 are connected via a network 40 (whether wired or wireless), such as the Internet. Yes.

  The validity checking station 10 is a system that provides a service for checking the validity of an electronic signature attached to an electronic document. The certificate authority 20 is a system that issues a certificate (public key certificate) for certifying the validity of a sender or the like of an electronic document.

  The client device 30 includes a PC (Personal Computer), a PDA (Personal Digital (Data) Assistants), a PDA used by the owner of the electronic document, such as a sender or receiver of the electronic document with the electronic signature and the public key certificate. Or it is terminals, such as a mobile telephone.

  The validity checking station 10 and the certificate authority 20 may be configured by a plurality of computers, respectively, but in the present embodiment, description will be made assuming that each is configured by a single computer.

  FIG. 2 is a diagram illustrating a hardware configuration example of the validity checking station according to the embodiment of the present invention. 2 has a drive device 100, an auxiliary storage device 102, a memory device 103, an arithmetic processing device 104, and an interface device 105, which are mutually connected by a bus B. Composed.

  A program for realizing the processing in the validity checking station 10 is provided by a recording medium 101 such as a CD-ROM. When the recording medium 101 on which the program is recorded is set in the drive device 100, the program is installed from the recording medium 101 to the auxiliary storage device 102 via the drive device 100.

  The auxiliary storage device 102 stores the installed program and also stores necessary files and data. The memory device 103 reads the program from the auxiliary storage device 102 and stores it when there is an instruction to start the program. The arithmetic processing unit 104 executes a function related to the validity checking station 10 in accordance with a program stored in the memory device 103. The interface device 105 is used as an interface for connecting to the network 40 of FIG.

  The certificate authority 20 and the client device 30 can also be realized by the same hardware configuration as that in FIG. However, the client device 30 may include a display device such as a display and an input device such as a mouse and a keyboard.

  FIG. 3 is a diagram for explaining a process of issuing validity certification data by the validity checking station. A user who wishes to confirm the validity of the electronic signature of the electronic document receives the validity certificate data from the validity confirmation authority 10 in advance (before long-term storage of the electronic document, etc.), and then the electronic document and the electronic signature. And validity proof data must be stored in association with each other. Here, the validity proof data refers to data that the validity checking authority 10 proves that the validity of the electronic signature has been confirmed at a certain point in time.

  In FIG. 3, an electronic document 310, an electronic signature 321 and a public key certificate 322 are stored in the client device 30. The public key certificate 322 is issued by the certificate authority 20. The validity checking station 10 has functions such as a communication unit 11, a public key certificate checking unit 12, a validity certificate data generating unit 13, and a validity certificate data management DB 14.

  In response to an instruction from the user, the client device 30 transmits the electronic signature 321 and the public key certificate 322 of the electronic document 310 to the validity checking authority 10, thereby issuing validity certificate data to the validity checking authority 10. A request is made (S101).

  When the communication unit 11 of the validity checking station 10 receives the electronic signature 321 and the public key certificate 322 together with the request for issuing the validity certificate data from the client device 30, the public key certificate checking unit 12 receives the received public certificate. The validity of the key certificate 322 is confirmed by inquiring the certificate authority 20 (S102). If revocation information for public key certificates is provided, check processing by OCSP (Online Certificate Status Protocol) and CRL (Certificate Revocation List) are downloaded and confirmed depending on how the revocation information is provided. Switch between processing. Further, for example, when there is a certificate authority A that issues a certificate of the certificate authority 20 that issued the public key certificate 322, and there is a certificate authority B that issues a certificate of the certificate authority A, When the hierarchical structure of the certificate authority is configured, the validity is confirmed by following the chain of public key certificates. This procedure is described in detail in Japanese Patent No. 3543618.

  When the validity of the public key certificate 322 can be confirmed, the validity certificate data generation unit 13 generates the validity certificate data 130 (S103). The generated validity proof data 130 is registered in the validity proof data management DB 14 (S104), and is transmitted by the communication unit 11 to the client device 30 that is the issue request source of the validity proof data 130 (S105). .

  The user of the client device 30 can confirm that the electronic signature 321 is valid at a later date by storing the validity certificate data 130 together with the electronic document 310, the electronic signature 321 and the public key certificate 322. Keep it like that.

  Next, details of the validity proof data generation process by the validity proof data generation unit will be described. FIG. 4 is a diagram for explaining the generation process of validity proof data by the validity proof data generation unit.

  A hash value (target hash value 131) is obtained by using a one-way hash function such as SHA-1 (Secure Hash Algorithm 1) or MD5 (Message Digest 5) for a combination of the electronic signature 321 and the public key certificate 322. ) Is calculated (S103a). The target hash value 131, information indicating the date and time when the validity confirmation processing (S102) of the public key certificate 322 was performed by the public key certificate confirmation unit 12 (confirmation date 132), and the public key certificate 322 are valid. Together with the information (certificate confirmation 133) indicating that the certificate is valid and the serial number 134 as the content of the validity certification data 130 (hereinafter simply referred to as “content”), the hash value (content hash value 135) for the content ) Is calculated (S103b).

  The content hash value 135 is encrypted with the private key (signature key 15) for electronic signature of the validity checking authority 10, and the electronic signature (the verification authority signature 136) by the validity checking authority 10 for the hash value 135 is generated (S103c). . The verification authority signature 136 and the verification authority certificate 137, which is a public key certificate corresponding to the signature key 15, are attached to the content to form validity certificate data 130 (S103d, S103e, S103f). The verification authority certificate 137 is issued in advance to the validity verification authority 10 from a predetermined certificate authority.

  The generated validity proof data 130 is registered in the following table of the validity proof data management DB 14.

  FIG. 5 is a diagram showing a configuration example of the validity proof data management table constituting the validity proof data management DB. In FIG. 5, the validity proof data management table 141 includes items for registering a target hash value, confirmation date / time, certificate confirmation certificate, serial number, confirmation authority signature, confirmation authority certificate, and the like. That is, one validity proof data 130 is registered in the validity proof data management table 141 as one record.

  Next, a method in which the user who has issued the validity proof data 130 confirms the validity of the electronic signature 321 based on the validity proof data 130 at a later date will be described. FIG. 6 is a flowchart for explaining the digital signature validity confirmation processing by the client apparatus. The processing in FIG. 6 is executed by the client device 30 based on a program in response to an instruction from the user.

  First, it is determined whether the public key certificate 322 has expired or whether the public key certificate 322 has expired (S201). If the validity period has not expired and has not been revoked (No in S201), the same processing as that of normal electronic signature verification is executed using the electronic document 310, the electronic signature 321 and the public key certificate 322. Thus, the validity of the electronic signature is verified (S202).

  On the other hand, when the validity period of the public key certificate 322 has expired or when the public key certificate 322 has expired (Yes in S202), the certification authority certificate 137 included in the validity certification data 130 is displayed. It is determined whether or not the valid period has expired or the certification authority certificate 137 has expired (S203). If the validity period has not expired and has not expired (No in S203), the correctness of the mathematical relationship among the electronic document 310, the electronic signature 321 and the public key certificate 322 is verified (S204). That is, the electronic signature may be verified without confirming the revocation information or the like of the public key certificate 322. If the mathematical relationship is not correct (No in S205), it is assumed that the validity of the electronic signature 321 has not been confirmed (S210).

  If the mathematical relationship is correct (Yes in S205), a hash value (hereinafter referred to as “current hash value”) is calculated for the combined electronic signature 321 and public key certificate 322 (S206), and the current hash value is calculated. Is matched with the target hash value 131 included in the validity proof data 130 (S207). If the current hash value and the target hash value 131 do not match, it is assumed that the validity of the electronic signature 321 has not been confirmed (S210).

  If the current hash value and the target hash value 131 match (Yes in S207), the content (the target hash value 131, the confirmation date 132, the certificate confirmation certificate 133, and the serial number 134) included in the validity certificate data 130 is stored. Whether or not the confirmation authority signature 136, which is an electronic signature, is a correct electronic signature is verified using the confirmation authority certificate 137 (S208. This verification may also be performed in the same manner as normal electronic signature verification).

  When it is determined that the verification authority signature 136 is a correct electronic signature, the electronic signature 321 is displayed on the date and time indicated by the confirmation date and time 132 by the confirmation date and time 132 and the certificate confirmation certificate 133 included in the validity certificate data 130. It is assumed that the validity of the public key certificate 322 has been confirmed, and the validity has been confirmed (S209).

  On the other hand, if the validity of the certification authority certificate 137 included in the validity certification data 130 has expired or the certification authority certificate 137 has expired (Yes in S203), the validity certification data 130 is validated. The validity confirmation station 10 is requested to confirm the validity (S211). When the validity of the validity proof data 130 is confirmed (Yes in S212), an electronic signature is obtained using the validity proof data 130 for which the validity is confirmed by performing the processing from step S204 to SS208 described above. The validity of 321 is confirmed. When the validity of the validity proof data 130 is not confirmed (No in S212), it is assumed that the validity of the electronic signature 321 is not confirmed (S210).

  Even if the validity of the certification authority certificate 137 included in the validity certification data 130 has not expired and the certification authority certificate 137 has not expired (No in S203), from step S204. Without performing the processing up to S209, the validity confirmation station 10 may be requested to confirm the validity of the validity proof data 130, as in step S211.

  Further, when the validity of the certification authority certificate 137 included in the validity certification data 130 has expired or when the certification authority certificate 137 has expired (Yes in S203), the processing from S204 to S208 is performed. After performing, the processing of S211 and S212 may be performed.

  Next, the validity confirmation processing of validity certification data by the validity confirmation station 10 that is started by a request from the client device 30 in step S211 will be described. FIG. 7 is a diagram for explaining validity confirmation processing of validity proof data.

  The client device 30 transmits validity certificate data 130 stored in association with the electronic document 310, the electronic signature 321, and the public key certificate 322 to the validity checking authority 10, thereby validating the validity certificate data 130. Is requested from the validity checking station 10 (S211a).

  When the communication unit 11 of the validity checking authority 10 receives the validity proof data 130, the validity proof data verification part 16 includes the content included in the validity proof data 130, the checking authority signature 136, and the checking authority certificate 137. Are in a mathematically correct relationship (S211b). When it is confirmed mathematically correct, the validity proof data verification unit 16 manages the validity proof data management record corresponding to the validity proof data 130 based on the serial number 134 of the validity proof data 130. A search is made from the validity proof data management table 141 of the DB 14 (S211c).

  When a record corresponding to the validity proof data 130 is retrieved, the validity proof data verification unit 16 checks the confirmation authority signature 136 included in the record and the confirmation included in the previous validity proof data 130. It is compared whether or not the values of the station signature 136 are completely matched (S211d). If the two match completely, the validity proof data verification unit 16 assumes that the validity proof data 130 has been validated and confirms the validity of the validity proof data 130 via the communication unit 11. Is returned to the client device 30 (S211f, S211g).

  By the way, it is conceivable that the user of the client device 30 may have to show the validity of the validity certification data 130 to another third party. In such a case, information indicating that the validity has been confirmed (for example, a true / false value) is not returned, but information for verifying that the validity has been confirmed (hereinafter referred to as “validity proof data”). ) Is convenient for the user of the client device 30. Hereinafter, the process of generating the validity proof data by the validity proof data verification unit 16 will be described.

  FIG. 8 is a diagram for explaining the process of generating the validity proof data by the validity proof data verification unit. The process of FIG. 8 is performed after the validity of the validity proof data 130 is confirmed (after step S211d (FIG. 7)).

  First, a hash value (validity proof data hash value 161) is calculated for the validity proof data 130 (S221). The validity proof data hash value 161 is encrypted with the current private key (current signature key 15a) for the electronic signature of the validity checking authority 10, and the electronic signature (the verification authority signature 162) for the validity proof data hash value 161 is obtained. Generate (S222). The current public key certificate (confirmation authority certificate 163) of the validity confirmation authority 10 with respect to the confirmation authority signature 162 is assigned and used as validity certification data 160 (S223, S224).

  The validity certification data 160 is transmitted to the client device 30 in step S211g in FIG. The user of the client device 30 that has received the validity proof data 160 passes the electronic document 310, the electronic signature 321, the public key certificate 322, the validity proof data 130, and the validity proof data 160 to another third party. Thus, it can be shown that the electronic signature 321 is valid. The third party to whom the electronic document 310, the electronic signature 321, the public key certificate 322, the validity proof data 130, and the validity proof data 160 are passed is valid for confirming the validity of the validity proof data 130. There is no need to access the verification station 10, and it is only necessary to check whether the validity certification data 130 and the validity certification data 160 have a correct relationship as an electronic signature.

  By the way, since the validity proof data management DB 14 is a final means for confirming whether the validity proof data 130 is finally valid, measures against threats such as tampering and destruction must be taken. I must. As countermeasures, physical access to the computer (certificate authority 10) on which the validity proof data management DB 14 is installed is restricted to a limited user, or access to the computer is controlled by an OS (Operating System). Control by an access control mechanism, defense by an access control function of a DBMS (DataBase Management System) or a falsification detection mechanism can be considered. When it is necessary to indicate to a third party that the contents of the validity certification data management DB 14 cannot be tampered with by the validity checking station 10 itself, as in the linking protocol method defined in the time stamp service, The hash values of a plurality of validity proof data 130 may be chained. Considering that the validity checking station 10 is positioned as a trusted TTP (Trusted Tier Party), the validity checking station 10 undergoes periodic system audits. Is also realistic.

  As described above, according to the validity checking system 1 in the present embodiment, when the validity period of the public key certificate 322 of the electronic document 310 has expired, or the public key certificate 322 has expired. Even if it is, the validity of the electronic signature 311 can be appropriately confirmed based on the validity proof data 130. Therefore, the present invention is effective as a means for confirming the validity of an electronic signature attached to an electronic document that requires long-term storage.

  The present invention is not limited to such specific embodiments, and various modifications and changes can be made within the scope of the gist of the present invention described in the claims.

It is a figure which shows the structural example of the validity confirmation system in embodiment of this invention. It is a figure which shows the hardware structural example of the validity check station in embodiment of this invention. It is a figure for demonstrating the issuing process of the validity certification | authentication data by a validity confirmation authority. It is a figure for demonstrating the production | generation process of the validity proof data by the validity proof data production | generation part. It is a figure which shows the structural example of the validity proof data management table which comprises validity proof data management DB. It is a flowchart for demonstrating the validity confirmation process of the electronic signature by a client apparatus. It is a figure for demonstrating the confirmation process of the validity of validity certification | authentication data. It is a figure for demonstrating the production | generation process of the validity proof data by the validity proof data verification part.

Explanation of symbols

1 Validity Confirmation System 10 Validity Confirmation Authority 11 Communication Unit 12 Public Key Certificate Confirmation Unit 13 Validity Proof Data Generation Unit 14 Validity Proof Data Management DB
15 Signing Key 15a Current Signing Key 16 Validity Proof Data Verification Unit 20 Certificate Authority 30 Client Device 40 Network 100 Drive Device 101 Recording Medium 102 Auxiliary Storage Device 103 Memory Device 104 Arithmetic Processing Device 105 Interface Device B Bus

Claims (16)

A method for generating electronic signature validity certification data indicating that the validity of an electronic signature of an electronic document has been confirmed,
A certification object acquisition procedure for acquiring the electronic signature and a first public key certificate for the electronic signature;
A public key certificate confirmation procedure for confirming the validity of the first public key certificate obtained in the certification object acquisition procedure;
A first hash value calculation procedure for calculating a hash value for the electronic signature and the first public key certificate;
A first electronic signature generation procedure for generating an electronic signature for the hash value;
And a storage procedure for storing data including at least the hash value and an electronic signature for the hash value as the electronic signature validity proof data and storing the electronic signature validity proof data in a predetermined storage area. A method for generating digital signature validity proof data. The electronic signature validity certification data includes information indicating that the validity of the first public key certificate has been confirmed in the public key certificate confirmation procedure, and validity of the first public key certificate. 2. The method for generating electronic signature validity certification data according to claim 1, further comprising information indicating the date and time of confirmation. The electronic signature validity proof data according to claim 1 or 2, wherein the electronic signature validity proof data includes a second public key certificate for an encryption key for generating an electronic signature for the hash value. Generation method. 4. The electronic signature according to claim 1, further comprising an electronic signature validity certificate data transmission procedure for transmitting the electronic signature validity certificate data to the device requesting the electronic signature validity certificate data. Method for generating validity proof data. A method for confirming the validity of electronic signature validity proof data for confirming the validity of electronic signature validity proof data generated by the method for generating electronic signature validity proof data according to any one of claims 1 to 4. And
An electronic signature validity certificate data acquisition procedure for acquiring the electronic signature validity certificate data;
An electronic signature validity procedure comprising: a presence confirmation procedure for confirming whether or not the electronic signature validity certification data acquired in the electronic signature validity certification data acquisition procedure exists in the predetermined storage area A method for confirming the validity of the proof data. When it is confirmed that the electronic signature validity proof data acquired in the electronic signature validity proof data acquisition procedure exists in the predetermined storage area,
6. The method for confirming the validity of electronic signature validity certification data according to claim 5, further comprising a second electronic signature generation procedure for generating an electronic signature for the electronic signature validity certification data. Data including an electronic signature for the electronic signature validity proof data generated in the second electronic signature generation procedure is used as the proof data for verifying the validity of the electronic signature validity proof data. 7. The method for confirming the validity of electronic signature validity proof data according to claim 6, further comprising a validity proof data transmission procedure for transmitting data to a device that requests data. An electronic signature verification procedure for verifying mathematical validity of the electronic signature with respect to the hash value included in the electronic signature validity proof data;
8. The validity of electronic signature validity certification data according to claim 6 or 7, wherein the second electronic signature generation procedure is performed when the mathematical validity of the electronic signature with respect to the hash value is verified. Confirmation method. An electronic signature validity for confirming the validity of the electronic signature of the electronic document based on the electronic signature validity certification data generated by the electronic signature validity certification data generation method according to any one of claims 1 to 4. Check method,
A second hash value calculation procedure for calculating a hash value for the electronic signature of the electronic document and the first public key certificate;
By comparing the hash value calculated in the first hash value calculation procedure and the hash value calculated in the second hash value calculation procedure included in the electronic signature validity certification data, And a determination procedure for determining the validity of the electronic signature of the electronic document. An electronic signature verification procedure for verifying the mathematical validity of the electronic signature of the electronic document;
10. The electronic signature validity checking method according to claim 9, wherein when the mathematical validity of the electronic signature of the electronic document is verified, the second hash value calculation procedure is performed. An electronic signature validity proof data generation device that generates electronic signature validity proof data indicating that the validity of an electronic signature of an electronic document has been confirmed,
A certification object acquisition means for acquiring the electronic signature and a first public key certificate for the electronic signature;
Public key certificate confirmation means for confirming the validity of the first public key certificate obtained by the certification object obtaining means;
First hash value calculation means for calculating a hash value for the electronic signature and the first public key certificate;
First electronic signature generation means for generating an electronic signature for the hash value;
Data including at least the hash value and an electronic signature for the hash value is used as the electronic signature validity proof data, and storage means for storing the electronic signature validity proof data in a predetermined storage area is provided. Electronic signature validity proof data generation device. An electronic signature validity proof data validity confirmation device for confirming the validity of the electronic signature validity proof data generated by the electronic signature validity proof data generation device according to claim 11,
Electronic signature validity proof data obtaining means for obtaining the electronic signature validity proof data;
Electronic signature validity certification means, comprising: existence confirmation means for confirming whether or not the electronic signature validity certification data acquired by the electronic signature validity certification data acquisition means exists in the predetermined storage area Sex verification data correctness confirmation device. An electronic signature validity confirmation device for confirming the validity of the electronic signature of the electronic document based on the electronic signature validity certification data generated by the electronic signature validity certification data generation device according to claim 11,
Second hash value calculation means for calculating a hash value for the electronic signature of the electronic document and the first public key certificate;
By comparing the hash value calculated by the first hash value calculation means and the hash value calculated by the second hash value calculation means, which are included in the electronic signature validity proof data, An electronic signature validity checking apparatus comprising: a determination unit that determines the validity of the electronic signature of the electronic document. An electronic signature validity proof data generation program for causing a computer to generate electronic signature validity proof data indicating that the validity of an electronic signature of an electronic document has been confirmed,
A certification object acquisition procedure for acquiring the electronic signature and a first public key certificate for the electronic signature;
A public key certificate confirmation procedure for confirming the validity of the first public key certificate obtained in the certification object acquisition procedure;
A first hash value calculation procedure for calculating a hash value for the electronic signature and the first public key certificate;
A first electronic signature generation procedure for generating an electronic signature for the hash value;
And a storage procedure for storing data including at least the hash value and an electronic signature for the hash value as the electronic signature validity proof data and storing the electronic signature validity proof data in a predetermined storage area. Electronic signature validity proof data generation program. An electronic signature validity proof data validity confirmation program for causing a computer to confirm the validity of the electronic signature validity proof data generated by the electronic signature validity proof data generation program according to claim 14,
An electronic signature validity certificate data acquisition procedure for acquiring the electronic signature validity certificate data;
An electronic signature validity procedure comprising: a presence confirmation procedure for confirming whether or not the electronic signature validity certification data acquired in the electronic signature validity certification data acquisition procedure exists in the predetermined storage area Sex data verification program. An electronic signature validity checking program for causing a computer to check the validity of the electronic signature of the electronic document based on the electronic signature validity certification data generated by the electronic signature validity certification data generation program according to claim 14. ,
A second hash value calculation procedure for calculating a hash value for the electronic signature of the electronic document and the first public key certificate;
By comparing the hash value calculated in the first hash value calculation procedure and the hash value calculated in the second hash value calculation procedure included in the electronic signature validity certification data, And a determination procedure for determining the validity of the electronic signature of the electronic document.

Images