JP2007043321A - Authenticity verification method and system of electronic document - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an authenticity verification method of an electronic document which can detect data of a problem upon verification failure, and verify for a long time. <P>SOLUTION: A client device 10 connected with a time stamp office 40 through a network calculates a hash value of an electronic signature attached to the electronic document, and creates a hash value list in which document ID attached to a plurality of electronic documents and the hash value correspond each other and are recorded. The time stamp office 40 gives time stamps to electronic signatures given in the hash value list. Further, the client information device 10 receives an electronic document of a verification object; compares the hash value calculated from the hash value list including the electronic documents of the verification object, and a hash value which is decoded and obtained from the electronic signature of the hash value list; verifies truth of the hash value list; compares the hash value calculated from the electronic signature of search object documents, and a hash value of the search object document described in the hash value list; and verifies the authenticity of the search object document. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to an electronic document authenticity verification method, apparatus, and system that can reduce processing time.

  Since April 2005, the “Law Concerning the Use of Information and Communication Technology in Document Preservation, etc. Performed by Private Business Operators” (hereinafter referred to as the e-Document Act) has been enforced (Non-Patent Document 1). Documents that have been required to be stored are now allowed to be stored as electronic documents. However, some documents are subject to tampering, so that a condition that an electronic signature / time stamp is given is imposed. However, since a time stamp costs about 10 yen per document, adding a time stamp to each document costs enormous costs. For this reason, the Ministry of Finance ordinance has to give one time stamp to a plurality of documents at least once per day.

In this way, when verifying the authenticity of a plurality of electronic documents with time stamps, the signatures of all the electronic documents to be time stamped are read from the server at an appropriate timing and combined with the signature data. A time stamp is assigned to the hash value. When verifying the time stamp, the signatures of all electronic documents are read, the hash value of the combined signature data is calculated, and this hash value is compared with the hash value obtained by decrypting the time stamp. It was verified by doing.
Prime Minister's Office, “Act on the Use of Information and Communication Technology in Document Preservation, etc. Performed by Private Business Operators”, [online], [searched on July 13, 2005], Internet <URL: http: // www. kantei.go.jp/jp/singi/it2/hourei/16-149gou/honbun.html>

  However, according to the method for verifying the authenticity of the electronic document, when verifying the time stamp given to the document, for example, even when there is one document to be verified, the signature of all data must be read. A lot of processing time is required for verification. In addition, when verification fails, it is not possible to detect data having a problem. Furthermore, there is a problem that the long-term guarantee of the time stamp cannot be performed.

  The present invention has been made in view of the above problems, and its purpose is to reduce the verification time and to detect data having a problem when verification fails. Another object of the present invention is to provide an electronic document authenticity verification method, apparatus, and program capable of long-term guarantee.

  According to the electronic document authenticity guarantee method of the present invention, the client device calculates a hash value of an electronic signature attached to an electronic document received from an input interface, the document ID assigned to each of a plurality of electronic documents, Create a hash value list in association with the calculated hash value, accept designation of the verification target electronic document, and calculate the hash value calculated from the hash value list included in the verification target electronic document, and the digital signature of the hash value list Is compared with the hash value obtained by decrypting, and the authenticity of the hash value list is verified by whether or not they match, and the hash value calculated from the electronic signature of the search target document and the hash value list Comparing the hash value of the retrieved search target document and verifying the authenticity of the search target document according to whether or not they match. To.

  According to the electronic document authenticity guarantee method, after verifying the authenticity of the hash value list by the electronic signature, the hash value of the electronic document described in the hash value list and the hash value calculated from the electronic signature of the electronic document are obtained. By comparing, the authenticity of the electronic document can be verified. In this way, since the verification can be performed by reading the hash value list and the electronic document to be verified, the processing time can be shortened.

  The client device is connected to a document management server including a time stamp database and a document management database, and a third party device that assigns a time stamp via a network, and the third party device includes the hash value list. A time stamp is attached to the electronic signature attached to the document management server, and the document management server includes, in the time stamp database, a time stamp ID for identifying the electronic signature attached with the time stamp, the hash value list, The electronic signature assigned to the hash value list is recorded in association with the document ID, the electronic document, the electronic signature of the electronic document, and the hash value of the document signature in the document management database. And a time stamp ID corresponding to the hash value list including the document ID The client device searches the document management database of the document management server, acquires the time stamp ID of the search target document, the document ID, and the electronic signature of the electronic document, and It is preferable that the time stamp database is searched based on the extracted time stamp ID, and the hash value list and the electronic signature attached to the hash value list are acquired.

  The electronic signature given to the hash value list may be a hysteresis signature. Since the hysteresis signature includes past signature information in a chained manner, long-term non-falsification proof of the hash value list is possible. Along with this, it is possible to certify the electronic document for a long time without falsification.

  The authenticity verification apparatus for a plurality of electronic documents according to the present invention includes a means for calculating a hash value of an electronic signature attached to an electronic document received from an input interface, and a document ID assigned to each of the plurality of electronic documents. Means for creating a hash value list in association with the calculated hash value; means for receiving a verification target electronic document; a hash value calculated from a hash value list included in the verification target electronic document; and the hash value Comparing the hash value obtained by decrypting the electronic signature of the list, verifying the authenticity of the hash value list according to whether or not they match, a hash value calculated from the electronic signature of the search target document, The hash value of the search target document described in the hash value list is compared, and the authenticity of the search target document is determined by whether or not they match. And having a means for evidencing.

  The authenticity verification program of the present invention is a program for causing a computer to execute an authenticity verification method for a plurality of electronic documents, and calculates a hash value of an electronic signature given to the electronic document received from the input interface. A step of creating a hash value list in which a document ID assigned to each of a plurality of electronic documents and the calculated hash value are associated with each other, a step of receiving a verification target electronic document, and the verification target electronic document Comparing the hash value calculated from the hash value list including the hash value obtained by decrypting the digital signature of the hash value list and verifying the authenticity of the hash value list depending on whether or not they match And the hash value calculated from the electronic signature of the search target document and the hash value list. Comparing the hash value of the document to be searched, and a step of verifying the authenticity of the document to be searched by whether or not they match each other.

  According to the electronic document authenticity verification method, apparatus, and system of the present invention, at the time of adding and verifying a time stamp, only the document to be assigned or verified is read, so the processing time can be shortened.

  Hereinafter, an embodiment of an electronic document authenticity verification method according to the present invention will be described with reference to the drawings. FIG. 1 is a configuration diagram illustrating an electronic document authenticity verification system 1 according to the present embodiment. As shown in FIG. 1, an electronic document authenticity verification system 1 includes a document management server 20, a client device 10, a scanner 30 as an input interface, and a time stamp station 40, which is a third party. ing. The client device 10 is, for example, a personal computer, and can send and receive information to and from the scanner 30 and the document management server 20 via the network 60. The network 60 is, for example, the Internet, a public telephone line network, a LAN (Local Area Network) or the like. The document management server 20, the client device 10, and the scanner 30 are connected to the time stamp station 40 through the network 50 so as to be able to transmit and receive information. The network 50 is, for example, the Internet, a public telephone line network, a dedicated line, or the like.

  The scanner 30 as an input interface may be integrated with the client device 10. In addition, a network connection unit (not shown) of the client device 10 is included as an input interface, that is, the input interface may accept an electronic document transmitted via the network.

  FIG. 2 is a diagram showing the configuration of the document management server 20. The document management server 20 includes a document management database 21, a time stamp database 22, a document information registration unit 23, a time stamp information registration unit 24, a document information acquisition unit 25, a time stamp information acquisition unit 26, and a transmission / reception unit. 27.

  FIG. 3 is a diagram showing a configuration of information recorded in the document management database 21. As shown in the figure, the document management database 21 includes an electronic document 71, a document ID 70 for identifying the electronic document, an electronic signature 72 of the electronic document 71, a hash value 73 of the electronic signature 72, and will be described later. A time stamp ID 74 is associated and recorded.

  FIG. 4 is a diagram showing the configuration of information recorded in the time stamp database 22. In the time stamp database 22, an electronic signature 76 of a hash value list to which a time stamp is given, a hash value list 75, and a time stamp ID 74 are recorded in association with each other. The hash value list 75 is a record in which an electronic document ID 70 and an electronic signature hash value 73 of the electronic document are associated with each other.

  The document information registration unit 23 records the electronic document received by the transmission / reception unit 27, the document ID, the electronic signature, the hash value, and the time stamp ID in the document management database 21. Further, the document information acquisition unit 25 searches the document management database 21 based on the request information received from the client device 10 and extracts the recorded information.

  The time stamp information registration unit 24 registers the hash value list, the electronic signature with the time stamp ID and the time stamp in the time stamp database 22. Further, the time stamp information acquisition unit 26 searches the time stamp database 22 based on the request information received from the client device 10 and extracts the recorded information.

  A hysteresis signature technique is used for the electronic signature 76 of the hash value list. This hysteresis signature technique is a technique for creating an electronic signature by reflecting signature history information up to the time of signature creation in a new signature, as described in Japanese Patent Laid-Open No. 2001-331105. As a result, since all the signatures created have a chain structure, tampering is difficult and long-term guarantees are possible. Further, since verification of the chain is performed in addition to verification of the signature at the time of verification, tampering can also be detected. In addition, a time stamp is given to the electronic signature 76 of the hash value list by the time stamp authority 40.

  FIG. 5 is a diagram illustrating the configuration of the client device 10. The client device 10 includes a hash value calculation unit 101, an electronic signature creation unit 102, a hash value list creation unit 103, a verification target document input unit 104, a time stamp ID request unit 105, an electronic signature request unit 106, Hash value list signature request unit 107, hash value list request unit 108, hash value list verification unit 109, electronic document verification unit 110, verification result display unit 111, electronic signature decryption unit 112, and transmission / reception unit 113 Is provided.

  The hash value calculation unit 101 calculates a hash value by applying a hash function to input data such as an electronic document and its meta information. The electronic signature creation unit 102 creates an electronic signature by encrypting a hash value of an electronic document or the like with a secret key based on a public key cryptosystem.

  The hash value list creation unit 103 records the document ID and the hash value in association with each other, and creates a hash value list. Then, the created hash value list is transmitted to the document management server 20 and recorded in the time stamp database 22 of the document management server 20.

  The verification target document input unit 104 accepts designation of a document to be verified. The time stamp ID request unit 105 sends a time stamp ID request, which is a command for obtaining a time stamp ID registered in the document management server 20, to the document management server 20 based on the designation of the document to be verified. The time stamp ID registered in the document management server 20 is acquired by receiving the time stamp ID transmitted from the document management server 20 in response to the time stamp ID request.

  The electronic signature request unit 106 transmits an electronic signature request, which is a command for acquiring an electronic signature registered in the document management server 20, to the document management server 20 based on the time stamp ID and the like. In response, the electronic signature registered in the document management server 20 is acquired by receiving the electronic signature transmitted from the document management server 20.

  The hash value list signature request unit 107 transmits to the document management server 20 an electronic signature request that is a command for obtaining the electronic signature of the hash value list registered in the document management server 20 based on the time stamp ID. The electronic signature of the hash value list registered in the document management server 20 is acquired by receiving the electronic signature of the hash value list transmitted from the document management server 20 in response to the electronic signature request.

  The electronic signature decryption unit 112 decrypts the electronic signature of the input hash value list and transmits the hash value of the hash value list to the hash value list signature request unit 107.

  The hash value list request unit 108 transmits a hash value list request, which is a command for acquiring a hash value list registered in the document management server 20, to the document management server 20 based on the time stamp ID. A hash value list registered in the document management server 20 is acquired by receiving a hash value list transmitted from the document management server 20 in response to the list request.

  The hash value list verification unit 109 compares the hash value of the hash value list decrypted by the digital signature decryption unit 112 with the hash value of the hash value list acquired by the hash value list request unit 108 and determines whether or not they match. To verify the authenticity of the hash value list.

  The electronic document verification unit 110 is calculated by the hash value calculation unit 101 based on the hash value of the electronic signature of the search target electronic document recorded in the hash value list and the electronic signature of the search target electronic document acquired by the electronic signature request unit 106. The hash values thus compared are compared, and the authenticity of the electronic document is verified depending on whether or not they match.

  The verification result display unit 113 displays the verification results in the hash value list verification unit 109 and the electronic document verification unit 110.

  Hereinafter, a procedure for assigning and verifying a time stamp to an electronic document using the electronic document authenticity verification system 1 will be described. FIG. 6 is a flowchart for explaining a process of giving a time stamp by the electronic document authenticity verification system 1. First, a document that is digitized and held is read by the scanner 30 and converted into an electronic document. The electronic document converted by the scanner 30 is transmitted via the network 60 and transmitted to the client device 10.

  The transmission / reception unit of the client device 10 receives the electronic document (S101). The client device 10 transmits the received electronic document to the document management server 20. Then, the document information registration unit 23 of the document management server 20 records the electronic document received by the transmission / reception unit 27 in the document management database 21 (S121). The electronic document is sent to the hash value calculation unit 101, and the hash value calculation unit 101 calculates a hash value from the recognition information of the electronic document (S102). The hash value calculated by the hash value calculation unit 101 is sent to the electronic signature creation unit 102. The electronic signature creation unit 102 creates an electronic signature by encrypting the received hash value with a secret key based on a public key cryptosystem (S103). The created electronic signature is transmitted from the transmission / reception unit 113 to the document management server 20. The electronic signature received by the transmission / reception unit 27 of the document management server 20 is recorded in the document management database 21 by the document information registration unit 23 (S122). The created electronic signature is sent to the hash value calculation unit 101, and the hash value calculation unit 101 calculates the hash value of this electronic signature (S104).

  The calculated hash value of the electronic signature is transmitted to the document management server 20 and recorded in the document management database 21 by the document information registration unit 23 (S123). Further, the client apparatus 10 assigns a document ID for identification to the electronic document (S105), and the document information registration unit 23 records the document ID in the document management database 21 (S124). Further, the document ID and the hash value of the electronic signature are sent to the hash value list creation unit 103 and recorded in the hash value list (S106).

  The client device 10 repeats the above steps until a predetermined condition is satisfied, for example, until one day of work is completed. Thereby, a hash value list in which a plurality of document IDs and hash values of electronic signatures are associated and recorded is created. This hash value list is transmitted from the transmission / reception unit 113 to the document management server 20. The transmission / reception unit 27 of the document management server 20 receives the hash value list and records it in the time stamp database 22 by the time stamp information registration unit 24.

  The client device 10 transmits the created hash value list to the hash value calculation unit 101, and calculates the hash value of the hash value list (S108). Further, the hash value of this hash value list is sent to the electronic signature creation unit 102. The electronic signature creation unit 102 encrypts information including the hash values in the hash value list, and creates a hysteresis signature using a hysteresis technique (S109).

  The created hysteresis signature is transmitted from the transmission / reception unit 113 to the time stamp authority 40, which is a third party, via the network 50. The time stamp authority 40 gives a time stamp to the received hysteresis signature (S110). This makes it possible to verify falsification of the signature of the hash value list. The time stamp authority 40 transmits a hysteresis signature with a time stamp to the document management server 20.

Next, the document management server 20 assigns a time stamp ID to the hysteresis signature provided with the time stamp received from the time stamp authority 40 (S111). This time stamp ID is transmitted to the document information registration unit 23 and the time stamp information registration unit 24. The time stamp information registration unit 24 records the time stamp ID in association with the hash value list recorded in the time stamp database 22 (S112). The document information registration unit 23 records the electronic document already recorded in the document management database 21 together with the time stamp ID corresponding to each electronic document (S113). In addition, the time stamp information registration unit 24 records a signature with a time stamp corresponding to the hash value list already recorded (S114).
Next, a time stamp verification method will be described. FIG. 7 is a flowchart showing a procedure for verifying the authenticity of the electronic document based on the time stamp. As shown in the figure, first, the verification target document input unit 104 of the client device 10 receives an input of a verification target document (S201). The time stamp ID request unit 105 transmits a time stamp ID request to the document management server 20 based on the input information of the verification target document. The document information acquisition unit 25 of the document management server 20 extracts the document management database 21 based on the time stamp ID request (S221). Then, the time stamp ID request unit 105 of the client device 10 acquires a time stamp ID corresponding to the verification target document (S202).

  Next, the hash value list is verified. First, the electronic signature request unit 106 transmits an electronic signature request based on the extracted time stamp ID information. The time stamp information acquisition unit 26 searches the time stamp database 22 based on the electronic signature request received by the transmission / reception unit 27, and acquires a hash value list and a signature with a time stamp (S223). The electronic signature is transmitted from the transmission / reception unit 27, and the electronic signature request unit acquires the electronic signature to which the time stamp corresponding to the time stamp ID is given (S205). This time-stamped signature is transmitted to the electronic signature decryption unit 112, and the digital signature decryption unit 112 obtains a hash value by decrypting the time-stamped signature with the public key (S206). This hash value is sent to the hash value list verification unit 109.

  In addition, the hash value list request unit 108 transmits a hash value list request to the document management server 20 based on the time stamp ID. The transmission / reception unit 27 of the document management server 20 receives the hash value list request, and the time stamp information acquisition unit 26 searches the hash value list recorded in the time stamp database 22 based on the hash value list request (S224). The retrieved hash value list is transmitted to the hash value list request unit 108 via the network (S207). Then, the hash value list request unit 108 transmits the acquired hash value list to the hash value calculation unit 101, and the hash value calculation unit 101 calculates a hash value of the hash value list (S208). The calculated hash value is transmitted to the hash value list verification unit 109.

  Next, the hash value list verification unit 109 compares the hash value obtained by decrypting the signature with time stamp with the hash value calculated from the read hash value list, thereby obtaining a hash value list or time stamp. The presence / absence of tampering is verified (S209). If the hash values do not match (does not match in S209), at least one of the hash value list and the time stamp is falsified. If the hash values match (match in S209), the hash value list and the time stamp have not been tampered with, and the authenticity of the hash value list has been confirmed.

  Next, the hash value calculation unit 101 calculates the hash value of the electronic signature of the search target document previously read from the document management database 21 (S204). The calculated hash value is transmitted to the electronic document verification unit 110. The electronic document verification unit 110 verifies whether or not the electronic document has been tampered with by comparing the hash value and the hash value described in the hash value list whose authenticity has been verified (S210). Here, when the hash value described in the hash value list and the hash value calculated from the signature of the electronic document do not match (no match in S210), the signature is falsified, and the authenticity of the corresponding electronic document Is not guaranteed (S213). If the hash value described in the hash value list matches the hash value calculated from the signature of the electronic document (match in S210), it means that no falsification has been performed and the authenticity of the electronic document is guaranteed. (S211). Verification results in the hash value list verification unit 109 and the electronic document verification unit 110 are transmitted to the verification result display unit 111 and displayed on the verification result display unit 111.

  According to the electronic document authenticity verification system 1, the following effects can be obtained. When verifying the time stamp, it is only necessary to read the signature of the electronic document to be verified, so that the time required for reading the electronic document can be reduced. Furthermore, since the signature of each electronic document can be verified based on the hash value list, the altered electronic document can be identified even if the altered electronic document is included. Further, by using a hysteresis signature for the digital signature of the hash value list, it is possible to certify the falsification of the hash value list for a long period of time, and therefore, it is possible to certify the falsification of the electronic document for a long period.

It is a block diagram which shows the authenticity verification system of the electronic document concerning this embodiment. It is a figure which shows the structure of a document management server. It is a figure which shows the structure of the information currently recorded on the document management database. It is a figure which shows the structure of the information currently recorded on the time stamp database. It is a figure which shows the structure of a client apparatus. It is a flowchart for demonstrating the flow which gives a time stamp by the authenticity verification system of an electronic document. It is a flowchart which shows the procedure which verifies the authenticity of an electronic document with a time stamp.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Electronic document authenticity guarantee system 10 Client apparatus 20 Document management server 21 Document management database 22 Time stamp database 23 Document information registration part 24 Time stamp information registration part 25 Document information acquisition part 26 Time stamp information acquisition part 30 Scanner 40 Time stamp station 50, 60 Network 70 Document ID 71 Electronic document 72 Electronic signature 72 (electronic document) 73 Hash value 74 Time stamp ID 75 Hash value list 76 Electronic signature 101 Hash value calculation unit 102 Electronic signature creation unit 103 Hash Value list creation unit 104 Verification target document input unit 105 Time stamp ID request unit 106 Electronic signature request unit 107 Hash value list signature request unit 108 Hash value list request unit 109 Hash value list verification unit 10 electronic document verifying unit 111 a verification result display unit 112 the electronic signature decoding unit 113 transceiver

Claims (5)

A method for verifying the authenticity of a plurality of electronic documents,
The client device is
Calculate the hash value of the electronic signature attached to the electronic document received from the input interface,
Creating a hash value list in which document IDs assigned to a plurality of electronic documents are associated with the calculated hash values;
Accept specification of electronic document to be verified,
The hash value calculated from the hash value list included in the verification target electronic document is compared with the hash value obtained by decrypting the electronic signature of the hash value list, and the authenticity of the hash value list is determined depending on whether or not they match. Verify the sex,
Comparing the hash value calculated from the electronic signature of the search target document with the hash value of the search target document described in the hash value list, and verifying the authenticity of the search target document based on whether or not they match A method for verifying the authenticity of an electronic document characterized by The client device is connected via a network to a document management server having a time stamp database and a document management database, and a third party device for giving a time stamp,
The third-party device gives a time stamp to the electronic signature given to the hash value list,
The document management server
In the time stamp database, a time stamp ID for identifying the electronic signature assigned with the time stamp, the hash value list, and the electronic signature assigned to the hash value list are recorded in association with each other,
The document management database associates the document ID, the electronic document, the electronic signature of the electronic document, the hash value of the document signature, and the time stamp ID corresponding to the hash value list including the document ID. Record it,
The client device is
Search the document management database of the document management server, obtain a time stamp ID of the search target document, the document ID, and an electronic signature of the electronic document;
2. The authenticity of an electronic document according to claim 1, wherein the time stamp database is searched based on the extracted time stamp ID, and the hash value list and the electronic signature attached to the hash value list are obtained. Sexuality guarantee method.   3. The method for guaranteeing the authenticity of an electronic document according to claim 1, wherein the electronic signature given to the hash value list is a hysteresis signature. An authenticity verification device for a plurality of electronic documents,
Means for calculating a hash value of an electronic signature attached to an electronic document received from an input interface;
Means for creating a hash value list in which a document ID assigned to each of a plurality of electronic documents is associated with the calculated hash value;
Means for receiving the electronic document to be verified;
The hash value calculated from the hash value list included in the verification target electronic document is compared with the hash value obtained by decrypting the electronic signature of the hash value list, and the authenticity of the hash value list is determined depending on whether or not they match. A means of verifying sex,
Means for comparing the hash value calculated from the electronic signature of the search target document and the hash value of the search target document described in the hash value list, and verifying the authenticity of the search target document based on whether or not they match A device for verifying authenticity of an electronic document, comprising: A program for causing a computer to execute an authenticity verification method for a plurality of electronic documents,
Calculating a hash value of an electronic signature attached to an electronic document received from an input interface;
Creating a hash value list in which a document ID assigned to each of a plurality of electronic documents is associated with the calculated hash value;
Receiving the electronic document to be verified;
The hash value calculated from the hash value list included in the verification target electronic document is compared with the hash value obtained by decrypting the electronic signature of the hash value list, and the authenticity of the hash value list is determined depending on whether or not they match. Verifying gender,
Comparing the hash value calculated from the electronic signature of the search target document with the hash value of the search target document described in the hash value list, and verifying the authenticity of the search target document according to whether or not they match When,
An electronic document authenticity verification program.

Images