JP2007082043A - Time stamp service system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a time stamp service system under policy in organization. <P>SOLUTION: The time stamp service system for performing processing in relation to the time stamp includes a memory unit for storing previously a formation policy for forming at least the time stamp; a reception unit for receiving a request about the time stamp transmitted from a client unit and information containing the time stamp processing object; a specifying means for specifying the client unit of the request source and the type of data from the information received by the reception unit; a determining means for determining whether the request is a formation request for forming the time stamp or not; and a formation processing means for referring formation policy stored in the memory unit if it is the time stamp formation request as a result of the determining means and forming the time stamp to the received data according to the policy. The formed time stamp is answered to the client unit of the request source. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to a time stamp service system, and more particularly to a time stamp service that guarantees the originality and existence of electronic data.

  With the progress of electronic commerce and electronic government, time stamp services that guarantee the originality and existence of electronic data are attracting attention. The time stamp service is a service provided via a communication network by a time stamp authority which is a reliable third party organization. The time stamp authority receives a hash value, which is a feature amount of electronic data sent from the user, and creates a time stamp token in which the hash value and the time information at that time are linked by a cryptographic technique. The time stamp authority returns the created time stamp token to the user. The user saves the electronic data and the received time stamp token. The user can check the time stamp token and the presence or absence of falsification after that by verifying the time stamp token at a later date.

  The time stamp station can provide time stamp services of various quality of service. Service quality refers to the characteristics of a time stamp token. For example, there are a time stamp method, an encryption algorithm to be used, a key length to be used for encryption processing, and an accuracy of time referred to by a time stamp authority. These service qualities indicate the safety of the time stamp token from the viewpoint of cryptographic technology, the validity period, and the accuracy of the time information included in the time stamp token.

  The time stamp service can be used as a mechanism for supporting corporate governance in a company. For example, by assigning time stamps to various business data and document data created by corporate activities, the existence and non-tampering of these data can be proved to a third party.

  Regarding the prior art, for example, Patent Document 1 (Japanese Patent Laid-Open No. 2003-22010) presents a menu of a time stamp expiration date to the user and issues a time stamp token that satisfies the selected expiration date. The service is disclosed. Non-Patent Document 1 discloses a method of including identifier information indicating a time stamp method desired by a user in request data transmitted by the user.

JP 2003-22010 (page 3-8, FIG. 2) ISO / IEC 18014-1: 2002, 2002, p. 7

It can be seen that the above prior art has the following problems.
That is, when the techniques disclosed in Patent Document 1 and Non-Patent Document 1 are used, the time stamp user includes information indicating the quality of the time stamp service in the time stamp request information transmitted to the time stamp station. There is a need. Therefore, the user can select the quality of the time stamp service according to his / her convenience. From the viewpoint of corporate governance, it is important to give time stamps to various business data and document data under a policy unified within the company and prove that the policy has been put into practice at a later date. Therefore, it is not preferable that a means for selecting the quality of the time stamp service is provided to the user.

  In addition, when the techniques disclosed in Patent Document 1 and Non-Patent Document 1 are used, the user side software or device requires time and effort for setting the quality of the time stamp service for each type of user or electronic data. appear. For large companies with a large number of users and software, it can be said that the effort required to manage these settings is large.

An object of the present invention is to uniformly manage a policy for a time stamp service and to provide a time stamp service under the policy.
More specifically, the present invention provides a time stamp service system, method, and program capable of creating and verifying a time stamp in response to a request from a client device using a uniformly managed policy. There is.

The present invention relates to a time stamp processing method for performing processing related to a time stamp in response to a request transmitted from a client device through a communication network, and includes information including a request regarding a time stamp transmitted from the client device and data to be processed by the time stamp. The client device that received the request through the interface, the type of the client device from which the request was issued, and the type of data are specified, and it is determined whether the request is a creation request for creating a time stamp. If the request is a time stamp creation request, the time stamp creation policy stored in the storage unit is referred to, a time stamp for the received data is created according to the policy, and the created time stamp is sent to the request source via the interface. To the client device Perform a time stamp service by Rukoto.
Preferably, the determination includes a determination as to whether the request is a verification request for verifying a time stamp. If the determination indicates that the request is a time stamp verification, the determination is stored in advance in the storage unit. A time stamp verification policy is referenced and configured to verify the time stamp according to the policy.
The present invention can be understood as a time stamp service system, a time stamp service server device, a time stamp processing method, and a program for performing these processes in the server device for realizing the above functions and processes.

  ADVANTAGE OF THE INVENTION According to this invention, the time stamp service according to a request | requirement can be provided under the policy managed uniformly within the organization.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.
FIG. 1 shows a configuration of a time stamp service system according to an embodiment. The time stamp service system includes one or more time distribution station devices (TA) 132, one or more time stamp station devices (TSA) 134, and one or more devices connected to the time stamp server device 100 via the communication network 152. The certificate authority device (CA) 136 is connected to the time stamp server device 100, and a plurality of client devices 130 are connected to the time stamp server device 100 via the communication network 150.

  The time distribution station device 132 performs reliable time information distribution and periodic time audit to the time stamp server device 110 based on the coordinated universal time created and distributed by the national time standard organization. The time stamp authority device 134 is a device that provides a time stamp service. These apparatuses have service quality having characteristics such as an organization that operates the apparatus, a facility in which the apparatus is installed, an encryption algorithm used when creating a time stamp, and a key length. The certificate authority device 136 is a device that issues a public key certificate used for a time stamp. Also, the revocation information of the public key certificate is made public.

The client device 130 transmits a time stamp service request to the time stamp server device 100. The client device 130 also receives the service result from the time stamp server device 100. The client device 130 holds the address of the time stamp server device 100 in order to communicate with the time stamp server device 100.
The time stamp service request is a time stamp creation request or a time stamp verification request. The timing at which the client device 130 transmits the time stamp service request is preferably, for example, a timing instructed by an operator operating the client device 130 or a timing at which electronic data is created in the client device 130. Of course, the time stamp service request may be transmitted periodically. The timing for receiving the time stamp service result may be synchronous or asynchronous.

The time stamp server apparatus 100 has a function of receiving a time stamp service request transmitted from the client 130 and executing a time stamp creation service or a time stamp verification service in response to the request.
The time stamp server apparatus 100 includes a request receiving unit 102, a policy management unit 104, an in-company TSA unit 106, a proxy TSA unit 108, and a time stamp verification unit 110. The time stamp server device 100 also has a large-capacity storage device. In the storage device, the communication partner information DB 112, the data type information DB 114, the security information DB 116, the policy information DB 118, the time stamp information DB 120, and the electronic data information DB 122 are stored. The reconfirmation task information DB 124 is retained.

  Here, the communication partner information DB 112 stores the time stamp request source that is the communication partner, that is, the address of the client 130. The data type information DB 114 stores the type information of data to be time stamped, for example, the type of text information or image information. The security information DB 116 stores a secret key used for creating a time stamp. The policy information DB 118 registers policies for time stamp creation and time stamp verification. The time stamp information DB 120 stores a time stamp to be serviced. The electronic data information DB 122 stores electronic data to be time stamped. The reconfirmation task information DB 124 stores tasks to be reconfirmed later. The meaning and storage format of various information stored in these DBs (databases) will be described later.

  In the time stamp server device 100, the request reception unit 102 receives the time stamp service request from the client device 130, refers to the communication partner information DB 112 and the data type information DB 114, and determines the time stamp request source and the time stamp target. Identify the type of electronic data. The policy management unit 104 refers to the identified time stamp request source, electronic data type, and policy information DB 118 to determine a time stamp creation method or a time stamp verification method. The in-house TSA unit 106 creates a time stamp using the secret key stored in the security information DB 116 and the time information subjected to time distribution and audit from the time distribution station 132. The proxy TSA unit 108 provides a proxy function of the time stamp function provided by the time stamp authority device 134. That is, a time stamp acquisition request is transmitted to the time stamp authority device 134 to acquire a time stamp.

  The time stamp verification unit 110 provides a time stamp verification function. When the time stamp verification unit 110 cannot sufficiently collect information necessary for verification when checking the validity of the time stamp when the time stamp service request is received, the time stamp verification unit 110 should execute it in the reconfirmation task information DB 114 at a later date. Register the task.

  The time stamp server apparatus 100 may store a time stamp handled at the time of time stamp creation or time stamp verification, or time stamp target electronic data in the time stamp information DB 120 or the electronic data information DB 122, respectively. The specific processing contents of these processing units included in the time stamp server device 100 will be described later in conjunction with other drawings.

  The time stamp server apparatus 100 is preferably a computer that allows a large number of simultaneous accesses and has a high-speed processing capability in order to provide services to a plurality of client apparatuses 130. In addition, it is desirable to provide a large-capacity storage device for managing a large amount of electronic data information and time stamp information. Further, when the time stamp server apparatus 100 is composed of two or more units, in order to share various programs and various data between these apparatuses, such as NAS (Network Attached Storage) or SAN (Storage Area Network). It is preferable to use storage system technology.

FIG. 2 shows a hardware configuration example of the time stamp server apparatus 100.
The time stamp server device 100 is, for example, a PC (personal computer), a central processing unit (CPU) 202, an input device 210 such as a keyboard and a mouse, an external storage device 206 such as a hard disk, and a memory such as a semiconductor memory (RAM) 204. Device, CRT display, liquid crystal display, output device 212 such as a printer, external media interface 214 for reading and writing storage media 216 such as magneto-optical media, communication interface 208 for communication, security such as secret key used for encryption processing A hardware security module (HSM) that executes information storage and encryption processing is connected by an internal communication line 200 such as a bus.
Here, the time stamp server device 100 is not limited to a PC, and any computer provided with an input device, an output device, and a communication device for use by a user can be used. In addition, other devices such as the client device 130 can also be realized by a PC or a portable terminal having the same hardware configuration as shown in FIG.

  The communication networks 150 and 152 can be realized by a communication network such as a public network, the Internet, ISDN, a dedicated line, a wired network such as a LAN, or a wireless network using a mobile communication base station or a communication artificial satellite. In addition, each apparatus which comprises a time stamp service system connects and communicates with a communication destination using the other apparatus address used as the communication destination other party preset in the apparatus.

  In each apparatus, addresses of a plurality of other apparatuses that provide the same function may be registered. For example, when the addresses of a plurality of time stamp server devices 100 are registered in one client device 130, the time stamp server device 100 as the communication destination of the client device 130 is selected, for example, in a round robin manner.

  The functions and processing units in each device described above are realized by the central processing unit 202 executing a program stored in the external storage device 206. Each program may be stored in advance in each external storage device 206, or, if necessary, removable storage medium 216 that can be used by the apparatus, communication networks 150 and 152 that are communication media, or communication. It may be transferred from another device via a carrier wave or a digital signal propagating on the networks 150 and 152.

Next, processing operations of each processing unit of the time stamp server device 100 will be described with reference to FIG. 3 and subsequent drawings.
FIG. 3 is a diagram showing a processing procedure for providing a time stamp service in the time stamp server apparatus 100.

First, the request reception unit 102 of the time stamp server device 100 receives a service request from the client device 130 (302).
An example of a request message transmitted from the client device 130 is shown in FIG. The request message includes a request source field 501 indicating the network address of the requesting client device 130, a request type field 502 indicating the type of the time stamp creation service or the time stamp verification service, and processing requested to the time stamp server device 100. The request data field 504 holds target data.
The information stored in the request data field 504 differs depending on the content of the request type 502. When the requested service is a time stamp creation service, the request data field 504 stores a hash value of electronic data to be time stamped or a substance (data string) of electronic data. When the requested service is a time stamp verification service, a time stamp token to be verified or a time stamp token and a substance (data string) of electronic data to be time stamped are stored therein.

  The request data may include information indicating the type of electronic data. For example, the type of electronic data can be indicated using a MIME (Multipurpose Internet Mail Extensions) type indicating the type of electronic data. In addition, the request message may include information indicating the client device 130, an operator who operates the client device 130, or an application program stored in the client device 130. Specifically, the network address of the client device 100, user authentication information of the operator, authentication information such as an electronic signature given to the application program, and the like can be considered.

The request reception unit 102 specifies the request source of the request message from the network address in the request source field 501 (304), and specifies the type of electronic data from the information included in the request data field 504 (306).
The request reception unit 102 also determines from the request type information held in the request type field 502 whether the request message is a time stamp creation request or a time stamp verification request (308). If it is determined that the request is a time stamp creation request, a time stamp creation policy is determined (310). On the other hand, if it is determined that the request is a time stamp verification request, a time stamp verification policy is determined (318). Thereafter, the process proceeds to processing by the policy management unit 104 and other processing units.

Here, an example of a time stamp creation policy stored in the policy information DB 118 will be described with reference to FIGS. 8 and 9.
FIG. 8 shows an example of a master table of a time stamp creation policy. It can be realized as a database record composed of a plurality of fields. The field 802 stores character string information (time stamp creation policy identification information) for identifying the time stamp creation policy. A field 804 stores information indicating a message digest creation method for electronic data to be time stamped. A field 806 stores information indicating time stamp creation timing. This information indicates, for example, whether the request is created each time a request is received or created at a fixed time.

A field 808 stores information indicating a time stamp station apparatus to be used. The field 810 stores information indicating a method for associating time stamp target data with a time stamp. For example, it indicates whether the relationship between the two is related by another file or by a ZIP archive.
The field 812 stores information indicating whether the created time stamp or time stamp target data is stored. When stored (ON), the data is stored in the storage device of the server device 100 and transmitted to the requesting client device 130. On the other hand, when it is not stored (OFF), it is not stored in the storage device of the server device 100 but only transmitted to the requesting client device 130.

FIG. 9 shows an example of a table in which a time stamp creation policy and a time stamp verification policy are mapped for each request source and electronic data type.
Fields 902 and 904 store information indicating a request source and an authentication method for specifying the request source. A field 906 stores information indicating the type of electronic data, for example, MIME type. A field 908 and a field 910 store identification information of a time stamp creation policy and identification information of a time stamp verification policy, respectively. The policy management unit 104 refers to these tables and specifies a time stamp creation policy corresponding to the time stamp service request source and the electronic data type.

  Returning to the description of FIG. 3 again, the policy management unit 104 creates a message digest for the electronic data in accordance with the identified policy (312). Here, with reference to FIG. 10 to FIG. 12, an example (three examples) of message digest creation will be described.

  FIG. 10 shows a case where the time stamp creation policy identifier 802 shown in FIG. 8 is “1.2.7”, that is, the message digest creation method is “binary combination, SHA-512”. Under this policy, the time stamp target data transmitted from the client device 130 is accumulated in the electronic data information DB 122, and one time stamp creation process is performed at a later time (for example, 17:00). Done. Electronic data 1002 to 1008 in FIG. 10 are data files indicating office documents. The in-company TSA unit 106 or the proxy TSA unit 108 of the time stamp server device 100 combines these electronic data files as binary data to create one data 1010. Thereafter, hashing is performed using a hash function indicated by SHA-512 to create a message digest 1012.

  FIG. 11 shows a case where the time stamp creation policy identifier shown in FIG. 8 is “1.2.8”, that is, the message digest creation method is “hash join, SHA-512”. Under this policy, the time stamp target data transmitted from the client device 130 is accumulated in the electronic data information DB 122, and one time stamp creation process is performed at a later time (for example, 17:00). Done. Therefore, the in-company TSA unit 106 or the proxy TSA unit 108 of the time stamp server device 100 hashes the electronic data files 1002 to 1008 to create hash data 1102 to 1108. Subsequently, these hash data are concatenated, the concatenated data is hashed, and a message digest 1112 is created.

  FIG. 12 shows a case where the time stamp creation policy identifier shown in FIG. 8 is “1.2.9”, that is, the message digest creation method is “byte range, SHA-512”. Under this policy, a time stamp creation process is performed every time the time stamp target data transmitted from the client device 130 is received. Therefore, the in-house TSA unit 106 or the proxy TSA unit 108 of the time stamp server device 100 extracts a specific byte range of the electronic data file, obtains a hash value for the data, and creates a message digest 1206. The definition of the byte range shown for each type of electronic data is stored in the data type information 114 provided in the time stamp server device 100. For example, if the type of electronic data is XML (Extensible Markup Language), information on a tag to be extracted from a DTD (Document Type Definition) indicating a document content or a schema is stored. The time stamp server device 100 extracts the tag information in the electronic data based on the tag information to be extracted.

  In FIG. 3, the time stamp server device 100 creates a time stamp (314). For example, when the time stamp creation policy shown in FIG. 8 is “1.2.7”, the proxy TSA unit 108 of the time stamp server device 100 uses the time stamp authority device (TSA) selected by the TSA selection information in the field 808. # 1) A time stamp request including the created message digest is transmitted to 134 via the communication network 152.

When creating the time stamp token, the time stamp authority device 134 transmits the time stamp token to the time stamp server device 100 as an answer.
Here, the time stamp token has a configuration shown in FIG. 7, for example. This data is a data structure of a time stamp token using an electronic signature technique. The data field 702 stores a message digest transmitted from the time stamp server apparatus 100 to the time stamp authority apparatus 134. The data field 704 stores time information indicating the time when the time stamp authority 134 performs the time stamp creation process. The data field 706 stores a data group that is an electronic signature target. The electronic signature target includes information on the public key certificate of the time stamp authority device necessary for signature verification. The data field 708 stores a non-signature target data group that is not a signature target. This area can be used as a place to store supplementary information after creating a time stamp token.

  For example, it stores public key certificate path information, revocation approval information, message digest creation method, and the like necessary for signature verification. When the time stamp server device 100 creates a time stamp using the external time stamp authority device 134, the time stamp server device 100 stores information on the message digest creation method in this non-signature attribute. Note that when the time stamp server apparatus 100 creates a time stamp using the in-company TSA unit, the time stamp server apparatus 100 stores information on a message digest creation method in a signature attribute or a non-signature attribute. The data field 710 stores an electronic signature value created with a secret key held by the time stamp authority device.

  In FIG. 3, when the proxy TSA unit 108 of the time stamp server device 100 receives the time stamp token from the time stamp authority device 134, it refers to the time stamp creation policy and associates the electronic data with the time stamp token. For example, if the time stamp creation policy shown in FIG. 8 is “1.2.7”, the policy is related by the ZIP archive.

  FIG. 13 shows an example of associating time stamp target electronic data with a time stamp token. That is, an example in which electronic data and a time stamp token are related by a ZIP archive, that is, a ZIP archive file is shown. The proxy TSA unit 108 creates a ZIP archive file 1302 using the received time stamp token. In this file, electronic data files 1304, 1306, and 1308 to be time stamps stored in the electronic data information DB 122 and a time stamp token file 1310 are stored. In addition, the time stamp server apparatus 100 stores information 1312 related to the message digest creation method in the non-signature attribute of the time stamp token file 1310. In the information on the message digest creation method, information indicating a procedure for verifying the correspondence between the electronic data and the time stamp is stored. In the example of FIG. 13, a method for creating electronic data, a hash algorithm, and a list of files to be time stamped are described.

As described above, when the time stamp server apparatus 100 finishes the process of creating a time stamp based on the time stamp creation policy, it is returned to the client apparatus 130 as a service result message (316).
Here, the structure of the service result message is shown in FIG. The service result message includes a data field 602 for storing information indicating a service result status (success, failure, etc.) and a field 504 for storing service result information. As the service result information, when the time stamp creation policy shown in FIG. 8 is “1.2.7”, information associated with the time stamp target electronic data and the time stamp token, that is, the created ZIP archive A file is stored.

Next, the time stamp verification service will be described.
This is a process executed when it is determined that the request is a time stamp verification request by the determination in step 308 in FIG.
The request receiving unit 102 first specifies a time stamp verification policy (318). Information regarding the time stamp verification policy is stored in the policy information DB 118.

FIG. 14 shows a table configuration example of the time stamp verification policy.
A field 1402 stores an identifier indicating a verification policy. A field 1404 is a flag indicating whether or not to consider a grace period associated with a public key certificate necessary for time stamp verification. The grace period indicates a period from when the public key certificate is revoked until when the revocation information is actually made public. A field 1406 is a flag indicating whether or not to extend the validity of the time stamp, that is, whether or not to perform the time stamp long-term guarantee. A field 1408 indicates conditions for performing a long-term guarantee of a time stamp.

  As a method for realizing a time stamp long-term guarantee, for example, an archive time stamp defined in the long-term signature format described in RFC3126 may be applied. In other words, after time stamp verification, verification information such as public key certificate path information and revocation information used for verification is stored in the non-signature attribute of the time stamp token, and the time stamp target data, the time stamp token to be verified, and the verification information A new time stamp is applied to, and this new time stamp is added to the non-signature attribute of the time stamp token to be verified. As a condition for executing the time stamp long-term guarantee, for example, when the verification policy of FIG. 14 is “2.1.1”, the validity period of the public key certificate required for time stamp token verification is 0. If it is determined that it is less than 5 years, a time stamp long-term guarantee is executed. The field 1410 stores a flag indicating whether or not to store a time stamp token subject to time stamp verification and time stamp application target data.

A specific example of time stamp verification in consideration of the grace period indicated by the data field 1404 will be described with reference to FIGS.
FIG. 15 is a diagram illustrating a difference in verification results when the grace period is considered and not considered. A public key certificate 1502 having a serial number of 22 describes public key information necessary for verifying the signature of the time stamp token 1504. The administrator of the time stamp authority device 134 makes a certificate revocation application to the certificate authority device 136 when changing an item described in the public key certificate or when stopping the time stamp issuing operation. When the certificate authority device 136 accepts the revocation application, the certificate authority device 136 performs examination, determines the revocation date and time, adds the corresponding public key certificate information to the public key certificate revocation list, and makes it public as public key certificate revocation information. .

  In the example shown in FIG. 15, the revocation application and revocation date and time are 11:23:45 on June 1, and the date and time that is actually disclosed as public key certificate revocation information is 8:00 on June 2 0 minutes and 0 seconds. At this time, when the time stamp time included in the time stamp token to be verified is, for example, 13:23:45 on June 1, after the expiration date and time, the case where the grace period is not taken into consideration Then, the verification results in the grace period will be different. When the grace period is not considered (when the grace period is ignored), the public key certificate 1502 is not registered in the public key certificate revocation list 1506 that can be accessed during the grace period, so this public key certificate is valid. It is judged that.

  On the other hand, when considering the grace period, time stamp verification is performed based on information in the public key certificate revocation list 1508 that will be issued in the future. It becomes a state (a state that cannot be said to be success or failure). After that, the time stamp server apparatus 100 executes the revocation information confirmation task shown in FIG. The information of the next update date / time of the public key certificate revocation list is read (402), a task for reconfirmation at that time is created (404), and the task is registered (406). The reconfirmation task 124 is executed at the set date and time by the scheduler provided in the time stamp server apparatus 100.

  As described above, the time stamp server apparatus 100 performs time stamp verification based on the time stamp verification policy (FIG. 3, 320). Thereafter, a time stamp verification result is created (322), and the service result is returned to the client device 130 (316).

  As mentioned above, although one Example of this invention was described, this invention is not limited to the said Example, It can implement variously. For example, in the time stamp service system shown in FIG. 1, when only an external time stamp station is used, the in-company TSA 106 becomes unnecessary. On the other hand, when the service is provided only within the company without using the external time stamp station, connection to the proxy TSA 108 and the external time stamp station is not required.

  Furthermore, the DBs 112 to 124 formed in the storage device are merely examples, and can be implemented with appropriate modifications. For example, these DBs are not all formed in the external storage device. Some of these DBs may be stored in the RAM (FIG. 2, 204) in the server device.

  Further, the relationship between the process shown in FIG. 3 and the function in the server apparatus 100 of FIG. 1 that executes the process is not limited to the above embodiment. For example, in the above embodiment, the message digest is created by the in-house TSA unit 106 or the proxy TSA unit 108 of the time stamp server apparatus 100 (FIG. 3, 312). It may be performed as one of the processes in 104. Alternatively, as another example, a program only for creating a message digest may be incorporated in the server apparatus 100.

  As described above, according to the present embodiment, the time stamp service can be used under a policy that is uniformly managed in an organization such as a company. As described above, since no selection means related to the time stamp service quality is provided to the user's client device, it is possible to prevent the time stamp from being created and verified for the convenience of the user. Further, it is possible to reduce the trouble of setting the time stamp use policy for the client device.

The figure which shows the structure of the time stamp service system by one Example of this invention. The figure which shows the hardware constitutions of the time stamp server apparatus 100. FIG. 5 is a flowchart showing a time stamp service processing procedure in the time stamp server apparatus 100. 5 is a flowchart showing a re-confirmation process procedure of public key certificate validity in the time stamp server apparatus 100. The figure which shows the structural example of a time stamp service request message. The figure which shows the structural example of a time stamp service result message. The figure which shows the structural example of time stamp token data. The figure which shows the structural example of the table of a time stamp production policy. The figure which shows the example of the table which shows a time stamp production and verification policy. The figure which shows an example of a message digest preparation procedure. The figure which shows an example of a message digest preparation procedure. The figure which shows an example of a message digest preparation procedure. The figure which shows an example of correlation with time stamp object electronic data and a time stamp token. The figure which shows the structural example of the table of a time stamp verification policy. The figure which shows the example of public key certificate verification which considered the grace period.

Explanation of symbols

100: Time stamp server device, 130: Client device, 132: Time distribution station device, 134: Time stamp station device, 136: Certificate authority device, 102: Request reception unit, 104: Policy management unit, 106: In-house TSA unit 108: Proxy TSA unit 110: Time stamp verification unit 112: Communication partner information DB 114: Data type information DB 116: Security information DB 118: Policy information DB 120: Time stamp information DB 122: Electronic Data information DB 124: Reconfirmation task information DB.

Claims (17)

In a time stamp service system that performs processing related to a time stamp in response to a request transmitted from a client device connected to a communication network,
A storage device that stores in advance a creation policy for creating at least a time stamp;
A reception unit that receives a request related to a time stamp transmitted from the client device and information including data to be processed by the time stamp;
Identifying means for identifying the requesting client device and the type of data from the information received by the receiving unit;
Determining means for determining whether the request is a creation request for creating a time stamp;
If the result of the determination by the determination means is a time stamp creation request, a creation processing means for creating a time stamp for the received data according to the policy with reference to the creation policy stored in the storage device;
Have
A time stamp service system characterized in that the created time stamp is returned to the requesting client device. The request further includes a verification request for verifying the time stamp, and the previous storage device stores a verification policy for verifying the time stamp in advance.
Furthermore, when the determination unit determines that the request is a verification request, the verification unit includes a verification unit that refers to a time stamp verification policy stored in advance in the storage unit and verifies the time stamp according to the policy. The time stamp service system according to claim 1, wherein: A server device connected to the communication network and performing processing related to a time stamp, the server device including at least the receiving unit, the specifying unit, the determining unit, and the verification unit;
3. The time stamp service system according to claim 1, wherein the time stamp creation processing means is provided in a time stamp station device connected via the communication network. 4. The time stamp service system according to claim 1, further comprising information indicating a time stamp creation timing as one of the time stamp creation policies. 4. The time stamp service system according to claim 3, wherein information indicating a time stamp station to be selected is included as one of the time stamp creation policies. 6. The time stamp service system according to claim 1, wherein one of the time stamp creation policies includes information indicating a method for associating time stamp target data with a time stamp. 4. The time stamp service system according to claim 3, further comprising information indicating whether the server device stores the time stamp as one of the time stamp creation policies. One of the time stamp verification policies includes information indicating whether or not to determine the validity of the public key certificate after waiting for a grace period of the public key certificate necessary for time stamp verification. The time stamp service system according to claim 2. 9. The time stamp service system according to claim 2, wherein information indicating whether or not to extend the validity of the time stamp at the time of time stamp verification is included as one of the time stamp verification policies. 10. The time stamp service system according to claim 2, wherein, as one of the time stamp verification policies, information indicating whether or not the time stamp server device stores the time stamp after the time stamp verification is included. . In a server device that performs processing related to a time stamp in response to a request transmitted from a client device connected to a communication network,
A storage device that stores in advance a creation policy for creating at least a time stamp;
A communication unit for receiving a request related to a time stamp transmitted from a client device and information including data to be processed by the time stamp;
A processing device that performs processing related to a time stamp, wherein the processing device includes a specifying unit that specifies the requesting client device and the type of data from information received via the communication unit, and the request is a time A determination unit that determines whether the request is a creation request for creating a stamp; and, as a result of determination by the determination unit, if the request is a time stamp creation request, the creation policy stored in the storage device is referred to And a creation processing means for creating a time stamp for the received data according to
A server device for a time stamp service, characterized in that the created time stamp is transmitted to the requesting client device via the communication unit. The request further includes a verification request for verifying the time stamp, and the previous storage device stores a verification policy for verifying the time stamp in advance.
The processing device further refers to a time stamp verification policy stored in advance in the storage device when the determination means determines that the request is a verification request, and verifies the time stamp according to the policy. The server apparatus according to claim 11, comprising: As one of the time stamp creation policies, including information specifying a method for creating a message digest for the data to be time stamped,
The server apparatus according to claim 11 or 12, wherein the processing apparatus includes message digest creation means for creating a message digest by referring to information on the creation method in the creation policy. In a time stamp processing method for performing processing related to a time stamp in response to a request transmitted from a client device through a communication network,
Receiving a request related to a time stamp transmitted from the client device and information including data to be processed by the time stamp through the interface;
Identifying the client device from which the request was issued and the type of the data from the received information;
Determining whether the request is a creation request for creating a timestamp;
If the result of the determination is a time stamp creation request, refer to a time stamp creation policy stored in advance in the storage unit, and create a time stamp for the data received according to the policy;
Transmitting the created time stamp to the requesting client device via an interface;
A time stamp processing method. The determining step includes determining whether the request is a verification request for verifying a time stamp;
2. The method according to claim 1, further comprising a verification step of referring to a time stamp verification policy stored in advance in the storage unit and verifying the time stamp according to the policy when it is determined as time stamp verification as a result of the determination. 14 time stamp processing methods. In a program executed by a server device that performs processing related to a time stamp in response to a request transmitted from a client device through a communication network,
A specification unit that receives a request related to a time stamp transmitted from a client device and information including data to be processed by the time stamp, and identifies the client device from which the request is issued and the type of the data;
Determining means for determining whether the request is a creation request for creating a time stamp;
If the result of the determination is a time stamp creation request, a time stamp creation means for creating a time stamp for the data received in accordance with the policy with reference to a time stamp creation policy stored in advance in the storage unit;
Means for replying the created time stamp to the requesting client device. The determining means includes determining whether the request is a verification request for verifying a time stamp;
If it is determined that the time stamp is verified as a result of the determination, it further comprises a verification means for referring to a time stamp verification policy stored in advance in the storage unit and performing time stamp verification according to the policy. The time stamp processing program according to claim 16.

Images