JP2023156939A - Remote signature system and remote signature method - Google Patents

Abstract

To provide an electronic signature system that enables identification and validity confirmation on an object of signature through single-time execution of a verifying process.SOLUTION: A terminal device (2) has means for generating a key pair for executing an open key encryption system. A generated secret key is saved in a terminal device (2), and an open key is transmitted to a tamper-resistant device (5) and saved associatively with a corresponding signature key. Signature object data is used as a message to be verified. In electronic signing, the terminal device generates and transmits to the tamper-resistant device a signature request including an encryption token including signature object data to be signed and encrypted signature object data. The tamper-resistant device (5) decrypts the encryption token included in the signature request, verifies identity between the decrypted signature object data and the signature object data to be signed, and excludes a signature request having no subjective eligibility and a signature request having no validity as a signature object from electronic signatures.SELECTED DRAWING: Figure 2

Description

The present invention relates to a remote signature system that applies an electronic signature to data to be signed using a signature key.

A remote signature system has been proposed in which a user's signature key is installed on a business operator's server, the user remotely logs into the server, and uses his or her signature key to electronically sign on the business server. A remote signature system is expected to be a highly convenient signature system for users because it is possible to perform electronic signatures remotely and users do not need to manage signature keys.

As an electronic signature system using a remote signature method, an electronic signature system that includes a key management system that manages signature keys, a certificate issuing system that issues certificates, and a terminal device used by users has been proposed (for example, , see Patent Document 1). In this known electronic signature system, user authentication is performed using a combination of user ID and password based on the user account set in the key management system.

Furthermore, the applicant has proposed an electronic signature system using a remote signature method (for example, see Patent Document 2). In this electronic signature system, the tamper-resistant device generates a key pair of a private key and a public key in response to a request from a user. The private key becomes the signature key and is stored in a tamper-resistant device. The public key is sent to the terminal device and stored as an encryption key. Next, the user comes up with authentication information, such as a password, that indicates the authority to use his signature key, and sends it to the tamper-resistant device via the terminal device. The tamper-resistant device stores the received user authentication information in association with the user's signature key. The user's authentication information is stored in the user's brain and kept secret.

When signing an electronic signature, the user inputs his or her own authentication information into the terminal device. The terminal device generates a cryptographic token by encrypting the input authentication information using a cryptographic key (public key). Subsequently, a signature request including the cryptographic token, the data to be signed, and the signature key identification information is sent to the tamper-resistant device. The tamper-resistant device decrypts the cryptographic token using the decryption key, verifies the decrypted authentication information, and permits the electronic signature only if the correct authentication information is input. As a result, a remote signature system is constructed in which only a person who is authorized to use the signature key can electronically sign the signature key.
Patent No. 6465426 Japanese Patent Application Publication No. 2021-111925

In an electronic signature system that performs identity verification using authentication information, high security can be ensured because only the owner of the signature key who knows the authentication information can sign. However, since the authentication information is held in the user's brain, there is a problem that if the user forgets the authentication information, the signature system cannot be used. Furthermore, if the authentication information is composed of a simple password, there is a risk that it can be easily stolen by a hacker. If the authentication information is stolen by another person, a scandal may occur where a person who does not have the authority to use the information signs the electronic signature. On the other hand, in order to prevent authentication information from being stolen, it is assumed that complex passwords will be used. However, in this case, it is easy to forget the authentication information, and there is a possibility that the signature system cannot be used.

Furthermore, in the field of remote signatures, it is strongly desired to verify whether data to be signed (corresponding to an electronic document) that is sent from a terminal device to a tamper-resistant device has been tampered with. That is, if the data to be signed that has been tampered with is signed, a problem arises in that the wrong electronic document is signed. However, in the electronic signature system described above, verification of identity verification and verification of validity of data to be signed are performed separately. Therefore, it is necessary to perform two verification processes separately, which has the disadvantage of making the authentication process complicated. That is, when performing verification twice, it is necessary to collect verification data for two times, which makes the work of collecting verification data complicated.

An object of the present invention is to realize a remote signature system that can control a signature key without using authentication information such as a password.
Another object of the present invention is to realize a remote signature system that can verify the identity and the validity of the signature object, that is, check whether or not it has been tampered with, by executing a single verification step.

A remote signature system according to the present invention includes a signature system having one or more tamper-resistant devices having a function of generating and managing signature keys, a key management server that controls the tamper-resistant devices, and a user or signature system. The tamper-resistant device is a remote signature system that uses a signature key to electronically sign data to be signed, which is generated from an electronic document.
The terminal device includes a means for generating a key pair of a private key and a public key or a means for inputting an externally generated key pair, and a means for generating a cryptographic token by encrypting a message using the private key as an encryption key. has
The tamper-resistant device includes means for generating a signature key, means for storing the generated signature key, means for decrypting a cryptographic token containing an encrypted message using a decryption key, and a means for decrypting a cryptographic token containing an encrypted message using a decryption key. a verification means for verifying the validity of the signature request using the data to be signed, and a signature means for electronically signing the data to be signed using a signature key based on the verification result by the verification means;
The private key of the key pair is stored as an encryption key in a terminal device, the public key is transmitted to a tamper-resistant device and stored in association with the user's signature key,
a public key associated with the signing key functions as a decryption key to decrypt the cryptographic token;
The message is data to be signed or a message including data to be signed,
When applying an electronic signature, the terminal device encrypts the data to be signed using the encryption key to generate a cryptographic token, and generates a signature request including the data to be signed, the cryptographic token, and signature key identification information. and sent to a tamper-resistant device.
The tamper-resistant device searches for a decryption key for decrypting the cryptographic token included in the signature request, decrypts the cryptographic token included in the signature request using the searched decryption key, and decodes the decrypted signature target data and the signed data. It is characterized by verifying the consistency with the data to be signed, and applying an electronic signature based on the verification result.

The basic idea of the present invention is to combine a remote signature system with a public key cryptosystem and use the public key cryptosystem to control a signature key. In other words, the user's identity is verified using public key cryptography, and the signature key is controlled based on the result. As a result of various analyzes conducted by the present inventor regarding public key cryptography and remote signature systems, we found that the public key of a key pair that executes public key cryptography is used as a decryption key, and this decryption key is associated with the signature key of the signer. It has been found that public key cryptography can be coupled to a remote signature system by storing, ie by associating the decryption key and the signature key.

In the present invention, the tamper-resistant device generates a signature key for each user based on a request from the user. Each user's signature key is stored in a tamper-resistant device. The terminal device generates a key pair for executing public key cryptography, and stores the generated private key in the terminal device. The generated public key is sent to the tamper-resistant device where the signature key is stored, and is stored in association with the user's signature key. That is, the signature key and public key are stored as a pair for each user. The private key held in the terminal device functions as an encryption key that encrypts the message to be verified. The public key held in the tamper-resistant device functions as a decryption key for decrypting encrypted messages sent from the terminal device. When applying an electronic signature, the terminal device generates signature target data from a specified electronic document, and includes the generated signature target data, encrypted signature target data obtained by encrypting the signature target data, and signature key identification information. A signature request is sent from the terminal device to the tamper-resistant device.

The characteristics of the verification are that the signature target data generated from the electronic document is used as the message to be verified, and the signature target data to be signed and the encrypted signature target data that is the encrypted signature target data are used. The objective is to perform verification using the two signature target data. Here, the encrypted data to be signed is encrypted using a private key of public key cryptography to constitute a cryptographic token. When signing an electronic signature, the terminal device generates a signature request including signature key identification information that specifies the signature key and decryption key, data to be signed, and an encryption token, and transmits it to the tamper-resistant device.

The tamper-resistant device uses the search information to search for the decryption key. Since the decryption key is stored in association with the signature key, it is possible to search for the decryption key using, for example, signature key identification information or search information equivalent thereto. The cryptographic token is decrypted using the retrieved decryption key and a decrypted message is generated. At this point, the tamper-resistant device has two signature target data: the signature target data to be signed and the signature target data which is the decrypted message. In the present invention, the consistency of the two signature target data is verified, with one of the signature target data set as verification reference data and the other signature target data set as data to be verified.

First, signature data to be signed is set as verification reference data, and signature data that is a decrypted message is set as data to be verified. Here, the signature target data to be signed is assumed to be genuine signature target data that has not been tampered with.
As a verification result, if the decrypted message matches the data to be signed, the cryptographic token uses the same data to be signed as the data to be signed using a cryptographic key in a corresponding relationship with the decryption key (public key) of the tamper-resistant device. It is recognized that it was encrypted using a key (private key). Therefore, it is recognized that the signature request was made by the owner of the signature key, and it is determined that the subject of the signature request is a person who has legitimate authority to use the signature key.

As a verification result, if the decrypted message does not match the data to be signed, the validity of the signature request is denied. In other words, since the cryptographic token is encrypted, it cannot be tampered with during transmission. Therefore, the cause of the discrepancy may be that the data to be signed was encrypted using an encryption key that is not related to the decryption key held in the tamper-resistant device, or the data to be signed is different from the data to be signed that should be signed. It is assumed that encryption was performed on the However, since the data to be signed is formed by performing a hash operation on the electronic document on the terminal device, it is difficult to imagine that the data to be signed and the data to be encrypted are different. . Therefore, it is recognized that the cause of the discrepancy is that the data to be signed was encrypted using an encryption key that is not related to the decryption key held in the tamper-resistant device. This cause means that the signature request was formed on a terminal device for which a valid private key was not set. Therefore, such a signature request is determined to be a signature request by a person who does not have the authority to use the signature key. Therefore, if the decrypted message does not match the data to be signed, the signature request is determined not to satisfy the validity of the subject and is excluded from the electronic signature. As will be described later, if the data to be signed has been tampered with, the decrypted message and the data to be signed will not match regardless of the authenticity of the cryptographic token, so it can be treated as an error.

Next, the decrypted message is used as the reference data for verification, and the data to be signed is used as the data to be verified. The encrypted signature target data included in the cryptographic token is encrypted data obtained by encrypting the regular signature target data using a regular encryption key. Note that since the cryptographic token is encrypted, it cannot be tampered with during transmission. On the other hand, the signature target data to be signed includes the possibility of being tampered with.

If the data to be signed matches the decrypted message, it is recognized that the data to be signed has not been changed or tampered with during transmission. Therefore, it is determined that such a signature request satisfies the validity of the signature target. On the other hand, if the data to be signed does not match the decrypted message, it is determined that the data to be signed has been tampered with or changed while the signature request was sent from the terminal device to the tamper-resistant device. That is, since the data to be signed immediately after being generated is recognized as legitimate data to be signed, it is recognized that the cause of the discrepancy is due to falsification or modification of the data to be signed during transmission. In this way, when the decrypted message is used as the reference data, by verifying the consistency of the two signature target data, it is determined whether the signature target data included in the signature request has been tampered with. Validity or authenticity is determined. If the data to be signed does not match the decrypted message, the signature request is treated as an error and excluded from the digital signature.

As mentioned above, in signature systems that use authentication information such as passwords or challenge codes to verify identity, the message decrypted by a tamper-resistant device is verified to match the reference information stored in the tamper-resistant device. be done. Therefore, although the identity was verified, it was not possible to verify whether or not the information had been tampered with. Therefore, there was a risk that an electronic signature would be applied to data to be signed that had been tampered with. Furthermore, it has been pointed out that reference data serving as a standard for authentication must be set in advance in the tamper-resistant device, making the setup process complicated. In contrast, in the present invention, a signature request by a person who does not have the authority to use the signature key is excluded from being subject to an electronic signature, and even if the data to be signed is tampered with, it is also excluded from being subject to an electronic signature. Therefore, according to the present invention, it is possible to determine both the presence or absence of authority to use the signature key and the presence or absence of tampering with the signature object at once through a single verification process. In other words, by verifying the identity verification, the validity or authenticity of the data to be signed is verified in addition to the verification of the identity verification. That is, one authentication process verifies the suitability of the signer of the signature request and the validity of the signature target. As a result, an electronic signature system with a significantly improved security level is realized.

In the present invention, when creating an electronic signature, data to be signed and the same encrypted data to be signed are transmitted from a terminal device to a tamper-resistant device. This makes it possible to perform authentication processing using one signature target data as authentication reference data and the other signature target data as data to be verified. In other words, since the signature data to be verified and the standard data that serves as the basis for verification are sent together to the tamper-resistant device, there is no need to set the standard data in the tamper-resistant device in advance, which eliminates the complexity of setup. Ru.

Furthermore, in the present invention, since the user is verified without using authentication information such as a password, there is no need for the user to memorize a password, which reduces the burden on the user. In particular, the problem of being unable to use the signature system due to the user forgetting authentication information is resolved.

A preferred embodiment of the electronic signature system according to the present invention verifies the consistency between the decrypted data to be signed and the data to be signed included in the signature request. The present invention is characterized in that invalid signature requests are excluded from being subject to electronic signatures. That is, a signature request that does not satisfy the subject eligibility and the signature subject eligibility can be excluded from the digital signature by performing only one comparison verification.

In another preferred embodiment of the electronic signature system according to the present invention, the terminal device has means for generating signature target data from an electronic document, encrypts the generated signature target data to generate a cryptographic token,
The terminal device is characterized in that it generates a signature request including the generated data to be signed, a cryptographic token, and signature key identification information, and transmits it to the tamper-resistant device.
In the present invention, the private key of the key pair that constitutes the public key cryptosystem is held in the terminal device. Therefore, if a terminal device is equipped with a signature data generation means (for example, a hash calculation means) that generates signature data from an electronic document, the process from the generation of signature data to the generation of a signature request can be automatically performed on the terminal device. can be done.

The electronic signature method according to the present invention includes a signature system that includes a tamper-resistant device that generates and manages signature keys, a key management server that has a function of controlling the tamper-resistant device, and a terminal device used by a user or signer. An electronic signature method for digitally signing data to be signed using a signature key that is prepared and managed by a tamper-resistant device,
The terminal device generates a key pair of a private key and a public key, the generated private key is stored in the terminal device, and the public key is sent to a tamper-resistant device and stored in association with the signer's signature key,
When signing an electronic signature, the terminal device generates a cryptographic token by encrypting the data to be signed using the private key as an encryption key, and generates a signature including the data to be signed, the cryptographic token, and the signature key identification information. A request is generated and sent to the tamper-resistant device;
The tamper-resistant device decrypts the cryptographic token included in the signature request using the public key as a decryption key, verifies consistency between the decrypted signature target data and the signature target data included in the signature request,
According to the verification result, a signature request that lacks validity as a signer and a signature request that lacks validity as a signature target are excluded from the digital signature target.

In the present invention, the public key of the key pair that executes the public key cryptosystem is transmitted from the terminal device to the tamper-resistant device, and the public key is stored in association with the signature key of the signer, so the verification results of the public key cryptosystem are used. can control the signing key.
In addition, signature target data generated from an electronic document is used as the message to be verified, and two signature target data are used: the signature target data to be signed and the encrypted signature target data obtained by encrypting the signature target data. Since verification is performed, the validity of the subject and the validity of the signature target (whether or not it has been tampered with) can be determined by executing the verification process once, and a remote signature system with a high security level is constructed.
More importantly, since two pieces of data to be signed are used as authentication messages and no identity confirmation message such as a password is used, the user does not need to remember authentication information. As a result, the burden on the user is significantly reduced.
Further, since there is no need for the user to input information such as a password into the terminal device, automated processing can be performed. That is, a signed document can be automatically output simply by the user specifying an electronic document to be signed.
Furthermore, when data to be signed is transmitted from the terminal device to the tamper-resistant device, if the signature data is tampered with during transmission, an error process will be performed in any case. Therefore, the inconvenience of electronically signing falsified signature target data is avoided. Therefore, an electronic signature system with a significantly improved security level than conventional electronic signature systems is realized.

1 is a diagram showing the overall configuration of an electronic signature system according to the present invention. 1 is a diagram schematically showing a setup process and an authentication process of a remote signature system according to the present invention; FIG. FIG. 3 is a diagram showing an algorithm of a signature key generation process of the electronic signature system according to the present invention. FIG. 3 is a diagram showing an algorithm of the signature process of the electronic signature system according to the present invention. It is a figure which shows the modification of a setup process. It is a diagram showing an example of a terminal device. It is a figure showing an example of a tamper-proof device. FIG. 2 is a diagram illustrating an example of a key management server. FIG. 2 is a block diagram illustrating an example of an editing server. FIG. 6 is a diagram showing a modification of the electronic signature system according to the present invention.

Mode for carrying out the invention

FIG. 1 is a diagram showing the overall configuration of an electronic signature system according to the present invention. Terminal devices 2-1 to 2-n are connected to the network 1. These terminal devices are devices used by users or signers, and are, for example, personal computers or smart phones. Here, the user includes not only a signer who digitally signs an electronic document, but also a person who uploads an electronic document to the editing server and a person who downloads the electronic document from an external server to the editing server. Therefore, the terminal device in this example includes not only the terminal device used by the signer but also the terminal device used to upload the electronic document to be signed to the editing server.

A signature system 3 is connected to the network 1. The signature system 3 includes a key management server 4 and one or more tamper-resistant devices 5 connected to the key management server. The key management server 4 is connected to the network and has a function of managing and controlling the tamper-resistant device 5.

The tamper-resistant device 5 has a function of safely generating and managing a signature key without leaking it to the outside, and can be, for example, a Hardware Security Module (HSM). The tamper-resistant device includes a subsystem or device that has security management functions independent of the key management server. The tamper-resistant device has a key management module, which is a program that manages keys, and generates a key pair between a private key and a public key that acts as a signature key, creates a digital signature using the signature key, stores the signature key, and generates an encrypted Executes the function of decrypting the cryptographic token containing the message and verifying the decrypted data to be signed.

Furthermore, a certificate issuing server 6 provided at a certification authority is connected to the network 1. The certificate issuing server 6 generates a certificate issuing request (CSR) in response to a certificate generating request sent from a terminal device, and generates an electronic certificate. Furthermore, when generating a key pair constituting a signature key, a signature key generation request can be sent from the terminal device to the key management server via the certificate issuing server.

Furthermore, an editing server 7 is connected to the network 1. The editing server 7 has a function of managing and storing electronic documents to be signed, and manages electronic documents to be signed, such as electronic documents uploaded from a terminal device and downloaded from an external server. When an electronic document is uploaded, the editing server 7 notifies the terminal device of the signer who is to sign the electronic document. Furthermore, the editing server can also embed the electronic signature generated by the signature system 3 into the electronic document to generate a signed electronic document. The generated signed electronic document is stored in the editing server 7.

Next, an algorithm for generating a signed electronic document will be explained. FIG. 2 is a flowchart showing the setup process, and FIG. 3 is a flowchart showing the signature process. In the present invention, a public key cryptographic method is coupled to a remote signature system, and a signature key is controlled using the result of person authentication by the public key application method. As a result, the validity of the subject and the validity of the signature target can be determined by performing the verification process once, and the authentication process can be simplified.

FIG. 2 schematically shows the signal processing of the remote signature system according to the present invention. A user who wishes to set up the remote signature system of the present invention requests the tamper-resistant device to generate a signature key via the terminal device. In response, the tamper-resistant device generates a signature key, and stores the generated signature key together with signature key identification information in the signature key data storage section.
Next, the terminal device generates a key pair for executing the public key cryptosystem. The generated private key is stored in the terminal device as an encryption key, and the public key is sent to the tamper-resistant device. Since the public key functions to decrypt cryptographic tokens, it is also referred to as a decryption key. This public key is stored in the signature key data storage unit in association with the user's previously generated signature key. Therefore, as shown in FIG. 2, the signature key, decryption key, and signature key identification information are stored in a pairwise relationship. This completes the setup work.

When signing an electronic signature, the user or signer specifies the electronic document to be signed. Subsequent signal processing is performed automatically. When an electronic document is designated, a hash operation is performed on the designated electronic document to generate data to be signed. Next, the terminal device encrypts the data to be signed using the private key and generates a cryptographic token. Subsequently, the terminal device generates a signature request including the generated data to be signed, the cryptographic token, and the signature key identification information. The generated signature request is sent to the tamper-resistant device.

Upon receiving the signature request, the tamper-resistant device searches for the decryption key using the signature key identification information. Since the decryption key is stored in a paired relationship with the signature key, the decryption key can be searched using the signature key identification information or identification information equivalent thereto. Next, extract the cryptographic token from the signature request. The retrieved cryptographic token is decrypted using the retrieved decryption key to generate a decrypted message. Furthermore, the tamper-resistant device verifies consistency between the decrypted message and the data to be signed. The verification result is sent to the signature means, and an electronic signature is performed using the signature key.

As described above, in the present invention, after specifying an electronic document to be signed, the signer does not perform any information input operation. Therefore, all signal processing after designation of an electronic document can be performed automatically. As a result, the processing up to the generation of a signed document can be performed automatically.

FIG. 3 is a diagram showing an algorithm for the signature key generation process of the electronic signature system according to the present invention. Referring to FIG. 3, the user issues an authentication request to the key management server 4 of the signature system 3 via the terminal device 2. The authentication request shall be user authentication using a user ID and password. Note that if the user's account has not been created yet, the key management server 4 creates a new account for the user. Furthermore, as a user authentication method, in addition to the method of authenticating a combination of user ID and password, it is also possible to authenticate by transmitting a token stored in an IC card to a key management server. After user authentication, an authentication response is sent from the key management server 4 to the terminal device 2.

If the user authentication is successful, the user transmits a signature key generation request to the key management server 4 from the terminal device. The key management server 4 instructs the tamper-resistant device 5 to generate a signature key. The tamper-resistant device generates a key pair of a private key and a public key that serve as a signature key in response to the signature key generation request. The generated private key becomes a signature key, is stored in a tamper-resistant device, and is used for electronic signatures. The public key is also used by the user as signature key identification information. The tamper-resistant device sends a signature key generation notification containing the generated public key to the key management server, and the key management server sends the signature key generation notification to the terminal device. The terminal device stores the received public key as signature key identification information.

In response to receiving the signature key generation notification, the terminal device generates a key pair of a private key and a public key for executing the public key cryptosystem. The generated private key is stored in the terminal device and functions as an encryption key for encrypting the personal authentication message. In the present invention, the data to be signed is used as a message for personal authentication, and the data to be signed is encrypted. As an encryption method, the data to be signed can be encrypted by performing a signature operation on the data to be signed using a private key. The encrypted data to be signed acts as a cryptographic token. Further, the generated public key is sent to the tamper-resistant device and stored in association with the corresponding signature key. The public key stored in the tamper-resistant device functions as a decryption key for decrypting cryptographic tokens sent from the terminal device. Incidentally, in the case where a large amount of signature keys to be stored results in overflow, some of the signature keys may be encrypted and stored in a database external to the tamper-resistant device. In this way, by storing the public key that functions as a decryption key in association with the signature key, it is possible to combine the public key cryptosystem with the remote signature system.

When the tamper-resistant device completes storing the public key that functions as a decryption key, it sends a setup completion notification to the terminal device. Thereafter, the user can use the terminal device to sign electronically.

Subsequently, the user transmits an authentication request to the certificate issuing server 6 via the terminal device in order to obtain an electronic certificate (signature certificate). This user authentication is also a combination of user ID and password. An authentication response is sent from the certificate issuing server to the terminal device.

When the user authentication is successful, the terminal device transmits an electronic certificate generation request including the user ID, the public key paired with the signature key, and other necessary items to the certificate issuing server. The certificate issuing server creates a certificate issuing request (CSR) using the received public key and necessary information, and generates an electronic certificate after performing a predetermined examination process. The generated electronic certificate is sent to the terminal device. The terminal device stores the received electronic certificate. Note that the electronic certificate is transferred to the editing server as needed, and is also stored in the editing server.

FIG. 4 shows an algorithm for performing an electronic signature using the generated signature key. In the present invention, the signature key is controlled using the result of person authentication using public key cryptography. The terminal device generates signature target data from the electronic document to be signed. As the electronic document, an electronic document stored in a terminal device and an electronic document sent from an editing server that manages electronic documents are used. The terminal device generates a hash value by performing a predetermined logical operation (hash operation) on the area to be signed in the electronic document, and uses the generated hash value as data to be signed.

The signature target data of the present invention is not only signature target data directly generated from an electronic document, but also a message in which additional information such as generation date and time and expiration date is added to the generated signature target data. included. In other words, a message that includes part of the data to be signed can also be used as the data to be signed.

Subsequently, the terminal device encrypts the message using the encryption key (the stored private key) to generate a cryptographic token. In the present invention, signature target data is used as a message to be encrypted. Therefore, the terminal device encrypts the data to be signed using the encryption key and generates a cryptographic token. As an example of encryption, a signature operation is performed on data to be signed using an encryption key, and the obtained signature operation result is used as an encryption token.

Subsequently, the terminal device generates a signature request including signature key identification information, signature target data, and cryptographic token. The signature request has the meaning of requesting a digital signature from the tamper-resistant device. The signature request is then sent to the tamper-resistant device via the key management server.

Upon receiving the signature request, the tamper-resistant device searches for the signature key using the signature key identification information included in the signature request, and retrieves the decryption key stored in association with the retrieved signature key. As the signature key identification information, for example, a public key corresponding to a private key that constitutes the signature key can be used. Note that the identification information used to search for the decryption key is not only the same information as the signature key identification information, but also identification information in which additional changes have been made to the signature key identification information to distinguish it from the signature key, that is, signature key identification information. Equivalent identification information can also be used.

Next, the cryptographic token included in the signature request is decrypted using the retrieved decryption key to generate a decrypted message.

Next, the decrypted message is compared and verified with the data to be signed included in the signature request. As an example, a signature operation is performed on a cryptographic token using a decryption key to form a signature value. Then, the consistency between the obtained signature value and the data to be signed is verified.

If the verification result is that the decrypted message and the data to be signed match, the tamper-resistant device determines that the received signature request is valid. That is, it is determined that the received signature request is a signature request made by a person who has the legitimate right to use the signature key, and that the data to be signed has not been tampered with.

If the verification result is that the decrypted message and the data to be signed do not match, the tamper-resistant device determines that the received signature request is invalid. That is, the tamper-resistant device determines that the cryptographic token included in the received signature request has not been encrypted with an appropriate cryptographic key, or that the data to be signed has been tampered with, and processes it as an error.

If the signature request is determined to be valid, the tamper-resistant device applies a digital signature to the data to be signed using the corresponding signature key, and an electronic signature is generated. The signature result including the electronic signature and signature key identification information is sent to the terminal device via the key management server. The terminal device embeds the received electronic signature in the edited electronic document and creates a signed electronic document (signed document). The generated electronic signature is given a signature time stamp by the time stamp server and embedded in the electronic document as a long-term signature, thereby making it possible to guarantee the long-term validity of the electronic signature. The signed electronic document is stored in the terminal device and is transmitted to the editing server as necessary. Note that the generated electronic signature can be sent to the editing server and processed there.

FIG. 5 shows a modification of the setup process. In this example, the editing server 7 has a function as a management server that manages uploaded electronic documents. An electronic document to be signed is uploaded from a terminal device to the editing server, and upload information is input thereto. Further, an electronic document to be signed is also input from an external server. The upload information includes the electronic document to be signed, identification information of the signer who is to sign, and address information of the signer's terminal device. The uploaded electronic document is stored and managed by the editing server.

When the upload information is input, the editing server stores the uploaded electronic document and notifies the terminal device of the user who is to sign that a signature is requested. The user who receives the notification requests user authentication from the editing server via the terminal device. When user authentication is successfully performed, the editing server sends an authentication response to the terminal device.

The user confirms the electronic document to be signed. When signing the verified electronic document, the user requests the editing server to generate data to be signed via his/her own terminal device. This request from the terminal device to the editing server to generate data to be signed has a meaning as an expression of the signer's intention to request signature processing. Then, this generation request becomes a trigger to start signature processing, and a series of signature processing is automatically executed.

In response to receiving the signature target data generation request, the editing server edits the signature target electronic document and generates the signature target data from the electronic document. Subsequently, the editing server downloads the signature target data to the terminal device.

In response to the download of signature target data, the terminal device encrypts the downloaded signature target data using an encryption key (private key) and generates a cryptographic token.

Subsequently, the terminal device transmits the generated cryptographic token and signature information including signature key identification information to the editing server. Here, since the data to be signed is encrypted, it cannot be tampered with.

The editing server generates a signature request including signature key identification information, signature data for signature, and cryptographic token. The generated signature request is sent to the tamper-resistant device.

The tamper-resistant device uses the signature key identification information to search for the decryption key, and uses the decryption key to decrypt the cryptographic token included in the received signature request. Next, the data to be signed and the decrypted message are compared and verified. If the verification result is that the data to be signed and the decrypted message match, the signature request is determined to be valid, and a digital signature is applied to the data to be signed. The signature result including the generated electronic signature is sent to the editing server via the key management server.

The editing server embeds the received electronic signature in the electronic document and creates a signed electronic document (signed document). The signed electronic document is stored in the editing server and is transmitted to the terminal device as necessary.

FIG. 6 is a block diagram showing the functional configuration of the terminal device. Note that FIG. 6 shows only the part related to the electronic signature. The terminal device includes a communication means 10, a control section 11, an input device 12, and a storage section 13. The communication means 10 is connected to a network and sends and receives data to and from a key management server and the like. The control unit 11 includes an authentication request unit 14, and transmits an authentication request using a user ID and password to a key management server of the signature system. Subsequently, the user logs into the signature system and sends a signature key generation request from the signature key generation request unit 15 to the tamper-resistant device. The public key of the key pair generated by the tamper-resistant device is stored in the signature key identification information storage section 16 of the storage section via the communication means.

The electronic certificate issuance request unit 17 generates an electronic certificate issuance request including the public key received from the tamper-resistant device and sends it to the certificate issuance server. The created electronic certificate is received via the communication means and stored in the electronic certificate storage section 18.

The key pair generation unit 19 generates a key pair for identity verification. The generated private key functions to encrypt the signature data to be signed, and is stored in the encryption key storage unit 20. Further, the public key is transmitted to the tamper-resistant device via the communication means. In this way, the private key for encrypting the data to be signed is held in the terminal device, and the public key for decrypting the cryptographic token is held in the tamper-resistant device.

Here, the key pair generation means includes not only means for directly generating a key pair, but also means or a function for introducing a key pair generated externally and stored in a storage device into a terminal device. For example, the case where a key pair is stored in advance in a storage means such as a USB memory and the key pair is set by sending the stored key pair to a terminal device also corresponds to operating the key pair generating means.

The electronic document to be signed is stored in the electronic document storage section 21. When applying an electronic signature, the electronic document is read out and supplied to the signature target data generation section 22 . The signature target data generation unit generates signature target data from the electronic document. This signature target data generation section can be configured by, for example, hash calculation means.

The generated data to be signed is supplied to the cryptographic token generation section 23 and the signature request generation section 24. The cryptographic token generation unit 23 generates a cryptographic token by encrypting the data to be signed using the cryptographic key. The generated cryptographic token is supplied to the signature request generation section. The signature request generation unit generates an authentication request including data to be signed, a cryptographic token, and signature key identification information. The generated authentication request is transmitted to the tamper-resistant device authentication via the communication means 10.

The electronic document upload unit 25 creates an electronic signature generation request including the electronic document stored in the electronic document storage unit 21 and the stored electronic certificate, and sends it to the editing server. Furthermore, for electronic documents that require someone else's signature, the signer's ID and address are added to the electronic document to be signed and uploaded to the editing server.

When the electronic signature is completed in the tamper-resistant device, the electronic signature is sent to the terminal device. The received electronic signature is embedded in the electronic document to generate a signed electronic document. The generated signed electronic document is stored in the signed electronic document storage section 26.

FIG. 7 shows an example of the functional configuration of the tamper-proof device. The tamper-resistant device includes a management section 30, a processing section 31, and a storage section 32. Information signals transmitted from the terminal device or the editing server are input to the management unit 30 via the network and the key management server. The management section 30 controls each functional section provided in the processing section so that a specified function is executed according to the input information signal.

In response to receiving the signature key generation request, the signature key generation unit 33 operates to generate a key pair of a private key and a public key to be used as a signature key. The generated key pair is temporarily stored in the storage unit 34. The public key functions as signature key identification information that identifies the signature key and decryption key. This public key is duplicated and sent to the corresponding terminal device via the management unit.

When the public key of the key pair for identity verification is received, the received public key is sent to the storage unit 34. The storage unit forms signature key data by associating the key pair forming the signature key with the received public key. This signature key data includes a signature key (private key), signature key identification information (public key), and signature key (public key of a key pair for personal authentication). This signature key data is stored in a signature key data storage section 35 provided in the storage section 32 for each signer or user.

When a signature request is input, the cryptographic token is sent to the decryption unit 36 and the data to be signed is supplied to the verification unit 37. Subsequently, the signature key data storage unit 35 is searched using the signature key identification information included in the signature request, and the corresponding signature key and associated decryption key are retrieved. The extracted decryption key is supplied to the decryption unit 36. The cryptographic token is decrypted using the retrieved decryption key to form a decrypted message. The decrypted message is sent to the verification section 37. As a decryption method, it is also possible to generate a signature value by performing a signature operation on a cryptographic token using a decryption key, and use the generated signature value as a decryption message.

The verification unit 37 receives the decrypted message decrypted from the cryptographic token and the data to be signed included in the signature request. The verification unit compares these two data to verify consistency. As a method for verifying consistency, for example, it is possible to verify consistency between the signature value generated in the decryption process and the signature target data included in the signature request.

If the decrypted message and the data to be signed match, the verification unit 37 sends the data to be signed to the signature unit. Further, the signature key specified by the signature key identification information is sent from the signature key storage unit to the signature unit. The signature section applies an electronic signature to the data to be signed using the input signature key.

If the verification results do not match, this signature request is treated as an error.

FIG. 8 shows the functional configuration of the key management server. The key management server includes a communication means 40, a control section 41, and a user information database 42. The control unit includes a user authentication processing unit 43 and processes authentication requests from terminal devices.

A signature key generation request sent from the terminal device and a signature request sent from the editing server or the terminal device are supplied to the tamper-resistant device control section 34, and an instruction corresponding to the specified process is sent to the tamper-resistant device. Various information such as electronic signatures generated by the tamper-resistant device is sent to the terminal device, editing server, etc. via the tamper-resistant device control unit. Note that the key management server and the tamper-resistant device can be connected via an internal bus or an external bus. Alternatively, it is also possible to connect via LAN.

FIG. 9 is a block diagram showing the functional configuration of the editing server. This block diagram corresponds to the algorithm of FIG. The editing server includes a communication means 50, a control section 51, and a storage section 52. The communication means 50 is connected to a network, and transmits and receives information between the terminal device, the key management server, and the tamper-resistant device. The user authentication processing section 53 uses the user information stored in the user information storage section 54 to process an authentication request sent from a terminal device.

Upload information uploaded from the terminal device is input to the upload information receiving section 55. The upload information is sent to the signature notification section 56, which transmits a signature notification indicating that a signature is requested to the terminal device of the signer's address included in the upload information. Further, the electronic document included in the upload information is stored in the electronic document storage section 57.

A request for downloading data to be signed from a signer is input to the download request receiving section 58 . In response to the input download request, the signature target data generation unit 59 operates and generates two identical signature target data: signature target data for signature and signature target data for cryptographic token generation. The generated signature target data for cryptographic token generation is transmitted from the signature target data download unit 60 to the terminal device of the corresponding signer.

The signature information sent from the signer's terminal device is input to the signature request generation section 61. The signature request generation unit generates a signature request by adding signature target data for signature to the cryptographic token and signature key identification information included in the signature information. The generated signature request is sent to the tamper-resistant device.

The editing server has an editing section 62. The editing unit 62 edits the electronic document to be signed, and sets the arrangement method and arrangement position of fields of the electronic signature to be formed.

The electronic signature that is the signature result generated by the tamper-resistant device is input to the signed electronic document generation section 63. Editing information generated by the editing section is also input to the signed electronic document generation section, an electronic signature is embedded in the stored electronic document, and a signed electronic document (signed document) is generated. The generated signed electronic document is stored in the signed document storage section 64.

FIG. 10 is a diagram showing a modification of the electronic signature system according to the present invention. In this example, VPN connections 70 and 71 are provided between the key management server 4 and the certificate issuing server 6 and between the key management server 4 and the editing server 7, respectively. By providing a VPN connection, the key management server 4 and certificate issuing server 6 are equivalent to being directly interconnected, and the key management server 4 and editing server 7 are also equivalent to being interconnected. As a result, a secure encrypted transmission path is constructed between the certificate issuing server and editing server and the key management server.

Further, the certificate issuing server 6 and the editing server 7 are constituted by an authentication server having a personal authentication function. A user (terminal device) has an account on the authentication server (certificate issuing server 6 and editing server 7) and exchanges messages with the authentication server through the login authentication process using SSL encrypted communication. As a result, the communication between the terminal device 2 and the certificate issuing server 6 and between the terminal device 2 and the editing server 7 are protected by SSL encrypted communication.

In the signature key generation step, the public key of the key pair generated by the tamper-resistant device is sent to the terminal device via the key management server 4, the VPN connection 70, and the certificate issuing server 6. Further, the cryptographic token created by the terminal device is sent to the tamper-resistant device via the certificate issuing server 6, VPN connection 70, and key management server 4.

Furthermore, in the signature process, the cryptographic token generated by the terminal device is sent to the tamper-resistant device 4 via the editing server 7, VPN connection 71, and key management server. The electronic signature generated by the tamper-resistant device is sent to the editing server 7 via the key management server and VPN connection 71. As a result, an encrypted and secure transmission path is constructed between the terminal device that instructs the tamper-resistant device to sign and the key management server that issues a digital signature based on the instruction from the terminal device.

The present invention is not limited to the embodiments described above, and various modifications and changes are possible. For example, in the embodiments described above, an electronic signature system including a signature system, an editing server, a signer issuing server, and a terminal device was described, but it is also possible to use an independent electronic document management server that has the function of managing electronic documents. can. That is, an electronic document uploaded from a terminal device can be input to an electronic document management server and managed by the electronic document management server. Then, the upload information is transferred from the electronic document management server to the editing server, and processing such as generation of signature target data and signature request generation can be performed in the editing server.

Regarding the data to be signed, as an example, the data to be signed can be data extracted by performing a predetermined logical operation (hash operation) from the area to be signed in the electronic document.

1 Network 2 Terminal device 3 Signature system 4 Key management server 5 Tamper-resistant device 6 Certificate issuing server 7 Editing server 10 Communication means 11 Control section 12 Input device 30 Management section 31 Processing section 32 Storage section

A remote signature system according to the present invention includes a signature system that includes one or more tamper-resistant devices that have the function of generating and managing signature keys, and a key management server that controls the tamper-resistant devices, and a user or signer. A remote signature system that electronically signs data to be signed generated from an electronic document using a signature key managed by a tamper-resistant device,
The terminal device includes a means for generating a key pair of a private key and a public key or a means for installing an externally generated key pair, and a means for generating signature data to be subjected to an electronic signature using the private key as an encryption key. having means for encrypting to form a cryptographic token;
The tamper-resistant device includes a means for generating a signature key, a means for storing the generated signature key in the tamper-resistant device , a means for decrypting a cryptographic token containing encrypted data to be signed using a decryption key, and a means for decrypting a cryptographic token containing encrypted signature data using a decryption key. a verification means for verifying the validity of the signature request using the signature data to be signed and the signature data to be signed, and a signature key stored in the tamper-resistant device based on the verification result by the verification means. has a signature means for electronically signing data to be signed,
The private key of the key pair is stored in a terminal device, the public key of the key pair is transmitted to a tamper-resistant device, and is stored in the tamper-resistant device in association with the user's signature key;
The private key stored in the terminal device functions as an encryption key to encrypt the data to be signed , and the public key stored in the tamper-resistant device in association with the signature key functions as a decryption key to decrypt the encryption token. ,
When signing an electronic signature, the terminal device generates a cryptographic token by encrypting the data to be signed using the private key,
A signature request including data to be signed, a cryptographic token including the encrypted data to be signed , and signature key identification information is generated and transmitted to the tamper-resistant device;
The tamper-resistant device decrypts the cryptographic token using a public key stored in association with the signature key, verifies the match between the decrypted signature data and the signature data to be signed, and performs verification. It is characterized by an electronic signature based on the result.

FIG. 1 is a diagram showing the overall configuration of an electronic signature system according to the present invention. Terminal devices 2-1 to 2-n are connected to the network 1. These terminal devices are devices used by users or signers, and are, for example, personal computers or smart phones. Here, the user includes not only a signer who digitally signs an electronic document, but also a person who uploads an electronic document to the editing server and a person who downloads the electronic document from an external server to the editing server. Therefore, the terminal device in this example includes not only a terminal device used by a signer but also a terminal device used to upload an electronic document to be signed to an editing server.

Next, an algorithm for generating a signed electronic document will be explained. FIG. 2 is a flowchart showing the setup process, and FIG. 3 is a flowchart showing the signature process. In the present invention, a public key cryptosystem is coupled to a remote signature system, and a signature key is controlled using the result of person authentication by the public key cryptosystem . As a result, the validity of the subject and the validity of the signature target can be determined by performing the verification process once, and the authentication process can be simplified.

If the user authentication is successful, the user transmits a signature key generation request to the key management server 4 from the terminal device. The key management server 4 instructs the tamper-resistant device 5 to generate a signature key. The tamper-resistant device generates a key pair of a private key and a public key that serve as a signature key in response to the signature key generation request. The generated private key becomes a signature key, is stored in a tamper-resistant device, and is used for electronic signatures. Additionally, the public key is used as signature key identification information. The tamper-resistant device sends a signature key generation notification containing the generated public key to the key management server, and the key management server sends the signature key generation notification to the terminal device. The terminal device stores the received public key as signature key identification information.

A signature key generation request sent from the terminal device and a signature request sent from the editing server or the terminal device are supplied to the tamper-resistant device control section 34, and an instruction corresponding to the specified process is sent to the tamper-resistant device. Various information such as an electronic signature generated by the tamper-resistant device is sent to a terminal device, an editing server, etc. via a tamper-resistant device control unit. Note that the key management server and the tamper-resistant device can be connected via an internal bus or an external bus. Alternatively, it is also possible to connect via LAN.

A remote signature system according to the present invention includes a signature system that includes one or more tamper-resistant devices that have the function of generating and managing signature keys, and a key management server that controls the tamper-resistant devices, and a user or signer. A remote signature system that electronically signs data to be signed generated from an electronic document using a signature key managed by a tamper-resistant device,
The terminal device includes a means for generating a key pair of a private key and a public key or a means for installing an externally generated key pair, and a means for generating signature data to be subjected to an electronic signature using the private key as an encryption key. having means for encrypting to form a cryptographic token;
The tamper-resistant device includes a means for generating a signature key, a means for storing the generated signature key in the tamper-resistant device , a means for decrypting a cryptographic token containing encrypted data to be signed using a decryption key, and a means for decrypting a cryptographic token containing encrypted signature data using a decryption key. a verification means for verifying the validity of the signature request using the signature data to be signed and the signature data to be signed, and a signature key stored in the tamper-resistant device based on the verification result by the verification means. has a signature means for electronically signing data to be signed,
The private key of the key pair is stored in a terminal device, the public key of the key pair is transmitted to a tamper-resistant device, and is stored in the tamper-resistant device in association with the user's signature key;
The private key stored in the terminal device functions as an encryption key to encrypt the data to be signed , and the public key stored in the tamper-resistant device in association with the signature key functions as a decryption key to decrypt the encryption token. ,
When signing an electronic signature, the terminal device generates a cryptographic token by encrypting the data to be signed using the private key,
A signature request including data to be signed, a cryptographic token including the encrypted data to be signed , and signature key identification information is generated and transmitted to the tamper-resistant device;
The tamper-resistant device decrypts the cryptographic token using a public key stored in association with the signature key, verifies the match between the decrypted signature data and the signature data to be signed, and performs verification. It is characterized by an electronic signature based on the result.

FIG. 1 is a diagram showing the overall configuration of an electronic signature system according to the present invention. Terminal devices 2-1 to 2-n are connected to the network 1. These terminal devices are devices used by users or signers, and are, for example, personal computers or smart phones. Here, the user includes not only a signer who digitally signs an electronic document, but also a person who uploads an electronic document to the editing server and a person who downloads the electronic document from an external server to the editing server. Therefore, the terminal device in this example includes not only a terminal device used by a signer but also a terminal device used to upload an electronic document to be signed to an editing server.

Next, an algorithm for generating a signed electronic document will be explained. FIG. 2 is a flowchart showing the setup process, and FIG. 3 is a flowchart showing the signature process. In the present invention, a public key cryptosystem is coupled to a remote signature system, and a signature key is controlled using the result of person authentication by the public key cryptosystem . As a result, the validity of the subject and the validity of the signature target can be determined by performing the verification process once, and the authentication process can be simplified.

If the user authentication is successful, the user transmits a signature key generation request to the key management server 4 from the terminal device. The key management server 4 instructs the tamper-resistant device 5 to generate a signature key. The tamper-resistant device generates a key pair of a private key and a public key that serve as a signature key in response to the signature key generation request. The generated private key becomes a signature key, is stored in a tamper-resistant device, and is used for electronic signatures. Additionally, the public key is used as signature key identification information. The tamper-resistant device sends a signature key generation notification containing the generated public key to the key management server, and the key management server sends the signature key generation notification to the terminal device. The terminal device stores the received public key as signature key identification information.

A signature key generation request sent from the terminal device and a signature request sent from the editing server or the terminal device are supplied to the tamper-resistant device control section 34, and an instruction corresponding to the specified process is sent to the tamper-resistant device. Various information such as an electronic signature generated by the tamper-resistant device is sent to a terminal device, an editing server, etc. via a tamper-resistant device control unit. Note that the key management server and the tamper-resistant device can be connected via an internal bus or an external bus. Alternatively, it is also possible to connect via LAN.

A remote signature system according to the present invention includes a signature system that includes one or more tamper-resistant devices that have the function of generating and managing signature keys, and a key management server that controls the tamper-resistant devices, and a user or signer. A remote signature system that electronically signs data to be signed generated from an electronic document using a signature key managed by a tamper-resistant device,
The terminal device includes a means for generating a key pair of a private key and a public key or a means for installing an externally generated key pair, and a means for generating a cryptographic token by encrypting data to be signed using the private key as an encryption key. having means for forming;
The tamper-resistant device includes means for generating a signature key, means for storing the generated signature key in the tamper-resistant device , means for decrypting a cryptographic token containing encrypted data to be signed using the public key , and decryption. a verification means for verifying the validity of the signature request using the signed data to be signed; and based on the verification result by the verification means, electronically signing the data to be signed using a signature key stored in the tamper-resistant device. has a signature means;
The private key of the key pair is stored in a terminal device, the public key is transmitted to a tamper-resistant device and stored in the tamper-resistant device in association with the user's signature key,
The private key stored in the terminal device functions as an encryption key to encrypt the data to be signed , and the public key stored in the tamper-resistant device in association with the signature key functions as a decryption key to decrypt the encryption token. ,
The signature key, the public key, and signature key identification information for identifying the signature key are stored in a tamper-resistant device for each user as a pair,
When applying an electronic signature, the terminal device encrypts the data to be signed using the private key to generate a cryptographic token, and generates a signature request including the data to be signed, the cryptographic token, and signature key identification information. and sent to a tamper-resistant device.
The tamper-resistant device decrypts the cryptographic token using a public key stored in association with the signature key identified by the signature key identification information included in the signature request , and signs the decrypted signature target data. It is characterized by verifying the consistency with the data to be signed and applying an electronic signature based on the verification result.

The tamper-resistant device uses the search information to search for the decryption key. Since the decryption key is stored in association with the signature key, it is possible to search for the decryption key using, for example, signature key identification information or search information equivalent thereto. The cryptographic token is decrypted using the retrieved decryption key and a decrypted message is generated. At this point, the tamper-resistant device has two signature target data: the signature target data to be signed and the signature target data which is the decrypted message. In the present invention, the consistency of the two signature target data is verified, with one of the signature target data set as verification reference data and the other signature target data set as data to be verified.

FIG. 1 is a diagram showing the overall configuration of an electronic signature system according to the present invention. Terminal devices 2-1 to 2-n are connected to the network 1. These terminal devices are devices used by users or signers, and are, for example, personal computers or smart phones. Here, the user includes not only a signer who digitally signs an electronic document, but also a person who uploads an electronic document to the editing server and a person who downloads the electronic document from an external server to the editing server. Therefore, the terminal device in this example includes not only a terminal device used by a signer but also a terminal device used to upload an electronic document to be signed to an editing server.

Next, an algorithm for generating a signed electronic document will be explained. FIG. 3 is a flowchart showing the setup process, and FIG. 4 is a flowchart showing the signature process. In the present invention, a public key cryptosystem is coupled to a remote signature system, and a signature key is controlled using the result of person authentication by the public key cryptosystem . As a result, the validity of the subject and the validity of the signature target can be determined by performing the verification process once, and the authentication process can be simplified.

If the user authentication is successful, the user transmits a signature key generation request to the key management server 4 from the terminal device. The key management server 4 instructs the tamper-resistant device 5 to generate a signature key. The tamper-resistant device generates a key pair of a private key and a public key that serve as a signature key in response to the signature key generation request. The generated private key becomes a signature key, is stored in a tamper-resistant device, and is used for electronic signatures. Additionally, the public key is used as signature key identification information. The tamper-resistant device sends a signature key generation notification containing the generated public key to the key management server, and the key management server sends the signature key generation notification to the terminal device. The terminal device stores the received public key as signature key identification information.

The generated data to be signed is supplied to the cryptographic token generation section 23 and the signature request generation section 24. The cryptographic token generation unit 23 generates a cryptographic token by encrypting the data to be signed using the cryptographic key. The generated cryptographic token is supplied to the signature request generation section. The signature request generation unit generates a signature request including data to be signed, a cryptographic token, and signature key identification information. The generated signature request is sent to the tamper-resistant device via the communication means 10.

When the public key of the key pair for identity verification is received, the received public key is sent to the storage unit 34. The storage unit stores the key pair forming the signature key and the received public key in association with each other to form signature key data. This signature key data includes a signature key (private key), signature key identification information (public key), and decryption key (public key of a key pair for personal authentication). This signature key data is stored in a signature key data storage section 35 provided in the storage section 32 for each signer or user.

A signature key generation request sent from the terminal device and a signature request sent from the editing server or the terminal device are supplied to the tamper-resistant device control section 34, and an instruction corresponding to the specified process is sent to the tamper-resistant device. Various information such as an electronic signature generated by the tamper-resistant device is sent to a terminal device, an editing server, etc. via a tamper-resistant device control unit. Note that the key management server and the tamper-resistant device can be connected via an internal bus or an external bus. Alternatively, it is also possible to connect via LAN.

The present invention is not limited to the embodiments described above, and various modifications and changes are possible. For example, in the embodiments described above, an electronic signature system including a signature system, an editing server, a certificate issuing server, and a terminal device was described, but it is also possible to use an independent electronic document management server that has the function of managing electronic documents. can. That is, an electronic document uploaded from a terminal device can be input to an electronic document management server and managed by the electronic document management server. Then, the upload information is transferred from the electronic document management server to the editing server, and processing such as generation of signature target data and signature request generation can be performed in the editing server.

A remote signature system according to the present invention includes a signature system that includes one or more tamper-resistant devices that have the function of generating and managing signature keys, and a key management server that controls the tamper-resistant devices, and a user or signer. A remote signature system that electronically signs data to be signed generated from an electronic document using a signature key managed by a tamper-resistant device,
The terminal device includes a means for generating a key pair of a private key and a public key or a means for installing an externally generated key pair, and a means for generating a cryptographic token by encrypting data to be signed using the private key as an encryption key. having means for forming;
The tamper-resistant device includes means for generating a signature key, means for storing the generated signature key in the tamper-resistant device, and means for decrypting a cryptographic token containing encrypted data to be signed using the public key. a verification means for verifying the validity of the signature request using the decrypted data to be signed; and based on the verification result by the verification means, electronically signing the data to be signed using a signature key stored in the tamper-resistant device; have a signature means to
The private key of the key pair is stored in a terminal device, the public key of the key pair is transmitted to a tamper-resistant device, and is stored in the tamper-resistant device in association with the user's signature key;
The private key stored in the terminal device functions as an encryption key to encrypt the data to be signed, and the public key stored in the tamper-resistant device in association with the signature key functions as a decryption key to decrypt the encryption token. ,
The signature key, the public key, and signature key identification information for identifying the signature key are stored in a tamper-resistant device for each user as a pair,
When signing an electronic signature, the terminal device encrypts the data to be signed using the private key to generate a cryptographic token;
A signature request including data to be signed, a cryptographic token including the encrypted data to be signed, and signature key identification information is generated and transmitted to the tamper-resistant device;
The tamper-resistant device decrypts the cryptographic token using a public key stored in association with the signature key identified by the signature key identification information included in the signature request, and signs the decrypted signature target data. If the decrypted signature data and the signature data to be signed do not match, the signature request is excluded from the electronic signature, and if they match, it is tamper-resistant. The apparatus is characterized in that it digitally signs data to be signed using a signature key .

Claims (11)

A signature system that includes one or more tamper-resistant devices that have the function of generating and managing signature keys, a key management server that controls the tamper-resistant devices, and a terminal device used by a user or signer. A remote signature system that electronically signs data to be signed generated from an electronic document using a signature key that is equipped and managed by a tamper-resistant device,
The terminal device includes a means for generating a key pair of a private key and a public key or a means for installing an externally generated key pair, and a means for generating a cryptographic token by encrypting a message using the private key as an encryption key. have the means to
The tamper-resistant device includes means for generating a signature key, means for storing the generated signature key, means for decrypting a cryptographic token containing an encrypted message using a decryption key, and a means for decrypting a cryptographic token containing an encrypted message using a decryption key. a verification means for verifying the validity of the signature request using the data to be signed, and a signature means for electronically signing the data to be signed using a signature key based on the verification result by the verification means;
The private key of the key pair is stored as an encryption key in a terminal device, the public key is transmitted to a tamper-resistant device and stored in association with the user's signature key,
a public key associated with the signing key functions as a decryption key to decrypt the cryptographic token;
Data to be signed is used as the message,
When applying an electronic signature, the terminal device encrypts the data to be signed using the encryption key to generate a cryptographic token, and generates a signature request including the data to be signed, the cryptographic token, and signature key identification information. and sent to a tamper-resistant device.
The tamper-resistant device searches for a decryption key for decrypting the cryptographic token included in the signature request, decrypts the cryptographic token included in the signature request using the searched decryption key, and decodes the decrypted signature target data and the signed data. A remote signature system is characterized in that it verifies consistency with data to be signed and performs an electronic signature based on the verification result. 2. The remote signature system according to claim 1, wherein, based on the verification result, a signature request that lacks eligibility as a signer and a signature request that lacks validity as a signature target are excluded from being subject to an electronic signature. remote signing system. In the remote signature system according to claim 1 or 2, when it is confirmed that the decrypted data to be signed and the data to be signed are consistent, the tamper-resistant device uses the signature key to mark the data to be signed. A remote signature system that is characterized by electronically signing data. 4. The remote signature system according to claim 1, 2 or 3, in which the terminal device generates a cryptographic token by performing a signature operation on the data to be signed using the cryptographic key, and The device performs a signature operation on the cryptographic token included in the signature request using the decryption key to generate a signature value, and verifies the consistency between the generated signature value and the data to be signed included in the signature request. A remote signature system characterized by: The remote signature system according to any one of claims 1 to 4, wherein the decryption key is searched using signature key identification information that identifies the signature key or identification information equivalent to the signature identification information. Features a remote signature system. 6. The remote signature system according to claim 1, wherein the terminal device includes means for generating signature target data from an electronic document to be signed, and encrypts the generated signature target data. Generate a cryptographic token,
A remote signature system characterized in that the terminal device generates a signature request including data to be signed, a cryptographic token, and signature key identification information and sends it to a tamper-resistant device. The remote signature system according to any one of claims 1 to 5, further comprising an editing server that manages an electronic document to be signed, and a certificate that generates an electronic certificate for signing. A remote signature system comprising: a document issuing server. 8. The remote signature system according to claim 7, wherein the editing server includes means for generating data to be signed from an electronic document, and the editing server generates data to be signed from the electronic document and transmits it to a terminal device. encrypts the received data to be signed, generates a cryptographic token, and sends it to the editing server, and the editing server generates a signature request containing the received cryptographic token, data to be signed, and signature key identification information, and makes it tamper-resistant. A remote signature system characterized by sending to the device. A signature system that includes a tamper-resistant device that generates and manages signature keys, a key management server that has the function of controlling the tamper-resistant device, and a terminal device used by the user or signer, and is managed by the tamper-resistant device. A remote signature method for electronically signing data to be signed generated from an electronic document using a signature key, the remote signature method comprising:
The tamper-resistant device generates a signature key in response to a request from a user,
The terminal device generates a key pair of a private key and a public key, the generated private key is stored in the terminal device, and the public key is sent to a tamper-resistant device and stored in association with the user's signature key,
When applying an electronic signature, the terminal device generates a cryptographic token by encrypting the data to be signed using the private key as an encryption key, and generates a signature including the data to be signed, the cryptographic token, and the signature key identification information. A request is generated and sent to the tamper-resistant device;
The tamper-resistant device searches for a public key related to the user's signature key, uses the searched public key as a decryption key to decrypt the cryptographic token included in the signature request, and decrypts the decrypted data to be signed and the signature request. Verify the consistency with the data to be signed included in the
A remote signature method characterized in that, through the verification, a signature request that lacks qualification as a signer and a signature request that lacks validity as a signature target are excluded from being subject to an electronic signature. 10. The remote signature method according to claim 9, in the electronic signature, the terminal device generates a cryptographic token by performing a signature operation on data to be signed using a cryptographic key; A signature operation is performed on a cryptographic token included in a signature request using a key to generate a signature value, and consistency between the generated signature value and data to be signed included in the signature request is verified. electronic signature method. 11. The electronic signature method according to claim 9, wherein the terminal device generates signature target data from an electronic document to be signed, encrypts the generated signature target data to generate a cryptographic token, and generates a cryptographic token from the signature target data. An electronic signature method, comprising: generating a signature request including a cryptographic token, and signature key identification information, and transmitting the generated signature request to a tamper-resistant device.

Images