JP4774748B2 - Document registration system - Google Patents

Description

  The present invention relates to an apparatus and a system for registering an electronic document with a document server.

  There are many documents that are required to be kept for a certain period of time by law (hereinafter referred to as “retention obligation documents”). Some of these documents have been conventionally permitted to be created and stored as electronic documents by a computer or the like, but those that have been conventionally required to be stored in paper documents by the so-called e-document law are also electronic. The flow is allowed to be preserved.

  When electronically storing an obligatory document, it is necessary to take measures to prevent tampering and other fraud. Conventionally, digital signatures are generally used for such problems. Also, when a paper document is read and stored electronically, the digital image of the person who performed the read and save operation on the scanned image is used to ensure that the correct paper document is read and that there are no frauds in reading. A signature is also made.

  When considering the case of reading and digitizing and storing paper documents such as digital multi-function peripherals, this type of device is generally commonly used by multiple users. Therefore, digital signatures of individual users are attached to digitized documents. In order to apply, for example, a user often carries a token such as an IC card holding his private key (and public key certificate if necessary) and performs a digital signature using the token. However, such a mechanism is complicated because the user must always carry a token.

  In addition, if each individual has a token, the cost required for issuing the token and public key certificate becomes large.

  On the other hand, Patent Document 1 has a mechanism for storing personal identification information and a private key in association with each other on the server side, and generating a digital signature using the authenticated user's private key in response to a request from the client. It is disclosed. In this mechanism, in order to realize an organization signature similar to “company seal” etc. in the digital signature framework, a private key unique to the organization is associated with the user ID of each person belonging to the organization in the certificate information database. When the key management server registers and receives a signature request from a person in the organization, the digital signature is performed using a private key corresponding to the user ID of the person in the certificate information database. Although this mechanism has an advantage that it is not necessary to prepare a token, since it is necessary to manage the secret key for each organization in the key management server, the management becomes complicated as the number of organizations increases.

  In addition, there are many documents that require storage for a relatively long period of time, such as 7 years for receipts, 5 years for orders, and 10 years for commercial books. The expiration date of the key certificate is generally about 1 to 2 years. Therefore, it is highly possible that the certificate will expire during the document retention period. In such a case, it is difficult to verify the signature after the expiration date. If you want to avoid this, save each person's public key certificate that will be updated over time and build a system to provide it as needed, or give each person a public key certificate with a long validity period ( And a secret key) need to be taken. The former has a problem that it costs money to construct a system and store public key certificates of a large number of users. In the latter case, public keys and secret keys with a long validity period generally have longer key lengths to ensure resistance to attacks. Problems such as forcing you to wait for a long time may occur. In addition, there is a problem that a public key certificate having a long validity period has a high fee for receiving a certificate from a certificate authority.

JP 2002-247031 A

  The present invention provides a mechanism for realizing a digital signature for a document having a long retention obligation period at a low cost.

The document registration system according to the present invention includes a document registration apparatus and a time stamp server, and the time stamp server registers from the document registration apparatus and storage means for storing information on the retention period of the electronic document for each document content type. When the time stamp request including the digest value of the target electronic document, the document content type information, and the user identification information is received, the storage duty period corresponding to the document content type information included in the time stamp request is read from the storage unit. And generating proof content information including the digest value included in the time stamp request, user identification information, and time information indicating the current time, and the time stamp server itself for the generated proof content information. Among the multiple private keys with different expiration dates, the period from the current time to the expiration date is longer than the required retention period That by using a private key to generate the time stamp data by performing a digital signature, a time stamp providing means for providing the generated time stamp data into the document registration apparatus comprising a document registration apparatus, a predetermined authentication server Authentication request means for requesting user authentication by passing authentication data including user identification information, and when the user authentication by the authentication server is successful, the digest value of the electronic document to be registered, the document content type information, and the user's It sends a time stamp request including the identification information to the timestamp server, a time stamp obtaining means get the timestamp data provided from the time stamp server in response to the time stamp request, received from the time stamp server Associating the time stamp data with the electronic document to be registered, Comprising registration means for registering a server, a.

Further, in this apparatus, the certification content information generated by the time stamp providing means may further include the obtained retention obligation period .

In this system , the time stamp acquisition means generates a ticket request including the digest value of the electronic document to be registered and transmits it to the authentication server to acquire a ticket for receiving a time stamp service from the time stamp server. In response to this request, a ticket including the digest value encrypted with the key unique to the time stamp server is acquired from the authentication server, and the time stamp is sent to the time stamp server together with the time stamp request. Time stamp data may be acquired from the server.

Further, the document registration apparatus further includes a signature verification unit that verifies the validity of the digital signature of the time stamp data acquired by the time stamp acquisition unit, and the registration unit only when the validity is verified by the signature verification unit The electronic document and time stamp data may be associated with each other and registered in the document server.

A time stamp server according to the present invention is a time stamp server that generates time stamp data in response to a time stamp request from a document registration apparatus and provides the time stamp data to the document registration apparatus. A storage unit for storing period information, and a request receiving unit for receiving a time stamp request including a digest value of an electronic document to be registered, information on a document content type, and identification information of a user who performed a registration operation from a document registration apparatus A storage duty period corresponding to the document content type information included in the received time stamp request from the storage means, the digest value of the electronic document to be registered extracted from the time stamp request, the user identification information, Generate proof content information including time information indicating the current time, and for the generated proof content information, Time stamp data is generated by applying a digital signature using a private key whose duration from the current time to the expiration date is equal to or longer than the required storage period, among the multiple secret keys with different expiration dates that the Imstamp Server itself has. Signing means for providing the document registration apparatus with time stamp data generated by the signing means .

  The best mode for carrying out the present invention (hereinafter referred to as “embodiment”) will be described below with reference to the drawings.

  FIG. 1 is a diagram showing a schematic configuration of a document registration system according to the present invention. The system in Fig. 1 is for digitizing and storing commercial obligations, voucher documents (such as purchase orders, receipts), etc., which are required to be stored for a certain period of time under commercial law, tax law and other laws. A digital multifunction peripheral 10, a document server 20, an authentication server 30, and a time stamp server 30 connected to each other by a data communication network (not shown) such as a local area network or the Internet.

  The digital multifunction peripheral 10 is a device having functions such as a copier, a network printer, and a network scanner. In this system, the digital multifunction peripheral 10 is used to read a paper document and digitize it. The digital multifunction machine 10 includes an operation unit for receiving user input. The operation unit includes, for example, a touch panel for information display and user input, a numeric keypad for numeric input, a start button for instructing processing execution, and the like.

  The document server 20 is a server that stores a document digitized by the digital multifunction peripheral 10.

  The authentication server 30 performs an authentication process for a user who intends to use the system, and issues a ticket for access to each server belonging to the system in response to a request from a legitimate user. As such an authentication server 30, for example, a KDC (Key Distribution Center) server of a Kerberos (trademark) authentication system, which is a network authentication system, is known. In the example shown below, a KDC server is used as the authentication server 30. That is, in the present embodiment, the Kerberos (trademark) authentication method is used as an authentication framework. However, this is only an example, and any authentication server / authentication method that can realize the same function may be used.

  The time stamp server 40 is a server that performs time authentication on target data presented by the user. In the time authentication, digital data using the secret key of the time stamp server 40 is applied to certification content data including a digest value of target data (for example, a hash value obtained by applying a hash function), a user ID, and a time signal. This is done by signing. The certificate content information with the digital signature is provided to the request source as time stamp data.

  Next, with reference to FIG. 2, the procedure of the document registration work in this embodiment will be described. FIG. 2 shows a time series in which processing proceeds in order from top to bottom.

  In this procedure, first, the user takes a document such as a voucher document to be registered in the document server 20 to the digital multifunction peripheral 10, and a menu for calling a screen for inputting authentication information from the operation unit of the digital multifunction peripheral 10. Using the numeric keypad or the software keyboard on the screen for the input screen that is selected and displayed on the display (for example, touch panel) of the operation unit accordingly, the user ID that is the identification information of the user, the authentication information, Is input (S100). The user ID is a Kerberos name in the case of the Kerberos authentication method. The authentication information is generally a password (PWD) in the case of Kerberos authentication, but other information such as biometric identification information (for example, a fingerprint or a retina pattern) can also be used. Passwords can be entered from the numeric keypad or touch panel. In order to read the biometric identification information, a reading device for that purpose may be provided in the operation unit. For users who can use this system, account information including a user ID and authentication information is registered in advance in the authentication server 30 by a secure method. The user ID and authentication information input in step S100 are sent to the authentication server 30 via the network.

  The authentication server 30 performs user authentication using the received user ID and authentication information (S300). When the authentication is not successful (that is, when it is determined that the pair of the user ID and the authentication information is not valid), an error message indicating that the authentication has failed is returned to the digital multi-function peripheral 10 and the process ends ( (Not shown). If the authentication is successful, the authentication server 30 generates an initial ticket (also referred to as a TGT: Ticket-Granting Ticket) in Kerberos authentication and transmits it to the digital multi-function peripheral 10 (S302). The ticket issued by the authentication server 30 including the initial ticket includes the user ID information of the ticket issue destination.

  In the case of the Kerberos authentication method, data exchanged between nodes (devices such as the digital multi-function peripheral 10 and the authentication server 30) is encrypted with a destination key or a session key, which is well known. The explanation is omitted.

  Upon receiving the initial ticket, the digital multi-function peripheral 10 displays a scan operation menu on the display of the operation unit. In response to this, when a user sets a paper document to be registered in the document server 20 on the platen or automatic document feeder (ADF) of the digital multifunction peripheral 10 and presses the start button, the paper is scanned by the scanning mechanism of the digital multifunction peripheral 10. The document is read (S102). The scanned image data of the paper document generated by this scanning process is held and managed by the control program of the digital multi-function peripheral 10. The control program calculates a digest value by applying a message digest function to the scanned image data (S104), generates ticket request data for requesting issuance of a service ticket for using the time stamp server 40, This ticket request data is transmitted to the authentication server 30 together with the initial ticket (S106). The ticket request data includes information indicating a service to be used (in this case, the time stamp server 40). Note that the digest value calculation in step S104 may be performed after S106.

  Upon receiving the ticket request data and the initial ticket, the authentication server 30 extracts the session key from the initial ticket, and decrypts the ticket request data with this key, so that the request obtains a ticket for accessing the time stamp server 40. Recognize what you want. In response to this, the authentication server 30 generates a service ticket for accessing the time stamp server 40 and transmits it to the digital multifunction peripheral 10 (S304).

  Upon receiving the service ticket, the digital multifunction peripheral 10 generates time stamp request data (S108), and transmits it to the time stamp server 40 together with the service ticket. The time stamp request data includes the digest value of the scanned image data calculated in S104.

  Upon receiving the time stamp request data and the service ticket, the time stamp server 40 determines whether the data is valid according to the Kerberos authentication method, and issues the time stamp data if it is valid (S400). In this time stamp data issuance processing, first, the time stamp server 40 extracts the session key from the service ticket and decrypts the time stamp request data with this key to obtain the digest value of the scan image data to be time stamped. To do. Then, as shown in FIG. 3, this digest value, the user ID of the user who requested the time stamp addition (this can be obtained from the service ticket or the time stamp request data), and time information indicating the time at that time (For example, including date, month, day, hour, minute, and second information) is generated, and the time stamp server 40 digitally signs the certificate content information. The digital signature is performed by, for example, obtaining a signature value 54 by encrypting the digest value of the certification content information with the private key of the time stamp server 40 itself, and adding the signature value 54 to the certification content information 52. . The certification content information 52 with the signature value 54 obtained in this way becomes the time stamp data 50 and is transmitted to the requesting digital multi-function peripheral 10. The time stamp server 40 may encrypt the time stamp data 50 using a session key and then transmit the encrypted data to the digital multi-function peripheral 10. In this case, since the digital multi-function peripheral 10 has the session key used when making the time stamp request, the encrypted time stamp data 50 can be decrypted.

  As shown in FIG. 4, the digital multi-function peripheral 10 adds the time stamp data 50 received from the time stamp server 40 to the stored scan image data 60, and the scan image data 60 with the time stamp data 50 is added to the document. It transmits to the server 20 and requests registration (S110). At this time, if the digital multi-function peripheral 10 verifies the validity of the received time stamp data 50, the security is further improved. This verification is performed by verifying the digital signature of the time stamp data 50 using the public key in the public key certificate of the time stamp server 40 (which can be obtained because it is public). Just do it.

  Upon receiving this request, the document server 20 registers the scanned image data 60 with the time stamp data 50 received from the digital multifunction peripheral 10 in the document database managed by the document server 20 (S200).

  In the above example, authentication is not performed when the scanned image data 60 with the time stamp data 50 is registered in the document server 20. Instead, the digital multi-function peripheral 10 also receives a document from the authentication server 30 at this time. A service ticket for accessing the server 20 may be acquired, and the service ticket and the scanned image data 60 with the time stamp data 50 may be passed to the document server 20 to request registration.

  As described above, in this system, when the electronic data of the document read by the digital multi-function peripheral 10 (that is, the scanned image data 60) is stored in the document server 20, the time stamp to which the digital signature of the time stamp server 40 is applied. Data 50 is added. The time stamp data 50 includes the ID of the user who registered the document, the time of registration, and the digest value of the electronic data, and the digital signature of the time stamp server 40 is added thereto. By examining the time stamp data 50, it is possible to determine which user is a registered document and when the user ID, registration time, and document data contents have been tampered with.

  Further, in this system, since the digital signature for the read document data is performed by the specific time stamp server 40, the digital signature key is compared with the conventional method for applying the digital signature of the user who performed the registration operation. Easy to manage. In other words, in the case of the conventional method, each user has to carry a token holding his / her private key or store the private key of each user in the key management server. It is only necessary for the stamp server 40 to store its private key.

  Further, as described as a problem of the prior art, since the signature verification becomes difficult if the expiration date of the public key certificate expires during the retention obligation period of the target document, it is applied to the document registered in the document server 20. The digital signature is preferably valid during the retention period of the document, that is, the public key certificate corresponding to the signature is valid at least during the retention period. Thus, this system is also effective as a mechanism for performing a digital signature with an appropriate expiration date. That is, in the case of the conventional method for applying digital signatures of individual users, it is necessary to receive a high-cost public key certificate with a long expiration date for each user. Since only the server 40 needs to be issued, it is advantageous in terms of cost.

  Further, in this system, since the digital signature for the document to be registered is performed by the time stamp server 40 that generally has a higher calculation capability than the digital multifunction peripheral 10, the possibility of waiting the user for the signature can be reduced.

  In this system, since it is necessary to acquire a service ticket from the authentication server 30 in order to access the time stamp server 40, the authentication server 30 can centrally manage time stamp issuance. In other words, when electronically storing paper preservation obligation documents, from the viewpoint of falsification prevention, etc., the person who performs the digitization work should be limited to a specific person in the organization, and the responsibility of that person should be clearly defined There are many. When such a document digitization / registration operation is permitted only by a specific person (or a plurality of persons), the specific person is registered in the authentication server 30 as a person having a time stamp request authority. Then, the authentication server 30 does not issue a service ticket even if a request for a service ticket for a time stamp comes from a person who does not have the time stamp request authority. Thereby, the use of the time stamp service can be limited to authorized persons.

  In addition, the retention obligation period differs depending on the type of the storage obligation document. In this system, a digital signature (time stamp) having an appropriate validity period according to the content type is attached to the document. You can also Such a modification will be described below.

  That is, in this modification, the time stamp server 40 has a validity period of 5 years or more when registering an order form among a plurality of private keys with different validity periods held by the time stamp server 40, a commercial book. In this case, a digital signature is made by using a secret key having a valid period remaining to cover the storage obligation period, such as using a secret key having a valid period of 10 years or more. The processing flow in this case is as shown in FIG. In FIG. 5, steps having the same processing contents as the steps shown in FIG.

  In the procedure of FIG. 5, the digital multi-function peripheral 10 determines the content type of the scanned paper document (S107). For example, a code representing the content type is printed at a specific location in a paper document, and the digital multifunction peripheral 10 recognizes the code from the scanned image data, thereby recognizing the content type of the document. That's fine. Further, a character string representing a document content type such as “receipt” or “order form” may be extracted from the scanned image data, and the document content type may be determined by performing character recognition. In addition, when such an automatic determination is attempted and fails, it is preferable that the user specify a document content type from the operation unit. Of course, the user can always input the type of the read document without performing automatic determination, and the digital multifunction peripheral 10 can determine the content type of the document from this input. This step S107 may be executed any time before the generation of the time stamp request data (S108). When the document content type is known, the digital multi-function peripheral 10 generates time stamp request data including the digest value of the scanned image data and information of the document content type, and transmits this to the time stamp server 40 together with the service ticket. (S108). As shown in FIG. 6, the time stamp server 40 has a table 70 indicating the retention period for each document content type, acquires information on the document content type from the time stamp request data, and the document content type. Is stored from the table 70, a secret key having a remaining effective period that covers from the current time until the storage obligation period elapses is selected, and a digital signature is applied to the certification content information using this secret key. Thus, time stamp data is created (S400).

  Since the remaining validity period of the public key certificate is shortened with the passage of the month and day, the time stamp server 40 can cover the document content type with the longest storage obligation period so that it can be covered. Receive a new public key certificate if necessary. To be able to support the 10-year preservation period of commercial books, for example, if you receive a public key certificate with a validity period (the period from the issuance date to the expiration date) of 12 years, every two years Good. Note that a private key with a validity period of 12 years cannot be used for signing a commercial book after two years from the date of issue, but it can still be used for signing documents such as purchase orders that have a shorter storage obligation.

  In the above example, the document content type information is passed from the digital multi-function peripheral 10 to the time stamp server 40, and the time stamp server 40 obtains the storage duty period corresponding to the document content type from the table 70. Absent. Instead, the digital multi-function peripheral 10 has a table 70, the digital multi-function peripheral 10 obtains a retention duty period corresponding to the document content type, and the information on the retention duty period is time stamped instead of the document content type information. You may make it pass to the server 40. FIG. In this case, the time stamp server 40 may select a secret key having a remaining effective period that covers the received retention period and perform a digital signature.

  In this modified example, since the time stamp server 40 can know the retention period of the target document, as shown in FIG. 7, the certificate content information 52 including the retention period information 56 is digitally displayed. The time stamp data 50 can also be generated by applying a signature. In this case, since the information on the retention period is also guaranteed by the time stamp server 40 and cannot be tampered with, security is improved.

  Next, another modification will be described. In this modification, the digital multi-function peripheral 10 incorporates the digest value of the scanned image data obtained by reading the paper document into the ticket request data generated in step S106 in the processing procedure shown in FIG. 2 or FIG. The ticket request data is encrypted with the session key received together with the initial ticket or a unique key (for example, public key) of the authentication server 30. The authentication server 30 receives the ticket request data and obtains a digest value. In step S304, the authentication server 30 generates a service ticket including the digest value. This service ticket is encrypted with a unique key of the target service, in this case, the time stamp server 40. In step S108, the digital multi-function peripheral 10 that has received the service ticket generates time stamp request data that does not include the digest value, and passes it to the time stamp server 40 together with the service ticket. The time stamp server 40 obtains the digest value of the document (scanned image data) from the service ticket, not the time stamp request data, and generates proof content information 52 (see FIG. 3), and applies a digital signature thereto. (S400).

  As described above, in this modification, the digest value can be put into the service ticket encrypted with the key of the time stamp server 40 and sent to the time stamp server 40, so that the risk of falsification of the digest value is reduced. be able to.

  In the above-described embodiment and its modifications, a case where a paper document is read by the scanner function of the digital multifunction peripheral 10 and registered in the document server 20 is taken as an example, but created by an application installed in a personal computer or the like. The same mechanism as described above can be applied to the electronic document.

It is a figure which shows schematic structure of the document registration system which concerns on this invention. It is a flowchart which shows the procedure of the document registration process in a document registration system. It is a figure which shows the example of the time stamp data which a time stamp server issues. It is a figure which shows the example of the document data (scan image data) with a time stamp registered into a document server. It is a flowchart which shows the procedure of the document registration process in the system of a modification. It is a figure which shows the example of the table which registered the preservation | save obligation period for every document content classification. It is a figure which shows the example of the time stamp data containing the information of a preservation duty period.

Explanation of symbols

  10 digital MFP, 20 document server, 30 authentication server, 40 time stamp server.

Claims (7)

Including a document registration device and a time stamp server,
The time stamp server
Storage means for storing information on an electronic document retention obligation period for each document content type;
When a time stamp request including the digest value of the electronic document to be registered, the document content type information, and the user identification information is received from the document registration device, the storage obligation corresponding to the document content type information included in the time stamp request is received. A period is obtained from the storage means, and proof content information including a digest value included in the time stamp request, user identification information, and time information indicating the current time is generated, and the generated proof content information The time stamp data can be obtained by applying a digital signature using a secret key whose duration from the current time to the expiration date is equal to or greater than the required storage period, among the multiple secret keys with different expiration dates that the timestamp server itself has. A time stamp providing means for generating and providing the generated time stamp data to the document registration device;
With
The document registration device
Authentication request means for requesting user authentication by passing authentication data including user identification information to a predetermined authentication server;
If the user authentication by the authentication server is successful, it transmits a time stamp request including the identification information of the digest value and the document content type of the information and the user of the electronic document to be registered in the timestamp server, the time stamp request a time stamp obtaining means get the timestamp data provided from the time stamp server in response to,
Registration means for registering time stamp data received from a time stamp server in a predetermined document server in association with an electronic document to be registered;
Equipped with a,
A document registration system characterized by that . 2. The document registration system according to claim 1 , wherein the proof content information generated by the time stamp providing means further includes the required retention period . The time stamp acquisition means generates a ticket request including the digest value of the electronic document to be registered in order to acquire a ticket for receiving the time stamp service from the time stamp server, and transmits the ticket request to the authentication server. The time stamp data is obtained from the time stamp server by acquiring a ticket including the digest value encrypted with the key unique to the time stamp server from the authentication server and sending the ticket to the time stamp server together with the time stamp request. The document registration system according to claim 1, wherein the document registration system is acquired. The document registration device
A signature verification unit for verifying the validity of the digital signature of the time stamp data acquired by the time stamp acquisition unit;
Only when the validity is verified by the signature verification unit, the registration unit associates the electronic document with the time stamp data and registers it in the document server.
Document registration system according to any one of claims 1 to 3, characterized in that. A time stamp server that generates time stamp data in response to a time stamp request from a document registration device and provides the data to the document registration device,
Storage means for storing information on an electronic document retention obligation period for each document content type;
A request receiving means for receiving a time stamp request including a digest value of an electronic document to be registered , information of a document content type, and identification information of a user who performed a registration operation from the document registration device;
A storage duty period corresponding to the document content type information included in the received time stamp request is obtained from the storage means, the digest value of the electronic document to be registered extracted from the time stamp request , the user identification information, and the current time Proof content information that includes the time information indicating the time period , and for the generated proof content information , the period from the current time to the expiry date among the multiple private keys with different expiry dates of the time stamp server itself Signing means for generating time stamp data by applying a digital signature using a secret key that is equal to or longer than the storage obligation period requested by ;
The provided, timestamp server that provides a time stamp data signature means has generated the document registration apparatus. 6. The time stamp server according to claim 5 , wherein the proof content information generated by the signing means further includes the obtained retention obligation period . The request receiving means receives a ticket issued by a predetermined authentication server to the document registration apparatus together with the time stamp request,
The signing means determines the validity of the ticket received together with the time stamp request, and if it is valid, extracts the digest value of the electronic document to be registered from the ticket, and generates time stamp data using the digest value.
The time stamp server according to claim 5 .

Images