JP7230287B1 - REMOTE SIGNATURE SYSTEM AND REMOTE SIGNATURE METHOD - Google Patents

Abstract

An object of the present invention is to realize an electronic signature system capable of confirming the identity of a person and confirming the validity of a signature target by executing a single verification process. A terminal device (2) has means for generating a key pair for performing public key cryptography. The generated private key is stored in the terminal device (2), and the public key is transmitted to the tamper-resistant device (5) and stored in association with the corresponding signature key. Data to be signed is used as a message to be verified. When performing the electronic signature, the terminal device generates a signature request including a cryptographic token including signature target data to be signed and encrypted signature target data, and transmits the signature request to the tamper resistant device. The tamper-resistant device (5) decrypts the cryptographic token included in the signature request, verifies the consistency between the decrypted data to be signed and the data to be signed to be signed, and confirms the signature request without subjective eligibility. and exclude signature requests that are not valid as signature targets from electronic signatures. [Selection drawing] Fig. 2

Description

The present invention relates to a remote signature system that electronically signs data to be signed using a signature key.

A remote signature system has been proposed in which a user's signature key is installed in a business operator's server, the user remotely logs into the server, and an electronic signature is made on the business operator's server using his own signature key. The remote signature system is expected to be a highly convenient signature system for users, because it enables electronic signatures to be made remotely and does not require the user to manage the signature key.

An electronic signature system that includes a key management system that manages signature keys, a certificate issuance system that issues certificates, and a terminal device that users use has been proposed as an electronic signature system of the remote signature method (for example, , see Patent Document 1). In this known electronic signature system, user authentication is performed using a combination of a user ID and password based on the user's account set in the key management system.

Also, the present applicant has proposed an electronic signature system using a remote signature method (see, for example, Patent Document 2). In this electronic signature system, a tamper-resistant device generates a key pair of a private key and a public key in response to a request from a user. The private key becomes a signature key and is stored in the tamper resistant device. The public key is sent to the terminal device and stored as an encryption key. Subsequently, the user conceives of authentication information such as a password indicating authorization to use his/her own signature key, and transmits it to the tamper-resistant device via the terminal device. The tamper-resistant device stores the received user authentication information in association with the user's signature key. The user's authentication information is stored in the user's brain and kept confidential.

When performing an electronic signature, the user enters his/her authentication information into the terminal device. The terminal device encrypts the input authentication information using a cryptographic key (public key) to generate a cryptographic token. Subsequently, a signature request is sent to the tamper-resistant device, which includes the cryptographic token, the signature target data to be signed, and the signature key identification information. The tamper-resistant device decrypts the cryptographic token using the decryption key, verifies the decrypted authentication information, and permits the electronic signature only when correct authentication information is input. As a result, a remote signature system is constructed in which only a person who is authorized to use the signature key can electronically sign.
Japanese Patent No. 6465426 JP 2021-111925 A

In an electronic signature system that performs identity verification using authentication information, only the owner of the signature key who knows the authentication information can sign, so high security can be ensured. However, since the authentication information is held in the user's brain, there is a problem that the signature system cannot be used if the user forgets the authentication information. Also, if the authentication information is composed of a simple password, there is a danger that it will be easily stolen by hackers. If the authentication information is stolen by another person, a scandal occurs in which a person who does not have the authority to use the information signs an electronic signature. On the other hand, in order to prevent theft of authentication information, it is assumed that a complicated password is used. However, in this case, it becomes easy to forget the authentication information, and there is a possibility that the signature system cannot be used.

Furthermore, in the field of remote signatures, it is strongly desired to verify whether data to be signed (corresponding to an electronic document) sent from a terminal device to a tamper-resistant device has been tampered with. In other words, if the signature target data that has been tampered with is signed, an incorrect electronic document will be signed. However, in the electronic signature system described above, verification of identity verification and verification of validity of data to be signed are performed separately. For this reason, it is necessary to execute two verification processes separately, which has the drawback of complicating the authentication process. That is, when performing verification twice, it is necessary to collect verification data for two times, which complicates the work of collecting verification data.

SUMMARY OF THE INVENTION An object of the present invention is to realize a remote signature system capable of controlling a signature key without using authentication information such as a password.
Another object of the present invention is to realize a remote signature system capable of verifying the identity of a person to be signed and verifying the validity of a signature target, that is, verifying the presence or absence of tampering by executing a single verification process.

A remote signature system according to the present invention includes a signature system having one or more tamper-resistant devices having a function of generating and managing a signature key and a key management server controlling the tamper-resistant devices, and a user or a signer A remote signature system that electronically signs signature target data generated from an electronic document using a signature key managed by a tamper-resistant device, comprising:
The terminal device comprises means for generating a key pair of a private key and a public key or means for installing an externally generated key pair, and encrypts data to be signed using the private key as a cryptographic key to generate a cryptographic token. having means for forming
The tamper-resistant device includes means for generating a signature key, means for storing the generated signature key in the tamper-resistant device, means for decrypting a cryptographic token including encrypted data to be signed using the public key, Verification means for verifying validity of a signature request using decrypted data to be signed, and electronic signature on the data to be signed using a signature key stored in a tamper-resistant device based on the verification result by the verification means has a signature means to
The private key of the key pair is stored in the terminal device, the public key of the key pair is transmitted to the tamper-resistant device, and stored in the tamper-resistant device in association with the user's signature key,
The private key stored in the terminal device functions as an encryption key for encrypting data to be signed, and the public key stored in the tamper-resistant device in association with the signature key functions as a decryption key for decrypting the encryption token. ,
The signature key, the public key, and the signature key identification information for identifying the signature key are stored in a tamper-resistant device for each user as a pair relationship,
At the time of electronic signature, the terminal device encrypts the data to be signed using the private key to generate a cryptographic token,
a signature request including signature target data to be signed, a cryptographic token including encrypted signature target data, and signature key identification information is generated and transmitted to the tamper resistant device;
The tamper-resistant device decrypts the cryptographic token using the public key stored in association with the signature key identified by the signature key identification information included in the signature request, and signs the decrypted data to be signed. If the decrypted data to be signed and the data to be signed do not match, the signature request is excluded from being subject to electronic signatures. The apparatus is characterized by electronically signing data to be signed using a signature key .

The basic idea of the present invention is to combine a remote signature system with a public key cryptosystem and control a signature key using the public key cryptosystem. That is, the public key cryptosystem is used to verify the identity of the user, and the signature key is controlled based on the result. As a result of various analyzes of the public key cryptosystem and the remote signature system by the inventor, the public key of the key pair that executes the public key cryptosystem is used as the decryption key, and this decryption key is associated with the signature key of the signer. It has been found that public key cryptography can be coupled to a remote signing system by storing, ie by binding the decryption key and the signing key.

In the present invention, the tamper-resistant device generates a signature key for each user based on a request from the user. Each user's signature key is stored in a tamper-resistant device. The terminal device generates a key pair for executing public key cryptography, and stores the generated private key in the terminal device. The generated public key is transmitted to the tamper-resistant device in which the signature key is stored, and stored in association with the user's signature key. That is, the signature key and public key are stored as a pair relationship for each user. The private key held in the terminal device functions as an encryption key for encrypting the message to be verified. A public key held in the tamper-resistant device functions as a decryption key for decrypting an encrypted message sent from the terminal device. When performing an electronic signature, the terminal device generates signature target data from a specified electronic document, and includes the generated signature target data, encrypted signature target data obtained by encrypting the signature target data, and signature key identification information. A signature request is transmitted from the terminal device to the tamper resistant device.

The characteristics of verification are the use of signature target data generated from an electronic document as a message to be verified, and the signature target data to be signed and the encrypted signature target data obtained by encrypting the signature target data. To perform verification using two pieces of data to be signed. Here, the encrypted data to be signed is encrypted using a secret key of public key cryptography to form a cryptographic token. Then, when performing the electronic signature, the terminal device generates a signature request including signature key identification information specifying a signature key and a decryption key, data to be signed, and a cryptographic token, and transmits the signature request to the tamper-resistant device.

The tamper-resistant device searches for the decryption key using the search information. Since the decryption key is stored in association with the signature key, the decryption key can be retrieved using, for example, the signature key identification information or equivalent search information. Decrypt the cryptographic token using the retrieved decryption key to generate a decrypted message. At this point, the tamper-resistant device has two signature target data, namely, the signature target data to be signed and the signature target data that is the decrypted message. In the present invention, one signature target data of two signature target data is used as verification reference data, and the other signature target data is used as verification target data to verify the consistency of the two signature target data.

First, signature target data to be signed is used as verification reference data, and signature target data, which is a decrypted message, is used as verification target data. Here, the signature target data to be signed is assumed to be authentic signature target data that has not been falsified.
If the decrypted message matches the data to be signed as a verification result, the cryptographic token is a cryptographic token that corresponds to the same data to be signed as the data to be signed and the decryption key (public key) of the tamper-resistant device. It is recognized as having been encrypted using a key (private key). Therefore, the signature request is recognized as having been made by the owner of the signature key, and the subject of the signature request is determined to be a person who has valid authority to use the signature key.

As a verification result, if the decrypted message does not match the data to be signed, the validity of the signature request subject is denied. That is, since the cryptographic token is encrypted, it cannot be tampered with during transmission. Therefore, the reason for the discrepancy is that the data to be signed was encrypted using an encryption key that is not related to the decryption key held in the tamper-resistant device, or that the data to be signed is different from the data to be signed. is assumed to have been encrypted. However, since the signature target data is formed by executing a hash operation on the electronic document in the terminal device, it is difficult to assume that the signature target data to be signed and the signature target data to be encrypted are different. . Therefore, it is recognized that the cause of the discrepancy is that the data to be signed was encrypted using an encryption key that is not related to the decryption key held in the tamper-resistant device. This cause means that the signature request was made with a terminal device that does not have a valid private key set. Therefore, such a signature request is determined as a signature request by a person who does not have the right to use the signature key. Therefore, if the decrypted message does not match the data to be signed, the signature request is determined not to satisfy the validity of the subject and is excluded from electronic signature. As will be described later, if the data to be signed has been tampered with, the decrypted message and the data to be signed do not match regardless of the authenticity of the cryptographic token, so this can be treated as an error.

Next, the decrypted message is used as reference data for verification, and the data to be signed is used as data to be verified. Encrypted data to be signed included in the cryptographic token is encrypted data obtained by encrypting regular data to be signed with a regular encryption key. Since the cryptographic token is encrypted, it cannot be tampered with during transmission. On the other hand, signature target data to be signed includes the possibility of being tampered with.

If the data to be signed matches the decrypted message, the data to be signed is deemed not to have been altered or tampered with during transmission. Therefore, it is determined that such a signature request satisfies the validity of the signature target. On the other hand, if the data to be signed does not match the decrypted message, it is determined that the data to be signed has been tampered with or changed while the signature request was transmitted from the terminal device to the tamper-resistant device. That is, since the signature target data immediately after being generated is recognized as legitimate signature target data, it is recognized that the cause of the discrepancy is due to falsification or alteration of the signature target data during transmission. In this way, when the decrypted message is used as the reference data, it is determined whether or not the signature target data included in the signature request has been tampered with by verifying the consistency of the two signature target data. Validity or authenticity is determined. If the data to be signed does not match the decrypted message, the signature request is treated as an error and excluded from electronic signature.

As mentioned above, in signature systems that use authentication information such as passwords and challenge codes to verify identity, the message decrypted by the tamper-resistant device is verified for consistency with the reference information stored in the tamper-resistant device. be done. Therefore, although identity verification was performed, it was not possible to verify the presence or absence of falsification. Therefore, there is a risk of electronically signing falsified data to be signed. In addition, it has been pointed out that it is necessary to preset reference data, which serves as a reference for authentication, in the tamper-resistant device, which complicates the setup process. On the other hand, according to the present invention, a signature request by a person who does not have the right to use the signature key is excluded from the object of electronic signature, and even if the data to be signed has been tampered with, it is also excluded from the object of electronic signature. Therefore, according to the present invention, it is possible to determine both the presence or absence of the authority to use the signature key and the presence or absence of tampering with respect to the signature target by a single verification process. In other words, by verifying the identity verification, the validity or authenticity of the data to be signed is also verified along with the verification of the identity verification. That is, a single authentication process verifies the eligibility of the signer of the signature request and the validity of the signature target. As a result, an electronic signature system with a significantly improved security level is realized.

In the present invention, when performing an electronic signature, data to be signed and the same encrypted data to be signed are transmitted from the terminal device to the tamper-resistant device. As a result, the authentication process can be executed with one signature target data as authentication reference data and the other signature target data as data to be verified. That is, since the signature target data to be verified and the reference data serving as the reference for verification are sent together to the tamper-resistant device, there is no need to set the reference data in the tamper-resistant device in advance, and the complexity of setup is eliminated. be.

Furthermore, in the present invention, since personal identification is performed without using authentication information such as a password, there is no need for the user to remember the password, thus reducing the burden on the user. In particular, it solves the problem that the signature system cannot be used due to the user forgetting the authentication information.

A preferred embodiment of the electronic signature system according to the present invention verifies the consistency between the decrypted signature target data and the signature target data included in the signature request, thereby verifying the signature request lacking validity of the subject and the validity of the signature target. It is characterized in that a signature request lacking in character is excluded from the electronic signature. In other words, a signature request that does not meet subject eligibility and signature target eligibility can be excluded from the digital signature by performing comparison verification only once.

In another preferred embodiment of the electronic signature system according to the present invention, the terminal device has means for generating data to be signed from an electronic document, encrypting the generated data to be signed to generate a cryptographic token,
The terminal device is characterized by generating a signature request including the generated signature target data, cryptographic token, and signature key identification information, and transmitting the signature request to the tamper-resistant device.
In the present invention, the private key of the key pair that constitutes the public key cryptosystem is held in the terminal device. Therefore, if the terminal device is provided with signature target data generation means (e.g., hash calculation means) for generating signature target data from an electronic document, the process from generation of signature target data to generation of a signature request can be automatically performed in the terminal device. can be done.

An electronic signature method according to the present invention includes a signature system having a tamper-resistant device that generates and manages a signature key, a key management server that has a function of controlling the tamper-resistant device, and a terminal device used by a user or a signer. An electronic signature method for digitally signing data to be signed using a signature key managed by a tamper-resistant device,
The terminal device generates a key pair of a private key and a public key, the generated private key is stored in the terminal device, the public key is sent to the tamper-resistant device and stored in association with the signature key of the signer,
When performing an electronic signature, the terminal device encrypts data to be signed using the private key as an encryption key to generate a cryptographic token, and generates a signature including the data to be signed, the cryptographic token, and signature key identification information. a request is generated and sent to the tamper resistant device;
The tamper-resistant device decrypts the cryptographic token included in the signature request using the public key as a decryption key, verifies consistency between the decrypted data to be signed and the data to be signed included in the signature request,
According to the verification result, a signature request lacking validity as a signer and a signature request lacking validity as a signature target are excluded from digital signature targets.

In the present invention, the public key of the key pair for executing the public key cryptosystem is transmitted from the terminal device to the tamper resistant device, and the public key is stored in association with the signature key of the signer. can control the signing key.
Also, using signature target data generated from an electronic document as a message to be verified, and using two signature target data: signature target data to be signed and encrypted signature target data obtained by encrypting the signature target data Since verification is performed, the validity of the subject and the validity of the signature target (whether or not there is falsification) can be determined by executing the verification process only once, and a remote signature system with a high security level can be constructed.
More importantly, the user does not need to memorize the authentication information because the two pieces of data to be signed are used as the authentication message and the identity verification message such as a password is not used. As a result, the burden on the user is greatly reduced.
Furthermore, since the information input operation of inputting information such as a password into the terminal device by the user is unnecessary, automated processing can be performed. In other words, the signed document can be automatically output only by the user designating the electronic document to be signed.
Furthermore, when the data to be signed is transmitted from the terminal device to the tamper-resistant device, error processing is performed in any case if the data is tampered with during transmission. Therefore, the inconvenience of electronically signing falsified data to be signed is avoided. Therefore, an electronic signature system with a much higher security level than conventional electronic signature systems is realized.

1 is a diagram showing the overall configuration of an electronic signature system according to the present invention; FIG. Fig. 2 is a schematic diagram of the setup and authentication steps of a remote signing system according to the invention; FIG. 4 is a diagram showing an algorithm of the signature key generation process of the electronic signature system according to the present invention; FIG. 3 shows an algorithm of the signature process of the electronic signature system according to the present invention; It is a figure which shows the modification of a setup process. It is a figure which shows an example of a terminal device. It is a figure which shows an example of a tamper-resistant apparatus. It is a figure which shows an example of a key management server. 4 is a block diagram showing an example of an editing server; FIG. It is a figure which shows the modification of the electronic signature system by this invention.

MODE FOR CARRYING OUT THE INVENTION

FIG. 1 is a diagram showing the overall configuration of an electronic signature system according to the present invention. Terminal devices 2-1 to 2-n are connected to the network 1. FIG. These terminal devices are devices used by users or signers, and for example, personal computers and smart phones are used. Here, the user includes not only a signer who electronically signs an electronic document, but also a person who uploads an electronic document to an editing server and a person who downloads an electronic document from an external server to the editing server. Therefore, the terminal device in this example includes not only the terminal device used by the signer, but also the terminal device used for uploading the electronic document to be signed to the editing server.

A signature system 3 is connected to the network 1 . The signature system 3 comprises a key management server 4 and one or more tamper resistant devices 5 connected to the key management server. The key management server 4 is connected to the network and has a function of managing or controlling the tamper resistant device 5 .

The tamper-resistant device 5 has a function of safely generating and managing a signature key without leaking it to the outside, and can be a Hardware Security Module (HSM), for example. A tamper-resistant device includes a subsystem or device that has security management functions independent of the key management server. The tamper-resistant device has a key management module, which is a program that manages keys, generates a key pair of a private key and a public key acting as a signature key, digitally signs the signature key, stores the signature key, and encrypts Decryption of cryptographic tokens containing messages and verification of decrypted data to be signed.

Furthermore, the network 1 is connected to a certificate issuing server 6 provided in a certificate authority. The certificate issuance server 6 generates a certificate issuance request (CSR) in response to the certificate generation request sent from the terminal device and generates an electronic certificate. Also, when generating a key pair that constitutes a signature key, the terminal device can send a signature key generation request to the key management server via the certificate issuing server.

Furthermore, an editing server 7 is connected to the network 1 . The editing server 7 has a function of managing and storing electronic documents to be signed, and manages electronic documents to be signed such as electronic documents uploaded from terminal devices and electronic documents downloaded from external servers. When the electronic document is uploaded, the editing server 7 notifies the terminal device of the signer who should sign the electronic document. Furthermore, the editing server can embed the electronic signature generated by the signature system 3 in the electronic document to generate a signed electronic document. The generated signed electronic document is stored in the editing server 7 .

Next, an algorithm for generating a signed electronic document will be described. FIG. 3 is a flow chart showing the setup process, and FIG. 4 is a flow chart showing the signing process. In the present invention, the public key cryptosystem is combined with the remote signature system, and the signature key is controlled using the result of personal authentication by the public key cryptosystem . As a result, the validity of the subject and the validity of the signature target can be determined by executing the verification process only once, and the authentication process can be simplified.

FIG. 2 shows an overview of the signal processing of the remote signing system according to the invention. A user who wishes to set up the remote signature system of the present invention requests the tamper-resistant device to generate a signature key via a terminal device. In response to this, the tamper-resistant device generates a signature key, and stores the generated signature key together with the signature key identification information in the signature key data storage unit.
Next, the terminal device generates a key pair for performing public key cryptography. The generated private key is stored as an encryption key in the terminal device, and the public key is transmitted to the tamper-resistant device. The public key is also referred to as the decryption key because it serves the function of decrypting the cryptographic token. This public key is stored in the signature key data storage unit in association with the previously generated signature key of the user. Therefore, as shown in FIG. 2, signature keys, decryption keys, and signature key identification information are stored in pairs. This completes the setup work.

For electronic signature, the user or signer designates the electronic document to be signed. Subsequent signal processing is performed automatically. When an electronic document is specified, a hash operation is performed on the specified electronic document to generate data to be signed. Subsequently, the terminal device encrypts the data to be signed using the private key to generate a cryptographic token. Subsequently, the terminal device generates a signature request including the generated signature target data, cryptographic token, and signature key identification information. The generated signature request is transmitted to the tamper resistant device.

Upon receiving the signature request, the tamper-resistant device searches for the decryption key using the signature key identification information. Since the decryption key is stored in a paired relationship with the signature key, the decryption key can be retrieved using the signature key identification information or identification information equivalent thereto. It then extracts the cryptographic token from the signing request. The retrieved cryptographic token is decrypted using the retrieved decryption key to generate a decrypted message. Furthermore, the tamper-resistant device verifies the consistency between the decrypted message and the data to be signed. The verification result is sent to the signature means, and an electronic signature is applied using the signature key.

Thus, according to the present invention, the signer does not perform any information input operation after designating the electronic document to be signed. Therefore, all signal processing after designation of the electronic document can be automatically performed. As a result, the processing up to the generation of the signed document can be automatically performed.

FIG. 3 is a diagram showing an algorithm for the signature key generation process of the electronic signature system according to the present invention. Referring to FIG. 3, the user makes an authentication request to the key management server 4 of the signature system 3 via the terminal device 2 . The authentication request shall be user authentication by user ID and password. If the user's account has not yet been created, the key management server 4 creates a new account for the user. As a user authentication method, not only a method of authenticating a combination of a user ID and a password, but also authentication by transmitting a token stored in an IC card to the key management server is possible. After user authentication, an authentication response is transmitted from the key management server 4 to the terminal device 2 .

When the user authentication succeeds, the user transmits a signature key generation request to the key management server 4 from the terminal device. The key management server 4 instructs the tamper resistant device 5 to generate a signature key. The tamper-resistant device generates a key pair of a private key and a public key as a signature key in response to the signature key generation request. The generated private key becomes a signature key, is stored in the tamper-resistant device, and is used for the electronic signature. Also, the public key is used as signature key identification information. The tamper-resistant device sends a signature key generation notification including the generated public key to the key management server, and the key management server sends the signature key generation notification to the terminal device. The terminal device stores the received public key as signature key identification information.

Upon receiving the signature key generation notification, the terminal device generates a key pair of a private key and a public key for executing the public key cryptosystem. The generated secret key is stored in the terminal device and functions as an encryption key for encrypting the personal authentication message. In the present invention, the data to be signed is used as a message for personal authentication, and the data to be signed is encrypted. As an encryption method, the data to be signed can be encrypted by performing a signature calculation using a secret key. Encrypted data to be signed acts as a cryptographic token. Also, the generated public key is transmitted to the tamper-resistant device and stored in association with the corresponding signature key. The public key stored in the tamper-resistant device functions as a decryption key for decrypting the cryptographic token sent from the terminal device. If the number of signature keys to be stored becomes large and overflows, a part of the signature keys can be encrypted and stored in a database outside the tamper-resistant device. In this way, by storing the public key functioning as the decryption key in association with the signature key, it is possible to combine the public key cryptosystem with the remote signature system.

The tamper-resistant device transmits a setup completion notification to the terminal device when the storage of the public key that functions as the decryption key is completed. Thereafter, the user can use the terminal device to sign electronically.

Subsequently, the user transmits an authentication request to the certificate issuing server 6 via the terminal device in order to obtain an electronic certificate (certificate for signature). This user authentication is also a combination of user ID and password. An authentication response is sent from the certificate issuing server to the terminal device.

If the user authentication succeeds, the terminal device transmits an electronic certificate generation request containing the user ID, the public key paired with the signature key, and other necessary items to the certificate issuing server. The certificate issuing server uses the received public key and necessary information to create a certificate issuance request (CSR), performs a predetermined examination process, and then generates an electronic certificate. The generated electronic certificate is sent to the terminal device. The terminal device stores the received electronic certificate. Note that the electronic certificate is transferred to the editing server and stored in the editing server as necessary.

FIG. 4 shows an algorithm for electronic signature using the generated signature key. In the present invention, the signature key is controlled using the result of personal authentication by the public key cryptosystem. The terminal device generates data to be signed from the electronic document to be signed. As the electronic document, the electronic document stored in the terminal device and the electronic document sent from the editing server that manages the electronic document are used. The terminal device generates a hash value by performing a predetermined logical operation (hash operation) on the signature target area of the electronic document, and uses the generated hash value as signature target data.

The data to be signed according to the present invention includes not only data to be signed that is directly generated from an electronic document, but also messages to which additional information such as date and time of generation and expiration date are added to the generated data to be signed. included. That is, a message including signature target data as part thereof can also be used as signature target data.

The terminal then encrypts the message using the cryptographic key (stored private key) to generate a cryptographic token. In the present invention, signature target data is used as a message to be encrypted. Therefore, the terminal device encrypts the data to be signed using the encryption key to generate a cryptographic token. As an example of encryption, signature calculation is performed on data to be signed using an encryption key, and the obtained signature calculation result is used as a cryptographic token.

Subsequently, the terminal device generates a signature request including signature key identification information, data to be signed, and a cryptographic token. The signature request has the significance of requesting a digital signature from the tamper-resistant device. The signature request is then sent to the tamper-resistant device via the key management server.

Upon receiving the signature request, the tamper-resistant device retrieves the signature key using the signature key identification information included in the signature request, and retrieves the decryption key stored in association with the retrieved signature key. As the signature key identification information, for example, a secret key forming the signature key and a corresponding public key can be used. As the identification information for searching the decryption key, not only the same information as the signature key identification information, but also the identification information obtained by adding additional changes to the signature key identification information to distinguish it from the signature key, that is, the signature key identification information. Equivalent identification information can also be used.

Subsequently, using the retrieved decryption key, the cryptographic token included in the signature request is decrypted to generate a decrypted message.

Subsequently, the decrypted message and the data to be signed included in the signature request are compared and verified. As an example, a signature operation is performed on the cryptographic token using the decryption key to form a signature value. Then, the consistency between the obtained signature value and the data to be signed is verified.

As a verification result, if the decrypted message and the data to be signed match, the tamper-resistant device determines that the received signature request is valid. That is, it is determined that the received signature request is a signature request by a person who has a legitimate right to use the signature key, and that the data to be signed has not been tampered with.

If the verification result shows that the decrypted message and the data to be signed do not match, the tamper-resistant device determines that the received signature request is invalid. That is, the tamper-resistant device determines that the cryptographic token included in the received signature request has not been encrypted with an appropriate cryptographic key, or that the data to be signed has been tampered with, and processes it as an error.

When the signature request is determined to be valid, the tamper-resistant device applies a digital signature to the data to be signed using the corresponding signature key to generate an electronic signature. The signature result including the electronic signature and signature key identification information is transmitted to the terminal device via the key management server. The terminal device embeds the received electronic signature in the edited electronic document to create a signed electronic document (signed document). The generated electronic signature can be given a signature time stamp by a time stamp server and embedded in the electronic document as a long-term signature to ensure long-term validity of the electronic signature. The signed electronic document is stored in the terminal device and sent to the editing server as needed. The generated electronic signature can be transmitted to the editing server and processed in the editing server.

FIG. 5 shows a variant of the set-up process. In this example, the editing server 7 functions as a management server for managing uploaded electronic documents. An electronic document to be signed is uploaded from a terminal device to the editing server, and upload information is entered. An electronic document to be signed is also input from an external server. The upload information includes the electronic document to be signed, the identification information of the signer to be signed, and the address information of the signer's terminal device. The uploaded electronic document is stored by the editing server and managed in the editing server.

When the upload information is input, the editing server stores the uploaded electronic document and notifies the terminal device of the user who should sign it that the signature is requested. The notified user requests user authentication from the editing server via the terminal device. When user authentication is successfully performed, the editing server sends an authentication response to the terminal device.

The user confirms the electronic document to be signed. When signing the confirmed electronic document, the user requests the generation of data to be signed from the editing server via his/her own terminal device. The signature target data generation request from the terminal device to the editing server has significance as a manifestation of the signer's intention to request signature processing. This generation request serves as a trigger for starting signature processing, and a series of signature processing is automatically executed.

The editing server edits the signature target electronic document and generates signature target data from the electronic document in response to receiving the signature target data generation request. Subsequently, the editing server downloads the data to be signed to the terminal device.

In response to the download of the data to be signed, the terminal device encrypts the downloaded data to be signed using an encryption key (private key) to generate a cryptographic token.

Subsequently, the terminal device transmits signature information including the generated cryptographic token and signature key identification information to the editing server. Here, since the data to be signed is encrypted, it cannot be tampered with.

The editing server generates a signature request including signature key identification information, signature target data for signature, and a cryptographic token. The generated signature request is transmitted to the tamper resistant device.

The tamper-resistant device uses the signature key identification information to retrieve the decryption key, and uses the decryption key to decrypt the cryptographic token included in the received signature request. Subsequently, the data to be signed and the decrypted message are compared and verified. As a verification result, if the signature target data and the decrypted message match, the signature request is determined to be valid, and the signature target data is digitally signed. The signature result including the generated electronic signature is transmitted to the editing server via the key management server.

The editing server embeds the received electronic signature in the electronic document to create a signed electronic document (signed document). The signed electronic document is stored in the editing server and sent to the terminal device as required.

FIG. 6 is a block diagram showing the functional configuration of the terminal device. Note that FIG. 6 shows only the part related to the electronic signature. The terminal device has communication means 10 , control section 11 , input device 12 and storage section 13 . The communication means 10 is connected to a network and transmits and receives data to and from a key management server or the like. The control unit 11 has an authentication requesting unit 14, and transmits an authentication request based on a user ID and password to a key management server or the like of the signature system. Subsequently, the user logs into the signature system, and transmits a signature key generation request from the signature key generation request unit 15 to the tamper resistant device. The public key of the key pair generated by the tamper-resistant device is stored in the signature key identification information storage section 16 of the storage section via communication means.

The electronic certificate issuance request unit 17 generates an electronic certificate issuance request including the public key received from the tamper-resistant device, and transmits the generated electronic certificate issuance request to the certificate issuance server. The created electronic certificate is received via communication means and stored in the electronic certificate storage unit 18 .

The key pair generation unit 19 generates a key pair for personal identification. The generated private key functions to encrypt the data to be signed and is stored in the encryption key storage unit 20 . Also, the public key is transmitted to the tamper-resistant device via communication means. Thus, the private key for encrypting the data to be signed is held in the terminal device, and the public key for decrypting the cryptographic token is held in the tamper-resistant device.

Here, the key pair generation means includes not only means for directly generating a key pair, but also means or functions for introducing a key pair generated externally and stored in a storage device into the terminal device. For example, storing a key pair in advance in a storage means such as a USB memory, sending the stored key pair to a terminal device, and setting the key pair also corresponds to operating the key pair generating means.

An electronic document to be signed is stored in the electronic document storage unit 21 . For electronic signature, the electronic document is read out and supplied to the signature target data generator 22 . The signature target data generation unit generates signature target data from the electronic document. This signature target data generation unit can be configured by, for example, hash calculation means.

The generated data to be signed is supplied to the cryptographic token generation unit 23 and signature request generation unit 24 . The cryptographic token generator 23 encrypts the data to be signed using the cryptographic key to generate a cryptographic token. The generated cryptographic token is supplied to the signature request generator. The signature request generator generates a signature request including data to be signed, a cryptographic token, and signature key identification information. The generated signature request is transmitted to the tamper-resistant device via communication means 10 .

The electronic document upload unit 25 creates an electronic signature generation request including the electronic document stored in the electronic document storage unit 21 and the stored electronic certificate, and transmits it to the editing server. For electronic documents that require the signature of another person, the electronic document to be signed is added with the ID and address of the signer and uploaded to the editing server.

When the electronic signature is completed in the tamper-resistant device, the electronic signature is sent to the terminal device. The received electronic signature is embedded in the electronic document to generate a signed electronic document. The generated signed electronic document is stored in the signed electronic document storage unit 26 .

FIG. 7 shows an example of the functional configuration of the tamper resistant device. The tamper resistant device has a management unit 30 , a processing unit 31 and a storage unit 32 . An information signal transmitted from a terminal device or an editing server is input to the management section 30 via a network and a key management server. The management unit 30 controls each functional unit provided in the processing unit so that the designated function is executed according to the input information signal.

Upon receipt of the signature key generation request, the signature key generation unit 33 operates to generate a key pair of a private key and a public key, which serves as a signature key. The generated key pair is temporarily stored in the storage unit 34 . The public key functions as signature key identification information that identifies the signature key and decryption key. This public key is duplicated and transmitted to the corresponding terminal device via the management section.

When the public key of the key pair for personal identification is received, the received public key is sent to the storage unit 34 . The storage unit associates and stores a key pair forming a signature key and the received public key to form signature key data. This signature key data includes a signature key (private key), signature key identification information (public key), and a decryption key (public key of key pair for personal authentication). This signature key data is stored in the signature key data storage section 35 provided in the storage section 32 for each signer or user.

When the signature request is input, the cryptographic token is sent to the decryption section 36 and the data to be signed is supplied to the verification section 37 . Subsequently, the signature key data storage unit 35 is searched using the signature key identification information included in the signature request, and the decryption key associated with the corresponding signature key is extracted. The extracted decryption key is supplied to the decryption unit 36 . The cryptographic token is decrypted using the retrieved decryption key to form a decrypted message. The decrypted message is sent to verification unit 37 . As a decryption method, a decryption key can be used to perform a signature calculation on an encryption token to generate a signature value, and the generated signature value can be used as a decryption message.

The verification unit 37 receives the decrypted message decrypted from the cryptographic token and the data to be signed included in the signature request. The verification unit compares these two pieces of data to verify consistency. As a matching verification method, for example, matching between the signature value generated in the decryption process and the data to be signed included in the signature request can be verified.

If the decrypted message and the data to be signed match, the data to be signed is sent from the verification section 37 to the signature section. Also, the signature key specified by the signature key identification information is sent from the signature key storage unit to the signature unit. The signature unit applies an electronic signature to the data to be signed using the input signature key.

If the verification results do not match, the signature request is treated as an error.

FIG. 8 shows the functional configuration of the key management server. The key management server has communication means 40 , control section 41 and user information database 42 . The control unit has a user authentication processing unit 43 and processes an authentication request from the terminal device.

A signature key generation request sent from the terminal device and a signature request sent from the editing server or the terminal device are supplied to the tamper-resistant device control unit 34, and an instruction corresponding to the designated processing is sent to the tamper-resistant device. Various information such as an electronic signature generated by the tamper-resistant device is sent to a terminal device, an editing server, or the like via a tamper-resistant device control unit. Note that the key management server and the tamper-resistant device can be connected via an internal bus or an external bus. Alternatively, it is also possible to connect via a LAN.

FIG. 9 is a block diagram showing the functional configuration of the editing server. This block diagram corresponds to the algorithm of FIG. The editing server has communication means 50 , control section 51 and storage section 52 . The communication means 50 is connected to a network, and transmits and receives information to and from the terminal device, the key management server, and the tamper-resistant device. The user authentication processing unit 53 uses the user information stored in the user information storage unit 54 to process the authentication request sent from the terminal device.

The upload information uploaded from the terminal device is input to the upload information receiving section 55 . The upload information is sent to the signature notification unit 56, which transmits a signature notification indicating that a signature is requested to the terminal device of the signer's address included in the upload information. Electronic documents included in the upload information are stored in the electronic document storage unit 57 .

A download request for the data to be signed from the signer is input to the download request receiving section 58 . In response to the input download request, the signature target data generating unit 59 operates to generate two identical signature target data, ie, the signature target data for signature and the signature target data for cryptographic token generation. The generated signature target data for cryptographic token generation is transmitted from the signature target data download unit 60 to the terminal device of the corresponding signer.

The signature information sent from the signer's terminal device is input to the signature request generator 61 . The signature request generation unit generates a signature request by adding signature target data for signature to the cryptographic token and signature key identification information included in the signature information. The generated signature request is transmitted to the tamper resistant device.

The editing server has an editing section 62 . The editing unit 62 edits the electronic document to be signed, and sets the arrangement method and arrangement position of the fields of the electronic signature to be formed.

An electronic signature, which is a signature result generated by the tamper-resistant device, is input to the signed electronic document generation unit 63 . Editing information generated by the editing section is also input to the signed electronic document generation section, and an electronic signature is embedded in the stored electronic document to generate a signed electronic document (signature document). The generated signed electronic document is stored in the signed document storage unit 64 .

FIG. 10 is a diagram showing a modification of the electronic signature system according to the present invention. In this example, VPN connections 70 and 71 are provided between the key management server 4 and the certificate issuing server 6 and between the key management server 4 and the editing server 7, respectively. By providing the VPN connection, the key management server 4 and the certificate issuing server 6 are equivalent to being directly interconnected, and the key management server 4 and the editing server 7 are also equivalent to being interconnected. As a result, a secure encrypted transmission path is constructed between the certificate issuing server/editing server and the key management server.

Further, the certificate issuing server 6 and the editing server 7 are composed of an authentication server having a personal authentication function. A user (terminal device) has an account in the authentication server (certificate issuing server 6 and editing server 7) and exchanges messages with the authentication server through SSL encrypted communication through the login authentication process. As a result, communication between the terminal device 2 and the certificate issuing server 6 and between the terminal device 2 and the editing server 7 are protected by SSL encrypted communication.

In the signature key generation process, the public key of the key pair generated by the tamper-resistant device is sent to the terminal device via the key management server 4 , VPN connection 70 and certificate issuing server 6 . Also, the cryptographic token created by the terminal device is sent to the tamper-resistant device via the certificate issuing server 6 , VPN connection 70 and key management server 4 .

Further, in the signature process, the cryptographic token generated by the terminal device is sent to the tamper resistant device 4 via the editing server 7, VPN connection 71 and key management server. The electronic signature generated by the tamper-resistant device is sent to the editing server 7 via the key management server and VPN connection 71 . As a result, an encrypted secure transmission path is constructed between the terminal device that issues a signature instruction to the tamper-resistant device and the key management server that performs a digital signature based on the instruction from the terminal device.

The present invention is not limited to the above-described embodiments, and various modifications and changes are possible. For example, in the above-described embodiments, an electronic signature system including a signature system, an editing server, a certificate issuing server, and a terminal device has been described. can. That is, an electronic document uploaded from a terminal device can be input to an electronic document management server and managed by the electronic document management server. Then, the upload information is transferred from the electronic document management server to the editing server, and processing such as generation of data to be signed and generation of a signature request can be performed in the editing server.

As for the signature target data, for example, the signature target data can use data extracted by performing a predetermined logical operation (hash operation) from the signature target area of the electronic document.

1 network 2 terminal device 3 signature system 4 key management server 5 tamper resistant device 6 certificate issuing server 7 editing server 10 communication means 11 control unit 12 input device 30 management unit 31 processing unit 32 storage unit

Claims (9)

A signature system having one or more tamper-resistant devices having a function of generating and managing a signature key and a key management server that controls the tamper-resistant devices, and a terminal device used by a user or a signer, A remote signature system that electronically signs signature target data generated from an electronic document using a signature key managed by a tamper-resistant device,
The terminal device comprises means for generating a key pair of a private key and a public key or means for installing an externally generated key pair, and encrypts data to be signed using the private key as a cryptographic key to generate a cryptographic token. having means for forming
The tamper-resistant device includes means for generating a signature key, means for storing the generated signature key in the tamper-resistant device, means for decrypting a cryptographic token including encrypted data to be signed using the public key, Verification means for verifying validity of a signature request using decrypted data to be signed, and electronic signature on the data to be signed using a signature key stored in a tamper-resistant device based on the verification result by the verification means has a signature means to
The private key of the key pair is stored in the terminal device, the public key of the key pair is transmitted to the tamper-resistant device, and stored in the tamper-resistant device in association with the user's signature key,
The private key stored in the terminal device functions as an encryption key for encrypting data to be signed, and the public key stored in the tamper-resistant device in association with the signature key functions as a decryption key for decrypting the encryption token. ,
The signature key, the public key, and the signature key identification information for identifying the signature key are stored in a tamper-resistant device for each user as a pair relationship,
At the time of electronic signature, the terminal device encrypts the data to be signed using the private key to generate a cryptographic token,
a signature request including signature target data to be signed, a cryptographic token including encrypted signature target data, and signature key identification information is generated and transmitted to the tamper resistant device;
The tamper-resistant device decrypts the cryptographic token using the public key stored in association with the signature key identified by the signature key identification information included in the signature request, and signs the decrypted data to be signed. If the decrypted data to be signed and the data to be signed do not match, the signature request is excluded from being subject to electronic signatures. A remote signature system , wherein the device electronically signs data to be signed using a signature key . 2. The remote signature system according to claim 1, wherein a signature request lacking eligibility for personal authentication and a signature request in which data to be signed has been falsified are excluded from targets of electronic signature. 2. The remote signature system according to claim 1, wherein in the electronic signature, the terminal device generates a cryptographic token by performing a signature calculation on the data to be signed using the cryptographic key, and the tamper-resistant device decrypts the data. A signature operation is performed on a cryptographic token included in a signature request using a key to generate a signature value, and the consistency between the generated signature value and the data to be signed included in the signature request is verified. remote signature system. 2. The remote signature system according to claim 1, wherein said decryption key is retrieved using identification information including signature key identification information or signature key identification information that identifies a signature key. 2. The remote signature system according to claim 1, wherein said terminal device has means for generating data to be signed from an electronic document, and encrypts the generated data to be signed to generate a cryptographic token. Remote signature system. 2. The remote signature system according to claim 1, further comprising an editing server for managing electronic documents to be signed, and a certificate issuing server for generating electronic certificates for signatures. A remote signing system characterized by: 7. The remote signature system according to claim 6, wherein said editing server has means for generating data to be signed from an electronic document. 2. The remote signature system according to claim 1, wherein said tamper-resistant device comprises a Hardware Security Module (HSM). It is used in a remote signature system comprising a signature system having a tamper-resistant device that generates and manages signature keys and a key management server that has a function to control the tamper-resistant device, and a terminal device used by a user or a signer. A remote signature method for electronically signing signature target data generated from an electronic document using a signature key managed by a tampering device,
The tamper-resistant device generates a signature key in response to a request from a user,
the terminal device generates a key pair of a private key and a public key or has an externally generated key pair installed;
The private key of the key pair is stored in the terminal device, the public key of the key pair is sent to the tamper-resistant device, and stored in the tamper-resistant device in association with the user's signature key,
The private key stored in the terminal device functions as an encryption key for encrypting data to be signed, and the public key stored in the tamper-resistant device in association with the signature key functions as a decryption key for decrypting the encryption token. ,
The signature key, the public key, and the signature key identification information for identifying the signature key are stored in a tamper-resistant device for each user as a pair relationship,
At the time of electronic signature, the terminal device encrypts the data to be signed using the private key to generate a cryptographic token,
a signature request including signature target data to be signed, a cryptographic token including encrypted signature target data, and signature key identification information is generated and transmitted to the tamper resistant device;
The tamper-resistant device decrypts the cryptographic token using the public key stored in association with the signature key identified by the signature key identification information included in the signature request, and signs the decrypted data to be signed. verifying consistency with the data to be signed, and if the decrypted data to be signed and the data to be signed do not match, the signature request is excluded from being subject to electronic signature; if they match, the tamper-resistant device is a remote signature method characterized by using a signature key to electronically sign data to be signed .

Images