KR100642979B1 - Method for signing digital documents and verifying thereof using the signed attributes and computer readable record medium on which a program therefor is recorded - Google Patents

Abstract

The present invention provides an electronic signature method using an electronic signature attribute, comprising: (a) acquiring document information to prepare a certificate and a private key; (b) setting signature information of the signature data; (c) a hash of the page. Setting a value; (d) determining whether the page is the first page; (e) if the first page is the determination result of step (d), setting the total number of pages; (f) sequential information of the current page (G) determining a hash value by encoding the signature attribute; (h) determining whether or not to sign each page; (i) as a result of determining in step (h), a signature is not required for each page. In the case of encoding the signature document; (j) determining whether or not the current signed page is the last page; (k) if the determination result of step (j), if not the last page to return to step (b), Terminating the signature if it is the last page; (l) the edition of step (h) As a result, when signatures are required for each page, generating a signature value and setting the signature value item; And (m) if the result of step (d) is not the first page, the hash value for the signature text obtained when the signature document of the previous page is generated or the hash value for the signature attribute is used as part of the digital signature attribute of the current page. And setting the hash value of the page, and then proceeding to step (f).

Digital signature, signature attribute, hash, encoding

Description

Method for signing digital documents and verifying about using the signed attributes and computer readable record medium on which a program therefor is recorded }             

1 is an exemplary diagram of an electronic signature system using a public key infrastructure according to an embodiment of the present invention.

2 is a flowchart illustrating an electronic signature using a signature attribute according to an embodiment of the present invention.

3 is a conceptual diagram of an electronic signature using an electronic signature attribute according to an embodiment of the present invention.

4 is a general flow diagram for verification of an electronically signed electronic document using the electronic signature attribute in accordance with an embodiment of the present invention.

The present invention relates to an electronic signature using an electronic signature attribute, a verification method thereof, and a computer-readable recording medium having recorded thereon a program for executing the same.

More specifically, in the present invention, in each page constituting a digitized document (hereinafter referred to as "electronic document"), the hash value (digest) of the page included in the signed attributes of the previous page. Value) as part of the digital signature attribute of the next page so that it can be correlated with the digital signature attribute of the immediately preceding page at the time of the digital signature of a given page, ensuring the order and integrity of the electronic document and enabling signature verification for a particular page. The present invention relates to a computer-readable recording medium recording a digital signature using the digital signature attribute, a verification method thereof, and a program for executing the same.

As for the method of digitally signing a digitized document, a number of applications have been filed and registered in addition to Korean Patent Publication No. 2001-0098202, "Security Method for Electronic Documents Exchange on the Internet."

The security method for exchanging electronic documents on the Internet creates a new pseudo random generator object used as a seed for generating a DSA key pair, generates a 100-byte pseudo random number, obtains a KeyPairGenerator object, and then uses a 512 bit KeyPairGenerator object. Generating a keyPair object from a KeyPairGenerator object, obtaining a secret key and a public key of the KeyPair object, and storing them in a file; A signature generation step of transmitting a public key among the keys generated by the DSA key generator to the web server, the client signing the message with the secret key, and then sending the signed message to the web server; And the web server decrypts the received client signature with the previously received public key and authenticates if the decryption value is the same as the registered user.

However, using the above invention, the electronic signature is made individually for each page of the electronic document composed of a plurality of pages. For this reason, the conventional digital signature method makes it possible to check whether a forgery exists for each page, but it is easy to check whether a specific page is missing in the entire electronic document, for example, two pages should exist after one page. There was a problem that could not be.

In the conventional digital signature method, the electronic signature is independently performed for each page. For example, in the electronic document including 10 pages, the signature and verification of the remaining pages can be guaranteed only by the signature and verification of the final page. There was also a problem that can not be.

SUMMARY OF THE INVENTION An object of the present invention is to solve the above problems, and includes an n-1 hash value including the digital signature attribute of page n-1 in a digest value of the electronic signature attributes of page n to construct an electronic document. This ensures the order and integrity of each page, and enables you to sign and verify specific pages.

Another object of the present invention is to use the digital signature attribute of the previous page in each electronic signature of the pages constituting the electronic document, so that the integrity and integrity of the entire electronic document can be checked only by signing and verifying the last page. have.

The present invention for achieving the above object, relates to a digital signature method using the electronic signature attribute, (a) the digital signature module includes information related to the number, location, size of the document to attempt to perform the electronic signature Acquiring document information to prepare a certificate and a private key for use in digital signature of the acquired document; (b) the digital signature module setting the digital signature information of the digital signature data by setting the digital signature document version, the digital signature target text information, the digital signature information version, the digital signature identification information, the hash algorithm, and the signature algorithm; (c) setting, by the digital signature module, a hash value of each digital signature target page included in the digital signature attribute; (d) the electronic signature module determining whether the electronic signature target page is the first page of the electronic document; (e) if the first page is determined as the result of step (d), setting, by the digital signature module, the total number of pages using an electronic signature attribute; (f) setting, by the digital signature module, sequential information of a current page using the digital signature attribute; (g) the digital signature module encoding a digital signature attribute to obtain a hash value for the digital signature attribute; (h) determining whether the digital signature module should perform an electronic signature for each page; (i) if the digital signature module does not need to be digitally signed for each page, as a result of the determination of step (h); (j) the electronic signature module determining whether the currently signed page is the last page; (k) if it is determined that the step (j) is not the last page, the digital signature module returns to step (b), and if the last page, the digital signature module terminates the digital signature; (l) When the digital signature is required for each page as a result of the determination in the step (h), the digital signature module generates the digital signature value using the private key of the digital signature certificate and sets it in the digital signature value item. step; And (m) if it is not the first page, as a result of the determination of step (d), a hash value for the original electronic signature or a hash value for the electronic signature attribute obtained by the digital signature module when the digital signature document is generated on the previous page. Setting a hash value of the previous page as part of the digital signature attribute of the current page, and then executing the procedure to step (f); It includes.

Preferably step (b) comprises the steps of: setting a digital signature of the digital signature and certificate revocation list; It characterized in that it further comprises.

Also preferably, after the step (f), the digital signature module may set a signature time using SigningTime among the digital signature attributes; It characterized in that it further comprises.

And preferably, the digital signature module causes the DB module to store the digitally signed electronic document or outputs the electronic document output module as a 2D barcode; It characterized in that it further comprises.

On the other hand, the present invention relates to a digital signature verification method using an electronic signature attribute, the method comprising the steps of: (a ') the digital signature verification module receiving the electronic signature from the digital signature module; (b ') decoding each page constituting the digitally signed electronic document received by the digital signature verification module; (c ') the electronic signature verification module extracting an electronic signature time when there is information on the electronic signature time in each of the decoded pages, and calculating a hash value of the electronic signature electronic document; (d ') the digital signature verification module determining whether the hash value calculated for each digitally signed page and the hash value for the current page included in the electronic signature attribute match; (e ') treating the digital signature verification module as having failed verification if it does not match, as a result of the determination of step (d'); (f ') As a result of the determination in the step (d'), if there is a match, the digital signature verification module has the total number of pages after the hash value among the digital signature attributes for each page of the electronic signature, or the hash of the previous page. Determining whether there is a value; (g ') the electronic signature verification module acquiring a sequential value of a next page when there is a hash value of the previous page as a result of the determination in step (f'); (h ') when the electronic signature verification module acquires the total number of pages when there is a total number of pages as a result of the determination in the step (f'), performing the procedure to the step (g '); (i ') the digital signature verification module encoding and hashing the digital signature attribute of each of the electronically signed pages; (j ') determining whether the digital signature verification module has an electronic signature value in the digital signature information; (k ') determining whether a page to be verified remains by the digital signature verification module when there is no digital signature value as a result of the determination in step (j'); (l ') As a result of determining in step (k'), if there is a page to be verified, the digital signature verification module returns to step (b '), and if there is no page to be verified, the electronic Determining, by the signature verification module, whether the obtained total number of pages matches the number of pages processed; (m ') As a result of the determination in the step (l'), if the digital signature verification module does not verify the verification if it does not match, and if there is a match, whether the digital signature verification module has sequential information on the page where the digital signature is Determining; (n ') determining that the digital signature verification module is connected to the hash value of the previous page from the page having the total number of pages to the last page when there is no sequential information as a result of the determination in step (m'); (o ') if the connection result is determined in step (n'), the electronic signature verification module processing the validity of the electronically signed electronic document as verification; (p ') if there is sequential information as a result of the determination of step (m'), the digital signature verification module arranging pages according to the sequential information, and then performing the procedure to (n '); (q ') If the digital signature value is found as a result of the determination in step (j'), the digital signature verification module determines whether the digital signature value and the value decrypted by the digital signature certificate match and match. The digital signature verification module performing the procedure to step (k '), and if the digital signature verification module does not match, processing the digital signature verification module as having failed verification; It includes.

In the present invention, in order to perform an electronic signature using an electronic signature attribute, (A) the digital signature module acquires document information including information related to the number, position, and size of a document to be attempted to perform the electronic signature. A function of preparing a certificate and a private key for use in digital signature of the acquired document; (B) the digital signature module setting the digital signature information of the digital signature data by setting the digital signature document version, the digital signature target text information, the digital signature information version, the digital signature identification information, the hash algorithm, and the signature algorithm; (C) the digital signature module setting a hash value of each digital signature target page included in an electronic signature attribute; (D) a function of the electronic signature module to determine whether the electronic signature target page is the first page of the electronic document; (E) a function of setting the total number of pages using the digital signature attribute by the digital signature module when the first page is determined as a result of the determination of the function (D); (F) the electronic signature module setting the sequential information of the current page using the digital signature attribute; (G) the digital signature module encoding a digital signature attribute to obtain a hash value for the digital signature attribute; (H) a function for determining whether the digital signature module should perform an electronic signature for each page; (I) a function for encoding the electronic signature document by the electronic signature module when it is not necessary to perform the electronic signature for each page as a result of the determination of the function (H); (J) a function of the electronic signature module to determine whether the currently signed page is the last page; (K) a function of the electronic signature module returning to the function (B) if it is not the last page as a result of the determination of the function (J), and terminating the electronic signature by the electronic signature module if the last page; (L) As a result of the determination of the function (H), when the digital signature is to be performed for each page, the digital signature module generates a digital signature value using the private key of the digital signature certificate and sets it in the electronic signature value item. function; And (M) if it is not the first page, as a result of the determination of the (D) function, a hash value for the original electronic signature or a hash value for the electronic signature attribute obtained by the digital signature module when the digital signature document is generated on the previous page. Setting a hash value of the previous page as part of the electronic signature attribute of the current page, and then executing the procedure to the above (F) function; And a computer readable recording medium having recorded thereon a program for executing the program.

Preferably, the function (B) comprises: setting a digital signature of the digital signature and a certificate revocation list; And a computer-readable recording medium having recorded thereon a program for executing the program.

Also preferably, after the function (f), the digital signature module sets a signature time using SigningTime among the digital signature attributes; And a computer-readable recording medium having recorded thereon a program for executing the program.

And preferably, the digital signature module causes the DB module to store the digitally signed electronic document or the electronic document output module to output a 2D barcode. And a computer-readable recording medium having recorded thereon a program for executing the program.

On the other hand, the present invention to perform the digital signature verification using the electronic signature attribute, (A ') the digital signature verification module to receive the electronic signature signed from the digital signature module; (B ') decoding each page constituting the electronically signed electronic document received by the digital signature verification module; (C ') the digital signature verification module extracting an electronic signature time when there is information on the electronic signature time in each of the decoded pages, and calculating a hash value of the electronically signed electronic document; (D ') the digital signature verification module determining whether the hash value calculated for each digitally signed page and the hash value for the current page included in the digital signature attribute match; (E ') a function of processing the digital signature verification module as having failed verification if it is not matched as a result of the determination of the function (D'); (F ') As a result of the determination of the function (D'), if there is a match, the digital signature verification module has the total number of pages after the hash value among the digital signature attributes for each page of the electronic signature, or a hash of the previous page. Determining whether there is a value; (G ') a function of the electronic signature verification module acquiring a sequential value of a next page when there is a hash value of the previous page as a result of the determination of the function (F'); (H ') a function of executing the procedure to the (G') function after the digital signature verification module acquires the total number of pages if the total number of pages exists as a result of the determination of the function (F '); (I ') the digital signature verification module hashing after encoding the digital signature attribute of each electronically signed page; (J ') a function of determining whether the digital signature verification module has an electronic signature value in the digital signature information; (K ') determining that, if there is no digital signature value, the page on which the digital signature verification module should perform verification remains as a result of the determination of the function (J'); (L ') As a result of the determination of the function (K'), if there is a page to be verified, the digital signature verification module returns to the function (B '), and if there is no page to be verified, the electronic A function of determining whether a signature verification module matches the total number of pages acquired and the number of pages processed; (M ') As a result of the determination of the (L') function, if it does not match, the digital signature verification module treats verification as failed, and if it matches, whether there is sequential information on the page where the digital signature verification module is digitally signed. A function of determining; (N ') determining that the digital signature verification module is connected to the hash value of the previous page from the page having the total number of pages to the last page when there is no sequential information as a result of the determination of the function (M'); (O ') a function of, when connected, the digital signature verification module processing the validity of the electronically signed electronic document as a result of the determination of the function (N'); (P ') a function of executing the procedure to the (N') function after the digital signature verification module arranges the pages according to the sequential information, as a result of the determination of the (M ') function; (Q ') As a result of the determination of the function (J'), when there is an electronic signature value, it is determined whether the digital signature verification module and the value decrypted by the digital signature certificate match and match. The digital signature verification module implements the procedure with the (K ') function, and if the digital signature verification module does not match, the digital signature verification module processes the verification as failed; And a computer readable recording medium having recorded thereon a program for executing the program.

Hereinafter, with reference to the accompanying drawings will be described in detail the present invention.

Referring to FIG. 1, a digital signature and a system configuration for verifying the same according to an embodiment of the present invention will be described.

1 is a diagram illustrating an electronic signature based on a public key infrastructure and a verification system thereof according to an embodiment of the present invention.

As shown, an electronic signature system using a public key infrastructure according to an embodiment of the present invention includes an electronic signature module 100, an electronic signature verification module 200, an electronic document output module 300, and a DB module 400. It includes.

The digital signature module 100 may include an electronic signature original text management unit 110 that manages the number of digital signature target documents and a page number, a certificate management unit 120 that manages a certificate of a public key infrastructure used for digital signatures, The digital signature execution unit 130 for receiving a certificate from the certificate management unit to perform an electronic signature and the electronic signature electronic document received from the digital signature execution unit to store in the DB module 400 or the electronic document And an electronic signature document manager 140 for causing the output module 300 to output the electronic document in an additional form, for example, a 2D barcode.

In addition, the digital signature verification module 200 is an electronic signature document management unit 210 for receiving an electronically signed document from the electronic signature module and the digital signature verification execution unit for performing signature verification on the received digital signature document (220), the electronic signature original text management unit 230 for receiving the signature-verified electronic document from the digital signature verification performing unit to verify the integrity of the document and arranging the order of the electronic document, and the signature verification is normally performed, Or a certificate validity performing unit 240 for checking the validity of the certificate of the electronic document after the integrity check by Online Certificate Status Protocol (OCSP), RA, and Certificate Revocation List (CRL) profile.

In addition, the electronic document output module 300 performs a function of outputting an electronically signed electronic document received from the electronic signature performing unit in an additional form, for example, a 2D barcode.

The DB module 400 stores the digitally signed electronic document received from the digital signature performing unit, and transmits the stored digitally signed electronic document to the digital signature document manager when a request is received from the digital signature verification module. It performs the function.

Referring to Figures 2 and 3 the flow of the electronic signature using the electronic signature attribute according to an embodiment of the present invention using the system as follows.

2 is a flowchart illustrating an electronic signature using an electronic signature attribute according to an embodiment of the present invention, and FIG. 3 is a conceptual diagram of an electronic signature using an electronic signature attribute according to an embodiment of the present invention.

The digital signature original text management unit 110 acquires document information including information related to the number, location, and size of a document about to be digitally signed, and the certificate manager 120 is configured to execute the digital signature original text management unit 110. A certificate and a private key to be used for the digital signature of the acquired document are prepared (S2).

 In order to generate the digital signature document, the digital signature performing unit 130 may include the digital signature document version, the digital signature target text information, the digital signature information version, the digital signature identification information, and the hash algorithm as shown in the following codes 1 to 4. The digital signature information of the digital signature data is set by setting the signature algorithm according to the RFC2630 / 3396 method and setting the digital signature of the digital signature and the certificate revocation list according to the RFC2630 / 3396 method if necessary (S4).

[Code 1]

SignedData :: = SEQUENCE {

        version CMSVersion,

        digestAlgorithms DigestAlgorithmIdentifiers,

        encapContentInfo EncapsulatedContentInfo,

        certificates [0] IMPLICIT CertificateSet OPTIONAL,

        crls [1] IMPLICIT CertificateRevocationLists OPTIONAL,

        signerInfos SignerInfos}

Here, SignedData is the digital signature data, version is the digital signature document version information, digestAlgorithms is a list of hash algorithms for obtaining the hash value of the original digital signature and the digital signature attribute, and encapContentInfo is the type of the digital signature target and the original target of the digital signature. Where certificates denote the digital signature of the digital signature and issuer's certificates, crls denote the certificate revocation lists, and signerInfos denote the digital signature's information list.

[Code 2]

SignerInfo :: = SEQUENCE {

        version CMSVersion,

        sid SignerIdentifier,

        digestAlgorithm DigestAlgorithmIdentifier,

        signedAttrs [0] IMPLICIT SignedAttributes OPTIONAL,

        signatureAlgorithm SignatureAlgorithmIdentifier,

        signature SignatureValue,

        unsignedAttrs [1] IMPLICIT UnsignedAttributes OPTIONAL}

Here, SignerInfo is the digital signature information, version is the digital signature information version, sid is the digital signature information, digestAlgorithm is a hash algorithm for obtaining the hash value of the original and signature attributes, signedAttrs is a digital signature value. The digital signature attributes used are signatureAlgorithm, the digital signature algorithm, signature is the digital signature value created from the hash value and the private key of the digital signature certificate, and unsignedAttr is the non-digital signature attribute.

[Code 3]

SignedAttributes :: = SET SIZE (1..MAX) OF Attribute

Here, Attribute means that digital signature attributes consist of several attribute values.

[Code 4]

Attribute :: = SEQUENCE {

        attrType OBJECT IDENTIFIER,

        attrValues SET OF AttributeValue}

Here, attrType refers to identification information for identifying the type of digital signature attribute, and attrValues refers to digital signature attribute values.

The electronic signature performing unit 130 sets a hash value of each page of the electronic signature target included in the electronic signature attribute (S6).

The electronic signature performing unit 130 determines whether the electronic signature target page is the first page of the electronic document (S8).

As a result of the determination in step S8, in the case of the first page, the digital signature performing unit 130 sets the total number of pages by the following code 5 using sequenceNumber in the electronic signature attribute (S10).

[Code 5]

sequenceNumber ATTRIBUTE :: = {

           WITH SYNTAX SequenceNumber

           EQUALITY MATCHING RULE integer Match

           SINGLE VALUE TRUE

           ID pkcs-9-at-sequenceNumber}

An electronic signature attribute according to an embodiment of the present invention including the sequenceNumber is configured as follows.

ㆍ Content-Type Oid

Content-Type Value

ㆍ SigningTime Oid

ㆍ SigningTime Value

Message-digest Oid

The message digest of the content.

Message-digest Oid

The message digest of the content.

SequenceNumber Oid

ㆍ Total page Number

SequenceNumber Oid

ㆍ current page sequence number

ㆍ Other Attributes (Optional)

Among the digital signature attributes, Content-Type Oid (Object Identifier) is an identifier indicating the type of content to be digitally signed. For example, id-data (general data), signed-data (signed data), and enveloped-data (certificate). Encrypted data), digested-data (hashed data), encrypted-data (encrypted data), authenticated-data, etc. The Content-Type Value indicating the type (eContentType Value) of the signature object (EncapsulatedContentInfo).

Also, the SigningTime Oid (Object Identifier) of the digital signature attribute is an identifier indicating that it is a signature time and an optional item, and includes the SigningTime Value indicating current time information at the time of digital signature. The SigningTime Value may apply the same first signing time to the last page to help verify the integrity.

The message-digest object identifier (ID) of the digital signature attribute is an identifier indicating a hash value and includes the message digest of the content which is a hash value for a current page.

In addition, the message-digest Oid (Object Identifier) of the digital signature attribute is an identifier indicating that the hash value exists only after the second page, and is a hash value of the original text or digital signature attribute of the previous digital signature document. Contains content

In addition, the sequenceNumber Oid (Object Identifier) in the digital signature attribute is an identifier indicating that the serial number exists only on the first page and includes the Total page Number indicating the total number of pages.

The sequenceNumber Oid (Object Identifier) in the digital signature attribute is an identifier indicating a serial number and is an optional item and includes a current page sequence number indicating a sequence of the current page. The current page sequence number is helpful for faster sorting and integrity checking.

The digital signature performing unit 130 sets the sequence information of the current page using the sequenceNumber (S12).

The digital signature performing unit 130 sets a signature time by the following code 6 using SigningTime in the digital signature attribute (S14).

[Code 6]

signingTime ATTRIBUTE :: = {

           WITH SYNTAX SigningTime

           EQUALITY MATCHING RULE signingTimeMatch

           SINGLE VALUE TRUE

           ID pkcs-9-at-signingTime}

The digital signature performing unit 130 obtains a hash value for the digital signature attribute by DER encoding the digital signature attribute (S16).

The electronic signature performing unit 130 determines whether the electronic signature should be performed for each page (S18).

As a result of the determination in step S18, when it is not necessary to perform the electronic signature for each page, the electronic signature performing unit 130 DER encodes the electronic signature document (S20).

Although the encoding method of the digital signature document is set to the DER encoding method in the present embodiment, the present invention is not limited thereto, and the electronic signature document may be encoded by another encoding method.

The electronic signature performing unit 130 determines whether the currently signed page is the last page (S22).

As a result of the determination in step S22, if it is not the last page, the process returns to the step S4, and if it is the last page, the electronic signature is terminated (S24).

As a result of the determination in step S18, when the digital signature is to be performed for each page, the digital signature performing unit 130 generates the digital signature value using the private key of the digital signature certificate and sets it in the digital signature value item. (S26).

As a result of the determination in step S8, if it is not the first page, the digital signature performing unit 130 uses the messageDigest as the hash value for the original electronic signature or the hash value for the electronic signature attribute obtained when generating the electronic signature document of the previous page. After setting the hash value of the previous page using the following code 7 (S28), the procedure proceeds to the step S12.

[Code 7]

messageDigest ATTRIBUTE :: = {

           WITH SYNTAX MessageDigest

           EQUALITY MATCHING RULE octetStringMatch

           SINGLE VALUE TRUE

           ID pkcs-9-at-messageDigest}

The electronic signature document management unit 140 receives the electronically signed electronic document by the above-described process from the electronic signature performing unit 130 and stores the electronically signed electronic document in the DB module 400 or the electronic document. The document output module 300 causes the electronically signed electronic document to be output in an additional form, for example, a 2D barcode.

The concept of performing an electronic signature using the electronic signature attribute of the previous page by the above-described process is summarized in FIG. 3.

That is, the electronic signature of the first page of the electronic document is based on the sequenceNumber Oid, and the electronic signature of the second page uses the first hash value composed of the electronic signature attributes of the first page including the sequenceNumber Oid. It is based on the messageDigest of after and the digital signature of the subsequent page is based on it after repeatedly performing the electronic signature process of the second page using the electronic signature attribute of the previous page.

By performing the electronic signature by this process, each page constituting the electronic document is not electronic signature independently, and the electronic signature is made in a chain, so that it is easy to check the omission of some pages. By signing and verifying the last page, the entire electronic document can be signed and verified.

The flow of verifying the electronic document on which the electronic signature is performed by the above-described process by RFC2630 / 3396 will be described with reference to FIG. 4 as follows.

4 is a flowchart illustrating a verification of an electronically signed electronic document using an electronic signature attribute according to an embodiment of the present invention.

As shown, the electronic signature document management unit 210 receives the electronically signed electronic document from the electronic signature module 100 to prepare for digital signature verification (S32).

The digital signature verification execution unit 220 decodes each page constituting the electronically signed electronic document received by the digital signature document manager 210 (S34).

The electronic signature verification execution unit 220 extracts the electronic signature time when there is information on the electronic signature time in each of the decoded pages, and calculates a hash value of the electronic signature electronic document (S36).

The digital signature verification performing unit 220 includes two messageDigests included in the hash value calculated in step S36 and the first hash value included in the digital signature attribute, that is, the digital signature attribute. It is determined whether or not the first messageDigest is matched (S38).

As a result of the determination in step S38, if it does not match, the digital signature verification execution unit 220 processes the verification as having failed (S39).

As a result of the determination in step S38, if it matches, the digital signature verification performing unit 220 determines whether the total number of pages after the hash value among the digital signature attributes or the hash value of the previous page for each page of the electronic signature. It is determined whether there is a (S40).

As a result of the determination in step S40, when there is a hash value of the previous page, the digital signature verification performing unit 220 obtains a sequential value of the next page (S42).

As a result of the determination in step S40, if there are the total number of pages, the digital signature verification execution unit 220 acquires the total number of pages (S43), and then proceeds to step S42.

The digital signature verification execution unit 220 DER-encodes the digital signature attribute of each page of the electronic signature and hashes it (S44).

The digital signature verification performing unit 220 determines whether the digital signature value is present in the digital signature information (S46).

As a result of the determination in step S46, when there is no electronic signature value, the digital signature verification execution unit 220 determines whether a page to be verified remains (S48).

As a result of the determination in step S48, when there is a page to be verified, the digital signature verification performing unit 220 returns to step S34, and when there is no page to be verified, the digital signature verification performing unit. 220 determines whether or not the acquired total number of pages and the number of pages processed coincide (S50).

As a result of the determination in step S50, if there is a mismatch, the digital signature verification performing unit 220 processes the verification as unsuccessful, and if there is a match, the electronic signature verification performing unit 220 sequentially displays the information on the page that has been digitally signed. It is determined whether there is (S52).

As a result of the determination in step S52, when there is no sequential information, the electronic signature verification execution unit 220 determines whether or not the page from the page with the total number of pages to the last page of the hash value of the previous page (S54).

As a result of the determination in step S54, when connected, the digital signature verification performing unit 220 processes the validity of the electronically signed electronic document as verification (S56).

As a result of the determination in step S52, if there is sequential information, the digital signature verification execution unit 220 arranges pages according to the sequential information (S58), and then proceeds to step S54.

As a result of the determination in step S46, if there is an electronic signature value, the digital signature verification execution unit 220 determines whether the digital signature value and the value decrypted by the digital signature certificate match (S60), If the digital signature verification performing unit 220 performs the procedure to the step S48, if it does not match, the digital signature verification performing unit 220 processes the verification as failed.

The digital signature and its verification method using the above-mentioned digital signature attribute can be applied to signatures for 2D barcodes and their verification, separate signatures and verification for large files, and individual signatures and verification of a plurality of files.

The present invention can be embodied as computer readable codes on a computer readable recording medium. The computer-readable recording medium includes all kinds of recording devices in which data that can be read by a computer system is stored. Examples of computer-readable recording media include ROM, RAM, CD-ROM, magnetic tape, floppy disk, optical data storage, and the like, and also include those implemented in the form of carrier waves such as transmission over the Internet. . The computer readable recording medium can also be distributed over network coupled computer systems so that the computer readable code is stored and executed in a distributed fashion.

According to the present invention as described above there is an effect that can be signed for each page or the entire page and the verification thereof.

In addition, the present invention also has the effect of determining the order of the pages.

In addition, according to the present invention there is an effect that can confirm the integrity of the entire electronic document consisting of each page.

In addition, the present invention also has the effect of determining whether the page is missing or replaced.

In addition, according to the present invention, there is an effect that the entire electronic document can be verified by only signing the last page without generating a signature value of the entire electronic document.

Claims (10)

In the digital signature method using an electronic signature attribute using a system including an electronic signature module, digital signature verification module, electronic document output module and DB module, (a) obtaining, by the digital signature module, document information including information relating to the number, position, and size of a document to be performed by the digital signature module, and preparing a certificate and private key for use in digital signature of the acquired document ( S2); (b) setting the digital signature information of the digital signature data by setting the digital signature document version, the digital signature target text information, the digital signature information version, the digital signature identification information, the hash algorithm, and the signature algorithm by the digital signature module (S4). ); (c) setting, by the electronic signature module, a hash value of each of the electronic signature target pages included in the electronic signature attribute (S6); (d) determining, by the electronic signature module, whether the electronic signature target page is the first page of the electronic document (S8); (e) if the first page is determined as the result of step (d), setting, by the digital signature module, the total number of pages using an electronic signature attribute (S10); (f) setting, by the digital signature module, sequential information of a current page using the digital signature attribute (S12); (g) the electronic signature module encoding a digital signature attribute to obtain a hash value for the digital signature attribute (S16); (h) determining, by the electronic signature module, whether or not the electronic signature should be performed for each page (S18); (i) if it is not necessary to perform an electronic signature for each page as a result of the determination in the step (h), the electronic signature module encoding an electronic signature document (S20); (j) the electronic signature module determining whether the currently signed page is the last page (S22); (k) if it is determined that the step (j) is not the last page, the electronic signature module returns to step (b), and if the last page, the electronic signature module terminates the electronic signature (S24); (l) When the digital signature is required for each page as a result of the determination in the step (h), the digital signature module generates the digital signature value using the private key of the digital signature certificate and sets it in the digital signature value item. Step S26; And (m) As a result of the determination in the step (d), if it is not the first page, the hash value for the original electronic signature or the hash value for the electronic signature attribute obtained by the digital signature module when the digital signature document is generated on the previous page is present. Setting a hash value of the previous page as part of the electronic signature attribute of the page (S28), and then executing the procedure to step (f); Including but not limited to: In step (b), Establishing a certificate and a certificate revocation list of the digital signature; Electronic signature method using an electronic signature property, characterized in that it further comprises. delete The method of claim 1, After step (f), Setting (S14), by the digital signature module, a signature time using SigningTime among the digital signature attributes; Electronic signature method using an electronic signature property, characterized in that it further comprises. The method of claim 1, The electronic signature module causing the DB module to store the electronically signed electronic document or the electronic document output module to output a 2D barcode; Electronic signature method using an electronic signature property, characterized in that it further comprises. In the digital signature verification method using the digital signature attribute using a system including an electronic signature module, digital signature verification module, electronic document output module and DB module, (a ') step (S32), by the electronic signature verification module, receiving the electronically signed electronic document from the electronic signature module; (b ') decoding each page constituting the electronically signed electronic document received by the digital signature verification module (S34); (c ') the electronic signature verification module extracting an electronic signature time when there is information on the electronic signature time in each of the decoded pages, and calculating a hash value of the electronically signed electronic document (S36); (d ') the digital signature verification module determining whether the hash value calculated for each of the digitally signed pages and the hash value for the current page included in the electronic signature attribute match (S38); (e ') processing of the digital signature verification module to fail the verification if it is not matched as a result of the determination of step (d') (S39); (f ') As a result of the determination in the step (d'), if there is a match, the digital signature verification module has the total number of pages after the hash value among the digital signature attributes for each page of the electronic signature, or the hash of the previous page. Determining whether there is a value (S40); (g ') the electronic signature verification module acquiring a sequential value of a next page when there is a hash value of the previous page as a result of the determination in step (f'); (h ') if the electronic signature verification module acquires the total number of pages (S43) when the total number of pages exists as a result of the determination in the step (f'), performing the procedure to the step (g '); (i ') the electronic signature verification module encoding and then hashing the digital signature attribute of each electronically signed page (S44); (j ') determining whether the digital signature verification module has an electronic signature value in the digital signature information (S46); (k ') determining whether a page to be verified by the digital signature verification module remains when there is no electronic signature value as a result of the determination in step (j') (S48); (l ') As a result of determining in step (k'), if there is a page to be verified, the digital signature verification module returns to step (b '), and if there is no page to be verified, the electronic Determining, by the signature verification module, whether the acquired total number of pages matches the number of pages processed (S50); (m ') As a result of the determination in the step (l'), if the digital signature verification module does not verify the verification if it does not match, and if there is a match, whether the digital signature verification module has sequential information on the page where the digital signature is Determining (S52); (n ') as a result of determining in step (m'), if there is no sequential information, determining whether the digital signature verification module is connected to the hash value of the previous page from the page having the total number of pages to the final page ( S54); (o ') step (S56) of the electronic signature verification module processing the validity of the electronically signed electronic document as a result of the determination in the step (n'); (p ') when the determination result of step (m') indicates that there is sequential information, the digital signature verification module arranges pages according to the sequential information (S58), and then executes the procedure to step (n '). ; (q ') In the determination result of the step (j'), if there is an electronic signature value, the electronic signature verification module determines whether the digital signature value and the value decrypted by the digital signature certificate match (S60). If there is a match, the digital signature verification module executes the procedure to step (k '), and if it does not match, the digital signature verification module processes the verification as failed; Digital signature verification method using an electronic signature attribute comprising a. In order to perform the digital signature using the digital signature attribute, (A) a function for acquiring document information including information relating to the number, position, and size of a document to be performed by the digital signature module to perform the digital signature, and preparing a certificate and private key for use in the digital signature of the acquired document; (B) the digital signature module setting the digital signature information of the digital signature data by setting the digital signature document version, the digital signature target text information, the digital signature information version, the digital signature identification information, the hash algorithm, and the signature algorithm; (C) the digital signature module setting a hash value of each digital signature target page included in an electronic signature attribute; (D) a function of the electronic signature module to determine whether the electronic signature target page is the first page of the electronic document; (E) a function of setting the total number of pages using the digital signature attribute by the digital signature module when the first page is determined as a result of the determination of the function (D); (F) the electronic signature module setting the sequential information of the current page using the digital signature attribute; (G) the digital signature module encoding a digital signature attribute to obtain a hash value for the digital signature attribute; (H) a function for determining whether the digital signature module should perform an electronic signature for each page; (I) a function for encoding the electronic signature document by the electronic signature module when it is not necessary to perform the electronic signature for each page as a result of the determination of the function (H); (J) a function of the electronic signature module to determine whether the currently signed page is the last page; (K) a function of the electronic signature module returning to the function (B) if it is not the last page as a result of the determination of the function (J), and terminating the electronic signature by the electronic signature module if the last page; (L) As a result of the determination of the function (H), when the digital signature is to be performed for each page, the digital signature module generates a digital signature value using the private key of the digital signature certificate and sets it in the electronic signature value item. function; And (M) As a result of the determination of the function (D), if it is not the first page, a hash value for the original electronic signature or a hash value for the electronic signature attribute obtained by the digital signature module when the digital signature document is generated on the previous page is present. Setting a hash value of the previous page as part of the digital signature attribute of the page, and then executing the procedure to the above (F) function; Run the The (B) function, Setting a digital signature of the digital signature and a certificate revocation list; A computer-readable recording medium that records a program for executing more. delete The method of claim 6, After the above (f) function, Setting, by the digital signature module, a signing time using SigningTime among the digital signature attributes; A computer-readable recording medium that records a program for executing more. The method of claim 6, The digital signature module causes the DB module to store the electronically signed electronic document or the electronic document output module to output a 2D barcode; A computer-readable recording medium that records a program for executing more. To perform digital signature verification using digital signature attributes, (A ') the digital signature verification module receiving the electronically signed electronic document from the digital signature module; (B ') decoding each page constituting the electronically signed electronic document received by the digital signature verification module; (C ') the digital signature verification module extracting an electronic signature time when there is information on the electronic signature time in each of the decoded pages, and calculating a hash value of the electronically signed electronic document; (D ') the digital signature verification module determining whether the hash value calculated for each digitally signed page and the hash value for the current page included in the electronic signature attribute match; (E ') a function of processing the digital signature verification module as having failed verification if it is not matched as a result of the determination of the function (D'); (F ') As a result of the determination of the function (D'), if there is a match, the digital signature verification module has the total number of pages after the hash value among the digital signature attributes for each page of the electronic signature, or a hash of the previous page. Determining whether there is a value; (G ') a function of the electronic signature verification module acquiring a sequential value of a next page when there is a hash value of the previous page as a result of the determination of the function (F'); (H ') a function of executing the procedure to the (G') function after the digital signature verification module acquires the total number of pages if the total number of pages exists as a result of the determination of the function (F '); (I ') the digital signature verification module hashing after encoding the digital signature attribute of each electronically signed page; (J ') a function of determining whether the digital signature verification module has an electronic signature value in the digital signature information; (K ') determining that, if there is no digital signature value, the page on which the digital signature verification module should perform verification remains as a result of the determination of the function (J'); (L ') As a result of the determination of the function (K'), if there is a page to be verified, the digital signature verification module returns to the function (B '), and if there is no page to be verified, the electronic A function of determining whether a signature verification module matches the total number of pages acquired and the number of pages processed; (M ') As a result of the determination of the (L') function, if there is a mismatch, the digital signature verification module treats the verification as unsuccessful; A function of determining; (N ') determining that the digital signature verification module is connected to the hash value of the previous page from the page having the total number of pages to the last page when there is no sequential information as a result of the determination of the function (M'); (O ') a function of, when connected, the digital signature verification module processing the validity of the electronically signed electronic document as a result of the determination of the function (N'); (P ') a function of executing the procedure to the (N') function after the digital signature verification module arranges the pages according to the sequential information, as a result of the determination of the (M ') function; (Q ') As a result of the determination of the function (J'), when there is an electronic signature value, it is determined whether the digital signature verification module and the value decrypted by the digital signature certificate match and match. The digital signature verification module implements the procedure with the (K ') function, and if the digital signature verification module does not match, the digital signature verification module processes the verification as failed; A computer-readable recording medium that records a program for executing the program.

Images