KR102310811B1 - Method and System for electronic authentication and encryption of data Based On Cloud System - Google Patents

Abstract

The present invention relates to a cloud-based data electronic authentication and encryption method and system, and more particularly, by issuing and storing a certificate and a private key in a secure storage of the cloud, even if the user does not directly possess the certificate and the private key, a cloud environment It relates to a cloud-based data electronic authentication and encryption method and system capable of performing data digital signature and data encryption and decryption.

Description

Cloud-based data electronic authentication and encryption method and system {Method and System for electronic authentication and encryption of data Based On Cloud System}

The present invention relates to a cloud-based data electronic authentication and encryption method and system, and more particularly, by issuing and storing a certificate and a private key in a secure storage of the cloud, even if the user does not directly possess the certificate and the private key, a cloud environment It relates to a cloud-based data electronic authentication and encryption method and system capable of performing data digital signature and data encryption and decryption.

In modern times, with the advent of the smart era, cloud computing technology is developing due to the spread of the Internet and rapid development of information and communication technology. An environment is being prepared where you can always download digital data and perform desired tasks without time and space restrictions by storing it in the .

Meanwhile, in modern times, digital signature technology for authenticating data sent by a specific user is utilized in data transmission and reception. According to the prior art, it is essential to install an application program necessary to perform a digital signature, or to detect malicious code and prevent phishing through a security solution such as ActiveX. However, these security solutions are relatively expensive, so it is true that it is difficult for all service providers to provide security solutions to all users. As the types of malicious code or phishing are diversifying day by day, security solutions also need to be continuously updated or upgraded. .

In addition, a separate certificate issuance procedure is required through the user terminal, and there is an inconvenience of having to directly possess a certificate and a private key for digital signature in a local storage such as a terminal designated by the user. As such, when the user possesses the certificate and the private key, when the user loses the corresponding terminal, the risk of leakage of the private key increases, thereby increasing the possibility of a personal information infringement accident.

In order to solve this problem, the certificate that has been installed on the user's terminal is stored in a cloud-based external system, and digital signature is performed through the certificate while being stored in the external system at the time when user authentication is required. In addition, there is a need for a method for encrypting and decrypting data in an external system such as cloud-based without the need for installation of an installed application and security solution. None.

The present invention issues and stores a certificate and a private key in a secure storage of the cloud, so that the user can digitally sign data in a cloud environment and perform encryption and decryption of data even if the user does not directly possess the certificate and private key, An object of the present invention is to provide a cloud-based data electronic authentication and encryption method, system and computer-readable medium.

In order to solve the above problems, the present invention provides a data digital signature and encryption method by a cloud system including a web portal server, an electronic signature server, an encryption server, and a key management server, A first step of receiving recipient information; The digital signature is performed by the sending user's certificate and private key stored in the key management server, and includes encrypted digital signature data for the original data encrypted by the encryption key stored in the key management server, and the recipient information. a second step of generating and transmitting the sending data to the sending user's terminal; a third step of receiving the sending data and information of the receiving user from the terminal of the receiving user of the sending data; and verifying verification information including information of the receiving user and recipient information included in the sending data, and using a decryption key stored in the key management server according to the verification result of the verification information to digitally sign the encrypted digital signature data. A fourth step of decrypting the original text data and transmitting the digitally signed text data to the terminal of the receiving user; provides a data digital signature and encryption method comprising the.

In an embodiment of the present invention, the second step includes a digital signature step, wherein the digital signature step includes: receiving, by the electronic signature server, the original text data from the web portal server; receiving, by the key management server, the original text data from the digital signature server; deriving digital signature data by performing, by the key management server, a digital signature based on the sending user's certificate and private key; and receiving, by the electronic signature server, the digital signature data from the key management server, wherein the key management server may be connected to the electronic signature server and may not be connected to the web portal server. can

In an embodiment of the present invention, the second step includes a sending data generating step, wherein the sending data generating step performs encryption of the original text data and the digital signature data derived by performing the digital signature. deriving the encrypted digital signature data; deriving a message integrity verification code for verifying the integrity of the recipient information and the encrypted digital signature data; and generating transmission data based on the recipient information, the encrypted digital signature data, and the message integrity verification code and transmitting the transmission data to the terminal of the sending user.

In an embodiment of the present invention, the sending data includes: the recipient information; the encrypted digital signature data; and a message integrity verification code for verifying the integrity of the recipient information and the encrypted digital signature data.

In an embodiment of the present invention, the fourth step includes: receiving, by the encryption server, the information of the receiving user and the sending data from the web portal server; a verification step of deriving a verification result of the verification information by the encryption server; transmitting, by the encryption server, the encrypted digital signature data from the encryption server to the key management server according to the verification result; a decryption step of performing decryption of the encrypted digital signature data by the key management server; receiving, by the encryption server, the digitally signed original text data decrypted from the key management server; and receiving, by the web portal server, the digitally signed original text data from the encryption server, wherein the key management server can be connected to the digital signature server and is not connected to the web portal server. may not be

In an embodiment of the present invention, the fourth step includes a verification step, wherein the verification step includes: a user verification step of deriving a user verification result based on whether the recipient user information and the recipient information match; and message integrity verification for deriving a message integrity verification code for verifying the integrity of the recipient information and the encrypted digital signature data, and deriving a message integrity verification result based on whether the message integrity verification code included in the verification information matches or not step; may include.

In an embodiment of the present invention, the fourth step includes a decryption step, wherein the decryption step includes a decryption key stored in the key management server when the user verification result and the message integrity verification result are derived as verification. can decrypt the digitally signed original text data from the encrypted digital signature data.

In order to solve the above problems, an embodiment of the present invention includes a web portal server, an electronic signature server, an encryption server, and a key management server, and as a cloud system for performing digital signature and encryption of data, the web The portal server receives the original text data and recipient information from the sending user's terminal, the key management server performs digital signatures based on the sending user's certificate and private key stored in the key management server, and the encryption server uses the key Generates sending data including encrypted digital signature data for the original data encrypted by the encryption key stored in the management server, and the recipient information, the web portal server transmits the sending data to the sending user's terminal, , the web portal server receives the sending data and the receiving user's information from the terminal of the receiving user of the sending data, and the encryption server verifies including the receiving user's information and the recipient information included in the sending data. information is verified, and the key management server decrypts the digitally signed original text data from the encrypted digital signature data using a decryption key stored in the key management server according to the verification result of the verification information, and the web portal server uses the electronic There is provided a cloud system for transmitting the signed original text data to the terminal of the receiving user, and performing digital signature and encryption of data.

In order to solve the above problems, an embodiment of the present invention is a method for digitally signing and encrypting data by a cloud system including a web portal server, an electronic signature server, an encryption server, and a key management server, a terminal of a sending user A first step of receiving the original data and recipient information from the; The digital signature is performed by the sending user's certificate and private key stored in the key management server, and includes encrypted digital signature data for the original data encrypted by the encryption key stored in the key management server, and the recipient information. a second step of generating and transmitting the sending data to the sending user's terminal; a third step of receiving the sending data, information of the receiving user, and a public key of the receiving user from the terminal of the receiving user of the sending data; and verifying verification information including information of the receiving user and recipient information included in the sending data, and encrypting the decryption key stored in the key management server using the public key of the receiving user according to the verification result of the verification information. a fourth step of deriving one encryption key data and transmitting the encryption key data to a terminal of a receiving user; and a fifth step of decrypting, by the receiving user's terminal, the decryption key from the encryption key data using the receiving user's private key, and decrypting the digitally signed text data from the encrypted digital signature data using the decryption key; It provides a data digital signature and encryption method, including.

According to an embodiment of the present invention, it is possible to exhibit the effect of performing digital signature on data only by simple self-authentication without needing to possess a certificate and a private key during certificate-based digital signature.

According to an embodiment of the present invention, by performing encryption and decryption in the cloud system, the user can exhibit the effect of encrypting and decrypting without installing an installed solution such as a plug-in in his/her terminal.

According to an embodiment of the present invention, by performing encryption and decryption in the cloud system, it is unnecessary to install an installed solution such as a plug-in in the user's terminal, thereby reducing the investment cost for the introduction and operation of the installed solution. can have an effect.

According to an embodiment of the present invention, by storing the user's certificate and private key in the cloud system, leakage of the certificate and private key is prevented, thereby reducing damage due to leakage of personal information.

According to an embodiment of the present invention, the web portal server connected to a plurality of user terminals has a system that cannot be connected to the key management server in which the user's certificate and private key are stored, so that the security of personal information is strengthened. can be effective.

1 schematically shows the overall system form of a cloud-based data electronic authentication and encryption method according to an embodiment of the present invention.
2 schematically illustrates a process of performing a first step and a second step of the cloud system according to an embodiment of the present invention.
3 schematically illustrates a process of performing a third step and a fourth step of the cloud system according to an embodiment of the present invention.
4 schematically shows steps of a digital signature process of a cloud system according to an embodiment of the present invention.
5 schematically illustrates steps of a process of generating and transmitting transmission data in a cloud system according to an embodiment of the present invention.
6 schematically illustrates a process of processing information received from a sending user's terminal according to an embodiment of the present invention.
7 schematically shows the form of transmission data according to an embodiment of the present invention.
8 schematically illustrates steps of a decryption process of a cloud system according to an embodiment of the present invention.
9 schematically illustrates a message integrity verification process of an encryption server according to an embodiment of the present invention.
10 schematically illustrates a process of processing information received from a receiving user terminal according to an embodiment of the present invention.
11 schematically illustrates an internal configuration of a computing device according to an embodiment of the present invention.

BRIEF DESCRIPTION OF THE DRAWINGS Various embodiments are now described with reference to the drawings, wherein like reference numerals are used to refer to like elements throughout. In this specification, various descriptions are presented to provide an understanding of the present invention. However, it is apparent that these embodiments may be practiced without these specific descriptions. In other instances, well-known structures and devices are provided in block diagram form in order to facilitate describing the embodiments.

As used herein, the terms “component,” “module,” “system,” “part,” and the like refer to a computer-related entity, hardware, firmware, software, a combination of software and hardware, or execution of software. For example, a component can be, but is not limited to being, a process running on a processor, a processor, an object, a thread of execution, a program, and/or a computer. For example, both an application running on a computing device and the computing device may be a component. One or more components may reside within a processor and/or thread of execution, and a component may reside within one computer.

It may be localized within, or distributed between two or more computers. In addition, these components can execute from various computer readable media having various data structures stored therein. The components may contain, for example, a signal having one or more data packets (eg, data from one component interacting with another component in a local system, a distributed system and/or data via a network such as the Internet with another system via a signal). ) may communicate via local and/or remote processes.

Also, the terms "comprises" and/or "comprising" mean that the feature and/or element is present, but excludes the presence or addition of one or more other features, elements and/or groups thereof. should be understood as not

Also, terms including an ordinal number such as 1st, 2nd, etc. may be used to describe various components, but the components are not limited by the terms. The above terms are used only for the purpose of distinguishing one component from another. For example, without departing from the scope of the present invention, a first component may be referred to as a second component, and similarly, the second component may also be referred to as a first component. and/or includes a combination of a plurality of related listed items or any of a plurality of related listed items.

In addition, in the embodiments of the present invention, unless otherwise defined, all terms used herein, including technical or scientific terms, are generally understood by those of ordinary skill in the art to which the present invention belongs. have the same meaning as Terms such as those defined in a commonly used dictionary should be interpreted as having a meaning consistent with the meaning in the context of the related art, and unless explicitly defined in an embodiment of the present invention, an ideal or excessively formal meaning is not interpreted as

The "user terminal" referred to below may be implemented as a computer or portable terminal that can access a server or other terminal through a network. Here, the computer includes, for example, a laptop, a desktop, and a laptop equipped with a web browser (WEB Browser), and the portable terminal is, for example, a wireless communication device that ensures portability and mobility. , PCS (Personal Communication System), GSM (Global System for Mobile communications), PDC (Personal Digital Cellular), PHS (Personal Handyphone System), PDA (Personal Digital Assistant), IMT (International Mobile Telecommunication)-2000, CDMA (Code) Division Multiple Access)-2000, W-Code Division Multiple Access (W-CDMA), Wireless Broadband Internet (Wibro) terminals, and the like may include all types of handheld-based wireless communication devices. In addition, "network" refers to a wired network such as a local area network (LAN), a wide area network (WAN), or a value added network (VAN), or a mobile radio communication network or satellite. It may be implemented as any kind of wireless network, such as a communication network.

1 schematically shows the overall system form of a cloud-based data electronic authentication and encryption method according to an embodiment of the present invention.

The terminal of the sending user or the terminal of the receiving user of FIG. 1 may correspond to the user terminal described above, and the web portal server 1100, the electronic signature server 1200, the encryption server 1300, and the key management server 1400. corresponds to a computing device including one or more processors and one or more memories. Although the web portal server 1100, the electronic signature server 1200, the encryption server 1300, and the key management server 1400 are separately shown in FIG. 1, in another embodiment, the web portal server 1100, the electronic signature The server 1200, the encryption server 1300, and the key management server 1400 may exist as an integrated server.

The terminal of the sending user and the terminal of the receiving user may access the web portal server 1100 of the cloud system through a web browser program or through a dedicated application.

Each of the sending user's terminal and the receiving user's terminal can log in to their account by performing authentication through bio-information or entering a password. Bio-information should be interpreted as information that includes both bio-information that can be extracted from living bodies such as fingerprints, iris, face recognition, voice, and veins, or bio-information of behavioral characteristics such as motion.

The web portal server 1100 can perform communication by accessing a user's terminal, such as a terminal of a sending user and a terminal of a receiving user, the electronic signature server 1200 and the encryption server 1300, and Upon request, the key management server 1400 may be requested to perform the digital signature through the digital signature server 1200 , or the key management server 1400 may be requested to perform encryption or decryption through the encryption server 1300 .

The electronic signature server 1200 receives the original text data and receiver information received from the terminal of the sending user from the web portal server 1100, requests an electronic signature to the key management server 1400, and the key management server 1400 ) can receive the derived digital signature data.

The encryption server 1300 receives the original text data, recipient information and digital signature data from the web portal server 1100, requests encryption to the key management server 1400, and the encryption derived by the key management server 1400 By receiving the digital signature data, it is possible to generate the sending data.

The key management server 1400 stores key data including at least one of a certificate for performing an electronic signature, a private key, a public key, an encryption key, and a decryption key, and the electronic signature server 1200 and encryption It can receive data from the server 1300 and perform digital signature by receiving a request for digital signature, encryption and decryption, or perform encryption and decryption according to stored key data.

Hereinafter, the operation of the cloud system will be described in more detail.

2 schematically illustrates a process of performing a first step and a second step of the cloud system according to an embodiment of the present invention.

The cloud system of the present invention can provide a data digital signature and encryption service. Briefly, by issuing and storing a certificate and a private key in a secure storage of the cloud, data digital signature and data encryption and decryption can be performed in the cloud environment even if the user does not directly possess the certificate and private key.

2 illustrates a process of performing digital signature and generating transmission data in the cloud system. Specifically, the data digital signature and encryption method by the cloud system including the web portal server 1100, the electronic signature server 1200, the encryption server 1300, and the key management server 1400 is performed from the terminal of the sending user. A first step of receiving the original data and recipient information; Encrypted digital signature data for the original data encrypted by the encryption key stored in the key management server 1400 and digital signature is performed by the sending user's certificate and private key stored in the key management server 1400; and a second step of generating transmission data including the recipient information and transmitting the transmission data to a terminal of the sending user. a third step of receiving the sending data and information of the receiving user from the terminal of the receiving user of the sending data; and verification information including information of the receiving user and recipient information included in the sending data, and the encrypted digital signature data using a decryption key stored in the key management server 1400 according to the verification result of the verification information. and a fourth step of decoding the digitally signed original text data from the , and transmitting the digitally signed original text data to the terminal of the receiving user.

Specifically, in step S100, the original text data and recipient information are transmitted from the sending user's terminal to the cloud system. The original data is information that the sending user wants to send to the receiving user, and the form may vary. The recipient information is information of the recipient to whom the sending user wants to send the original text data input through the sending user terminal. The step S100 may correspond to the first step of receiving the original text data and recipient information from the sending user's terminal.

In step S110, the digital signature is performed using the sending user's certificate and private key stored in the key management server 1400 . The cloud system derives digital signature data for the original text data received from the terminal of the sending user by performing the digital signature.

In step S120, encryption of the received original text data and the derived digital signature data is performed using the encryption key stored in the key management server 1400 to derive encrypted digital signature data for the original text data.

In step S130, the cloud system derives a message integrity verification code that verifies the integrity of the recipient information and the encrypted digital signature data.

In step S140, the cloud system generates transmission data based on the recipient information, the encrypted digital signature data, and the message integrity verification code.

In step S150, the cloud system transmits the generated sending data to the terminal of the sending user, and the sending user's terminal receiving the sending data transmits the sending data to the terminal of the receiving user who will receive the sending data to perform data communication. can Steps S110 to S150 may correspond to the second step.

In this way, the sending user can digitally sign sensitive documents containing personal information without having to possess the sending user's certificate and private key in the sending user's terminal, and perform digital signature and encryption in a cloud environment. This can have the effect of sending the encrypted and decrypted data as an individual document.

3 schematically illustrates a process of performing a third step and a fourth step of the cloud system according to an embodiment of the present invention.

Specifically, FIG. 3 shows a process of verifying the verification information of the cloud system according to the present invention and a process of performing decryption of transmission data.

In step S200, the receiving user's terminal transmits the sending data and the receiving user's information received from the sending user's terminal to the cloud system.

In step S210, a verification result including user verification and message integrity verification is derived based on verification information including recipient information and message integrity verification code included in the transmission data.

In step S220, according to the verification result of the verification information derived in step S210, the digitally signed original text data is encrypted and the encrypted digital signature data is decrypted.

In step S230, the cloud system transmits the digitally signed original text data derived by decrypting the encrypted digital signature data to the terminal of the receiving user.

In step S240, the receiving user's terminal may receive and view the digitally signed original text data from the cloud system, and may perform verification of the electronic signature.

In this way, the receiving user's terminal performs decryption on the transmitted data received by the decryption key stored in the key management server 1400 of the cloud system only by simple authentication using the receiving user's information, so that personal information is included. It can have the effect of safely verifying sensitive documents without the risk of leakage.

In another embodiment of the present invention, the receiving user's terminal may receive a decryption key from the cloud system to directly decrypt the encrypted encrypted digital signature data. Preferably, the cloud system of the present invention and the receiving user's terminal include: a first step of receiving the original text data and the recipient's information from the sending user's terminal; The digital signature is performed by the sending user's certificate and private key stored in the key management server, the encrypted digital signature data for the original data encrypted by the encryption key stored in the key management server 1400, and the recipient a second step of generating sending data including information and transmitting it to the sending user's terminal; a third step of receiving the sending data, information of the receiving user, and a public key of the receiving user from the terminal of the receiving user of the sending data; and verifying the verification information including the recipient information included in the information of the receiving user and the sending data, and decrypting stored in the key management server 1400 by the public key of the receiving user according to the verification result of the verification information. a fourth step of deriving encryption key data obtained by encrypting the key and transmitting the encryption key data to a terminal of a receiving user; and a fifth step of decrypting, by the receiving user's terminal, the decryption key from the encryption key data using the receiving user's private key, and decrypting the digitally signed text data from the encrypted digital signature data using the decryption key; can be done

In another embodiment of the present invention, after performing the first to second steps as described above, the cloud system 1000 is configured to provide the sending data, the receiving user's information, and the A third step of receiving the public key of the receiving user is performed.

Then, in the fourth step, the encryption server 1200 verifies the verification information including the recipient information included in the information of the receiving user and the sending data, and the key management server 1400 determines the verification result of the verification information. If it is derived through verification, encryption key data is derived by performing encryption on the decryption key stored in the key management server 1400 using the public key of the receiving user. Thereafter, the derived encryption key data is transmitted to the encryption server 1200, and the encryption server 1200 transmits the received encryption key data to the web portal server. Thereafter, it is transmitted to the terminal of the receiving user by the web portal server 1100 .

In step 5, the receiving user's terminal decrypts the encryption key data received from the web portal server 1100 using the receiving user's private key to derive a decryption key. Thereafter, by performing decryption of the encrypted digital signature data included in the outgoing data using the decryption key decrypted from the encryption key data, digitally signed original text data can be derived. Preferably, the public key and the private key of the receiving user can be generated one-time according to a transaction and discarded after use. As described above, encryption key data that is a decryption key encrypted with the public key of the receiving user from the web portal server 1100 The receiving user's terminal that has received the decryption decrypts the received encryption key data with the receiving user's private key to derive the decryption key, and can directly decrypt the encrypted digital signature data included in the sent data by the decryption key.

4 schematically shows steps of a digital signature process of a cloud system according to an embodiment of the present invention.

In order to perform digital signature, the certificate and private key of the subject who wants to digitally sign are required. In the present invention, the certificate and private key necessary for performing the digital signature are stored in the key management server 1400 of the cloud system, and the digital signature is performed by the key management server 1400 . In the cloud system of the present invention, the digital signature is performed by the sending user's certificate and private key stored in the key management server 1400 , and the original data encrypted by the encryption key stored in the key management server 1400 . A second step of generating transmission data including encrypted digital signature data and the recipient information, and transmitting it to the sending user's terminal, is performed, wherein the second step includes a digital signature step, In the digital signature step, the second step includes a digital signature step, and the digital signature step includes: receiving the original text data from the web portal server 1100 by the digital signature server 1200 ( S111); Receiving the original text data from the digital signature server 1200 by the key management server 1400 (S112); performing a signature to derive digital signature data (S113); receiving, by the digital signature server 1200, the digital signature data from the key management server 1400 (S114); and receiving the digital signature data from the digital signature server 1200 by the web portal server 1100 (S115), wherein the key management server 1400 includes the digital signature server 1200. can be connected to, and is not connected to the web portal server 1100 .

Specifically, in step S111 , the web portal server 1100 that has received the original text data and recipient information from the sending user's terminal transmits the original text data to the digital signature server 1200 .

In step S112, the digital signature server 1200 transmits the original text data received from the web portal server 1100 to the key management server 1400 to request an electronic signature on the original text data.

In step S113 , the key management server 1400 digitally signs the original text data received from the digital signature server 1200 using the certificate and private key stored in the key management server 1400 to derive digital signature data. The stored certificate may include identification information of the sending user, the public key of the sending user, a serial number of the certificate, and certification authority information, a signature of the certification authority, and the like. For example, the key management server 1400 may perform digital signature by encrypting the certificate including the public key of the sending user with the private key. Alternatively, the digital signature may be performed by deriving a hash value of the original text data and encrypting it with a private key. As such, the digital signature that can be performed by the key management server 1400 is not limited to one example, as long as it uses a certificate and a private key, and may be performed in various forms.

In step S114 , the key management server 1400 transmits the derived digital signature data to the digital signature server 1200 .

In step S115 , the digital signature server 1200 transmits the digital signature data received from the key management server 1400 to the web portal server 1100 . In this way, the digital signature data derived by performing the digital signature by the key management server 1400 is transmitted to the web portal server 1100 through the digital signature server 1200 . Preferably, the key management server 1400 may be connected to the digital signature server 1200 , but not to the web portal server 1100 . Through this, the electronic signature is performed in a system in which the web portal server 1100 communicating with the terminals of a plurality of users does not directly communicate with the key management server 1400 storing personal information such as certificates and private keys. , it is possible to exert the effect of strengthening the security of data communication.

5 schematically illustrates steps of a process of generating and transmitting transmission data in a cloud system according to an embodiment of the present invention.

In the cloud system of the present invention, the digital signature is performed by the sending user's certificate and private key stored in the key management server 1400 , and the original data encrypted by the encryption key stored in the key management server 1400 . A second step of generating outgoing data including encrypted digital signature data, and the recipient information, and transmitting it to the sending user's terminal is performed, wherein the second step includes a sending data generating step, The sending data generating step may include: deriving the encrypted digital signature data by performing encryption of the original text data and the digital signature data derived by performing the digital signature (S320); deriving a message integrity verification code for verifying the integrity of the recipient information and the encrypted digital signature data (S340); and generating transmission data based on the recipient information, the encrypted digital signature data, and the message integrity verification code and transmitting the transmission data to the sending user's terminal (S350 and S360).

Specifically, in step S300 , the web portal server 1100 transmits the original text data received from the sending user's terminal, the recipient information, and the digital signature data received from the digital signature server 1200 to the encryption server 1300 .

In step S310 , the encryption server 1300 transmits the original text data and the digital signature data received from the web portal server 1100 to the key management server 1400 .

In step S320 , the key management server 1400 derives encrypted digital signature data by the encryption key stored in the key management server 1400 based on the original text data and the digital signature data received from the encryption server 1300 . The encryption key for performing encryption on the original text data is preferably a symmetric key. However, the encryption key is not limited to the symmetric key, and encryption may be performed using an asymmetric key including the sending user's private key and public key depending on circumstances.

In step S330, the key management server 1400 transmits the encrypted digital signature data derived by performing encryption of the original text data and the digital signature data to the encryption server 1300 in step S320.

In step S340, the encryption server 1300 derives a message integrity verification code for verifying the integrity of the recipient information received from the web portal server 1100 and the encrypted digital signature data received from the key management server 1400 . In one embodiment of the present invention, the encryption server 1300 may derive a message integrity verification code using a MAC (Message Authentication Code) algorithm. The encryption server 1300 derives the message integrity verification code by the encryption key stored in the key management server 1400, and the encryption key is a symmetric key. In another embodiment of the present invention, a hash value of the recipient information and encrypted digital signature data may be derived, the hash value may be encrypted using the sending user's private key, and this may be used as a message integrity verification code. The message integrity verification code is generated by the encryption server 1300 , and the encrypted digital signature data is generated by performing data encryption by the key management server 1400 .

In step S350, the encryption server 1300 generates transmission data based on the recipient information, the encrypted digital signature data, and the message integrity verification code. The sent data generated in this way includes recipient information, encrypted digital signature data, and a message integrity verification code for verifying the integrity of the recipient information and encrypted digital signature data.

In step S360 , the encryption server 1300 transmits the generated transmission data to the web portal server 1100 .

In this way, encryption is performed by the encryption key stored in the key management server 1400 of the cloud system, and the sending data is generated and transmitted to the sending user's terminal, so that the sending user does not have the private key in his or her terminal. Even if it is not, the effect of encryption can be exerted.

In addition, by performing encryption in the cloud system, it is unnecessary to install an installed solution such as a plug-in in the user's terminal, thereby reducing the investment cost for the introduction and operation of the installed solution.

In another embodiment of the present invention, the sending user's terminal may request the transmission of the encryption key when transmitting the original text data to the cloud system. The cloud system may further receive a request for transmission of the encryption key in the first step of receiving the original text data and recipient information from the sending user's terminal. Thereafter, the web portal server 1100 transmits an encryption key transmission request and original text data to the digital signature server 1200; transmitting, by the digital signature server 1200, a request for transmission of the received original text data and encryption key to the key management server 1400; deriving digital signature data by performing an electronic signature in the key management server 1400 based on the sending user's certificate and private key; transmitting the digital signature data and the encryption key from the key management server 1400 to the digital signature server 1200; and transmitting, by the digital signature server 1200, the digital signature data and the encryption key to the web portal server 1100; Thereafter, the web portal server 1100 transmits the digital signature data and the encryption key to the sending user's terminal, and the sending user's terminal receiving the digital signature data and the encryption key receives the digital signature data and the encryption key from the web portal server 1100. By performing encryption of the original text data and the digital signature data by the encryption key, the encrypted digital signature data can be derived, and the message integrity verification code for verifying the integrity of the recipient information and the encrypted digital signature data can be derived to generate the sending data. . As described above, in another embodiment of the present invention, the sending user can obtain an encryption key from the cloud system through the sending user's terminal in the cloud system and can perform encryption directly on the sending user's terminal.

6 schematically illustrates a process of processing information received from a sending user's terminal according to an embodiment of the present invention.

Specifically, FIG. 6 shows a process of processing information in the process of performing digital signature and encryption in the cloud system.

As shown in (a) of FIG. 6 , the sending user's terminal transmits original text data and receiver information to the web portal server 1100 . The web portal server 1100 transmits the received original text data to the electronic signature server 1200 , and the electronic signature server 1200 transmits the received original text data to the key management server 1400 . The key management server 1400 derives digital signature data by performing digital signature on the received original text data using the stored certificate and private key. The key management server 1400 transmits the derived digital signature data to the digital signature server 1200 , and the digital signature server 1200 transmits the digital signature data to the web portal server 1100 .

Thereafter, as shown in (b) of FIG. 6, the web portal server 1100 encrypts the original text data received from the sending user's terminal, the recipient information, and the digital signature data received from the key management server 1400 to the encryption server ( 1300). The encryption server 1300 transmits the original text data and the digital signature data received from the web portal server 1100 to the key management server 1400, and the key management server 1400, the original text data received by the stored encryption key. and encryption of the digital signature data to derive the encrypted digital signature data.

Then, as shown in (c) of FIG. 6, the key management server 1400 transmits the derived encrypted digital signature data to the encryption server 1300, and the encryption server 1300, the web portal server 1100. A message integrity verification code is derived based on an algorithm for deriving a message integrity verification code that verifies the integrity of the recipient information received from the key management server 1400 and the encrypted digital signature data received from the key management server 1400 .

Thereafter, as shown in (d) of FIG. 6, the encryption server 1300 generates transmission data based on the recipient information, the encrypted digital signature data, and the derived message integrity verification code.

As such, even if the sending user's terminal and the receiving user's terminal do not store sensitive personal information in information security such as certificates, private keys, encryption keys, and decryption keys, digital signatures for data and encryption and decryption of data As this is done in the cloud system, the risk of personal information leakage can be prevented and the security of transmitted and received data can be further strengthened.

7 schematically shows the form of transmission data according to an embodiment of the present invention.

As shown in FIG. 7, the sending data generated by the encryption server 1300 of the cloud system of the present invention is message integrity verification for verifying the integrity of the recipient information, the encrypted digital signature data, and the recipient information and the encrypted digital signature data. include code.

The recipient information refers to information about a recipient user who will receive transmission data input through the sending user's terminal.

The encrypted digital signature data is data derived by performing digital signature data and original text data derived by performing digital signature of the original text data transmitted from the sending user's terminal by performing encryption with the encryption key stored in the key management server 1400. it means. Since the encrypted digital signature data is included in the transmission data in an encrypted form and transmitted, even sensitive documents containing personal information can be transmitted without the risk of leakage.

The message integrity verification code is a code for verifying the integrity of the recipient information and the encrypted digital signature data, and the encryption server 1300 may derive the message integrity verification code using a MAC (Message Authentication Code) algorithm. The encryption server 1300 derives the message integrity verification code by the encryption key stored in the key management server 1400, and the encryption key is a symmetric key.
Alternatively, a hash value of the recipient information and encrypted digital signature data may be derived, the hash value may be encrypted using the sending user's private key, and this may be used as a message integrity verification code. The message integrity verification code is generated by the encryption server 1300 , and the encrypted digital signature data is generated by performing data encryption by the key management server 1400 . This message integrity verification code performs decryption of the message integrity verification code on the receiving side, derives a hash value of the recipient information and encrypted digital signature data, and compares the message integrity verification code with the decrypted value. can be verified. After that, the message integrity verification code is verified to verify the encrypted digital signature data, which is the encrypted digitally signed original text data of the outgoing data. can proceed. Such transmission data may be communicated in a form separated or combined into recipient information, encrypted digital signature data, and message integrity verification code within the cloud system.

8 schematically illustrates steps of a decryption process of a cloud system according to an embodiment of the present invention.

The cloud system of the present invention verifies verification information including the recipient information included in the recipient user information and the transmission data, and stores the decryption key in the key management server 1400 according to the verification result of the verification information. a fourth step of decrypting the digitally signed original text data from the encrypted digital signature data and transmitting the digitally signed original text data to the terminal of the receiving user; and the fourth step is the encryption server 1300 ), receiving the information of the receiving user and the sending data from the web portal server 1100 (S400); a verification step (S410 and S420) of deriving a verification result of the verification information by the encryption server 1300; transmitting, by the encryption server 1300, the encrypted digital signature data from the encryption server 1300 to the key management server 1400 according to the verification result (S430); A decryption step (S440) of performing, by the key management server (1400), decryption of the encrypted digital signature data using the decryption key stored in the key management server (1400); receiving, by the encryption server 1300, the digitally signed original text data decrypted from the key management server 1400 (S450); Receiving, by the web portal server 1100, the digitally signed original text data from the encryption server 1300 (S460); and the key management server 1400 is the digital signature server 1200. can be connected to, and is not connected to the web portal server 1100 .

Specifically, in step S400 , the web portal server 1100 transmits the receiving user's information and sending data received from the receiving user's terminal to the encryption server 1300 .

In step S410 , the encryption server 1300 derives a user verification result based on whether the recipient information received from the web portal server 1100 matches the recipient information included in the sending data. If the recipient user's information and the recipient's information match, a user verification result is derived through verification.

In step S420, the encryption server 1300 derives a message integrity verification code for verifying the integrity of the recipient information and encrypted digital signature data included in the sent data for which user verification is completed. Thereafter, the message integrity verification result is derived by determining whether the message integrity verification code included in the verification information included in the sending data matches the message integrity verification code directly derived from the encryption server 1300 . Preferably, the verification information includes a message integrity verification code for verifying the integrity of the recipient information, the recipient user information, and the recipient information and the encrypted digital signature data.

When the message integrity verification code directly derived from the encryption server 1300 matches the message integrity verification code included in the sent data, the message integrity verification result for the received recipient information and encrypted digital signature data is derived as verification, If each message integrity verification code does not match, the message integrity verification result for recipient information and encrypted digital signature data is derived as non-verifiable.

In step S430, the encryption server 1300 converts the encrypted digital signature data included in the transmission data received from the web portal server 1100 to the key management server 1400 when the user verification result and the message integrity verification result are derived as verification. ) to send

In step S440, the key management server 1400 decrypts the encrypted digital signature data using the stored decryption key to derive the decrypted digitally signed original text data.

In step S450 , the key management server 1400 transmits the decrypted digitally signed original text data to the encryption server 1300 .

In step S460, the encryption server 1300 transmits the decrypted digitally signed original text data received from the key management server 1400 to the web portal server. In this way, the digitally signed original text data decrypted by the key management server 1400 is transmitted to the web portal server 1100 through the encryption server 1300 . Preferably, the key management server 1400 may be connected to the encryption server 1300 , but is not connected to the web portal server 1100 .

In this way, data security can be improved by performing a verification step on the transmission data including user verification and message integrity verification, and decoding the received transmission data only when verified through the verification step. , by performing the decryption in the cloud system, the receiving user can exhibit the effect of performing decryption even if he/she does not have a decryption key in his/her terminal.

9 schematically illustrates a message integrity verification process of the encryption server 1300 according to an embodiment of the present invention.

As shown in FIG. 9 , the encryption server 1300 separates the message integrity verification code from the transmission data received from the web portal server 1100 . Thereafter, the encryption server 1300 directly derives a message integrity verification code for verifying the integrity of the recipient information and the encrypted digital signature data. Thereafter, the message integrity verification result is derived based on whether the message integrity verification code separated from the sent data matches the message integrity verification code directly derived. If the two compared message integrity verification codes match, the message integrity verification result is derived through verification. It is judged to be true and the message integrity verification result is derived as non-verifiable.

In this way, by performing message integrity verification, it is possible to exhibit the effect of verifying whether the recipient information and encrypted digital signature data included in the sent data are forged/falsified.

10 schematically illustrates a process of processing information received from a receiving user terminal according to an embodiment of the present invention.

Specifically, FIG. 10 shows a process of processing information in a process of performing decryption in a cloud system.

As shown in FIG. 10 , the receiving user's terminal transmits the sending data and the receiving user's information to the web portal server 1100 . The web portal server 1100 transmits the received outgoing data and the receiving user's information to the encryption server 1300, and the encryption server 1300 verifies the verification information included in the outgoing data, and according to the verified verification result, The encrypted digital signature data included in the transmission data is transmitted to the key management server 1400 . Thereafter, the key management server 1400 decrypts the received encrypted digital signature data using the stored decryption key to derive digitally signed original text data. The key management server 1400 transmits the digitally signed original text data derived by performing the decryption to the encryption server 1300, and the encryption server 1300 sends the digitally signed original text data to the web portal server 1100. do. The web portal server 1100 may transmit the received digitally signed original text data to the receiving user's terminal, and the receiving user's terminal may check the original text data and verify the digital signature. As described above, by performing the decryption in the cloud environment, it is possible to exhibit the effect of performing the decryption without having a decryption key in the receiving user's terminal and without the need to install an installed solution.

11 schematically illustrates an internal configuration of a computing device according to an embodiment of the present invention.

All or some of the components illustrated in FIG. 1 may include components of a computing device to be described later.

11, the computing device 11000 includes at least one processor 11100, a memory 11200, a peripheral interface 11300, an input/output subsystem ( I/O subsystem) 11400 , a power circuit 11500 , and a communication circuit 11600 may be included at least.

The memory 11200 may include, for example, a high-speed random access memory, a magnetic disk, an SRAM, a DRAM, a ROM, a flash memory, or a non-volatile memory. have. The memory 11200 may include a software module, an instruction set, or other various data necessary for the operation of the computing device 11000 .

In this case, access to the memory 11200 from other components such as the processor 11100 or the peripheral device interface 11300 may be controlled by the processor 11100 . The processor 11100 may be configured as a single or plural number, and may include a GPU and a TPU type processor to improve operation processing speed.

Peripheral interface 11300 may couple input and/or output peripherals of computing device 11000 to processor 11100 and memory 11200 . The processor 11100 may execute a software module or an instruction set stored in the memory 11200 to perform various functions for the computing device 11000 and process data.

The input/output subsystem 11400 may couple various input/output peripherals to the peripheral interface 11300 . For example, the input/output subsystem 11400 may include a controller for coupling a peripheral device such as a monitor, keyboard, mouse, printer, or a touch screen or sensor as required to the peripheral interface 11300 . According to another aspect, input/output peripherals may be coupled to peripheral interface 11300 without going through input/output subsystem 11400 .

The power circuit 11500 may supply power to all or some of the components of the terminal. For example, the power circuit 11500 may include a power management system, one or more power sources such as batteries or alternating current (AC), a charging system, a power failure detection circuit, a power converter or inverter, a power status indicator, or a power source. It may include any other components for creation, management, and distribution.

The communication circuit 11600 may enable communication with another computing device using at least one external port.

Alternatively, as described above, if necessary, the communication circuit 11600 may include an RF circuit to transmit and receive an RF signal, also known as an electromagnetic signal, to enable communication with other computing devices.

This embodiment of FIG. 11 is only an example of the computing device 11000, and the computing device 11000 may omit some components shown in FIG. 11 or further include additional components not shown in FIG. 11, or 2 It may have a configuration or arrangement that combines two or more components. For example, a computing device for a communication terminal in a mobile environment may further include a touch screen or a sensor in addition to the components shown in FIG. 11 , and various communication methods (WiFi, 3G, LTE) are provided in the communication circuit 1160 . , Bluetooth, NFC, Zigbee, etc.) may include a circuit for RF communication. Components that may be included in the computing device 11000 may be implemented in hardware, software, or a combination of both hardware and software including an integrated circuit specialized for one or more signal processing or applications.

Methods according to an embodiment of the present invention may be implemented in the form of program instructions that can be executed through various computing devices and recorded in a computer-readable medium. In particular, the program according to the present embodiment may be configured as a PC-based program or an application dedicated to a mobile terminal. The application to which the present invention is applied may be installed in the user terminal through a file provided by the file distribution system. As an example, the file distribution system may include a file transmission unit (not shown) that transmits the file according to a request of the user terminal.

The device described above may be implemented as a hardware component, a software component, and/or a combination of the hardware component and the software component. For example, devices and components described in the embodiments may include, for example, a processor, a controller, an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a field programmable gate array (FPGA). , a programmable logic unit (PLU), a microprocessor, or any other device capable of executing and responding to instructions, may be implemented using one or more general purpose or special purpose computers. The processing device may execute an operating system (OS) and one or more software applications running on the operating system. The processing device may also access, store, manipulate, process, and generate data in response to execution of the software. For convenience of understanding, although one processing device is sometimes described as being used, one of ordinary skill in the art will recognize that the processing device includes a plurality of processing elements and/or a plurality of types of processing elements. It can be seen that can include For example, the processing device may include a plurality of processors or one processor and one controller. Other processing configurations are also possible, such as parallel processors.

Software may comprise a computer program, code, instructions, or a combination of one or more thereof, which configures a processing device to operate as desired or is independently or collectively processed You can command the device. The software and/or data may be any kind of machine, component, physical device, virtual equipment, computer storage medium or device, to be interpreted by or to provide instructions or data to the processing device. , or may be permanently or temporarily embody in a transmitted signal wave. The software may be distributed over networked computing devices and stored or executed in a distributed manner. Software and data may be stored in one or more computer-readable recording media.

The method according to the embodiment may be implemented in the form of program instructions that can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, etc. alone or in combination. The program instructions recorded on the medium may be specially designed and configured for the embodiment, or may be known and available to those skilled in the art of computer software. Examples of the computer-readable recording medium include magnetic media such as hard disks, floppy disks and magnetic tapes, optical media such as CD-ROMs and DVDs, and magnetic such as floppy disks. - includes magneto-optical media, and hardware devices specially configured to store and carry out program instructions, such as ROM, RAM, flash memory, and the like. Examples of program instructions include not only machine language codes such as those generated by a compiler, but also high-level language codes that can be executed by a computer using an interpreter or the like. The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the embodiments, and vice versa.

As described above, although the embodiments have been described with reference to the limited embodiments and drawings, various modifications and variations are possible from the above description by those skilled in the art. For example, the described techniques are performed in a different order than the described method, and/or the described components of the system, structure, apparatus, circuit, etc. are combined or combined in a different form than the described method, or other components Or substituted or substituted by equivalents may achieve an appropriate result.

Therefore, other implementations, other embodiments, and equivalents to the claims are also within the scope of the following claims.

Claims (9)

A data digital signature and encryption method by a cloud system including a web portal server, an electronic signature server, an encryption server, and a key management server, the method comprising:
The key management server may be connected to the digital signature server, but is not connected to the web portal server,
The sending user's terminal and the receiving user's terminal can communicate only with the web portal server,
The key management server performs the digital signature only in response to the digital signature request from the digital signature server,
The key management server performs encryption of data only in response to the encryption request of the encryption server,
The key management server stores key data including at least one of a certificate and a private key, a public key, an encryption key, and a decryption key for performing an electronic signature,
The cloud system is
a first step of receiving, by the web portal server, original text data and recipient information from a terminal of a sending user;
The digital signature is performed by the key management server by the sending user's certificate and private key stored in the key management server, and the original data encrypted by the encryption server by the encryption key stored in the key management server. a second step of generating, by the web portal server, sending data including encrypted digital signature data and the recipient information, and transmitting it to the sending user's terminal;
a third step of receiving, by the web portal server, the sending data and information of the receiving user from the terminal of the receiving user of the sending data; and
The encryption server verifies the verification information including the recipient information included in the information of the receiving user and the sent data, and the key management server stores the verification information stored in the key management server according to the verification result of the verification information. a fourth step of decrypting the digitally signed original text data from the encrypted digital signature data using a decryption key, and transmitting the digitally signed original text data to the terminal of the receiving user by the web portal server;
The second step includes a digital signature step,
The electronic signature step is
receiving, by the electronic signature server, the original text data from the web portal server;
receiving, by the key management server, the original text data from the digital signature server;
deriving digital signature data by performing, by the key management server, a digital signature based on the sending user's certificate and private key; and
Receiving, by the digital signature server, the digital signature data from the key management server;
The second step includes a sending data generation step,
The sending data generation step is,
deriving the encrypted digital signature data by encrypting, by the key management server, the original text data and the digital signature data derived by performing the digital signature;
deriving, by the encryption server, a message integrity verification code for verifying the integrity of the recipient information and the encrypted digital signature data;
Generating, by the encryption server, sending data based on the recipient information, the encrypted digital signature data, and the message integrity verification code, and transmitting it to the sending user's terminal; .
delete delete The method according to claim 1,
The sending data is
the recipient information;
the encrypted digital signature data; and
and a message integrity verification code for verifying the integrity of the recipient information and the encrypted digital signature data.
The method according to claim 1,
The fourth step is
receiving, by the encryption server, the information of the receiving user and the sending data from the web portal server;
a verification step of deriving a verification result of the verification information by the encryption server;
transmitting, by the encryption server, the encrypted digital signature data from the encryption server to the key management server according to the verification result;
a decryption step of performing decryption of the encrypted digital signature data by the key management server;
receiving, by the encryption server, the digitally signed original text data decrypted from the key management server; and
Receiving, by the web portal server, the digitally signed original text data from the encryption server;
The key management server may be connected to the digital signature server, but not connected to the web portal server.
The method according to claim 1,
The fourth step includes a verification step,
The verification step is
a user verification step of deriving, by the encryption server, a user verification result based on whether the recipient user information and the recipient information match; and
By the encryption server, a message integrity verification code for verifying the integrity of the recipient information and the encrypted digital signature data is derived, and a message integrity verification result is obtained based on whether the message integrity verification code included in the verification information matches. Containing, digital signature and encryption method of the message;
7. The method of claim 6,
The fourth step includes a decryption step,
The decryption step is
When the user verification result and the message integrity verification result are derived by verification by the encryption server, the original text digitally signed by the key management server from the encrypted digital signature data by the decryption key stored in the key management server A data digital signature and encryption method that decrypts data.
A cloud system comprising a web portal server, an electronic signature server, an encryption server, and a key management server, and performing digital signature and encryption of data,
The key management server may be connected to the digital signature server, but is not connected to the web portal server,
The sending user's terminal and the receiving user's terminal can communicate only with the web portal server,
The key management server performs the digital signature only in response to the digital signature request from the digital signature server,
The key management server performs encryption of data only in response to the encryption request of the encryption server,
The key management server stores key data including at least one of a certificate and a private key, a public key, an encryption key, and a decryption key for performing an electronic signature,
The web portal server receives the original text data and recipient information from the sending user's terminal,
The key management server performs digital signatures using the sending user's certificate and private key stored in the key management server;
In performing the electronic signature,
The digital signature server receives the original text data from the web portal server,
receiving the original text data from the digital signature server by the key management server;
Deriving digital signature data by performing digital signature by the key management server using the sending user's certificate and private key,
receiving the digital signature data from the key management server by the digital signature server;
The encryption server generates encrypted digital signature data for the original data encrypted by the encryption key stored in the key management server, and transmission data including the recipient information,
In generating the sending data,
The key management server derives the encrypted digital signature data by performing encryption of the original text data and the digital signature data derived by performing the digital signature,
The encryption server derives a message integrity verification code for verifying the integrity of the recipient information and the encrypted digital signature data,
The encryption server generates transmission data based on the recipient information, the encrypted digital signature data, and the message integrity verification code,
The web portal server transmits the sending data to the sending user's terminal,
The web portal server receives the sending data and information of the receiving user from the terminal of the receiving user of the sending data,
The encryption server verifies verification information including information of the receiving user and recipient information included in the sending data,
The key management server decrypts the digitally signed original text data from the encrypted digital signature data using a decryption key stored in the key management server according to the verification result of the verification information;
The web portal server transmits the digitally signed original text data to the terminal of the receiving user, a cloud system for performing digital signature and encryption of data.
A data digital signature and encryption method by a cloud system including a web portal server, an electronic signature server, an encryption server, and a key management server, the method comprising:
The key management server may be connected to the digital signature server, but is not connected to the web portal server,
The sending user's terminal and the receiving user's terminal can communicate only with the web portal server,
The key management server performs the digital signature only in response to the digital signature request from the digital signature server,
The key management server performs encryption of data only in response to the encryption request of the encryption server,
The key management server stores key data including at least one of a certificate and a private key, a public key, an encryption key, and a decryption key for performing an electronic signature,
The cloud system is
a first step of receiving the original text data and recipient information from the terminal of the sending user by the web portal server and the web portal server;
The digital signature is performed by the key management server by the sending user's certificate and private key stored in the key management server, and the original data encrypted by the encryption server by the encryption key stored in the key management server. a second step of generating, by the web portal server, sending data including encrypted digital signature data and the recipient information, and transmitting it to the sending user's terminal;
a third step of receiving, by the web portal server, the sending data, the information of the receiving user, and the public key of the receiving user from the terminal of the receiving user of the sending data; and
The encryption server verifies the verification information including the recipient information included in the information of the recipient user and the outgoing data, and the key management server verifies the public key of the recipient user according to the verification result of the verification information a fourth step of deriving encryption key data obtained by encrypting the decryption key stored in the key management server, and transmitting, by the web portal server, the encryption key data to a terminal of a receiving user; and
a fifth step of decrypting, by the receiving user's terminal, the decryption key from the encryption key data using the receiving user's private key, and decrypting the digitally signed text data from the encrypted digital signature data using the decryption key; do,
The second step includes a digital signature step,
The electronic signature step is
receiving, by the electronic signature server, the original text data from the web portal server;
receiving, by the key management server, the original text data from the digital signature server;
deriving digital signature data by performing, by the key management server, a digital signature based on the sending user's certificate and private key; and
Receiving, by the electronic signature server, the digital signature data from the key management server;
The second step includes a sending data generation step,
The sending data generation step is,
deriving the encrypted digital signature data by encrypting, by the key management server, the original text data and the digital signature data derived by performing the digital signature;
deriving, by the encryption server, a message integrity verification code for verifying the integrity of the recipient information and the encrypted digital signature data;
Generating, by the encryption server, sending data based on the recipient information, the encrypted digital signature data, and the message integrity verification code, and transmitting it to the sending user's terminal; .

Images