JP2001350405A - Validity term extension system for digital signature, validity term extending device for the same, verifying method for the same and validity term extending method for the same - Google Patents

Abstract

PROBLEM TO BE SOLVED: To enable a person different from an original signatory to perform the extending of the validity term of an original digital signature. SOLUTION: The validity term extending device 4 for a digital signature transmits an original digital signature 42 to a time stamp issuing server 10 within the validity term and the time stamp issuing server 10 combines time information 43 concerning a time when the original digital signature 42 is received with the signature to generate a digital signature as a time stamp 45. The device 4 successively repeats an operation that a new digital signature having the new validity term is generated by combining the digital signature 42 with the time stamp 45 and the new digital signature is transmitted to the time stamp server 10 within the new validity term.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an apparatus for extending the validity period of a digital signature generated by using a public key system.

[0002]

2. Description of the Related Art FIG. 13 shows an apparatus for extending a digital signature constructed in accordance with the conventional method for extending the validity of a cryptographic certificate shown in Japanese Patent Application Laid-Open No. 8-504965. Digital signature expiration date extension device,
Reference numeral 102 denotes a document obtaining unit that obtains an original digital document to which a digital signature is to be attached, 103 denotes a signature generation unit that generates an original digital signature for the obtained document, and 104 denotes that the expiration date of the digital signature is extended. Extension means for generating data for use.

Next, the operation will be described. FIG. 14 shows FIG.
3 is a flowchart showing the operation of the digital signature extension device shown in FIG. 3, where S101 is a step of obtaining an original digital document to be digitally signed; and S102 is an operation of obtaining the original digital document by using the digital signature function F1. Generating a digital signature, S1
03 is a step of combining the original document and the digital signature, and S104 is a step of generating a new digital signature for the combined original digital document and digital signature using the digital signature function F2. First, the digital signature expiration date extension apparatus 101 acquires the original digital document D to be signed by the document acquisition means 102 (step S101). Next, a digital signature C1 = F1 (D) is generated by the digital signature function F1 valid for the digital document D (meaning that the digital certificate to be used has not expired) by the signature generation means 103. (Step S10
2). Next, the original document D and the signature C1 are combined (step S103). At some point after the time when the first signature C1 is generated in step S102 and before the expiration date of the signature C1, the new digital signature function F2 (expiration date is later in time than F1) is used. , A signature C2 = (D, C1) is generated for the data combined in step S103 (step S1).
04).

[0004] This conventional digital signature expiration date extension apparatus applies a signature to a combination of an original document and a signature by a new signature method with a longer expiration date before the digital signature expires. , To maintain the validity of the signature on the original document.

[0005]

The conventional digital signature expiration date extension device is based on the premise that the signature is changed by the original signer, and entrusts the trouble of changing the signature to another person. On the contrary, there is a problem in that it is not possible to provide a service in which another person takes the trouble of changing the signature.

Further, the conventional digital signature validity term extension device is premised on knowing the expiration date in advance, so that its validity is unexpectedly lost before the expiration date indicated on the digital certificate. (For example, the revocation of a digital certificate due to a transfer or retirement of a person in charge, or loss of validity due to leakage of a secret key).

SUMMARY OF THE INVENTION The present invention has been made to solve the above-described problem, and has as its object to enable a person different from the original signer to extend the expiration date of the original digital signature.

Another object of the present invention is to make it possible to extend the validity period even when the validity of a digital signature is unexpectedly lost.

[0009]

A digital signature expiration date extension system according to the present invention is a digital signature expiration date extension system including a digital signature expiration date extension device and a time stamp generation device. The time extension device includes a signature extension unit, a time stamp acquisition unit, and a signature storage unit. The signature extension unit includes a first digital signature having a first expiration date and the time stamp acquisition unit having the time stamp. A first time stamp corresponding to the first digital signature obtained from the stamp generating apparatus, and combining the first time stamp with the first time stamp to generate combined data; converting the combined data into a digital signature to generate a second data after the first expiration date;
Generates a second digital signature having an expiration date of before the first expiration date, and the time stamp obtaining means includes:
Transmitting the first or second digital signature to the time stamp generating device, and transmitting the first or second time stamp corresponding to the first or second digital signature from the time stamp generating device to the first or second digital signature, respectively; Or, before the second expiration date, the signature storage unit stores each digital signature generated by the signature extension unit and each timestamp obtained by the timestamp obtaining unit. Receiving the first or second digital signature from the time stamp obtaining means, and receiving the first or second digital signature at the time when the first or second digital signature is received;
Alternatively, it generates a first or a second time stamp for certifying that a second digital signature has been present.

In the digital signature expiration date extension system according to the present invention, the time stamp generating device includes the first or second digital signature received from the time stamp obtaining means. A preliminary stamp is generated by combining time information related to the time at which the digital signature was received, and data containing a signed preliminary stamp generated by digitally signing the preliminary stamp is used as the first or second time stamp. This is transmitted to the time stamp acquisition means.

Further, in the digital signature expiration date extension system according to the present invention, the digital signature expiration date extension device includes an expiration date detecting means for detecting a remaining period of the first digital signature until the first expiration date. Further, the signature extension unit combines the first digital signature and the first time stamp stored in the signature storage unit when the remaining period detected by the expiration date detection unit becomes a predetermined value or less. And generating a second digital signature having a second expiration date longer than the first expiration date.

Further, in the digital signature expiration date extension system according to the present invention, the digital signature expiration date extension device includes a temporary extension signature generation unit, a temporary extension signature storage unit,
The temporary extension signature generating unit further includes a revocation signature search unit and a storage extension signature selection unit, wherein the temporary extension signature generation unit sets the latest extension signature at a predetermined time interval within the expiration date of the latest digital signature stored in the signature storage unit. A temporary extension signature which is a digital signature generated from the digital signature of the above and the corresponding time stamp is generated, and the time stamp obtaining means transmits the temporary extension signature to the time stamp generation device, and A corresponding temporary extension time stamp is obtained from the time stamp generation device, and the temporary extension signature storage unit stores the temporary extension signature and a temporary extension time stamp corresponding to the temporary extension signature in association with each other, and stores the time stamp. When receiving the temporary extension signature from the time stamp obtaining means, the generation device may generate the temporary extension signature at a time when the temporary extension signature is received. A temporary extension time stamp for proving that a time extension signature was present is generated, and the invalidation signature search means searches for an invalid digital signature from the latest digital signature, and the invalid digital signature is An invalidation time that has become invalid is acquired, and the storage extension signature selecting means, wherein the invalidation time is selected from the temporary extension signatures generated from the latest invalid digital signature acquired by the invalidation signature search means. The most recently generated and latest temporary extension signature and the time stamp corresponding to the temporary extension signature are stored as the latest digital signature and the corresponding time stamp in the signature storage unit.

Further, in the digital signature validity extension system according to the present invention, the time stamp generating device may include, in the temporary extension signature received from the time stamp obtaining means, a time associated with a time when the temporary extension signature is received. A preliminary stamp is generated by combining the information, and the preliminary stamp is digitally signed, and the data including the signed preliminary stamp is transmitted to the time stamp acquisition unit as the temporary extension time stamp.

Further, in the digital signature validity term extension system according to the present invention, the digital signature validity term extension device and the time stamp generation device are integrally formed.

Further, in the digital signature verification method according to the present invention, when the second digital signature is successfully verified, the first digital signature is received by the time stamp generating device when the first digital signature is received. It is determined that the file exists at the specified time and has not been tampered with since the reception time.

A digital signature expiration date extension device according to the present invention is a digital signature expiration date extension device for extending a digital signature having a predetermined expiration date set therein. At any time within the expiration date of a certain extension target digital signature, a time stamp obtaining means for obtaining a time stamp certifying that the extension target digital signature was present at the time, and the extension target digital signature and the time Signature extension means for generating combined data by combining the time stamps obtained by the stamp obtaining means, and generating a digital signature having an expiration date longer than the expiration date from the combined data; It is provided with a signature storing means for storing a corresponding time stamp in association with the time stamp.

A method for extending the validity period of a digital signature according to the present invention includes the following steps. (1) generating a timestamp certifying that a first digital signature having a first expiration date exists at a predetermined time within the first expiration date before the first expiration date; (2) Before the first expiration date, the first digital signature and the time stamp are combined to generate combined data, and the combined data is converted into an electronic signature, which is used after the first expiration date. Generating a second digital signature having a second expiration date.

[0018]

DESCRIPTION OF THE PREFERRED EMBODIMENTS Embodiment 1 Embodiment 1 will be described with reference to FIGS. To explain the diagram,
FIG. 1 is a block diagram showing the configuration of a system including a digital signature expiration date extension device according to this embodiment.
Is a flowchart showing the operation of this system, FIG. 3 is a diagram showing the structure of a digital certificate in this embodiment,
4 and 8 are diagrams showing the configuration of a time stamp in this embodiment, FIG. 5 is a diagram showing the configuration of a signature storage unit in this embodiment, and FIG. 6 is a digital signature expiration date in this embodiment of the present invention. FIG. 7 is a flowchart showing the operation of the extension device, and FIG. 7 is a diagram showing the configuration of the digital signature in this embodiment.

First, the configuration of the system will be described with reference to FIG. In FIG. 1, reference numeral 1 denotes a user client that applies a signature to an original digital document and issues a request to a digital signature expiration date extension device, and 2 denotes a user digital certificate for the original digital document. The signature generating means 3 for generating a digital signature based on the digital signature is a communication means for transmitting a message for requesting extension of the expiration date of the digital signature generated by the signature generating means 2.

Reference numeral 4 denotes a digital signature expiration date extension device for providing an extension service of a digital signature in response to a request message from the user client 1. Reference numeral 5 denotes communication means for receiving a request message from the user client 1. Reference numeral 6 denotes a digital signature. Expiration date detecting means for detecting the expiration date of the digital signature stored in the expiration date extension device 4 from the expiration date of the digital certificate used to generate the signature, 7
Is a timestamp obtaining means for obtaining a timestamp from a timestamp issuing server 10 described later via the communication means 5, 8 is an extension signature storing means for managing a signature obtained from a user client, a timestamp and an extended signature,
Reference numeral 9 denotes a signature storage unit for actually storing a signature, a time stamp, and an extended signature obtained from a user client.
2 is a signature extension means for generating a digital signature extended by the digital signature validity term extension device 4, 10 is a time stamp issuing server for generating and issuing a time stamp, 11
Is a network that enables exchange of messages between the user client 1, the digital signature validity term extension device 4, and the time stamp issuing server 10. The time stamp issuing server 10 is a time stamp generating device according to the present invention.

Reference numeral 21 denotes a receiver client for receiving a digital document with a digital signature from the user client 1. Reference numeral 22 denotes a signature verification unit for verifying the digital signature received from the user client. Reference numeral 23 denotes a receiver client. Communication means for communicating with the user client 1 and the digital signature expiration date extension device 4.

The digital signature expiration date extension device 4 comprises:
A private key and a public key for the own device and a digital certificate corresponding to the public key are periodically acquired from a certificate authority (not shown). These secret key, public key, and digital certificate are used when the digital signature expiration date extension device 4 generates a digital signature, and are used in the “signature method” of the digital signature expiration date extension device 4 in the following description. Included. Therefore, it is also updated periodically like the "signature method" of the digital signature validity term extension device 4. The digital certificate has an expiration date given by the above-mentioned certificate authority. Within this expiration date, the digital signature expiration date extension device 4 transmits a new private key, a public key and a digital key corresponding to the public key. Obtain a certificate. The expiration date of this new digital certificate is later in time than the expiration date of the digital certificate obtained earlier.

Next, the operation will be described. First, an initial operation when a user sends a signature extension request to the signature extension service will be described with reference to a flowchart shown in FIG. The user requests the extension of the expiration date of the digital signature, for example, while the content of the original digital document D is a contract for 10 years, while the expiration date that can be obtained for the digital signature is less than 10 years, for example, For example, six months.

First, the signature is generated by the signature generation means 2 of the user client 1 based on the digital certificate valid for the user.
Digital signature Sc (D) of original digital document D
Is generated (step S1). Digital signature Sc (D)
Is generated by taking the hash value of the target digital document D by an algorithm such as MD5 or SHA-1, and encrypting the hash value with a private key Ksu of the RSA public key cryptosystem unique to the user client 1. By combining the encrypted data with a digital certificate issued by a certificate authority (not shown), which is a trusted third party, for the public key Kpu corresponding to the secret key Ksu. This relationship is shown in FIG. The digital certificate 31 shown in FIG. 3 is provided with an expiration date Au by the above certificate authority.
The digital certificate 31 is valid only before u.
The expiration date Au is the digital signature Sc (D) 3
2 is the expiration date. Further, since the digital certificate 31 contains the public key Kpu, the digital signature Sc
Using (D) 32 and the original digital document D33, it is possible to verify whether the digital document D33 has been tampered with.

Next, the user client 1 transmits a signature extension request including the digital signature Sc (D) 32 to the digital signature extension unit 4 via the network 11 by the communication means 3 before the expiration date Au (see FIG. 2). Step S
2).

The digital signature validity term extension device 4 receives the digital signature Sc (D) by the communication means 5 (step S3). This digital signature Sc (D) is stored in the signature storage unit 9 by the signature storage unit 8. Next, the digital signature expiration date extension device 4
As a result, a time stamp issuance request for the digital signature Sc (D) is transmitted to the time stamp issuance server 10 via the communication means 5 (step S4). This time stamp issuance request includes the digital signature Sc (D).

The time stamp issuance server 10 receives this time stamp issuance request, and applies a time stamp TSo (Sc) to the digital signature Sc (D) included therein.
(D)) is created and transmitted to the digital signature validity term extension device 4 via the network 11 (step S5).

A method of generating a time stamp is, for example, to generate a preliminary stamp by combining data to be subjected to the time stamp (in this case, the digital signature Sc (D)) and time information. The time stamp issuance server 10 generates a digital signature. This time information is the time stamp issuing server 1 here.
It is assumed that 0 is information including the time (including the date) when the time stamp issuance request is received. Further, a method of generating a digital signature for the preliminary stamp is performed by using the digital signature Sc in the signature generation unit 2 of the user client 1.
This is the same as the generation of (D). The hash value of the spare stamp is obtained by an algorithm such as MD5 or SHA-1, and the hash value is encrypted with the secret key Kst0 of the RSA public key cryptosystem unique to the time stamp issuing server 10. A public key Kp corresponding to the secret key Kst0 is added to the encrypted data.
For example, a digital certificate issued by a certificate authority (not shown), which is a trusted third party, is combined with t0. This relationship is shown in FIG. Digital certificate 4 in Figure 4
1 includes the above-mentioned public key Kpt0, if the combined value 44 of the digital signature Sc (D) 42 and the time information 43 has been tampered with, it is possible to detect the tampered value, and the third party can trust the time stamp issuing server. The operation by the user can prove that the target digital signature Sc (D) 42 exists at the time indicated by the time information 43 attached thereto (this time is referred to as t0). The digital certificate 41 has an expiration date At0, which indicates a time after the time t0. The expiration date A of the digital signature Sc (D) 32
u must also be a time after time t0. The encrypted data of the hash value in FIG. 4 is the signature preliminary stamp in the present invention.

The digital signature validity term extension device 4 uses the time stamp TSo (Sc (D)) 45 by the communication means 5.
Is received, the signature Sc (D) and the time stamp TSo (S
c (D)) to the signature storage unit 8, which stores the signature Sc (D) and the time stamp TSo.
(Sc (D)) and ((Sc (D), TSo
(Sc (D))) is stored in the signature storage unit 9 (step S6). At this time, the signature storage 9 stores 9a, 9 in FIG.
The original data Sc (D) and the above ((Sc (D), TSo (Sc (D))) are respectively stored only in the area b. The initial action to request an extension has been completed.

Next, the operation of extending the digital signature in the digital signature expiration date extension device 4 will be described with reference to the flowchart shown in FIG. First, the digital signature validity term extension device 4 uses the validity term detecting means 6 to detect a digital signature with a near expiration date in the signature storage unit 9 (step S11). The determination as to whether the expiration date is near or not is made, for example, by a certain number of days or a period
If the remaining period from the current date or date and time until the expiration date shown in the digital certificate attached to the digital signature is less than P as shown in FIG. It is determined that the expiration date is not near. If there is no near-expired digital signature, the process returns to step S11. If there is a near-expired digital signature Si (X), the process proceeds to step S13 (step S12). However, the X is a previous signature Si-1 (Si-2 (Si-2 (X)) in a series of "extended signatures" (signature series) generated from the original digital signature Sc (D) as described later. Si-3 (・ ・
.. Sc (D)...), TSi-2 (Si-2 (S
i-3 (... Sc (D)...)) and TSi-1 (Si-1 (Si-2
(Si-3 (... Sc (D) ...), TSi-
2 (Si-2 (Si-3 (... Sc (D)...)
-) Represents the combined data of ()). Here, i is 0 or a positive integer, and S0 (X) = Sc (D). FIG.
Steps S11 to S15 in the flowchart of FIG.
In the first time of the flow of i, i = 0, and thereafter i =
I is sequentially incremented from 1.

If there is a digital signature Si (X) whose expiration date is almost expired in step S12, the digital signature expiration date extension device 4 uses the signature extension means 12 to update the latest signature whose expiration date is sufficiently longer than P. Method (that is, a method of generating a digital signature using a private key corresponding to a public key indicated by the latest digital certificate whose expiration date is sufficiently longer than P), the digital signature Si (X ) And the corresponding time stamp TSi (S
i (X)) digital signature Si + 1 for the combination
(Si (X) + TSi (Si (X))) is generated (step S13).

This digital signature Si + 1 (Si (X) +
A method for producing TSi (Si (X)) will be described. Data is stored only in the areas 9a and 9b in FIG. 5 in the signature storage unit 9, and the expiration date detection unit 6 determines that the period until the expiration date Au of the digital signature Sc (D) of 9b is less than P. Is detected, the signature extension means 12 combines the digital signature Sc (D) and the corresponding time stamp TSo (Sc (D)) as shown in FIG.
1 is generated, and a digital signature 73 is generated for the combined data 71. A method of generating a digital signature for the combined data 71 is as shown in FIG.
A hash value of the spare stamp is obtained by an algorithm such as 1 and the hash value is encrypted with the latest secret key Kse1 of the secret key of the RSA public key cryptosystem unique to the digital signature validity term extension device 4. Then, the public key Kpe1 corresponding to the secret key Kse1 is combined with a digital certificate 72 issued by a trusted third-party certificate authority (not shown).

The digital certificate 72 shown in FIG. 7 has an expiration date A that expires after the expiration date Au by the certificate authority.
e1 is provided, and the digital certificate 72 is valid only before the expiration date Ae1, and the expiration date Ae1 corresponds to the digital signature S1 (Sc (D), TS
0 (Sc (D))) 73. Further, since the digital certificate 72 includes the public key Kpe1, the digital signature S1 (Sc (D), TS0 (Sc
(D))) 73, the digital signature Sc (D), and the time stamp TS0 (Sc (D)) are used to determine whether the digital signature Sc (D) and the time stamp TS0 (Sc (D)) have been tampered with. Can be verified.

Next, the digital signature expiration date extension device 4
The digital signature S
1 (Sc (D), TS0 (Sc (D)) and the time stamp TS1 (S1 (Sc (D), TS0 (Sc
(D))) is obtained from the time stamp issuing server 10 (step S14).

Here, as described above, the digital signature S1 (S
c (D), TS0 (Sc (D)) 73 will be represented as S1 (X). The procedure in which the time stamp issuing server 10 generates the time stamp TS1 (S1 (X)) is the same as the procedure in FIG. 4 in which the time stamp of the digital signature Sc (D) is generated. X)
81 and the time information 82 are combined to generate a preliminary stamp 83, a hash value of the preliminary stamp 83 is obtained by an algorithm such as MD5 or SHA-1, and the hash value is used as an RSA public key encryption unique to the time stamp issuing server 10. The encrypted data 84 encrypted with the latest secret key Kst1 of the secret keys of the system is added to the public key Kpt1 corresponding to the secret key Kst1 by a certificate authority (not shown) which is a third party which can be trusted. By combining the digital certificate 85 issued by the company. The time information 82 is the time at which the time stamp issuing server 10 receives the digital signature S1 (X) 81, and the time represented by the time information 82 is t1. An expiration date At1 is provided in the digital certificate 85, and the expiration date At1 indicates a time after the time t1.

Next, the signature expiration date extension device 4 sends the signature S1
(X) and the time stamp TS1 (S1 (X)) are stored in the area 9c of the signature storage means 9 by the signature storage means 8 (S15). Thereafter, the signature expiration date extension device 4 returns to step S11, and generates a digital signature Si + 1 (Si (X), T (Si + 1)) while sequentially incrementing i.
The time stamp TSi + 1 (Si + 1 (Si
(X), T (Si + 1))) are obtained and stored in the signature storage unit 9. At this time, in the signature storage unit 9, all the “extended signature” sequences (signature sequences) generated from the original signature Sc (D) associate the digital signature with the corresponding time stamp as shown in FIG. And store it. Here, each digital signature Si + 1 (Si
The digital certificate included in (X), TSi (Si (X))) has an expiration date Aei + 1, and the secret key K
sei + 1 and a public key secret key Kpei + 1 are included. Also,
Each time stamp TSi + 1 (Si + 1 (Si (X),
TSi (Si (X))) is given by the time stamp issuing server 10 time information indicating the time ti + 1 at which the digital signature validity term extension device 4 requests the time stamp issuing server 10 to issue this time stamp. ing. The time ti + 1 indicates a later time as i becomes larger. Further, respective time stamps TSi + 1 (Si + 1 (Si (X), T
Si (Si (X)))) includes the digital certificate valid at time ti + 1.

Next, verification of the “extended signature” stored in the signature storage unit 9 of the digital signature validity term extension device 4 as shown in FIG. 5 will be described. The user client 1 stores the original digital document D and the digital signature Sc (D) for the original digital document D as the expiration date A of the digital signature Sc (D).
At time tz after u, the communication means 3 transmits the message to the recipient client 21 and sends it to the recipient client 2.
1 is received by the communication means 23. FIG. 5 shows the signature sequence at this time tz, and the latest digital signature is Sn (Sn-1 (Y), TSn-1 (Sn-1
(Y))), the latest time stamp is TSn (Sn (Sn (S
n-1 (Y), TSn-1 (Sn-1 (Y))), and the digital signature and the time stamp are valid at this time tz, that is, the validity of the digital certificate included in the latest digital signature. The expiration date Aen and the expiration date Atn of the digital certificate included in the latest time stamp are the time t
Assume that it is later than z. The meaning of X in columns 9d and 9e in FIG. 5 is as described above. Also, 9f,
In the 9g column, Y is the original digital signature Sc as well as X.
In the signature series generated from (D), the combined data of the signature and the time stamp immediately before the 9f column is shown.

Since the validity period of the received digital signature Sc (D) has passed, the recipient client 21 signs the digital signature validity period extension device 4 to confirm the validity of the digital signature Sc (D). A series transmission request is transmitted by the communication unit 23. The digital signature Sc (D) is attached to this signature series transmission request. The communication unit 5 of the digital signature expiration date extension device 4 receives the signature sequence transmission request, and converts the digital signature Sc (D) attached to the received signature sequence transmission request into the signature storage unit 8. The signature sequence corresponding to the digital signature Sc (D) is specified and transmitted to the receiver client 21. The receiver client 21 receives the signature sequence by the communication unit 23, and then starts verification of the extended digital signature in the signature sequence received by the signature verification unit 22. Hereinafter, the procedure of verification in the signature verification unit 22 will be described.

(1) Latest digital signature Sn (Sn-1)
(Y), TSn-1 (Sn-1 (Y))) is based on a valid digital certificate as described above, and has a digital signature Sn-
Since 1 (Y) and the time stamp TSn-1 (Sn-1 (Y)) can be obtained from the signature sequence, respectively, the latest digital signature Sn (Sn-1 (Y), TSn-1 (Sn-1 (Y)) )) Can be verified, and if the verification is successful, the digital signature S
n-1 (Y) and the time stamp TSn-1 (Sn-1 (Y)) correspond to the latest digital signatures Sn (Sn-1 (Y), TSn-1 (Sn-
1 (Y)) is guaranteed not to have been tampered with since the time of generation.

(2) Latest time stamp TSn (Sn
(Sn-1 (Y), TSn-1 (Sn-1 (Y)))) is the latest digital signature Sn (Sn-1 (Y), TSn-1 (Sn-1).
(Y))) and a time stamp indicating the time tn at which the time stamp issuance server 10 receives the digital signature, generates a spare stamp, and then takes the hash value of the spare stamp to obtain the latest secret of the time stamp issuance server. Key Kst
Since it includes a general procedure for generating a digital signature of encrypting with n, verification as a digital signature is possible.
The latest time stamp TSn (Sn (Sn-1 (Y), T
Sn-1 (Sn-1 (Y)))) is based on a valid digital certificate as described above and has a digital signature Sn (Sn-1
(Y), TSn-1 (Sn-1 (Y))) can be obtained from the signature sequence, so the latest time stamp can be verified. If the verification is successful, the digital signature Sn (Sn-1 (Y)) is obtained.
(Y), TSn-1 (Sn-1 (Y))) is proved to exist at time tn.

(3) From the above (1) and (2), the digital signature Sn-1 (Y) and the time stamp TSn-1 (Sn-1
(Y)) is guaranteed not to have been tampered with from the time tn to the present time.

(4) This time tn is the digital signature Sn-1
Since the digital certificate Sn-1 (Y) is valid before the expiration date Aen-1 of the digital certificate attached to (Y), if the digital signature Sn-1 (Y) is successfully verified, Y becomes equal to or later than the time of generation of the digital signature Sn-1 (Y). It is guaranteed that it has not been tampered with.

(5) At time tn, the time stamp T
Since the digital certificate attached to Sn-1 (Sn-1 (Y)) was valid, the time stamp TSn-1 (Sn-1 (Y))
Is successful, it is proved that the digital signature Sn-1 (Y) exists at the time tn-1.

(6) From (4) and (5), Y is at time tn-
It is guaranteed that tampering has not been performed from 1 to tn.

By repeating the above verification, the signature Sc (D) of the original document D and the time stamp TS0
It can be proved that (Sc (D)) has not been falsified from time t0 to time t1, and S ₁ (Sc (D), TS ₀ (Sc (D))) and TS ₁ (S ₁
(Sc (D), TS ₀ (Sc (D)))) is guaranteed not to have been tampered from t1 to t2, so that its signature and time stamp have not been tampered with from t2 to t3. By repeating the procedure that the time tn-
1 to tn, the digital signature Sn-1 (Y) and the time stamp TSn-1 (Sn-1
(Y)) is guaranteed not to have been tampered with from the time tn to the present time, so the following two points are guaranteed. Original document D has not been tampered with since creation.
The digital signature Sc (D) of the original document D is at time t0
That existed.

From the above, the validity of the original document D and its digital signature Sc (D) has been proved.

In the above embodiment, the digital signature Sc (D) 32 and the digital signature S1 (Sc
(D), TS0 (Sc (D))) 73 correspond to the first digital signature and the second digital signature in the present invention, respectively. The expiration dates Au and Ae1 correspond to the first expiration date and the second expiration date in the present invention, respectively. Time stamps TS0 (Sc (D)) 45, T
S1 (S1 (X)) 85 corresponds to the first time stamp and the second time stamp in the present invention, respectively. Further, the digital signature Sc (D) 32 corresponds to the digital signature to be extended in the present invention.

As described above, the “digital signature” means that a device that generates a digital signature generates a hash from target data and encrypts the hash with a secret key of the device. And a digital certificate for a public key corresponding to the secret key of the device. "Digital signature"
Means an operation of generating the digital signature from the target data.

As described above, since a new signature having a long expiration date is applied before the expiration of the signature, it is determined that the original signature was valid at the time of generating the extension signature, that is, the original signature was forged. Can be guaranteed.

Further, since the time stamp of the signature generated for extension is generated, the time when the extended signature is generated is certainly the time when the original signature has not expired. It can be assured that the extension signature was generated at the time the original signature was valid.

Further, since the signature generated from the original signature is sequentially stored together with the time stamp,
The validity of the original signature can be confirmed by performing the signature verification and the time stamp verification sequentially from the latest extension signature that is currently valid. It also detects near-expiring digital signatures,
Since a means for performing the extension process is provided, the work required for the signature extension service provider for the signature extension process can be reduced. In addition, since a user client can request a digital signature expiration date extension device that is remote via a network to extend the signature, the extension of the signature must be entrusted to a third party (signature extension service provider) instead of the user. Can be.

In the above embodiment, the time stamp issuing server 10 has a different structure from the digital signature validity term extension device 4, but the digital signature validity term extension device 4 is different from the user and the receiver. If managed by a trusted third party, the time stamp issuing server 10 may be integrated into the digital signature expiration date extension device 4 as an integrated configuration.

Embodiment 2 In the first embodiment,
The signature extension process is performed based on the expiration date recorded in advance in the digital signature. Next, in the case where the digital signature expires unexpectedly, the digital signature expiration date is used. An embodiment of temporarily extending is shown. Here, the case where the validity is unexpectedly lost means that the digital certificate is canceled due to a transfer or resignation of a person in charge, or the validity is lost due to the leakage of a secret key.

FIG. 9 is a block diagram showing the configuration of a system including a digital signature expiration date extension device according to this embodiment. In the figure, the same portions as those in FIG. 1 described in the first embodiment are denoted by the same reference numerals, and description thereof will be omitted. Reference numeral 13 denotes a temporary extension signature generating means for generating a signature (temporary extension signature) temporarily extended by the latest signature method for the latest signature of each signature series stored in the signature storage unit 9; Temporary extension signature storage means for storing a temporary extension signature generated by the extension signature generation means 13 and a time stamp for the temporary extension signature in association with each other for each series;
Reference numeral 15 denotes a temporary signature storage unit which is a storage in which the temporary extension signature storage unit 14 actually stores a signature and a time stamp;
Reference numeral 16 denotes a valid and latest signature and time stamp from among the temporary extension signatures stored in the temporary signature storage unit 15 when the latest signature of each signature series in the signature storage unit 9 has expired. And a storage extension signature selecting unit 17 for obtaining a CRL (Certificate Revocation List: list of certificates whose validity has been lost for some reason) for the latest signature of each signature sequence in the signature storage unit 9.
RL acquisition means, 18 is a CRL for verifying the acquired CRL
The verification unit 19 is a CRL server that manages the latest CRL and issues it in response to a request. The CRL acquisition means 17
The CRL verification means 18 constitutes an invalidated signature search means in the present invention.

Next, the operation will be described. The initial operation when the user sends a signature extension request to the signature extension service follows the flowchart of FIG. 2 as in the first embodiment. The signature storage unit 9 stores the digital signature Sc (D) and the corresponding time stamp TS0 (Sc (D)), and thereafter forms a signature sequence according to the flowchart of FIG. Here, the operation of generating and managing a temporary extension signature in the digital signature validity term extension device 4 will be described with reference to the flowchart shown in FIG. In this flowchart, from step S21 to step S
In the first time of the flow of 23, i = 1, and i is thereafter incremented.

Here, it is assumed that a signature sequence is formed in the signature storage unit 9 as shown in FIG. First, the temporary extension signature generating means 13 updates the latest digital signature Sn (Z) stored in the signature storage 9 and the time stamp TSn (Sn
For the combination data that is the combination of (Z)),
The temporary extension signature Sk1 (Sn (Z), T
Sn (Sn (Z))) is generated (step S21).
Here, Z is a digital signature Sn-1 (Y) and a time stamp TSn-1 (Sn-
1 (Y)). The method of generating the temporary extension signature is the same as that described in the first embodiment with reference to FIG. 7, and includes the digital signature Sn (Z) and the time stamp TS.
n (Sn (Z)) to generate combined data, further generate a hash value, and use this hash value as the latest secret key among RSA public key cryptosystem secret keys unique to the digital signature validity term extension device 4. A public key Kpe10 corresponding to the secret key Kse10 is added to the encrypted data encrypted by Kse10.
By combining a digital certificate issued by a certificate authority (not shown), which is a trusted third party.

Next, the temporary extension signature Sk1 is transmitted from the time stamp issuing server 10 by the time stamp acquisition unit 7.
(Sn (Z), TSn (Sn (Z))) with respect to the time stamp TSk1 (Sk1 (Sn (Z), TSn (Sn
(Z)))) is obtained (step S22). At this time, the time stamp issuing server 10 sets the time stamp TSk1.
The procedure for generating (Sk1 (Sn (Z), TSn (Sn (Z)))) is the same as that described with reference to FIG. 8 in the first embodiment, and the time stamp issuing server 10 transmits the temporary extension signature Sk1 (Sn (Z), TSn (Sn (Z))), the time information regarding the time tk1 and the temporary extension signature Sk
1 (Sn (Z), TSn (Sn (Z))) to generate a preliminary stamp, further generate a hash value from the preliminary stamp, and use this hash value as a unique RSA public key of the time stamp issuing server 10. A certificate authority (not shown), which is a third-party organization that can trust the public key Kpt10 corresponding to the secret key Kst10 in the encrypted data encrypted with the latest secret key Kst10 of the secret keys of the cryptosystem. By combining digital certificates issued by This time stamp TSk1 (Sk1 (Sn (Z), TSn (S
n (Z)))) is the temporary extension time stamp in the present invention.

Next, the temporary extension signature storing means 14 stores the temporary extension signatures Sk1 (Sn (Z), TSn (Sn
(Z))) and the time stamp TSk1 (Sk1 (Sn
(Z), TSn (Sn (Z))))) and store them in the temporary signature storage unit 15 for each sequence (step S2).
3). Thereafter, step S is performed based on a predetermined cycle L.
Steps S23 to S23 are repeated. FIG. 11 shows a state of the temporary extension signature stored in the temporary signature storage unit 15 at that time. The time stamp TSki (S
ki (Sn (Z), TSn (Sn (Z)))) is the time tki at which the time stamp issuing server 10 receives the digital signature time Ski (Sn (Z), TSn (Sn (Z))), respectively. Time information shown.

Next, an operation for determining a digital signature to be stored as an extension signature based on the CRL will be described with reference to a flowchart shown in FIG. First, the digital signature expiration date extension device 4 acquires the latest CRL by the CRL acquisition means 17 according to a predetermined cycle (step S31). At this time, the CRL acquisition means 17
Sends a CRL issuance request to the CRL server 19 via the network 11 using the communication means 5, and the CRL server 19 generates the latest CRL according to the request, and transmits the digital signature expiration date via the network 11. It is sent to the extension device 4 and the CRL acquisition means 17
To obtain the CRL.

Next, the CRL verification means 18 stores, in the signature storage unit 9, the digital signature that has lost validity among the latest digital signatures in the series of extension signatures, into the CRL.
(Step S32). Next, the CRL verification unit 18 determines whether there is a signature whose validity has been lost (step S33).

If there is no signature whose validity has been lost, the process returns to step S31. On the other hand, if there is a signature Sn (Z) whose validity has been lost, the storage extension signature selecting means 16 stores the invalidation described in the CRL among the extension signatures corresponding to the relevant signature from the temporary signature storage unit 15. The extension signature Ski (Sn (Z), TSn (Sn) generated before the date and time and created at the time closest to the invalidation date and time.
(Z))) and the time stamp TSki (Ski (Sn
(Z), TSn (Sn (Z)))) (step S34). Next, the extension signature Ski (Sn (Z),
TSn (Sn (Z))) and the time stamp TSki (S
ki (Sn (Z), TSn (Sn (Z)))) is additionally stored in the signature storage unit 9 by the extension signature storage unit 8 as the latest extension signature (step S35). The invalidation date is the invalidation time in the present invention.

Thereafter, the original digital document D and the digital signature Sc for the original digital document D are sent from the user client 1.
The operation in which the recipient client 21 (not shown in FIG. 9) that has received (D) verifies the extension signature is the same as in the first embodiment.

During the above operation, the expiration date detecting means 6
Has detected a digital signature whose expiration date is almost expired from the signature storage unit 9, and the digital signature expiration date extension device 4 operates according to the flowchart of FIG. 6 described in the first embodiment. Therefore, while the operation between step S31 and step S33 is repeated without the signature Sn (Z) invalidated in step S33, the expiration date of the latest signature in the signature storage unit 9 is approaching. The newly generated digital signature and time stamp are stored in the signature storage unit 9.

As described above, the latest digital signature stored in the signature storage unit 9 is configured to generate a temporary extension signature according to a certain cycle regardless of the expiration date determined by the digital certificate. Therefore, even when the validity of the digital signature is lost before the scheduled expiration date, that is, when the validity of the digital signature is lost due to an unexpected reason, the signature extension process can be performed.

In the above embodiment, the digital signature expiration date extension device 4 requests a CRL according to a certain rule. However, the CRL server 9 periodically or when the CRL is updated, updates the digital signature validity period with the latest CRL. It may be sent to the time limit extension device 4.

[0066]

As described above, the digital signature expiration date extension system according to the present invention is a digital signature expiration date extension system including a digital signature expiration date extension device and a time stamp generation device. The time extension device includes a signature extension unit, a time stamp acquisition unit, and a signature storage unit.
Generating a combined data by combining a first digital signature having an expiration date and a first time stamp corresponding to the first digital signature acquired by the time stamp obtaining means from the time stamp generating device, The combined data is digitally signed to generate a second digital signature having a second expiration date after the first expiration date before the first expiration date. Transmitting the first or second digital signature to the time stamp generation device, and transmitting the first or second time stamp corresponding to the first or second digital signature from the time stamp generation device to the first or second time stamp, respectively. 2 before the expiration date, and the signature storage unit acquires each digital signature generated by the signature extension unit and the time stamp acquisition unit. Stores a time stamp, the time stamp generating unit receives the first or second digital signature from the time stamp obtaining section, first
Alternatively, at the time when the second digital signature is received, the first or second time stamp for proving that the first or second digital signature is present is generated.
There is an effect that a person different from the original signer can extend the expiration date of the original digital signature.

Also, in the digital signature expiration date extension system according to the present invention, the time stamp generating device may add the first or second digital signature to the first or second digital signature received from the time stamp obtaining means. A preliminary stamp is generated by combining time information related to the time at which the digital signature was received, and data containing a signed preliminary stamp generated by digitally signing the preliminary stamp is used as the first or second time stamp. Since the data is transmitted to the time stamp acquisition unit, the existence of the first or second digital signature can be surely proved.

Further, the system for extending the expiration date of a digital signature according to the present invention further comprises expiration date detecting means for detecting the remaining period of the first digital signature until the first expiration date. When the remaining period detected by the expiration date detection unit becomes equal to or less than a predetermined value, the first digital signature stored in the signature storage unit and the first time stamp are combined to generate combined data. Since the data is digitally signed to generate a second digital signature having a second expiration date longer than the first expiration date, the digital signature can be reliably extended.

The digital signature expiration date extension system according to the present invention, wherein the digital signature expiration date extension device includes a temporary extension signature generation unit, a temporary extension signature storage unit,
The temporary extension signature generating unit further includes a revocation signature search unit and a storage extension signature selection unit, wherein the temporary extension signature generation unit sets the latest extension signature at a predetermined time interval within the expiration date of the latest digital signature stored in the signature storage unit. A temporary extension signature which is a digital signature generated from the digital signature of the above and the corresponding time stamp is generated, and the time stamp obtaining means transmits the temporary extension signature to the time stamp generation device, and A corresponding temporary extension time stamp is obtained from the time stamp generation device, and the temporary extension signature storage unit stores the temporary extension signature and a temporary extension time stamp corresponding to the temporary extension signature in association with each other, and stores the time stamp. When receiving the temporary extension signature from the time stamp obtaining means, the generation device may generate the temporary extension signature at a time when the temporary extension signature is received. A temporary extension time stamp for proving that a time extension signature was present is generated, and the invalidation signature search means searches for an invalid digital signature from the latest digital signature, and the invalid digital signature is An invalidation time that has become invalid is acquired, and the storage extension signature selecting means, wherein the invalidation time is selected from the temporary extension signatures generated from the latest invalid digital signature acquired by the invalidation signature search means. Since the previously generated and newest temporary extension signature and the time stamp corresponding to the temporary extension signature are stored in the signature storage unit as the latest digital signature and the corresponding time stamp, the validity of the digital signature is expected. In the case where the data is lost without being used, the expiration date can be extended.

In the digital signature expiration date extension system according to the present invention, the time stamp generation device may include, in the temporary extension signature received from the time stamp obtaining means, a time associated with the time when the temporary extension signature is received. A preliminary stamp is generated by combining the information, and the data including the signed preliminary stamp generated by digitally signing the preliminary stamp is transmitted to the time stamp obtaining means as the temporary extended time stamp. Has the effect of being reliably proved.

Further, in the digital signature validity term extension system according to the present invention, the digital signature validity term extension device and the time stamp generation device are integrally formed, so that the system configuration is simplified. .

Further, in the digital signature verification method according to the present invention, when the second digital signature is successfully verified, the first digital signature is received by the time stamp generation device when the first digital signature is received. Since it is determined that the digital signature exists at the specified time and has not been tampered with since the reception time, it is possible to verify the digital signature retrospectively.

The digital signature expiration date extension device according to the present invention is a digital signature expiration date extension device for extending the expiration date of a digital signature having a predetermined expiration date set, and is an object for extending the expiration date. At any time within the expiration date of a certain extension target digital signature, a time stamp obtaining means for obtaining a time stamp certifying that the extension target digital signature was present at the time, and the extension target digital signature and the time Signature extension means for generating combined data by combining the time stamps obtained by the stamp obtaining means, and generating a digital signature having an expiration date longer than the expiration date from the combined data; Signature storage means for storing the corresponding time stamp in association with the Expiration extension of barrel signatures there is an effect that it is possible to differ person performing the original signer.

The method for extending the expiration date of a digital signature according to the present invention includes the following steps.
There is an effect that the existence of the digital signature is reliably proved. (1) generating a timestamp certifying that a first digital signature having a first expiration date exists at a predetermined time within the first expiration date before the first expiration date; (2) Before the first expiration date, the first digital signature and the time stamp are combined to generate combined data, and the combined data is converted into an electronic signature, which is used after the first expiration date. Generating a second digital signature having a second expiration date.

[Brief description of the drawings]

FIG. 1 is a block diagram showing a configuration of a system according to a first embodiment of the present invention.

FIG. 2 is a flowchart showing an operation of the system according to the first embodiment of the present invention.

FIG. 3 is a view showing a first embodiment and a second embodiment of the present invention;
The figure which shows the structure of the digital certificate in FIG.

FIG. 4 is a view showing a first embodiment and a second embodiment of the present invention;
The figure which shows the structure of the time stamp in FIG.

FIG. 5 is a view showing a first embodiment and a second embodiment of the present invention;
The figure which shows the structure of the signature storage part in FIG.

FIG. 6 is a view showing a first embodiment and a second embodiment of the present invention;
5 is a flowchart showing the operation of the digital signature expiration date extension device in FIG.

FIG. 7 is a view showing a first embodiment and a second embodiment of the present invention;
The figure which shows the structure of the digital signature in FIG.

FIG. 8 is a view showing a first embodiment and a second embodiment of the present invention;
The figure which shows the structure of the time stamp in FIG.

FIG. 9 is a block diagram showing a configuration of a system according to a second embodiment of the present invention.

FIG. 10 is a flowchart showing an operation of generating and storing a temporary extension signature according to the second embodiment of the present invention.

FIG. 11 is a diagram showing a configuration of a temporary signature storage unit according to the second embodiment of the present invention.

FIG. 12 is a flowchart showing an operation of generating and storing a temporary extension signature according to the second embodiment of the present invention.

FIG. 13 is a diagram showing a configuration of a conventional digital signature expiration date extension device.

FIG. 14 is a flowchart showing the operation of a conventional digital signature expiration date extension device.

[Explanation of symbols]

1 user client, 2 signature generation means, 3
Communication means, 4 Digital signature expiration date extension device, 5
Communication means, 6 expiration date detecting means, 7 time stamp obtaining means, 8 extension signature storing means, 9 signature storage section, 10 time stamp issuing server, 11
Network, 12 signature extension means, 13 temporary extension signature generation means, 14 temporary extension signature storage means, 15
Temporary signature storage unit, 16 storage extension signature selection means,
17 CRL acquisition means, 18 CRL verification means, 1
9 CRL server, 21 recipient client, 2
2 signature verification means, 23 communication means, 31 digital certificate, 32 digital signature, 33 digital document, 41 digital certificate, 42 digital signature,
43 time information, 44 preliminary stamp, 45 time stamp, 71 combined data, 72 digital certificate, 73 digital signature, 81 digital signature,
82 Time information, 83 Preliminary stamp, 84 Encrypted data, 85 Digital certificate, 86 Time stamp, 101 Digital signature expiration date extension device, 1
02 Document acquisition means, 103 Signature generation means, 10
4 Signature extension means.

 ────────────────────────────────────────────────── ─── Continuing on the front page (72) Inventor Tetsuo Nakagawa 2-3-2 Marunouchi, Chiyoda-ku, Tokyo F-term in Mitsubishi Electric Corporation (reference) 5J104 AA09 AA11 LA06 NA02 NA12

Claims (9)

[Claims] 1. A digital signature expiration date extension system including a digital signature expiration date extension device and a time stamp generation device, wherein the digital signature expiration date extension device includes a signature extension unit, a time stamp acquisition unit, a signature A storage unit, wherein the signature extension unit includes a first digital signature having a first expiration date and a first digital signature corresponding to the first digital signature acquired from the time stamp generation device by the time stamp acquisition unit. To generate combined data, digitally sign the combined data, and
Generating a second digital signature having a second expiration date after the expiration date before the first expiration date, wherein the time stamp obtaining means converts the first or second digital signature to the time stamp To the generator,
Acquiring a first or second time stamp corresponding to the first or second digital signature from the time stamp generating device before the first or second expiration date, respectively; Storing each digital signature generated by the extension means and each time stamp obtained by the time stamp obtaining means, the time stamp generating apparatus receiving the first or second digital signature from the time stamp obtaining means, Generating a first or second time stamp for certifying that the first or second digital signature exists at the time of receiving the first or second digital signature, respectively. Expiration date extension system. 2. The time stamp generating apparatus according to claim 1, wherein the first or second digital signature received from the time stamp obtaining means includes time information related to the time at which the first or second digital signature is received. Generating a preliminary stamp by combining the preliminary stamp with a digital signature of the preliminary stamp;
2. The system according to claim 1, wherein the second time stamp is transmitted to the time stamp obtaining unit. 3. The digital signature expiration date extension device further includes expiration date detection means for detecting a remaining period of the first digital signature until the first expiration date, and wherein the signature extension means includes: When the remaining period detected by the expiration date detecting means becomes equal to or less than a predetermined value, the first digital signature stored in the signature storage unit and the first time stamp are combined to generate combined data. 3. The extension of the digital signature according to claim 1, wherein the digital signature is signed to generate a second digital signature having a second expiration date longer than the first expiration date. system. 4. The digital signature expiration date extension device,
A temporary extension signature generation unit, a temporary extension signature storage unit, an invalidation signature search unit, and a storage extension signature selection unit, wherein the temporary extension signature generation unit includes a latest digital signature stored in the signature storage unit; Within a validity period of the signature, a temporary extension signature which is a digital signature generated from the latest digital signature and a time stamp corresponding to the latest digital signature is generated at a predetermined time interval. The temporary extension signature is transmitted to the time stamp generation device, and a temporary extension time stamp corresponding to the temporary extension signature is obtained from the time stamp generation device. The temporary extension signature storage unit stores the temporary extension signature and a temporary extension signature corresponding to the temporary extension signature. The time stamp generation device stores the temporary extension signature from the time stamp acquisition unit. When receiving the temporary extension signature, a temporary extension time stamp is generated to prove that the temporary extension signature was present at the time when the temporary extension signature was received, and the invalidation signature search means invalidates the latest digital signature from the latest digital signature. , And obtains an invalidation time at which the invalidated digital signature became invalid. The storage extension signature selecting means outputs the latest invalidated signature acquired by the invalidating signature search means. Out of the temporary extension signatures generated from the digital signatures of the above, the newest temporary signature generated before the invalidation time and the time stamp corresponding to the temporary extension signature are stored in the signature storage unit as the latest digital signature. 3. The system according to claim 1, wherein the digital signature is stored as a time stamp. 5. The time stamp generating apparatus generates a preliminary stamp by combining the temporary extension signature received from the time stamp obtaining means with time information related to the time at which the temporary extension signature was received. 5. The system according to claim 4, wherein data including a signed preliminary stamp generated by digitally signing the preliminary stamp is transmitted to the time stamp obtaining unit as the temporary extended time stamp. 6. The expiration date extension system according to claim 1, wherein the digital signature expiration date extension device and the time stamp generation device are integrally formed. 7. A digital signature verifying method for verifying a digital signature generated by the digital signature expiration date extension system according to claim 1, wherein when the second digital signature is successfully verified, A digital signature verification method, comprising: determining that the first digital signature exists at the time when the time stamp generating device receives the first digital signature and has not been tampered with since the reception time. 8. A digital signature expiration date extension device for extending a digital signature for which a predetermined expiration date has been set, wherein any one of the digital signatures whose extension is to be extended is within the expiration date of the digital signature to be extended. At the time, the timestamp obtaining means for obtaining a timestamp proving that the extension target digital signature was present at the time, and combining the extension target digital signature with the timestamp obtained by the timestamp obtaining means Signature extension means for generating combined data, generating a digital signature having an expiration date longer than the expiration date from the combination data, and a signature for storing the digital signatures and time stamps corresponding to the digital signatures in association with each other A digital signature expiration date extension device comprising storage means. 9. A method for extending the expiration date of a digital signature, comprising the following steps. (1) generating a timestamp certifying that a first digital signature having a first expiration date exists at a predetermined time within the first expiration date before the first expiration date; (2) Before the first expiration date, the first digital signature and the time stamp are combined to generate combined data, and the combined data is converted into an electronic signature, which is used after the first expiration date. Generating a second digital signature having a second expiration date.