JP4912809B2 - Electronic signature server, electronic signature system, and electronic signature method - Google Patents

Description

  The present invention relates to an electronic signature server, an electronic signature system, and an electronic signature method, and in particular, an electronic signature server, an electronic signature system, and an electronic signature method for providing an electronic signature to content data in response to a signature request from a terminal device. About.

  Because of the necessity to certify the contents stored in the server, an electronic signature corresponding to a seal or signature in a paper document is given to the content data. As such an electronic signature system, content data (for example, contract data) to be given a signature is acquired by a signer's terminal device (for example, a personal computer), and then the electronic signature is generated in the terminal device. There is a system for assigning data (see Patent Document 1).

In addition, as a personal authentication technique as a substitute for a seal or signature, an electronic seal stamp using a public key cryptosystem using a public key and a secret key is known to determine whether to permit access to a server or the like (Patent Literature). 2).
JP 2004-080335 A Japanese Patent Laid-Open No. 2004-126889

  In the system described in Patent Document 1, when an electronic signature is assigned, a user needs to move or copy an entity (that is, content data) to be attached with a signature from a server to a terminal device. For this reason, when it is desired to give an electronic signature to content data having a large data size, the content that can be provided with the electronic signature is limited in a terminal device (for example, a mobile phone) with a limited memory capacity. In addition, a dedicated personal computer or IC card is required to keep data safe against frauds such as tampering by a third party, which hinders the introduction of the system.

  On the other hand, the electronic seal stamp described in Patent Document 2 does not involve moving or copying the entity to which the signature is attached, but only provides a function as a key necessary for permitting access to the server. It is not possible to give an electronic signature to the content data stored in the server after being applied.

  Therefore, the present invention provides an electronic signature server that can give an electronic signature to content data having a large data size even when a user who gives a signature uses a terminal device having a limited memory capacity, An object is to provide an electronic signature system and an electronic signature method.

  An electronic signature server according to the present invention is an electronic signature server for giving an electronic signature by a user of a terminal device to content data stored in advance, and generates random data corresponding to content data Means for encrypting the random number data with the user's public key to generate first encrypted data; transmitting means for transmitting the first encrypted data to the terminal device; and Receiving means for receiving the second encrypted data generated by being encrypted with the key; decrypting means for decrypting the second encrypted data with the public key; and data decrypted by the decrypting means is random number data If it matches the random number data generated by the generating means, the second encrypted data is associated with the content data, so that the user's electronic signature is converted into the content data. Comprising a signature adding unit that Azukasuru, storage means for storing in association with the content data and the second encryption data.

  According to the present invention, since it is not necessary to move or copy content data from the electronic signature server to the terminal device in order to give an electronic signature to the content data, a user who gives a signature can use a terminal device with a limited memory capacity. Even if it is used, an electronic signature can be given to content data having a large data size.

  In the electronic signature server, the transmission unit may be configured to transmit data for allowing the user to confirm the content data to the terminal device. With this configuration, the user of the terminal device can confirm in advance the content of the content data to which the electronic signature is attached without transmitting the entire content data from the server to the terminal device.

  In addition to being described as an invention related to an electronic signature server as described above, the present invention can be described as an invention related to an electronic signature system and an electronic signature method as follows.

  An electronic signature system of the present invention is an electronic signature system comprising a terminal device and an electronic signature server for giving an electronic signature by a user of the terminal device to content data stored in advance. The server includes random number data generating means for generating random data corresponding to the content data, encryption means for encrypting the random number data with the user's public key to generate first encrypted data, and the first encrypted data in the terminal device Transmitting means for transmitting to the terminal, receiving means for receiving the second encrypted data generated by encrypting the random number data with the user's private key by the terminal device, and decoding for decrypting the second encrypted data with the public key When the data decrypted by the encrypting means and the decrypting means match the random number data generated by the random number data generating means, the second encrypted data is And a storage unit that stores the content data and the second encrypted data in association with each other, and the terminal device stores the content data in association with the content data. User request transmitting means for transmitting a signature request for giving an electronic signature to the electronic signature server, encryption information receiving means for receiving the first encrypted data from the electronic signature server, and transmitting the second encrypted data to the electronic signature server Encryption information transmitting means, decryption means for decrypting the first encrypted data with the private key, and encryption for generating the second encrypted data by encrypting the data obtained by decrypting the first encrypted data with the private key with the private key Means.

  An electronic signature method of the present invention is an electronic signature method for giving an electronic signature by a user of a terminal device to content data stored in advance in an electronic signature server, wherein the electronic signature server A random number data generation step for generating random data corresponding to, a first encryption step for generating first encrypted data by encrypting the random number data using the user's public key in the electronic signature server, Obtained in a first transmission step of transmitting the encrypted data from the electronic signature server to the terminal device, a first decryption step of decrypting the first encrypted data using the user's private key in the terminal device, and a first decryption step A second encryption step for generating second encrypted data by encrypting the received data using a secret key in the terminal device; The second transmission step of transmitting from the apparatus to the electronic signature server, the second decryption step of decrypting the second encrypted data using the public key in the electronic signature server, and the data obtained in the second decryption step are random numbers In the case where it matches the random number data generated in the data generation step, the method includes a signature addition step of assigning the user's electronic signature to the content data by associating the second encrypted data with the content data.

  The invention related to the electronic signature system and the electronic signature method has the technical features corresponding to the invention related to the electronic signature server, and has the same functions and effects.

  According to the present invention, since it is not necessary to move or copy content data from the electronic signature server to the terminal device in order to give an electronic signature, the user who gives the signature uses a terminal device with a limited memory capacity. Even so, it is possible to attach an electronic signature to content data having a large data size.

  Hereinafter, an embodiment of an electronic signature server, an electronic signature system, and an electronic signature method according to the present invention will be described with reference to the drawings.

  First, the configuration of the electronic signature system according to the embodiment of the present invention will be described. The electronic signature system 1 according to the present embodiment is a system for giving an electronic signature by a user of the terminal device 10 to content data. The electronic signature system 1 encrypts and decrypts random number data (that is, data other than content data) corresponding to content data by a public key cryptosystem using a user's public key and secret key, so that the user's terminal In response to a signature request from the apparatus 10, an electronic signature is given to the content data of the content selected by the user.

  The electronic signature system 1 includes a server 20 (hereinafter referred to as “electronic signature server 20” or “server”) for giving an electronic signature by the user of the terminal device 10 to the terminal device 10 and the content data 23C stored in advance. 20 ”). FIG. 1 is a block diagram illustrating a functional configuration of the electronic signature system 1, and FIG. 2 is a diagram illustrating a hardware configuration of the electronic signature system 1.

  In the electronic signature system 1, the terminal device 10 can communicate with the communication module 201 of the server 20 via the communication network N using the communication module 101. As the communication network N, for example, a communication network including a mobile communication network composed of devices such as a base station and an exchange (both not shown) can be used.

  Next, elements and functions of the electronic signature system 1 will be described with reference to FIGS. 1 and 2.

  First, elements constituting the terminal device 10 and functions thereof will be described.

  As shown in the hardware configuration diagram of FIG. 2, the terminal apparatus 10 physically includes a communication module 101 that is a transmission / reception device for various data, a CPU 102 that performs data processing, hardware control, and the like, a storage ROM 103 and RAM 104 which are devices, a display device 105 which is a video output device composed of a liquid crystal display, a speaker 106 which is an audio output device, an input device 107 composed of a numeric keypad and a cross key, and a secret key A card slot 108 in which an IC card 30 storing information unique to the user such as information and public key information is stored. Each function of the terminal device 10 to be described later includes a communication module 101, a display device 105, a speaker 106, an input device 107, and a card slot under the control of the CPU 102 using predetermined applications stored in the ROM 103, the RAM 104, and the like. This is realized by operating 108, reading and writing data from the ROM 103 and RAM 104, and transmitting and receiving data via the communication module 101.

  Examples of such a terminal device 10 include a mobile phone and a personal computer having a communication function, a PDA (Personal Digital Assistance), and the like. Examples of the IC card 30 to be installed in the card slot 108 include a UIM (User Identity Module) card and a flash memory card.

  As shown in the block diagram of FIG. 1, the terminal device 10 includes, as functional components, a communication unit 11 (user request transmission means, encryption information reception means, encryption information transmission means), and encryption / decryption processing unit 12 ( Decryption means, encryption means), a storage unit 13, a notification unit 14, and an input unit 15.

  The communication unit 11 is a part that transmits and receives data to and from the server 20, and is configured with the communication module 101 as a main element on hardware. The communication unit 11 includes a user information transmission / reception unit 11A (user request transmission unit), a content information transmission / reception unit 11B, and an encryption information transmission / reception unit 11C (encryption information reception unit, encryption information transmission unit).

  The user information transmission / reception unit 11A requests the user information transmission / reception unit 11A to add a user signature to the content data 23C stored in the storage unit 23 of the server 20 in response to an operation of the input unit 15 by the user. The signature request to be transmitted is transmitted to the user information transmitting / receiving unit 21A of the server 20. Further, the user public key 13A and the certificate information 13B stored in the storage unit 13 are transmitted to the user information transmission / reception unit 21A of the server 20 in response to an operation of the input unit 15 by the user, a request from the server 20, and the like.

  The content information transmitting / receiving unit 11B receives the content information 23D related to the content data 23C that is the target of the signature request and the processing result information related to the addition of the electronic signature from the content information transmitting / receiving unit 21B of the server 20. The content information transmitting / receiving unit 11B transmits a confirmation completion notification for notifying the server 20 that the user has confirmed the content information 23D to the content information transmitting / receiving unit 21B of the server 20. Details of the content information 23D will be described later.

  The encrypted information transmission / reception unit 11 </ b> C transmits / receives encrypted data to / from the server 20. Specifically, encrypted data generated by the encryption processing unit 22B of the server 20 (first encryption data to be described later) is received from the server 20, and encrypted data generated by the encryption processing unit 12B of the terminal device 10 (Second encrypted data described later) is transmitted to the server 20.

  The encryption / decryption processing unit 12 is a part that performs encryption and decryption of data, and is configured with the CPU 102, the ROM 103, and the RAM 104 as main elements in hardware.

  The decryption processing unit 12 </ b> A decrypts the encrypted data using the user key information stored in the storage unit 13. Specifically, the encrypted data (first encrypted data) generated by the encryption processing unit 22B of the server 20 is decrypted with the user secret key 13C stored in the storage unit 13 to generate non-encrypted data. .

  The encryption processing unit 12B encrypts the data using the user key information stored in the storage unit 13. Specifically, data (that is, non-encrypted data) obtained by decrypting the first encrypted data by the decryption processing unit 12A using the user secret key 13C stored in the storage unit 13 is encrypted by the user secret key 13C. To generate second encrypted data. The encrypted data generated by the encryption processing unit 12B becomes a signature value that is paired with the content data to be signed.

  The storage unit 13 is a part that stores data such as user key information, and includes, in hardware, an IC card mounted in the card slot 108 as a main element in addition to the ROM 103 and the RAM 104. The data stored in the storage unit 13 includes content information 13D to be described later in addition to the user public key 13A in the public key cryptosystem, the certificate information 13B of the user public key 13A, and the user secret key 13C. Here, the certificate information is information indicating that the terminal device 10 of the user is permitted to use a specific service with respect to the electronic signature server 20. As such certificate information, for example, there is a client certificate used for SSL client authentication for logging in to a content provider site.

  The notification unit 14 is a part that notifies the user of data transmitted from the server 20, the operating state of the terminal device 10, and the like, and includes the display device 105 and the speaker 106 as main elements on hardware. By confirming the sound and image from the notification unit 14, the user can confirm the content of data (for example, content information described later) received from the server 20.

  The input unit 15 is a part that operates the terminal device 10 and is configured with the input device 107 as a main element in hardware. The user of the terminal device 10 operates the input device 15 to operate the terminal device 10 including transmission of a signature request to the server 20.

  With the above-described configuration, the terminal device 10 transmits / receives various data such as a signature request, encrypted data, and content information to / from the server 20, decrypts encrypted data, and stores non-encrypted data. Can be encrypted.

  Next, elements constituting the electronic signature server 20 and functions thereof will be described. This server 20 is an electronic signature server for giving an electronic signature by a user of the terminal device 10 to content data stored in advance.

  As shown in the hardware configuration diagram of FIG. 2, the server 20 physically includes a communication module 201 that is a transmission / reception device for various data, a CPU 202 that performs data processing, hardware control, and the like, and a storage device A ROM 203 and a RAM 204, an input device 205, and an output device 206. Each function of the server 20, which will be described later, operates the communication module 201, the input device 205, and the output device 206 under the control of the CPU 202 using a predetermined application stored in the ROM 203, the RAM 204, and the like. This is realized by reading and writing data from the RAM 204 and transmitting and receiving data via the communication module 201.

  As shown in the block diagram of FIG. 1, the server 20 includes, as functional components, a communication unit 21 (transmission means, reception means) and a signature processing unit 22 (random number data generation means, encryption means, decryption). Means, signature providing means) and a storage unit 23 (storage means).

  The communication unit 21 is a part that transmits / receives data to / from the terminal device 10 and includes the communication module 201 as a main element on hardware. The communication unit 21 includes a user information transmission / reception unit 21A, a content information transmission / reception unit 21B (transmission unit), and an encryption information transmission / reception unit 21C (transmission unit, reception unit).

  The user information transmitting / receiving unit 21A receives the signature request for the content data 23C selected by the user, the user public key 13A, and the certificate information 13B from the user information transmitting / receiving unit 11A of the terminal device 10. Further, the user information transmission / reception unit 21A transmits a user information request including a transmission request for the user public key 13A and the certificate information 13B to the user information transmission / reception unit 11A of the terminal device 10 in response to the signature request received from the terminal device 10. To do.

  In response to a signature request to the content data 23C, the content information transmitting / receiving unit 21B receives the content information 23D, which is data for allowing the user to confirm the content of the content data 23C to which the signature is to be added, and processing result information regarding the addition of the electronic signature. It transmits to the content information transmission / reception part 11B of the terminal device 10. Further, the content information transmitting / receiving unit 21B receives a confirmation completion notification for notifying the server 20 that the user has confirmed the content information 23D from the content information transmitting / receiving unit 11B of the terminal device 10.

  The encrypted information transmission / reception unit 21 </ b> C transmits / receives encrypted data to / from the terminal device 10. Specifically, encrypted data (first encrypted data) generated by an encryption processing unit 22B, which will be described later, is transmitted to the terminal device 10, and encrypted data (first data) generated by the encryption processing unit 12B of the terminal device 10 is also transmitted. 2 encryption data) is received from the encryption information transmitting / receiving unit 11C of the terminal device 10.

  The signature processing unit 22 is a part that performs processing for assigning an electronic signature by the user of the terminal device 10 to the content data, and includes the CPU 202, the ROM 203, and the RAM 204 as main components on the hardware.

  The random number data generation unit 22A generates random number data corresponding to the content data 23C stored in the storage unit 23. An existing algorithm can be used as a mechanism for generating random number data from the content data 23C by the random number data generation unit 22A. Specifically, MD5 can use a hash function such as SHA1.

  The encryption processing unit 22B encrypts data using the key information stored in the storage unit 23. Specifically, the random number data generated by the random number data generation unit 22A is encrypted with the user public key 23A to generate the first encrypted data. The user public key 23A used by the encryption processing unit 22B is the same as the user public key 13A received from the terminal device 10.

  The decryption processing unit 22C decrypts the encrypted data using the key information stored in the storage unit 23. Specifically, the encrypted data (second encrypted data) generated by the encryption processing unit 12B of the terminal device 10 is decrypted with the user public key 23A stored in the storage unit 23 to generate non-encrypted data. To do.

  When the data (non-encrypted data) decrypted by the decryption processing unit 22C matches the random number data generated by the random number data generation unit 22A, the signature assigning unit 22D generates the data by the encryption processing unit 12B of the terminal device 10 By associating the encrypted data (second encrypted data) with the content data 23C, the electronic signature of the user is given to the content data 23C. In other words, the signature assigning unit 22D collates the random number data obtained by decryption by the decryption processing unit 22C with the random number data generated by the random number data generation unit 22A, so that the second encrypted data is obtained. Confirm that it can be safely used as the user's own electronic signature. If the two data (that is, random number data) match, the signature assigning unit 22D generates data that associates the second encrypted data with the content data 23C using the user's signature value. As a result, the server 20 gives the second encrypted data to the content data 23C as the user's electronic signature (signature value). Data relating to the association between the content data 23C and the second encrypted data by the signature adding unit 22D is paired with the second encrypted data and stored in the storage unit 23 as signature data 23F.

  The storage unit 23 is a part for storing data such as content data, random number data, user key information, and the like, and is configured with the ROM 203 and the RAM 204 as main elements on hardware. Data stored in the storage unit 23 includes a user public key 23A, a user certificate 23B, content data 23C, content information 23D, random number data 23E, and signature data 23F.

  The user public key 23A is the same as the user public key 13A received from the terminal device 10 as described above. The user certificate 23B is the same as the certificate information 13B received from the terminal device 10.

  The content data 23C is content that is the subject of an electronic signature. The content of the content data 23C is not particularly limited, and may be generated by the server 20 or acquired from the outside through any means. Such content includes, for example, document data that requires a seal or seal certification, and more specifically, data such as a contract contract, a sales contract, and an account opening application form.

  The content information 23D is data for the user to confirm the contents of the content data 23C. The content information 23D is read from the storage unit 23 of the server 20 in response to a signature request from the terminal device 10, and information (for example, content name, outline, etc.) regarding the content data 23C that is the target of the signature request. ) Is included.

  The random number data 23E is the same as the random number data generated by the random number data generation unit 22A, and is stored in the storage unit 23 for processing in the signature adding unit 22D described above.

  As described above, the signature data 23F includes the second encrypted data and data related to the association between the content data 23C and the second encrypted data by the signature adding unit 22D. The second encryption data and the data relating to the association are paired.

  With the configuration as described above, the electronic signature server 20 can give an electronic signature by the user of the terminal device 10 to the content data 23C stored in advance. Further, when the content data 23C is used, the content data 23C can be safely handled as content data with an electronic signature without fear of falsification by referring to the signature data 23F.

  The electronic signature method according to the embodiment of the present invention will be described with reference to FIGS.

  FIGS. 3 to 5 show contents data 23C stored in the electronic signature server 20 in advance in the electronic signature system 1 shown in FIGS. 1 and 2 by a public key cryptosystem using a public key and a private key. FIG. 10 is a sequence diagram showing processing for giving an electronic signature by a user of the terminal device 10. In the figure, S indicates a processing step.

  First, when assigning an electronic signature to content data, in the terminal device 10, the user selects content (that is, content data 23C) to which an electronic signature is desired via the input unit 15 (S1). Specifically, if there are multiple contents that can be given an electronic signature, such as a contract, a sales contract, an account opening application, etc., select the contents (documents) that you want to give an electronic signature from. select. After the user selects the content to which the electronic signature is to be added, the terminal device 10 sends a signature request for requesting the user's electronic signature to the content data 23C via the user information transmission / reception unit 11A. The information is transmitted to the information transmitting / receiving unit 21A (S2).

  After receiving the signature request from the user information transmission / reception unit 11A by the user information transmission / reception unit 21A, the server 20 confirms the content of the signature request, and the content data 23C of the content selected by the user is stored in the storage unit 23. (S3). After confirming the content data 23C, the server 20 sends a user information request including a transmission request for the user public key 13A and certificate information 13B stored in the storage unit 13 via the user information transmission / reception unit 21A. Then, the data is transmitted to the user information transmitting / receiving unit 11A of the terminal device 10 (S4).

  The terminal device 10 receives the user information request from the server 20 at the user information transmission / reception unit 11A, and then reads the user public key 13A and the certificate information 13B stored in the storage unit 13 (S5), and the user information transmission / reception unit It is transmitted to the user information transmitting / receiving unit 21A of the server 20 via 11A (S6).

  The server 20 receives the user public key 13A and the certificate information 13B by the user information transmission / reception unit 21A, and then stores them in the storage unit 23 as the user public key 23A and the user certificate 23B (S7). In the present embodiment, only the case where the certificate information 13B is attached to the user public key 13A will be described. However, the certificate information 13B is valid when the user of the terminal device 10 accesses the server 20 from the terminal device 10. Since it is data for confirming that the user is a valid user, the transmission of the certificate information 13B is not essential when user authentication is not required or when user authentication is performed by other means.

  After receiving the user public key 13A and the certificate information 13B, the server 20 reads the content information 23D corresponding to the content selected by the previously received signature request from the storage unit 23 (S8), and the content information transmission / reception unit 21B. Is transmitted to the content information transmitting / receiving unit 11B of the terminal device 10 (S9).

  After the content information 23D is received by the content information transmission / reception unit 11B, the terminal device 10 stores the received content information 23D in the storage unit 13 as the content information 13D, and notifies the user via the notification unit 14; Confirmation of content information is requested (S10). After the user confirms that the notified content information corresponds to the content selected by himself / herself, the user operates the terminal device 10 via the input unit 15, whereby the content information is transmitted via the content information transmission / reception unit 11 </ b> B. A confirmation completion notification for notifying the server 20 that 23D has been confirmed is transmitted to the content information transmitting / receiving unit 21B of the server 20 (S11).

  After receiving the confirmation completion notification from the content information transmitting / receiving unit 11B by the content information transmitting / receiving unit 21B, the server 20 generates random number data corresponding to the content data 23C of the content selected by the user by the random number data generating unit 22A ( S12: random number data generation step). After generating random number data, the server 20 stores the random number data in the storage unit 23 as random number data 23E (S13). Further, the server 20 generates first encrypted data by encrypting the random number data 23E using the user public key 23A stored in the storage unit 23 (S14: first encryption step). Thereafter, the server 20 transmits the first encrypted data to the encryption information transmission / reception unit 11C of the terminal device 10 via the encryption information transmission / reception unit 21C (S15: first transmission step).

  After the terminal device 10 receives the first encrypted data by the encryption information transmitting / receiving unit 11C, the decryption processing unit 12A decrypts the first encrypted data using the user secret key 13C to generate non-encrypted data (S16). : First decoding step). This non-encrypted data is the same data as the random number data 23E. In addition, since the first encrypted data is data encrypted with the user public key 23A, it cannot be decrypted except for the user secret key 13C stored in the storage unit 13 due to the characteristics of the public key encryption method. .

  The terminal device 10 generates non-encrypted data by the decryption processing unit 12A, and then encrypts the non-encrypted data (data obtained by decrypting the first encrypted data) using the user secret key 13C by the encryption processing unit 12B. To generate second encrypted data (S17: second encryption step). After generating the second encrypted data, the terminal device 10 transmits the second encrypted data to the encrypted information transmitting / receiving unit 21C of the server 20 via the encrypted information transmitting / receiving unit 11C (S18: second transmitting step).

  The server 20 receives the second encrypted data by the encrypted information transmitting / receiving unit 21C, and then decrypts the second encrypted data by using the user public key 23A by the decryption processing unit 22C to generate non-encrypted data (S19: Second decoding step). After the non-encrypted data is generated by the decryption processing unit 22C, the server 20 stores the data (non-encrypted data) obtained by decrypting the second encrypted data by the signature adding unit 22D in the storage unit 23. It is determined whether or not it matches the random number data 23E that has been made (that is, the random number data generated by the random number data generation unit 22A) (S20).

  When the non-encrypted data obtained by decrypting the second encrypted data matches the random number data 23E, the second encrypted data is associated with the content data 23C, thereby giving the user's electronic signature to the content data (S21). : Signing step). Specifically, this association is performed by the signature providing unit 22D generating data that associates the second encrypted data with the content data 23C using the user's signature value. By such processing, the server 20 gives the user's electronic signature to the content data, and then pairs the data related to the association between the content data 23C and the second encrypted data with the second encrypted data. The data 23F is stored in the storage unit 23 (S22).

  On the other hand, if the non-encrypted data obtained by decrypting the second encrypted data does not match the random number data 23E, the processing is continued without performing processing relating to the provision of the signature and the storage of the signature data.

  After determining that the above-described non-encrypted data matches the random number data 23E, the server 20 generates processing result information as information regarding whether or not processing related to signature assignment and signature data storage has been performed (S23). It transmits to the content information transmission / reception part 11B of the terminal device 10 via the information transmission / reception part 21B (S24).

  After receiving the processing result information at the content information transmitting / receiving unit 11B, the terminal device 10 notifies the user of the processing result via the notification unit 14 (S25).

  Through the processing as described above, an electronic signature by the user of the terminal device 10 can be given to the content data 23C stored in advance in the electronic signature server 20.

  The operation and effect of the electronic signature server 20 according to the present embodiment described above will be described.

  The digital signature server 20 according to the present embodiment does not need to move or copy the content data 23C from the server 20 to the terminal device 10 in order to give the digital signature to the content data 23C. Even when using a terminal device with restrictions on content, an electronic signature can be attached to content data having a large data size.

  In the electronic signature server 20, the content information transmitting / receiving unit 21 </ b> B is configured to transmit data (content information 23 </ b> D) for the user to confirm the content of the content data 23 </ b> C to the terminal device 10. With this configuration, the user of the terminal device 10 can confirm in advance the content of the content data 23C to which the electronic signature is attached without transmitting the entire content data from the server 20 to the terminal device 10.

  The electronic signature system 1 and the electronic signature method described above have technical features corresponding to the electronic signature server 20 described above, and exhibit the same operations and effects.

  Further, in the electronic signature system 1 and the electronic signature method according to the present embodiment, since the public key and the private key stored in the IC card 30 or the like attached to the terminal device 10 are used, other dedicated personal computers and IC cards are used. Without introducing the system, it is possible to easily introduce a system capable of safely managing data against fraud such as tampering by a third party.

  Furthermore, in the electronic signature system 1 and the electronic signature method according to the present embodiment, the key information that can be safely managed by the terminal device 10 such as a mobile phone and the server 20 is used, so that the user's confirmation and credibility are improved. Electronic signatures can be used safely, and content can be prevented from being falsified or rejected.

  In the electronic signature system 1 and the electronic signature method according to the present embodiment, if the user has the terminal device 10, the electronic signature is used without depending on the platform for the content to which the electronic signature is to be given. be able to.

  In addition, this invention is not limited to embodiment mentioned above, Of course, a various change is possible in the range which does not deviate from the summary of this invention.

  For example, in the above-described embodiment, random number data generated from content data based on an existing algorithm is used as random number data corresponding to the content data. However, any random number generator is used to have no relation to the content data. After generating random number data, the random number data corresponding to the content data may be generated by associating the random number data with the content data.

  In the above-described embodiment, content information including data such as a content name and an outline is used instead of content data. However, content information is transmitted from the server 20 to the terminal device 10 to notify the user. Is not required. In addition, when hardware conditions such as the capacity of the storage unit permit in the terminal device 10, the content data itself is transmitted from the electronic signature server 20 to the terminal device 10 instead of the content information so that the user confirms it. May be.

  The content information stored in the electronic signature server may be created from the content data by the electronic signature server, or data input from the outside may be used together with the content data.

It is a block diagram which shows a functional structure about an electronic signature system provided with the electronic signature server which concerns on one Embodiment of this invention. It is a figure which shows the structure of hardware about an electronic signature system provided with the electronic signature server which concerns on one Embodiment of this invention. It is a sequence diagram which shows from the content selection to the storage of public key information and certificate information in the electronic signature method according to an embodiment of the present invention. In the electronic signature method which concerns on one Embodiment of this invention, it is a sequence diagram which shows from reading of content information to decoding of 1st encryption data. In the electronic signature method which concerns on one Embodiment of this invention, it is a sequence diagram which shows from the production | generation of 2nd encryption data to the display of process result information.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 1 ... Electronic signature system, 10 ... Terminal device, 11 ... Communication unit, 11A ... User information transmission / reception part, 11B ... Content information transmission / reception part, 11C ... Encryption information transmission / reception part, 12 ... Encryption / decryption processing unit, 12A ... Decryption processing part , 12B ... Encryption processing unit, 13 ... Storage unit, 13A ... User public key, 13B ... Certificate information, 13C ... User private key, 13D ... Content information, 14 ... Notification unit, 15 ... Input unit, 20 ... Electronic signature Server (server), 21 ... communication unit, 21A ... user information transmission / reception unit, 21B ... content information transmission / reception unit, 21C ... encryption information transmission / reception unit, 22 ... signature processing unit, 22A ... random number data generation unit, 22B ... encryption processing unit , 22C ... Decryption processing unit, 22D ... Signature giving unit, 23 ... Storage unit, 23A ... User public key, 23B ... User certificate, 23C ... Con Ntsudeta, 23D ... the content information, 23E ... random number data, 23F ... signature data, N ... communication network.

Claims (4)

An electronic signature server for giving an electronic signature by a user of a terminal device to content data stored in advance,
Random number data generating means for generating random number data corresponding to the content data;
Encryption means for encrypting the random number data with the public key of the user to generate first encrypted data;
Transmitting means for transmitting the first encrypted data to the terminal device;
Receiving means for receiving second encrypted data generated by the terminal device encrypting the random number data with the secret key of the user;
Decryption means for decrypting the second encrypted data with the public key;
When the data decrypted by the decryption means matches the random number data generated by the random number data generation means, the second encrypted data is associated with the content data, so that the electronic signature of the user is the content data A signature granting means for granting to
Storage means for storing the content data and the second encrypted data in association with each other;
An electronic signature server comprising:   The electronic signature server according to claim 1, wherein the transmission unit transmits data for the user to confirm the content data to the terminal device. An electronic signature system comprising: a terminal device; and an electronic signature server for giving an electronic signature by a user of the terminal device to content data stored in advance,
The electronic signature server is
Random number data generating means for generating random number data corresponding to the content data;
Encryption means for encrypting the random number data with the public key of the user to generate first encrypted data;
Transmitting means for transmitting the first encrypted data to the terminal device;
Receiving means for receiving second encrypted data generated by the terminal device encrypting the random number data with the secret key of the user;
Decryption means for decrypting the second encrypted data with the public key;
When the data decrypted by the decryption means matches the random number data generated by the random number data generation means, the second encrypted data is associated with the content data, so that the electronic signature of the user is the content data A signature granting means for granting to
Storage means for storing the content data and the second encrypted data in association with each other,
The terminal device
User request transmission means for transmitting to the electronic signature server a signature request for requesting addition of an electronic signature to the content data;
Encryption information receiving means for receiving the first encrypted data from the electronic signature server;
Encryption information transmitting means for transmitting the second encrypted data to the electronic signature server;
Decryption means for decrypting the first encrypted data with the secret key;
An electronic signature system comprising: encryption means for encrypting data obtained by decrypting the first encrypted data with the secret key to generate the second encrypted data. An electronic signature method for giving an electronic signature by a user of a terminal device to content data stored in advance in an electronic signature server,
A random number data generation step of generating random number data corresponding to the content data in the electronic signature server;
A first encryption step of generating first encrypted data by encrypting the random number data using the public key of the user at the electronic signature server;
A first transmission step of transmitting the first encrypted data from the electronic signature server to the terminal device;
A first decryption step of decrypting the first encrypted data using the user's private key in the terminal device;
A second encryption step of generating second encrypted data by encrypting the data obtained in the first decryption step using the secret key in the terminal device;
A second transmission step of transmitting the second encrypted data from the terminal device to the electronic signature server;
A second decryption step of decrypting the second cipher data using the public key at the electronic signature server;
When the data obtained in the second decryption step matches the random number data generated in the random number data generation step, the electronic signature of the user is assigned to the content by associating the second encrypted data with the content data. Adding a signature to the data;
An electronic signature method comprising:

Images