JP4183982B2 - Digital signature system - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a digital signature system, and more particularly to a digital signature system using a portable signature creation device such as an IC card.
[0002]
[Prior art]
Due to the spread of the global network environment centering on the Internet, paper documents are being replaced by electronic media in various fields of social life. As a method for detecting the presence or absence of tampering, the use of digital signatures instead of conventional signatures is becoming widespread. At present, a digital signature that is generally used is created by a calculation based on a predetermined algorithm using secret data unique to each individual person and using the secret data. The secret data is stored in an information processing device such as an IC card under the management of each individual, and the individual public data corresponding to the secret data of each individual is stored in a computer of a trusted certificate authority. When each individual wants to send a signed message to the other party, the digital signature is obtained by performing an operation based on a predetermined algorithm using the message data to be digitally signed and the personal private data. It is only necessary to create it, attach this digital signature to the original message data, and send it to the other party. The other party checks the authenticity of the individual public data with the certificate authority and verifies the received message data and digital signature using the individual public data, so that the digital signature is indeed the sender's. Then, it is possible to confirm whether the received message data has been tampered with.
[0003]
The public key cryptosystem is used for the calculation for creating the digital signature, and the private data of each individual cannot be obtained from the created digital signature or individual public data. Accordingly, consideration is given to the fact that a third party who has obtained a digital signature cannot obtain the original secret data based on the digital signature. However, if the secret data itself is read by unauthorized means, it becomes possible to forge a digital signature. For this reason, it is preferable to use a device with the highest possible security as a signature creation device that stores secret data and creates a digital signature using this secret data.
[0004]
For these reasons, a digital signature system that is currently in practical use is a message comprising a signature creation device comprising an IC card, a reader / writer device having an access function for the IC card, and a computer for controlling the reader / writer device. The combination of the processing apparatus is the mainstream. If an IC card is distributed to an individual and the secret data for each individual is stored in the IC card, the secret data can be managed with sufficient security. An IC card that functions as a signature creation device incorporates a calculation program based on a predetermined algorithm for creating a digital signature using secret data, and all calculations using secret data are performed inside the IC card. Will be executed. Message data to be digitally signed may be prepared on the computer functioning as a message processing device and transmitted to the IC card via the reader / writer device. The IC card executes a predetermined operation using the given message data and the secret data stored therein, creates a digital signature for the given message data, and uses this as a reader / writer device. To the computer. Thus, a digital signature can be obtained for any message data prepared on the computer side.
[0005]
[Problems to be solved by the invention]
In the digital signature system using the above-described IC card, sufficient security measures are taken so that personal secret data is stored in the IC card and is not read out by an unauthorized method. However, if the communication between the computer functioning as the message processing device and the IC card functioning as the signature creation device is intercepted, the secret data itself is not directly read out. The fact that a specific digital signature has been obtained will leak to the outside. Such communication interception can be performed in a signal path between the reader / writer device and the IC card, or can be performed in a signal path between the computer and the reader / writer device. Further, a result equivalent to the communication interception can be obtained by searching the memory in the computer. In recent years, there have been many examples of fraudulent activities by distributing computer viruses with such a communication interception function. If a large number of “correspondences between specific message data and specific digital signatures” are obtained due to such illegal acts, there is a risk that secret data in the IC card is estimated by analyzing them. Come out. It is also possible to determine a command code for creating a digital signature by intercepting communications, and an unauthorized access person can give a convenient message data intentionally created to the IC card together with the calculated command code. Thus, an illegal act (so-called adaptive selection document attack) of obtaining a digital signature for the message data becomes possible, and a crime using a forged signature may be performed in various ways.
[0006]
Therefore, the present invention provides a digital signature system capable of reducing the probability that the correspondence between the message data to be digitally signed and the digital signature about the message data is intercepted by an unauthorized method, and further improving security. The purpose is to provide.
[0007]
[Means for Solving the Problems]
  (1) According to a first aspect of the present invention, there is provided a system for creating a digital signature for personal authentication for predetermined message data.
  Personal secret data for personal use is stored internally, and a digital signature for personal authentication is applied to the message data by executing an operation based on a predetermined algorithm using the secret data for the given message data. A signature creation device with a function to create;
  A function that can be connected to this signature creation device, prepares predetermined message data to be a digital signature, a function that sends the prepared message data to the signature processing device, and is created inside the signature processing device A message processing device having a function of receiving a digital signature;
  Prepare
  Information exchange between the signature creation device and the message processing device is performed according to the transmission processing for transmitting a predetermined command from the message processing device to the signature creation device and the command from the signature creation device to the message processing device. A reply process that sends back a response,
  The message processing device transmits a “signature creation command” including predetermined message data to be digitally signed to the signature creation device, and receives a response returned from the signature creation device in response to the transmission. 1 and sends a “signature reply command” for requesting a digital signature reply to the signature creation apparatus, and receives a response sent back from the signature creation apparatus in response to the response. A second active process for retrieving a digital signature contained inAfter performing command transmission and response reception as the first active process, until a command transmission and response reception as the second active process is performed, a “dummy command” that is essentially meaningless is sent to the signature generation apparatus. A dummy active process for sending a response and receiving a response returned from the signature creation device in response to this,Have the ability to
  When a “signature creation command” is transmitted, the signature creation device internally executes an operation based on a predetermined algorithm using secret data on the message data included in the command, thereby Executes processing to create a digital signature for personal authentication of message data, stores the created digital signature inside, and includes the digital signature for the created message data as a response according to the "signature creation command" First response processing that returns a predetermined response that is not included, and a predetermined response that includes the stored digital signature as a response to the “signature response command” when the “signature response command” is transmitted A second passive process that returnsWhen a “dummy command” is sent, as a response in response to the “dummy command”, a dummy passive process that returns a “dummy response” that is originally meaningless;It has a function to perform.
[0008]
(2) According to a second aspect of the present invention, in the digital signature system according to the first aspect described above,
An IC card is used as a signature creation device, and a reader / writer device having a function of accessing the IC card and a computer for controlling the reader / writer device are used as a message processing device.
[0009]
  (3) According to a third aspect of the present invention, in the digital signature system according to the first or second aspect described above,
  A message input process for causing the message processing apparatus to input message data to be digitally signed, and a signature confirmation input process for allowing the individual to input the signature for the message data. The first active process is executed when the message input process is completed, and the second active process is executed when the signature confirmation input process is completed.Then, during the period from the completion of the message input process to the completion of the signature confirmation input process, the process of transmitting the “dummy command” is performed once or a plurality of times.It is what I did.
[0010]
(4) According to a fourth aspect of the present invention, in the digital signature system according to the third aspect described above,
When the message processing device displays an input field for inputting message data on the display screen and an instruction to complete the input operation to the input field is given, it is determined that the message input process has been completed. The first active process is executed, the confirmation button for confirming the intention of signature on the display screen is made operable, and the signature confirmation input process is completed when the confirmation button is operated. It is determined and the second active process is executed.
[0013]
  (Five)   Of the present invention5thThe above-mentioned aspects are the first to the above-mentioned4thIn the digital signature system according to the aspect of
  The “signature reply command” transmitted by the message processing apparatus as the second active process includes dummy message data unrelated to the message data to be digitally signed.
[0014]
  (6)   Of the present invention6thThe above-mentioned aspects are the first to the above-mentioned5thIn the digital signature system according to the aspect of
  The signature creation apparatus includes a dummy digital signature unrelated to the created digital signature in the “response according to the signature creation command” returned as the first passive process.
[0015]
  (7)   Of the present invention7thThe above-mentioned aspects are the first to the above-mentioned6thIn the digital signature system according to the aspect of
  The signature creation device performs the second passive processing based on the “signature reply command” and then erases the digital signature stored so far.
[0016]
  (8)   Of the present invention8thThe above-mentioned aspects are the first to the above-mentioned6thIn the digital signature system according to the aspect of
  When the signature creation device stores a new digital signature created by the first passive processing based on the new “signature creation command”, the signature creation device is created by the first passive processing based on the previous “signature creation command”. The process of deleting the digital signature stored in this way is executed.
[0017]
  (9)   Of the present invention9thThe above-mentioned aspects are the first to the above-mentioned6thIn the digital signature system according to the aspect of
  A non-volatile memory is provided in the signature creation device so that a digital signature created based on the “signature creation command” is stored in the non-volatile memory,
  When the power supply to the signature creation device is cut off and the power supply is started again, a reply process for the digital signature stored in the nonvolatile memory before the power supply cut-off is performed based on the “signature reply command”. In this case, the reply process is executed on condition that the access right is authenticated.
[0018]
  (Ten)  Of the present invention10thThe above-mentioned aspects are the first to the above-mentioned6thIn the digital signature system according to the aspect of
  A non-volatile memory is provided in the signature creation device so that a digital signature created based on the “signature creation command” is stored in the non-volatile memory,
  When the power supply to the signature creation device is shut off and the power supply is started again, if the “signature reply command” is given prior to the “signature creation command”, the digital data stored in the non-volatile memory A response indicating an error is returned without executing a reply process for a signature.
[0019]
  (11)  Of the present invention11thThe above-mentioned aspects are the first to the above-mentioned6thIn the digital signature system according to the aspect of
  If the signature creation device does not receive the “signature reply command” after receiving the “signature creation command” and before the occurrence of a predetermined specific event, A process of deleting the digital signature that has been created and stored is executed.
[0020]
  (12)  Of the present invention12thAspects of the above11thIn the digital signature system according to the aspect of
  A specific event is defined as the elapse of a predetermined time after receiving the “signature creation command”, and when the predetermined time elapses, the stored digital signature is deleted. Is.
[0021]
  (13)  Of the present invention13thAspects of the above11thIn the digital signature system according to the aspect of
  When a new “signature creation command” is received after a “signature creation command” is received and a new “signature creation command” is received without receiving a “signature reply command”. The digital signature stored so far is erased.
[0022]
  (14)  Of the present invention14thAspects of the above11thIn the digital signature system according to the aspect of
  It is determined that the power supply to the signature creation device is cut off as a specific event, and when the preparation for cutting off the power supply is made, the digital signature stored so far is deleted. It is a thing.
[0023]
  (15)  Of the present invention15thThe above-mentioned aspects are the first to the above-mentioned14thIn the digital signature system according to the aspect of
  When a “signature reply command” is given to the signature creation apparatus but no digital signature to be returned is stored, a response indicating an error is returned.
[0024]
  (16) According to a sixteenth aspect of the present invention, there is provided a signature creating apparatus having a function of creating a digital signature for personal authentication for predetermined message data.
A secret data storage unit for storing private secret data;
An information communication unit for exchanging information with an externally connected message processing device;
A signature creation unit that creates a digital signature for personal authentication of the message data by performing an operation based on a predetermined algorithm using secret data for given message data;
A signature storage unit for storing the created digital signature;
Provided,
When the information communication unit receives a “signature creation command” including predetermined message data to be digitally signed from the message processing device, the information communication unit gives the message data to the signature creation unit to create a signature. A first process for executing a process and returning a predetermined response not including a digital signature for the created message data to the message processing apparatus as a response corresponding to the “signature creation command”; When a “signature reply command” for requesting a reply of a digital signature is transmitted, a predetermined response including the digital signature stored in the signature storage unit as a response corresponding to the “signature reply command” is sent. From the message processing device and the second processing for returning the response to the message processing device When a “dummy command” that is originally meaningless is sent, a dummy process that returns a “dummy response” that is originally meaningless is performed as a response to the “dummy command”. Is.
[0025]
  (17) According to a seventeenth aspect of the present invention, there is provided a message processing apparatus for exchanging information by connecting to the signature generating apparatus according to the sixteenth aspect described above.
A first active processing unit that transmits a “signature creation command” including predetermined message data that is a target of a digital signature to the signature creation device and receives a response returned from the signature creation device in response thereto When,
Sends a “signature reply command” for requesting a digital signature reply to the signature creation device, receives a response sent back from the signature creation device in response to this, and receives the digital contained in the received response A second active processing unit for retrieving the signature;
After performing command transmission and response reception as the first active process, until a command transmission and response reception as the second active process is performed, a “dummy command” that is essentially meaningless is sent to the signature generation apparatus. A dummy active processing unit that transmits a response to the response and receives a response returned from the signature creation device in response thereto;
Is provided.
[0026]
  (18) According to an eighteenth aspect of the present invention, a program for causing a computer to function as the message processing apparatus according to the seventeenth aspect described above is prepared.
[0028]
DETAILED DESCRIPTION OF THE INVENTION
Hereinafter, the present invention will be described based on the illustrated embodiments.
§1. Basic embodiment of the present invention
FIG. 1 is a block diagram showing a configuration of a digital signature system according to a basic embodiment of the present invention. As shown in the figure, this digital signature system includes a message processing device 100 and a signature creation device 200. In this embodiment, the message processing device 100 is configured by a computer 110 and a reader / writer device 120, and the signature creation device 200 is configured by an IC card. As shown in the figure, the signature creating apparatus 200 composed of an IC card is provided with components such as an information communication unit 210, a secret data storage unit 220, a signature creation unit 230, and a signature storage unit 240. However, each of these components shows a configuration that focuses on the function of the IC card on the software, and from the viewpoint of the components on the hardware, the IC card includes a CPU and a memory (RAM, ROM). , EEPROM) and an input / output interface, the information communication unit 210 is configured by the input / output interface, and the secret data storage unit 220 and the signature storage unit 240 are non-volatile in the embodiment shown here. The area in the EEPROM, which is a volatile memory, is used as the secret data storage unit 220 and the signature storage unit 240), and the signature creation unit 230 is configured by a CPU that operates based on a program stored in the memory. The
[0029]
The signature creation device 200 formed of an IC card is a portable information processing device that can be carried by each user, and can be used by connecting to the message processing device 100 as necessary. Recently, IC cards have already begun to be used for various purposes. Therefore, the signature creation apparatus 200 does not necessarily have to be provided as a dedicated IC card that performs only the signature creation function. In practice, a general-purpose IC card that is shared for a plurality of uses is used as the signature creation apparatus 200. Is possible. The reader / writer device 120 has a function of exchanging information by connecting to the signature creation device 200 made up of the IC card. All direct access to the IC card is executed by the reader / writer device 120. On the other hand, the computer 110 has a function of controlling the reader / writer device 120 connected as a peripheral device, and can be configured by a personal computer for personal use, for example.
[0030]
Here, a case where Web browser software for browsing a Web page by connecting to the Internet is incorporated in the computer 110, and a user transmits message data with a digital signature to a specific site via the Internet. As an example, the basic operation of this system will be described. Such a basic operation is performed by division of work between the message processing apparatus 100 and the signature creation apparatus 200.
[0031]
That is, first, message data to be digitally signed is prepared on the message processing apparatus 100 side. The message data may be prepared by direct input from the user using the keyboard of the computer 110 or may be prepared by reading from a file in the storage device. Of course, it is also possible to prepare message data by taking it into the computer 110 via a network. The message data prepared in the computer 110 in this way is transmitted to the signature creation device 200 via the reader / writer device 120. More specifically, the message data is received by the information communication unit 210 and given to the signature creation unit 230. On the other hand, the secret data storage unit 220 stores secret data for the individual user who is the owner of the signature creation device 200 (IC card) to perform a digital signature for personal authentication. The signature creation unit 230 performs an operation based on a predetermined algorithm using the secret data in the secret data storage unit 220 on the message data given from the information communication unit 210, thereby personal authentication for the message data. Process to create a digital signature. The digital signature created in this way is temporarily stored in the signature storage unit 240 and then returned to the reader / writer device 120 via the information communication unit 210 and transmitted to the computer 110.
[0032]
Eventually, the signature creation apparatus 200 creates a digital signature for the message data transmitted from the message processing apparatus 100 using the secret data in the secret data storage unit 220, and uses the created digital signature as the message processing apparatus. The message processing apparatus 100 prepares predetermined message data to be a digital signature, transmits the prepared message data to the signature creation apparatus 200, and creates a signature. This means a device that functions to receive a digital signature created inside the device 200. Thus, when predetermined message data and a digital signature corresponding to the predetermined message data are prepared in the computer 110, they can be transmitted to a predetermined site via the Internet. On the site side, it is possible to confirm that legitimate message data has been transmitted from a legitimate user by inquiring a predetermined certificate authority about the legitimacy of the received message data and the digital signature.
[0033]
Next, let us explain the above basic operation using specific data. Here, a specific example in which a specific user “Taro Taro” accesses a specific Web site using the computer 110 and orders an encyclopedia from an online bookstore operated by the Web site is taken. View. First, in order to place such an order, the user “Taro Tokkyo” inputs message data M (data consisting of a character string “Look at the encyclopedia set”) as shown in FIG. To do. Then, the message data M is transmitted to the information communication unit 210 via the reader / writer device 120 and given to the signature creation unit 230. Here, the secret data H as shown in FIG. 2 (in this example, for the sake of convenience, the character string “ABC123”) is stored in the IC card possessed by the user “Taro Taro”. Let's take it. Specifically, the secret data H is stored in the secret data storage unit 220 (in this example, the EEPROM). The secret data H is written by a predetermined method at the issuer when the IC card is issued to the user “Taro Taro”.
[0034]
The signature creation unit 230 executes a predetermined operation using the secret data H on the message data M based on a predetermined algorithm prepared in advance, and a digital signature for personal authentication on the message data M is obtained. D is created. Here, for example, it is assumed that a digital signature D as shown in FIG. 2 (in this example, it is assumed that it is a numerical value “456789” for convenience) is created. Such an algorithm for creating a digital signature is prepared in advance as a program in a memory such as a ROM in the IC card. As a specific algorithm for creating a digital signature, for example, “a character string that configures secret data H is added to a character string that configures message data M, and these character strings are replaced with hexadecimal numbers to be digitized. An algorithm such as “a hash value obtained by applying a hash function to this numerical value is used as a digital signature” may be used. A hash value obtained by applying a hash function to a certain numerical value is uniquely determined. However, since the original numerical value cannot be calculated backward from the hash value, message data M and secret data H are given. For example, the signature creation unit 230 can uniquely determine the digital signature D given as the hash value. Conversely, even if the digital signature D and the message data M are known, the secret data H can be obtained from them. Cannot be asked.
[0035]
Thus, the digital signature D composed of the numerical value “456789” created by the signature creation unit 230 is stored in the signature storage unit 240 and then returned to the computer 110 via the information communication unit 210 and the reader / writer device 120. Is done. Therefore, the computer 110 sends the digital signature D together with the message data M to the online bookstore site as an order from the user “Patent Taro”, and orders the encyclopedia.
[0036]
On the other hand, the secret data H stored in the secret data storage unit 220 is also registered in the certificate authority to be trusted as the secret data for personal authentication of the user “Taro Taro”. Therefore, the online bookstore that has received the message data M “Encyclopedia complete set” and the digital signature D “456789” as an order from the user “Taro Taro” inquires them from the certificate authority. Thus, it can be confirmed that the combination of the message data M and the digital signature D is surely transmitted from “Taro Tokkyo”. That is, in the certificate authority, a predetermined algorithm (signature generation unit 230) is used by using message data M “I order a complete encyclopedia.” And data “ABC123” registered as secret data H of Patent Taro. If the same digital signature D “456789” is obtained, message data M “Encyclopedia complete order” and “456789” are obtained. It will be confirmed that the combination with the digital signature D is certainly sent by the user “Taro Taro”. Of course, when a part of the message data M is tampered with, the obtained digital signature is different, so that a correct authentication result cannot be obtained.
[0037]
Now, in this way, message data M is prepared on the message processing apparatus 100 side, this is given to the signature creating apparatus 200 side, and a digital signature D is created by an internal operation on the signature creating apparatus 200 side. In order to perform the basic operation of returning the message to the message processing apparatus 100 again, it is naturally necessary to exchange information between the message processing apparatus 100 and the signature creation apparatus 200. In general, information exchange between an IC card and a reader / writer device is performed by transmitting a predetermined command from the reader / writer device side to the IC card side and transmitting a predetermined response corresponding to the command from the IC card side to the reader / writer device. This is done by alternately executing a communication process of returning to the side.
[0038]
In the case of a conventional general digital signature system of the type in which a signature creation process is executed on the IC card side, first, for example, a signature command as shown in FIG. In response to this, a process of returning a response as shown in FIG. 3B, for example, from the IC card to the reader / writer device is performed to create a digital signature D for the predetermined message data M. In the specific example shown in FIG. 3, the signature command includes a head part including a command code “SIGN” (a code indicating that the command is a command for requesting signature creation), and “encyclopedia”. I will order a complete encyclopedia. ”And a body part consisting of message data M with a string of characters. The response to this signature command is a status code“ OK ”(the given command has been processed correctly) For example) and a subsequent part consisting of a digital signature D “456789”. The IC card side understands the signature command as shown in FIG. 3 (a), and uses the message data M included in the main body of the signature command and the secret data H stored therein to create a digital signature. If a function for executing a process of creating a D and sending back a response including the created digital signature D in the subsequent part is provided, a signature command as shown in FIG. Is given, a response as shown in FIG. 3B is returned, and the digital signature D for the predetermined message data M can be obtained.
[0039]
However, in this way, message data M to be digitally signed is prepared on the message processing device 100 side, a command including this message data M is given to the signature creation device 200 (IC card), and the message from the signature creation device 200 is sent to the message. As long as a method of obtaining the created digital signature D as a response returned to the processing device 100 is adopted, it is possible to be attacked by unauthorized means such as interception of communication between the message processing device 100 and the signature creation device 200. As described above, there is a possibility of giving a clue to guess the secret data H. For example, in the case of the example shown in FIG. 3, if the fact that the response shown in FIG. 3 (b) is returned to the signature command shown in FIG. It will be understood that the digital signature D corresponding to the message data M is “456789”. Of course, it is very difficult to guess the secret data H in the secret data storage unit 220 with only one combination of the message data M and the digital signature D. However, if the communication interception is continued, the message A large number of combinations of the data M and the digital signature D can be accumulated. The more such accumulation, the higher the estimation probability of the secret data H. If it can be recognized that the signature command code is “SIGN”, the unauthorized person can give the IC card a signature command including arbitrary message data M and obtain a response corresponding to the signature command. Therefore, it becomes easier to guess the secret data H.
[0040]
As described above, the present invention transmits a predetermined command from the message processing apparatus 100 to the signature creating apparatus 200, and returns a response corresponding to the command from the signature creating apparatus 200 to the message processing apparatus 100. It is an object of the present invention to improve security in a digital signature system in which information is exchanged between the two by alternately executing a reply process. The main points are a command (herein referred to as a signature creation command) for requesting signature creation by transmitting message data M to be a digital signature from the message processing device 100 to the signature creation device 200, and a signature creation device. A command (herein referred to as a signature reply command) for returning the digital signature D created on the 200 side to the message processing apparatus 100 side is prepared as a separate and independent command, and a response to the signature creation command is prepared. Is that the created digital signature is not included, and the response to the signature reply command is returned including the created digital signature.
[0041]
That is, in the digital signature system according to the present invention, the command and response shown in FIG. 4 are exchanged between the message processing device 100 and the signature creation device 200 shown in FIG. First, a signature creation command as shown in FIG. 4A is given from the message processing device 100 to the signature creation device 200. In this example, the signature creation command is composed of a head part composed of a command code “MAKE” and a main body part composed of message data M of a character string “I order a complete encyclopedia”. . The information communication unit 210 that has received such a signature creation command gives the message data M part to the signature creation unit 230 to create a digital signature D. As described above, the signature creation unit 230 performs an operation based on a predetermined algorithm for the message data M and the secret data H in the secret data storage unit 220, and generates a digital signature D such as “456789”, for example. A process of creating and writing this in the signature storage unit 240 is performed. On the other hand, the information communication unit 210 returns a response to the given signature creation command to the message processing apparatus 100. The response is created by the signature creation unit 230 and written in the signature storage unit 240. The digital signature D “456789” is not included. Specifically, for example, a process of returning a response as shown in FIG. This response is a response consisting only of the main body part having the status code “OK”, and there is no subsequent part. Eventually, this response is information indicating only that the given signature creation command has been executed without any problem. In other words, even if a signature creation command as shown in FIG. 4A is given, the created digital signature D “456789” is not returned as a response to the signature creation command.
[0042]
In the present invention, in order to obtain the created digital signature D, it is necessary to give a signature reply command as shown in FIG. 4C from the message processing device 100 to the signature creation device 200. In this example, the signature reply command is composed only of the finding part consisting of the command code “BACK”, and there is no main part. Upon receiving such a signature reply command, the information communication unit 210 reads the digital signature D “456789” stored in the signature storage unit 240 and sends a response including the digital signature D to the message processing apparatus 100. Process to reply. Specifically, this response is, for example, a response as shown in FIG. This response is a response obtained by adding the subsequent part “456789” to the main body part having the status code “OK”, indicating that the given signature reply command has been executed without any problem, and is a reply target. This is information indicating that the digital signature D is “456789”. In other words, the signature reply command shown in FIG. 4C is a command for requesting a reply of the digital signature D created by the signature creation command shown in FIG. 4A given in the past. If a signature reply command is given but the digital signature D is not stored in the signature storage unit 240 (that is, the signature reply command is given in the state where the signature creation command is not given). In this case, a response in which a status indicating an error is written in the main body is returned to the signature reply command.
[0043]
After all, in the digital signature system according to the present invention, in order to obtain the digital signature D for the predetermined message data M, the following processing is performed in the message processing device 100 and the signature creation device 200, respectively. Here, for convenience of explanation, the processing on the message processing device 100 side is referred to as “active processing”, and the processing on the signature creation device 200 side is referred to as “passive processing”.
[0044]
First, the following processing is performed on the message processing apparatus 100 side. First, a first active process for transmitting a “signature creation command” including predetermined message data M to be a digital signature to the signature creation apparatus 200 and receiving a response returned in response thereto is performed. Done. In other words, this first active process is a process for transmitting a signature creation command as shown in FIG. 4A and receiving a response as shown in FIG. become. Subsequently, a “signature reply command” for requesting a reply of the digital signature is transmitted to the signature creation apparatus 200, a response returned in response to the response is received, and the digital included in the received response is received. A second active process for retrieving the signature is performed. That is, the second active process transmits a signature reply command as shown in FIG. 4 (c), receives a response as shown in FIG. That is, a process of extracting the digital signature D “456789” included in.
[0045]
Of course, the first active process and the second active process do not necessarily need to be executed continuously, and another process (some command is sent from the message processing apparatus 100 side between the two processes). In response to this, a process for receiving a response may be executed. In addition, the command transmission work to the signature creation apparatus 200 is not performed based on a user's direct instruction, but based on an instruction of a program executed on the computer 110 constituting the message processing apparatus 100. It will be. Therefore, the procedure of the first active process and the second active process described above is described in a program executed on the computer 110.
[0046]
On the other hand, each time an individual command is given, the signature creating apparatus 200 side executes a predetermined process according to the content of the command and executes a process of returning a predetermined response. Specifically, first, when the above-mentioned “signature creation command” is transmitted, an operation based on a predetermined algorithm using the secret data H is internally performed on the message data M included in the command. Execute the process for creating the digital signature D for personal authentication for the message data M, store the created digital signature D therein, and create the message as a response according to the “signature creation command” A first passive process for returning a predetermined response not including the digital signature D for the data M is performed. That is, the first passive processing is performed by the message processing apparatus 100 to the information communication unit 210 as “signature creation including predetermined message data M to be digitally signed as shown in FIG. When the “command” is transmitted, the message data M is given to the signature creation unit 230 to execute the signature creation process, and the created message data M is sent as a response according to the “signature creation command”. For example, a predetermined response as shown in FIG. 4B is returned to the message processing apparatus 100 without including the digital signature D.
[0047]
When the above-mentioned “signature reply command” is transmitted, a second passive process for returning a predetermined response including the stored digital signature D as a response corresponding to the “signature reply command” is performed. Is called. That is, in the second passive processing, a “signature reply command” for requesting a digital signature reply as shown in FIG. 4C is transmitted from the message processing apparatus 100 to the information communication unit 210. When the message processing apparatus 100 receives a predetermined response as shown in FIG. 4D, for example, including the digital signature D stored in the signature storage unit 240 as a response to the “signature reply command”. It will be processing to reply to. As described above, if the digital signature D to be returned is not stored in the signature storage unit 240 even though the “signature reply command” has been transmitted, a response indicating an error. Will be replied.
[0048]
Of course, the first passive processing and the second passive processing are actually executed by the CPU in the IC card constituting the signature creation apparatus 200 based on a program stored in advance in ROM, EEPROM, or the like. It is processing to do. Therefore, the procedure of the first passive process and the second passive process described above is described in a program executed on this IC card.
[0049]
§2. Practical embodiments of the present invention
Although the basic embodiment of the present invention has been described above, a more practical embodiment is shown here.
[0050]
A feature of the present invention is that the message processing apparatus 100 receives a signature creation command for transferring the message data M from the message processing apparatus 100 side to the signature creation apparatus 200 side and instructing signature creation, and a digital signature D created on the signature creation apparatus 200 side. Separately from the signature reply command instructing the reply to the 100 side as a response, both the message data M and the corresponding digital signature D are included in the information exchanged by one command / response communication. Is to avoid the inclusion of security, and to improve security against attacks such as communication interception. That is, in the conventional digital signature system, as shown in FIG. 3, both the message data M and the corresponding digital signature D are included in the information exchanged by one command / response communication. On the other hand, in the digital signature system of the present invention, message data is included in information exchanged by a single command / response communication as shown in FIGS. 4 (a) and 4 (b). Only M is included, and only the digital signature D is included in the information exchanged by one command / response communication as shown in FIGS. 4 (c) and 4 (d). Absent. For this reason, even if the contents of individual command / response pairs are analyzed by unauthorized means such as communication interception, the pair of message data M and digital signature D is difficult to be exposed, and a signature must be created. Command code (“MAKE” in the example of FIG. 4) and a command code requesting a signature reply (“BACK” in the example of FIG. 4) are not easily exposed.
[0051]
As described above, the security improvement effect according to the present invention is that the timing for transmitting the signature creation command (timing for executing the first active process) and the timing for transmitting the signature reply command (timing for executing the second active process). ). In practical use, the greater the distance between these two timings, the greater the effect of improving security. Of course, the timing of the first active processing and the timing of the second active processing performed on the message processing device 100 side are all determined by a program operating on the computer 110 constituting the message processing device 100. Therefore, in the following, an example of the timing at which the first active process and the second active process should be executed in relation to a program running on the computer 110 will be shown.
[0052]
As described above, the computer 110 has a function of preparing message data M to be digitally signed, and such message data M is usually input by the user who performs the signature from the keyboard or the like. become. Therefore, the computer 110 has a function of performing message input processing for inputting the message data M to be digitally signed. In addition, the act of “digital signature” is usually performed in conjunction with legally meaningful acts such as the conclusion of purchase contracts for goods, and the user who performs the signature before performing “digital signature” It is preferable that the user inputs an input for confirming the signature of the message data M. Therefore, the computer 110 normally has a function of performing a signature confirmation input process (for example, a process for causing the user to click a signature button or the like).
[0053]
In the embodiment described here, there is a program for executing the first active process and the second active process by using the above-described input processing functions. That is, there is a program that executes the first active process when the message input process by the user is completed, and executes the second active process when the signature confirmation input process is completed. Specifically, an input field for inputting the message data M is displayed on the display screen, and it is determined that the message input process has been completed when an instruction to complete the input operation to the input field is given. Then, the first active process is executed, and a confirmation button for confirming the intention of signature is made operable on the display screen, and when the confirmation button is operated, the signature confirmation input process is completed. It can be determined that the second active process is executed.
[0054]
Let me explain this more concretely. For example, consider a case where a window as shown in FIG. 5 is displayed on the display screen of the computer 110. This window is a window for transmitting a signed document to a predetermined site via the Internet. On this window, a user inputs a message input process for inputting message data M to be transmitted and a signature confirmation input. Processing. The message input process is performed by inputting a predetermined character string in each of the three input fields I1, I2, and I3. In the example shown in the figure, the character string “Shinjuku-ku, Tokyo” has already been entered in the input field I1 where the address is to be entered, and the character “Taro Tokkyo” is entered in the input field I2 where the name is to be entered. The column has already been input, and a state where up to a character string “Encyclopedia encyclopedia” is input is shown in the input field I3 into which the content is to be input. Such an input operation is executed by operating a keyboard, a mouse, or the like. In this example, a “signature” button B1 and a “cancel” button B2 are displayed below the button. The button B1 is a confirmation button for confirming the intention of the digital signature, but at this point, it is not yet operable. That is, it is drawn with a broken line in the figure, and the button B1 is in a state where it does not react even if it is clicked. On the other hand, the button B2 is always operable. The user can cancel the procedure for sending the signed document by clicking this button B2.
[0055]
Now, when the user completes the input of the entire sentence “I want to order a complete encyclopedia” in the input field I3 and presses the Enter key or Tab key to complete the input, the three input fields I1, An instruction to the effect that the input operation for all of I2 and I3 has been completed is given. In this embodiment, the first active process is performed at this timing. That is, when the input operation for all the three input fields I1, I2, and I3 is completed, the input processing of the message data M to be signed is completed. At this time, the reader / writer device 120 is transferred from the computer 110 to the reader / writer device 120. The signature creation command as shown in FIG. 4 (a) is sent to the signature creation apparatus 200 side through the above (however, the main body part is “Shinjuku-ku, Tokyo / Taro Patent / Encyclopedia complete set.” In response to this, a response as shown in FIG. 4B is obtained. At this point, the button B1 becomes operable, and the window display is as shown in FIG. In other words, when the computer 110 determines that the input process of the message data M to be signed is completed, the computer 110 executes the first active process and presses the confirmation button B1 for confirming the signature intention on the display screen. Processing to make the operation ready is executed.
[0056]
Of course, the user cannot recognize that processing such as command transmission and response reception is being performed. Therefore, from the user's point of view, when the input of the character string into the input field I3 is completed (for example, when the Enter key or Tab key is input), the display of the button B1 changes as shown in FIG. It will be recognized that the clickable state has been reached. Here, the button B1 in the operable state requires the user to confirm the intention of the digital signature. When the user clicks the button B1, the final confirmation of the digital signature is confirmed. It will be. However, in practice, when the window display is in the state as shown in FIG. 6, the digital signature D for the message data M is already obtained by calculation in the signature creating apparatus 200 and stored in the signature storage unit 240. Will be stored.
[0057]
When the user clicks the button B1 shown in FIG. 6, it is determined that the operation for the confirmation button for confirming the intention of signature has been performed, and that the signature confirmation input process has been completed. In this embodiment, the second active process is performed at this timing. That is, when the signature confirmation input process is completed, a signature reply command as shown in FIG. 4 (c) is transmitted from the computer 110 to the signature creating apparatus 200 via the reader / writer apparatus 120. A response as shown in FIG. 4 (d) is obtained. Thus, since the message data M and the digital signature D corresponding to the message data M are prepared in the computer 110, processing for transmitting them to a predetermined site is performed.
[0058]
In this way, the input field for inputting the message data M is displayed on the display screen, and when the instruction to complete the input operation to the input field is given, it is determined that the message input process has been completed. The first active process is executed, and the confirmation button for confirming the intention of the signature is made operable on the display screen, and when the confirmation button is operated, the signature confirmation input process is completed. If it is determined that the second active process is executed, the first active operation is automatically performed only by the user himself / herself through a series of procedures from the input of the message data M to the signature confirmation. The timing of the process and the second active process will be instructed. The time from the timing of the first active processing instructed in this way to the timing of the second active processing is very long compared to the machine cycle of the CPU, and each timing is randomly determined by the user's own input operation. Therefore, higher security is secured against unauthorized attacks. That is, a sufficient time can be secured between the timing when the signature creation command shown in FIG. 4 (a) is given and the timing when the signature reply command shown in FIG. 4 (c) is given. It will be a random time due to.
[0059]
In order to further improve security, after the signature creation command shown in FIG. 4 (a) and the response shown in FIG. 4 (b) are sent back, the signature reply command shown in FIG. It is preferable that another command / response pair is inserted before the response of 4 (d) is returned. That is, after performing command transmission and response reception as the first active process, and before performing command transmission and response reception as the second active process, the first active process and the second active process If irrelevant command transmission and response reception are performed once or multiple times, the message data M included in the signature creation command in FIG. 4 (a) and the response to the signature reply command in FIG. 4 (d) are included. Since an irrelevant command / response is inserted between the digital signature D and the digital signature D, the correspondence between the message data M and the digital signature D is more difficult to grasp.
[0060]
When the signature creation command in FIG. 4 (a) is sent and the response in FIG. 4 (b) is sent back, the signature reply command in FIG. 4 (c) is sent and the response in FIG. 4 (d) is sent back. If the time interval from the point in time is some distance away, some system may automatically insert some other meaningful command / response pair. However, in practice, after the command transmission as the first active process and the response return as the first passive process are performed between the message processing apparatus 100 and the signature processing apparatus 200, there is essentially no meaning. It is preferable to send a dummy command and return a dummy response.
[0061]
In addition, the “response to the signature creation command” shown in FIG. 4B does not have a connection part. However, in practice, the “response to the signature creation command” sent back as the first passive process is created in the “response to the signature creation command”. It is preferable to include a dummy digital signature unrelated to the digital signature. Similarly, the “signature reply command” shown in FIG. 4 (c) has no main body, but in practice, the “signature reply command” transmitted as the second active process is subject to a digital signature. It is preferable that dummy message data unrelated to the message data to be included is included.
[0062]
FIG. 7 is a diagram illustrating an example of command / response exchange between the message processing apparatus 100 and the signature creation apparatus 200 including such a dummy command, dummy response, dummy digital signature, and dummy message data. First, {circle around (1)} signature creation command is a legitimate command and is a command indicating an instruction to create a digital signature for message data M. As described above, the signature creation unit 230 performs the process of creating the digital signature D and writing it in the signature storage unit 240 by this command. The subsequent response to (2) signature creation command is a regular response to the command (1). However, a dummy digital signature D “123789” is included in this response.^*It is included. As described above, the response to the command {circle around (1)} only needs to include status information “OK” indicating that the command has been executed without any problem, and this response includes the created digital signature. The point that D “456789” is not included is an important point of the present invention. However, in this response, a completely different dummy digital signature D is used instead of the original digital signature D “456789”.^*The inclusion of “123789” is useful for deceiving an analysis of an unauthorized access person when an unauthorized access person is attacked.
[0063]
In addition, (3) dummy command (part 1), (4) dummy response (part 1), (5) dummy command (part 2), and (6) dummy response (part 2) are all meaningful legitimate. It is not a command / response but a dummy command / response that has no meaning. By inserting a number of such dummy command / response pairs, the analysis of the unauthorized access person can be further deceived.
[0064]
The following (7) signature reply command is a legitimate command and is a command indicating an instruction to reply a digital signature created in the past. In response to this command, the response including the digital signature D “456789” stored in the signature storage unit 240 is returned as a response to the {8} signature reply command, as already described. However, in the (7) signature reply command shown in the figure, dummy message data M “Tomorrow's weather will be fine.”^*It is included. As described above, it is not necessary to attach the message data M to the signature reply command, and it is an important point of the present invention that the message data M is not included in the command. However, instead of the original message data M, “I will order a complete encyclopedia.” For this command, dummy message data M with completely different contents “Tomorrow ’s weather will be sunny.”^*It is useful to confuse the analysis of unauthorized users.
[0065]
In fact, an unauthorized accessor who obtained a series of command / response pairs as shown in FIG. 7 by unauthorized means such as communication interception, the message data “I will order a complete encyclopedia” and the digital signature “123789” The combination of the message data “Spring, Summer, Fall and Winter” and the digital signature “123123”, the message data “Children” and the digital signature “456456”, “Tomorrow ’s weather will be sunny. 4 combinations of inaccurate message data and a digital signature of “456789” are acquired, and the secret data H cannot be estimated even if an analysis based on these combinations is performed.
[0066]
By the way, when a signature creation command is given to the signature storage unit 240 in the IC card, the digital signature D created by the signature creation unit 230 is written, but in practice, the signature is written at a predetermined timing. It is preferable to perform an erasure process for erasing the digital signature D stored in the storage unit 240. The erasure process can be performed after the second passive process based on the signature reply command, for example. That is, since the digital signature D stored in the signature storage unit 240 is read by the signature reply command and returned as a response, it is no longer necessary to store the digital signature D. At this time, The digital signature D may be erased. Of course, depending on the program prepared on the computer 110 side, it is possible to adopt a usage form in which the digital signature D created by one signature creation command is repeatedly returned by a plurality of signature reply commands. Although possible, such a usage pattern is a special usage pattern. Normally, the digital signature D created by a single signature creation command is returned and used only by a single signature reply command, so it is the most natural method to delete it when the reply is completed. It is.
[0067]
Alternatively, when the reply is completed, the previous “signature creation” is performed when the newly created digital signature is stored by the first passive process based on the new “signature creation command” without performing the erasure process yet. The digital signature created and stored by the first passive process based on the “command” may be deleted. In this case, the digital signature D created by the previous “signature creation command” remains in the signature storage unit 240 until a new “signature creation command” is given.
[0068]
In the embodiment shown here, an EEPROM in an IC card is used as the signature storage unit 240. When such a non-volatile memory is used as the signature storage unit 240, the signature creation device 200 (IC card) is disconnected from the message processing device 100 (reader / writer device 120), and the user carries the signature creation device 200 alone. Even in this state, the digital signature D is still stored in the signature storage unit 240. In other words, power supply to the IC card is normally performed from the reader / writer device side. Therefore, when the IC card is disconnected from the reader / writer device, the power supply to the IC card is cut off. Therefore, the contents stored in the volatile memory such as the RAM in the IC card are lost when the IC card is disconnected from the reader / writer device. However, the contents stored in a nonvolatile memory such as an EEPROM are maintained as they are even after the power supply is cut off. Therefore, if the IC card is connected again to the reader / writer device and the power supply is started, the digital signature D remaining in the EEPROM can be read. Such a situation is not preferable from the viewpoint of security. For example, when a legitimate user loses an IC card being carried and an unauthorized accessor who has picked up the IC card attempts to access it using the reader / writer device 120 originally developed, the digital signature D remaining in the EEPROM is stored. May be read out.
[0069]
As a security measure against such an unauthorized attack, when the power supply to the IC card (signature generation apparatus 200) is shut off and the power supply is started again, the power supply is cut off based on the “signature reply command”. When the reply process for the digital signature stored in the nonvolatile memory is performed, the reply process may be executed on condition that the access right is authenticated. Alternatively, when the “signature reply command” is given prior to the “signature creation command” when the power supply to the IC card (signature creation apparatus 200) is shut off and the power supply is started again, the non-volatile A response indicating an error may be returned without executing the reply process for the digital signature stored in the memory. In any case, it is possible to prevent an unauthorized accesser who has picked up an IC card from reading out a legitimate digital signature D remaining in the EEPROM by an unauthorized method.
[0070]
As described above, it is not preferable in terms of security that the regular digital signature D is continuously stored in the signature storage unit 240 for a long time. Therefore, practically, after receiving the “signature creation command”, if the “signature reply command” is not received before the “predetermined specific event” occurs, the “signature creation command” It is preferable to program the IC card so that the process of deleting the digital signature created based on the above and stored in the signature storage unit 240 is executed.
[0071]
For example, “determining that a predetermined time has elapsed since receiving a signature creation command” is defined as a specific event, and when a predetermined time has elapsed, the digital signature stored so far is deleted. can do. Specifically, for example, “one minute has elapsed after receiving the signature creation command” is defined as a specific event, and when one minute has elapsed, the digital signature D stored in the signature storage unit 240 is deleted. What is necessary is just to perform the process to perform. Of course, when such a setting is made on the IC card side, the signature reply command is not transmitted to the program on the computer 110 side, for example, even if one minute has passed since the signature creation command was transmitted. In such a case, it is necessary to consider such as sending a signature creation command again.
[0072]
Also, after receiving the “signature creation command”, receiving a new “signature creation command” without receiving a “signature reply command” is defined as a specific event, and a new “signature creation command” is received. Sometimes, the digital signature stored so far may be erased. Alternatively, the fact that the power supply to the IC card (signature processing apparatus 200) is cut off is determined as a specific event, and the digital signature stored so far can be stored when preparations for cutting off the power supply are made. An erasing process may be performed. Specifically, when a preparation process for separating the IC card from the reader / writer device 120 (for example, an eject operation on the reader / writer device 120) is performed, a process of deleting the digital signature in the EEPROM is performed. Just keep it.
[0073]
As mentioned above, although this invention was demonstrated based on some embodiment shown in figure, this invention is not limited to these embodiment, In addition, it can implement with a various form. For example, in the above-described embodiment, a method using a hash function as an algorithm for obtaining a digital signature has been described. However, an algorithm for digital signature creation performed in the signature creation apparatus 200 is limited to a method using a hash function. Rather, in short, any algorithm may be used as long as some uniquely determined data is obtained based on the secret data H in the secret data storage unit 220 and the given message data M. In the above-described embodiment, an example is shown in which an IC card is used as the signature creation apparatus 200. However, the signature creation apparatus 200 does not necessarily have to be configured with an IC card, and stores secret data H with sufficient security. Any information processing apparatus may be used as long as the information processing apparatus has a function of performing an operation for creating a digital signature internally and is separate from the message processing apparatus 100. The “digital signature” in the present invention is not limited to data created by encryption using a so-called public key cryptosystem. For example, a “message authentication code ( Message authentication code (MAC) ”and the like, and the present invention can be applied to a system for creating a message authentication code defined in ISO / IEC 9797, JIS X5055, HMAC: RFC2104, and the like. is there.
[0074]
【The invention's effect】
As described above, according to the present invention, it is possible to reduce the probability that the correspondence between message data that is the subject of a digital signature and the digital signature for this will be intercepted in an unauthorized manner, thereby further improving security. Digital signature system can be realized.
[Brief description of the drawings]
FIG. 1 is a block diagram showing a basic configuration of a digital signature system according to an embodiment of the present invention.
FIG. 2 is a diagram showing specific examples of message data M, secret data H, and digital signature D used in a general digital signature system.
FIG. 3 is a diagram illustrating an example of a command / response used to obtain a digital signature in a conventional digital signature system.
FIG. 4 is a diagram showing an example of a command / response used for obtaining a digital signature in the digital signature system according to the present invention.
FIG. 5 is a diagram showing an example of a display window for performing input work of message data to be a digital signature in the digital signature system according to the present invention.
FIG. 6 is a diagram showing an example of a display window for performing an input operation of digital signature intention confirmation in the digital signature system according to the present invention.
FIG. 7 is a diagram showing a more practical example of a command / response used for obtaining a digital signature in the digital signature system according to the present invention.
[Explanation of symbols]
100: Message processing device
110: Computer
120: Reader / writer device
200 ... Signature creation device
210: Information communication unit
220: Secret data storage unit
230 ... Signature generator
240: Signature storage unit
B1, B2 ... button
D ... Digital signature
D^*... Dummy digital signature
H ... Secret data
I1, I2, I3 ... Input fields
M: Message data
M^*... Dummy message data

Claims (18)

A system for creating a digital signature for personal authentication for predetermined message data,
Personal secret data for personal use is stored therein, and a digital signature for personal authentication is applied to the message data by executing an operation based on a predetermined algorithm using the secret data for the given message data. A signature creation device with a function to create;
A function that can be connected to the signature creation device and prepares predetermined message data to be digitally signed, a function that transmits the prepared message data to the signature processing device, and creation inside the signature processing device A message processing device having a function of receiving the digital signature
With
Information exchange between the signature creation device and the message processing device includes transmission processing for transmitting a predetermined command from the message processing device to the signature creation device, and from the signature creation device to the message processing device. In response to the command, a response process that returns a response is performed.
The message processing device transmits a “signature creation command” including predetermined message data to be digitally signed to the signature creation device, and in response thereto, a response returned from the signature creation device. The first active process to be received and a “signature reply command” for requesting a digital signature reply are transmitted to the signature creation apparatus, and a response returned from the signature creation apparatus is received accordingly. Then, after performing a second active process for extracting a digital signature included in the received response, a command transmission as the first active process and a response reception, a command transmission as the second active process and Until the response is received, a “dummy command”, which is essentially meaningless, is sent to the signature creation device and responds accordingly. Has a function to perform a dummy active process, the receiving a response returned from the signature generation apparatus Te,
When the “signature creation command” is transmitted, the signature creation device internally performs an operation based on the predetermined algorithm using the secret data for the message data included in the command Thus, a process for creating a digital signature for personal authentication for the message data is executed, the created digital signature is stored therein, and the created digital signature is included as a response according to the “signature creation command”. A first passive process that returns a predetermined response and a predetermined signature including a digital signature stored as a response corresponding to the “signature reply command” when the “signature reply command” is transmitted. when the second passive processing of transmitting the response, the "dummy command" is transmitted, those Digital signature system, characterized in that as a response corresponding to the "dummy command", originally having a function of a dummy passive processing of transmitting the "dummy response" meaningless, the. The digital signature system of claim 1, wherein
A digital signature system using an IC card as a signature creation device, a reader / writer device having a function of accessing the IC card, and a computer for controlling the reader / writer device as a message processing device. The digital signature system according to claim 1 or 2,
A message input process in which a message processing apparatus causes a person who performs a signature to input message data to be digitally signed, and a signature confirmation input process in which the individual performs input for confirming the signature of the message data. If has a function to perform, the message input process executes the first active treatment at the time of completion, perform the second active treatment at the time of the signature confirmation input process is completed, the message input processing A digital signature system, wherein a process of transmitting a “dummy command” is performed once or a plurality of times during a period from the completion of the signature to the completion of the signature confirmation input process . The digital signature system according to claim 3.
When the message processing device displays an input field for inputting message data on the display screen and an instruction to complete the input operation to the input field is given, it is determined that the message input process has been completed. The first active process is executed, the confirmation button for confirming the intention of signature on the display screen is made operable, and the signature confirmation input process is completed when the confirmation button is operated. A digital signature system characterized in that the second active process is executed based on the judgment. The digital signature system according to any one of claims 1 to 4,
  A digital signature system characterized in that dummy message data unrelated to message data to be digitally signed is included in a “signature reply command” transmitted as a second active process by a message processing apparatus. The digital signature system according to any one of claims 1 to 5,
  A digital signature system characterized in that a dummy digital signature unrelated to a created digital signature is included in a “response according to a signature creation command” returned as a first passive process by a signature creation device. The digital signature system according to any one of claims 1 to 6,
  A digital signature system, wherein the signature creation apparatus performs a second passive process based on a “signature reply command” and then erases the digital signature stored so far. The digital signature system according to any one of claims 1 to 6,
  When the signature creation device stores a new digital signature created by the first passive processing based on the new “signature creation command”, the signature creation device is created by the first passive processing based on the previous “signature creation command”. A digital signature system that executes a process of erasing a digital signature stored in the memory. The digital signature system according to any one of claims 1 to 6,
  A non-volatile memory is provided in the signature creation device, and a digital signature created based on the “signature creation command” is stored in the non-volatile memory,
  When the power supply to the signature creation device is cut off and the power supply is started again, a reply process for the digital signature stored in the nonvolatile memory before the power supply cut-off is performed based on the “signature reply command”. A digital signature system characterized in that the reply process is executed on condition that the access right is authenticated. The digital signature system according to any one of claims 1 to 6,
  A non-volatile memory is provided in the signature creation device, and a digital signature created based on the “signature creation command” is stored in the non-volatile memory,
  When the power supply to the signature creation device is cut off and the power supply is started again, if the “signature reply command” is given prior to the “signature creation command”, it is stored in the nonvolatile memory. A digital signature system characterized in that a response indicating an error is returned without executing a reply process for a digital signature. The digital signature system according to any one of claims 1 to 6,
  If the signature creation device does not receive a “signature reply command” after receiving a “signature creation command” and before a specific event occurs in advance, it is based on the “signature creation command”. A digital signature system that executes a process of deleting a digital signature that has been created and stored. The digital signature system of claim 11, wherein
  A specific event is defined as the elapse of a predetermined time after receiving the “signature creation command”, and when the predetermined time elapses, the stored digital signature is deleted. A digital signature system characterized by that. The digital signature system of claim 11, wherein
  When receiving a new “signature creation command” after receiving a “signature creation command” and receiving a new “signature creation command” without receiving a “signature reply command” And erase the digital signature that was previously stored A digital signature system characterized in that processing is performed. The digital signature system of claim 11, wherein
  It is determined that the power supply to the signature creation device is cut off as a specific event, and the stored digital signature is erased when the preparation for the power supply cut-off is made. A digital signature system characterized by The digital signature system according to any one of claims 1 to 14,
  A response indicating an error is returned when a digital signature to be returned is not stored even though a “signature reply command” is given to the signature creation device. Digital signature system. A signature creation device having a function of creating a digital signature for personal authentication for predetermined message data,
  A secret data storage unit for storing private secret data;
  An information communication unit for exchanging information with an externally connected message processing device;
  A signature creation unit that creates a digital signature for personal authentication of the message data by performing an operation based on a predetermined algorithm using the secret data for given message data;
  A signature storage unit for storing the created digital signature;
  With
  The information communication unit, when a “signature creation command” including predetermined message data to be digitally signed is transmitted from the message processing device, gives the message data to the signature creation unit. A first process for executing a signature creation process and returning a predetermined response not including a digital signature for the created message data to the message processing apparatus as a response to the “signature creation command”; When a “signature reply command” for requesting a digital signature reply is transmitted from the message processing device, it is stored in the signature storage unit as a response corresponding to the “signature reply command”. A second response that returns a predetermined response including the digital signature to the message processing device; When a “dummy command” that is originally meaningless is sent from the message processing apparatus, a “dummy response” that is originally meaningless is returned as a response corresponding to the “dummy command”. A signature creation device having a function of performing dummy processing. A message processing device that connects to the signature creation device according to claim 16 and exchanges information,
  A first active device that transmits a “signature creation command” including predetermined message data to be digitally signed to the signature creation device, and receives a response returned from the signature creation device in response to this. A processing unit;
  A "signature reply command" for requesting a digital signature reply is transmitted to the signature creation apparatus, and a response returned from the signature creation apparatus is received in response to this, and is included in the received response A second active processing unit for retrieving a digital signature that is present;
  After performing the command transmission and response reception as the first active process, and before performing the command transmission and response reception as the second active process, a “dummy command” that is essentially meaningless is added to the signature. A dummy active processing unit that transmits to the creation device and receives a response sent back from the signature creation device in response thereto;
  A message processing apparatus comprising: A program for causing a computer to function as the message processing device according to claim 17.

Images