Remote signature system and Anti-tamper device

Abstract

Provided is a remote signature system that connects a public key encryption scheme to the remote signature system and performs identity verification for each signature request. A terminal device (2) has an authentication key pair generation means for executing the public key encryption scheme. A generated private key is saved in the terminal device (2), and a public key is transmitted to an anti-tamper device (5) and stored in association with a corresponding signature key. The anti-tamper device has a signature key storage means including, for each user, a signature key, a decryption key, and signature key identification information. During a signature request, a signature request is generated and transmitted to the anti-tamper device, the signature request having an encryption key token including signature key identification information, plaintext verification information, encrypted signature target data, and verification information. The anti-tamper device accesses the signature key storage unit and retrieves a decryption key and a signature key. The anti-tamper device uses the retrieved decryption key to decrypt the encryption token, and verifies consistency between the decrypted verification information and plaintext verification information. If these two sets of information are inconsistent with each other, the anti-tamper device excludes the signature request from the target of an electronic signature.

Description

Remote signature system and tamper-resistant device

[0001] The present invention relates to a remote signature system that digitally signs data to be signed, which is generated from an electronic document, using a signature key managed by a tamper-resistant device. The present invention relates to a tamper-resistant device used in a remote signature system.

[0002] A remote signature system has been proposed in which a user's signature key is installed on a business's server, and the user logs in to the server remotely and signs an electronic signature using their own signature key on the business's server. The remote signature system is expected to be a highly convenient signature system for users, as it allows electronic signatures to be issued remotely and does not require users to manage their signature keys.

[0003] As a remote signature type electronic signature system, an electronic signature system has been proposed that includes a key management system that manages signature keys, a certificate issuing system that issues certificates, and a terminal device used by a user (see, for example, Patent Document 1). In this known electronic signature system, user authentication is performed by a combination of a user ID and a password based on a user account set in the key management system.

[0004] The present inventor has also proposed a remote signature type electronic signature system (see, for example, Patent Document 2). In this electronic signature system, a tamper-resistant device generates a key pair consisting of a private key and a public key in response to a request from a user. The private key becomes a signature key and is stored in the tamper-resistant device. The public key is sent to a terminal device and stored as an encryption key. Next, the user generates authentication information, such as a password, indicating the authorization to use the user's signature key and sends it to the tamper-resistant device via the terminal device. The tamper-resistant device stores the received user authentication information in association with the user's signature key. This authentication information serves as reference information for verifying the user's identity. The user authentication information is stored in the user's mind and kept secret. The private key also functions as a decryption key for decrypting cryptographic tokens encrypted using the public key.

[0005] When signing an electronic signature, a user inputs their authentication information into a terminal device. The terminal device encrypts the input authentication information using an encryption key to generate a cryptographic token. A signature request is then sent to the tamper-resistant device, including the data to be signed, the cryptographic token, and signature key identification information. The tamper-resistant device decrypts the cryptographic token using a decryption key. The decrypted authentication information is verified for consistency with the authentication information stored together with the signature key, and an electronic signature is permitted only if they match. As a result, a remote signature system is constructed in which only those who have valid authorization to use the signature key can sign an electronic signature.

[0006] Japanese Patent No. 6465426 Japanese Patent Application Laid-Open No. 2021-111925

[0007] In a remote signature system, it is necessary to securely send a signature request, including the data to be signed that will be the subject of an electronic signature, to a tamper-resistant device. However, in systems that verify identity using a user ID and password, the data to be signed is sent to the tamper-resistant device in plain text, without being encrypted. This creates a risk that the data to be signed may be tampered with at a relay point in the network, posing a security problem.

[0008] In contrast, in an electronic signature system that uses authentication information to verify identity, both the authentication information and the data to be signed are encrypted and transmitted to the tamper-resistant device in the encrypted form. This avoids the risk of tampering with the data to be signed. Furthermore, since identity verification is performed and only the owner of the signature key who knows the authentication information can issue an electronic signature, high security is ensured. However, because the authentication information is secretly stored in the user's mind, there is a drawback in that if the user forgets the authentication information, the signature system becomes unusable. In this case, if the authentication information is configured as a simple password, there is a risk that it can be easily stolen by a hacker. Furthermore, if the authentication information is stolen by someone else, a scandal may occur in which an unauthorized person electronically signs the signature key. On the other hand, to prevent the theft of authentication information, a complex password is expected to be used. However, in this case, it becomes easy to forget the authentication information, which could render the signature system unusable. As such, the remote signature system described in Reference 2 has the drawback of placing an excessive burden on the user regarding the management of authentication information (passwords).

[0009] Furthermore, a method using a challenge code is known as a method for verifying identity. In this verification method, the tamper-resistant device transmits the challenge code to a terminal device. The terminal device encrypts the challenge code using an encryption key and returns it to the tamper-resistant device. The tamper-resistant device decrypts the encrypted challenge code using a decryption key and verifies whether it matches the legitimate challenge code. If they match, the signature key is activated and an electronic signature is issued. However, this verification method has the drawback that the verification process and the signature process are separated, and therefore the verification process is not executed for each signature request. In addition, it has been pointed out that the number of processing steps in the verification process and the signature process is too large, making the process complicated. More importantly, although identity verification is performed, the presence or absence of tampering with the signature request is not verified, which raises the risk of an electronic signature being issued to a fraudulent signature request.

[0010] An object of the present invention is to realize a remote signature system in which identity verification is performed for each signature request without using authentication information such as a password.A further object of the present invention is to provide a remote signature system in which the verification process and the signing process can be performed consecutively without using a challenge code.A further object of the present invention is to realize a remote signature system that effectively excludes tampered and fraudulent signature requests from being subject to electronic signatures.

[0011] A remote signature system according to the present invention comprises a signature system having one or more tamper-resistant devices configured to generate and manage signature keys and a key management server that controls the tamper-resistant devices, and a terminal device used by a user or signer, and electronically signs data to be signed that is generated from an electronic document using the signature key, wherein the terminal device has means for generating an authentication key pair having a private key and a public key or means for installing an externally generated authentication key pair, and means for using the private key as an encryption key to encrypt the data to be signed that is the subject of the electronic signature and verification information used to verify the identity of the user, and generating a cryptographic token; the tamper-resistant device comprises: a signature key generation means for generating a signature key; a storage means for storing the generated signature key; a storage means for storing the public key of an authentication key pair generated by a terminal device as a decryption key; a signature key storage means for storing, for each user, signature key information including a signature key, a decryption key, and signature key identification information; a means for accessing the signature key storage means and retrieving both the decryption key and the signature key identified by the signature key identification information; a means for decrypting the encrypted verification information and the encrypted data to be signed using the retrieved decryption key; a verification means for verifying the validity of a signature request using the decrypted verification information; and a means for electronically signing the data to be signed using the retrieved signature key; wherein the private key of the authentication key pair is stored in the terminal device as an encryption key, and the public key is transmitted to the tamper-resistant device and stored in the signature key storage means as a decryption key; The tamper-resistant device searches for both the decryption key and the signing key together using the signing key identification information included in the signature request, decrypts the cryptographic token using the searched decryption key, verifies the match between the decrypted verification information and the plaintext verification information, and if the decrypted verification information matches the plaintext verification information, electronically signs the decrypted signature target data using the searched signature key.

[0012] The basic concept of the present invention is to combine a public key cryptosystem with a remote signature system and control a signature key using the results of verification of identity verification using the public key cryptosystem. As a result of various analyses conducted by the inventors on public key cryptosystems and remote signature systems, it was found that the following three configurations can be used to control a signature key using the results of verification using the public key cryptosystem: (1) A tamper-resistant device is provided with a signature key storage means that stores, for each user, a signature key used for electronic signatures, a decryption key used to decrypt encrypted information, and signature key information including signature key identification information that identifies the signature key and decryption key; (2) When electronically signing, a signature request is generated that includes both information necessary for signature processing and information necessary for identity verification processing, and is transmitted to the tamper-resistant device; (3) The data to be signed that is the subject of an electronic signature and verification information used to verify identity verification are encrypted using the same encryption key and transmitted to the tamper-resistant device.

[0013] The information required for the digital signature includes a signature key identification code that identifies the signature key used for the digital signature and the data to be signed that is the subject of the digital signature. The information required for the verification process for identity verification includes encrypted verification information obtained by encrypting the verification information used for identity verification, and the verification information in plaintext before encryption.

[0014] The verification information functions as reference information used in the verification process for identity confirmation, and performs a function similar to that of a challenge code. There are no particular restrictions on this verification information, and any code information or message information generated by the user can be used. Furthermore, the data to be signed or signature key identification information can be used as the verification information. Alternatively, various information such as any number sequence or character string generated by a terminal device can be used. This verification information is generated by the terminal device or input into the terminal device by the user.

[0015] In the present invention, the data to be signed that is the subject of an electronic signature is encrypted and transmitted to the tamper-resistant device in order to prevent tampering. Verification information used to verify identity is also encrypted using the same encryption key. By encrypting the data to be signed and the verification information using the same encryption key, both the verification information and the data to be signed can be reproduced in the tamper-resistant device through a single decryption process using the same decryption key.

[0016] The setup process will now be described. The tamper-resistant device generates a signing key for each user based on a request from the user. The generated signing key is stored in the signing key storage means together with identification information that identifies the signing key. The signing key identification information is sent to the terminal device and is also saved in the terminal device. The terminal device generates an authentication key pair for executing public key cryptography. The generated private key is stored in the terminal device. The public key is also sent to the tamper-resistant device and stored in the signing key storage means in association with the user's signing key. The private key saved in the terminal device functions as an encryption key that encrypts verification information and data to be signed, and the public key functions as a decryption key that decrypts the encrypted verification information and data to be signed. Therefore, the terminal device holds the encryption key, and the tamper-resistant device holds the decryption key.

[0017] Furthermore, signature key information including a signature key used for the electronic signature, a decryption key for decrypting encrypted information, and signature key identification information for identifying the signature key and decryption key is created for each user and stored in the signature key storage means. The signature key identification information serves as identification information or search information for identifying a pair of the signature key and decryption key. With this configuration, the signature key and decryption key set for each user are searched together by identifying the signature key identification information. The signature key and decryption key are searched together, and the data to be signed and the verification information are encrypted using the same encryption key, so that the electronic signature is generated following the decryption and verification processes. The setup process is completed by storing the signature key information in the signature key storage means.

[0018] Next, a signature request that requests a digital signature from a tamper-resistant device will be described. In the present invention, since the verification process and the digital signature are executed consecutively, the signature request includes information necessary for verifying identity verification and information necessary for the digital signature. The information necessary for verifying identity verification is encrypted verification information and verification information in plain text before encryption. The information necessary for the digital signature is signature key identification information that identifies the user's signature key and the data to be signed that is the subject of the digital signature. In the present invention, this information is effectively combined to generate a signature request.

[0019] The verification information is encrypted in the terminal device, and the verification information is included in a signature request together with the plaintext verification information before encryption and sent to the tamper-resistant device. The tamper-resistant device decrypts the encrypted verification information using a decryption key and verifies whether the decrypted verification information matches the plaintext verification information, thereby verifying identity. In other words, because the plaintext verification information is reference information before encryption, the plaintext verification information can be reproduced by decrypting the encrypted verification information using a decryption key associated with the encryption key. Therefore, the tamper-resistant device decrypts the cryptographic token using a decryption key identified by the signature key identification information included in the signature request and verifies whether the decrypted verification information matches the plaintext verification information. If they match, the encrypted verification information is determined to have been encrypted using an encryption key associated with the decryption key stored in the tamper-resistant device. As a result, the signature request is determined to be a signature request from a person authorized to use the signature key.

[0020] The data to be signed is encrypted before transmission to prevent tampering. At this time, the data to be signed and the verification information are encrypted using the same encryption key. Furthermore, the signature key identification information is transmitted in plain text. The information required for verification is the encrypted verification information and the verification information in plain text before encryption. The signature request is assumed to be in the following format: Signature request = plain text (signature key identification information) + plain text (verification information) + cryptographic token (encrypted verification information + encrypted signature data)

[0021] When signing an electronic signature, the terminal device performs a hash calculation on the electronic document to be signed to generate data to be signed. The terminal device then uses a cryptographic key to encrypt the generated data to be signed and verification information to generate a cryptographic token. The cryptographic token has a preset format structure. A signature request is then generated that includes signature key identification information, plaintext verification information, and the cryptographic token containing the encrypted data to be signed and verification information, and is sent to the tamper-resistant device. The data to be signed is thus sent from the terminal device to the tamper-resistant device in a secure, encrypted state. This prevents the data to be signed from being tampered with during transmission.

[0022] When the tamper-resistant device receives a signature request, the search means is activated. The search means accesses the signature key storage means and retrieves both the decryption key and the signature key associated with the signature key identification information included in the signature request. The search means then uses the retrieved decryption key to decrypt the cryptographic token and decrypt the verification information and the data to be signed. The decrypted verification information is then verified for consistency with the plaintext verification information. If they match, the searched signature key is used to digitally sign the decrypted data to be signed.

[0023] In the present invention, since both the decryption key and the signature key are retrieved in one search process, the signature process can be executed consecutively after the decryption and verification processes are completed. It is also possible to first search for a decryption key, use the retrieved decryption key to decrypt the verification information in the cryptographic token and execute verification, confirm the verification result, then search for a signature key and use the retrieved signature key to digitally sign the data to be signed.

[0024] If the verification result shows that the decrypted verification information does not match the plaintext verification information, the validity of the signature request is denied. In other words, because the cryptographic token is encrypted, it cannot be tampered with during transmission. Therefore, the cause of the mismatch is assumed to be that the verification information was encrypted using an encryption key that is not related to the decryption key stored in the tamper-resistant device. Such a signature request is determined to be a signature request made by someone who does not have the authority to use the signature key. Therefore, if the decrypted verification information does not match the plaintext verification information, the signature request is determined to be invalid and is excluded from the scope of electronic signatures.

[0025] Next, processing when a signature request is tampered with will be described. The signature request of the present invention includes plaintext signature key identification information, plaintext verification information, and a cryptographic token. The cryptographic key token is encrypted and therefore cannot be tampered with. Therefore, only the plaintext signature key identification information and the plaintext verification information can be tampered with. If the signature key identification information is tampered with, the tamper-resistant device searches for a signature key different from the legitimate signature key and searches for a decryption key unrelated to the cryptographic key used to encrypt the cryptographic token. As a result, decryption processing is performed using a decryption key different from the legitimate decryption key, and the legitimate verification information is not reproduced. Therefore, in the verification processing, the decrypted information does not match the plaintext verification information, and this is treated as an error. Furthermore, if the plaintext verification information is tampered with, the plaintext verification information and the decrypted verification information do not match, and this is treated as an error. As such, in the present invention, if a signature request is tampered with, error processing is performed, and the tampered signature request is excluded from the scope of electronic signatures. Therefore, in the present invention, the validity of a signature request is determined not only from the viewpoint of whether or not the signature key has been authorized to be used, but also from the viewpoint of whether or not the signature key has been tampered with.

[0026] An embodiment will be described in which the signature target data is used as the verification information. When the signature target data is used as the verification information, the encrypted verification information and the encrypted signature target data are the same, so the signature request is formed as follows: Signature request = Signature key identification information + Plaintext (Signature target data) + Cryptographic token (Encrypted signature target data) When a signature request is input to a tamper-resistant device, the following processing is performed. First, both the signature key and decryption key identified by the signature key identification information included in the signature request are searched for. The cryptographic token is decrypted using the searched decryption key, and the encrypted signature target data is decrypted. Next, the match between the decrypted signature target data and the plaintext signature target data is verified. If they match, the signature target data is signed using the searched signature key. Note that a digital signature may be applied to the plaintext signature target data, or the decrypted signature target data may be signed. Note that verification according to the present invention also has the significance of verifying the authenticity of the cryptographic token. Furthermore, the signature target data is encrypted before transmission and is transmitted safely without being tampered with. Therefore, the decrypted signature target data has important significance as authentic information. Therefore, placing a digital signature on the decrypted data to be signed, rather than on the plaintext data to be signed, achieves beneficial effects in ensuring the security of the system. In this example, the match between the decrypted data to be signed and the plaintext data to be signed is verified. Therefore, identity verification is performed and the presence or absence of tampering with the data to be signed is also verified. If the data to be signed has been tampered with, it is treated as an error.

[0027] Next, an embodiment using a signature key identification as verification information will be described. In this case, the signature key identification and the plaintext verification information are the same, so the signature request is set as follows: Signature Request = Plaintext (Signature Key Identification) + Cryptographic Token (Encrypted Signature Key Identification + Encrypted Signature Target Data) In the tamper-resistant device, the decryption key and signature key are searched for using the signature key identification. Next, the cryptographic token is decrypted using the searched decryption key, and the match between the plaintext signature key identification and the decrypted signature key identification is verified. If they match, a digital signature is applied to the signature target data decrypted using the searched signature key. In this example, identity verification is performed and the presence or absence of tampering with the signature key identification is also verified. That is, if the plaintext signature key identification is tampered with during transmission of the signature request, the decryption will be performed using a decryption key unrelated to the encryption key, and the decrypted signature key identification will not match the plaintext signature key identification. As a result, signature requests with tampered signature key identification are excluded from the scope of digital signatures.

[0028] An embodiment using the signature target data and the signature key identification information as verification information will be described. The signature request is set as follows: The terminal device generates data information that concatenates the signature key identification information and the signature target data, and each can be extracted separately. Data information = Signature key identification information + Signature target data Signature request = Plaintext (data information) + Cryptographic token (encrypted data information) In this example, the signature key identification information is extracted from the data information, and the extracted signature key identification information is used to search for a decryption key and a signature key. Next, the cryptographic token is decrypted using the retrieved decryption key, and the match between the plaintext data information and the decrypted data information is verified. If they match, the signature target data is extracted from the data information, and the decrypted data is digitally signed using the retrieved signature key. In this example, identity verification is performed, and the presence or absence of tampering with the signature key identification information and the signature target data is also verified. For example, if at least one of the signature key identification information or the signature target data has been tampered with, the decrypted information and the plaintext information will not match, and the signature request is determined to be invalid and excluded from the scope of the digital signature.

[0029] In the remote signature system of the present invention, any code string conceived by the user can also be used as verification information. In this case, the signature request is set as follows: Signature request = Signature key identification information + Plain text (Verification information) + Cryptographic token (Encrypted verification information + Encrypted signature target data) In this example, the match between the decrypted verification information and the plain text verification information is verified, and if they match, a digital signature is applied to the decrypted signature target data. In this example, any code string conceived by the user during setup can be used as verification information, or any code string conceived by the user when generating a signature request can be used as verification information. Furthermore, the code string used as verification information can be changed for each signature request. In this case, when generating a signature request, the user inputs the verification information into a terminal device via input means such as a keyboard.

[0030] In the present invention, verification information written in plain text before encryption and encrypted verification information are used as information required for verifying identity. Furthermore, no special restrictions are imposed on the content of the verification information, and any information generated by the terminal device can be used. Therefore, the present invention does not use a challenge code generated by the tamper-resistant device and transmitted to the terminal device, eliminating the complexity of the verification process. Furthermore, in the present invention, the validity of a signature request is confirmed simply by comparing the plain text verification information with the decrypted verification information, eliminating the need for the user to memorize a password or authentication information. This eliminates the inconvenience of the system becoming unusable due to a forgotten password. Furthermore, because the data to be signed is transmitted to the terminal device in an encrypted state, the data to be signed cannot be tampered with.

[0031] Furthermore, in the present invention, the verification information used to verify identity and the data to be signed that is the subject of an electronic signature are encrypted using the same encryption key. Therefore, both the verification information and the data to be signed can be reproduced by a single decryption process. As a result, the advantage of being able to perform the verification process and the signing process consecutively is achieved.

[0032] In the present invention, the validity of a signature request is confirmed without using a challenge code, thereby eliminating the complexity of the verification process. Furthermore, the tamper-resistant device is provided with a signature key storage means in which, for each user, signature key information is generated, including a decryption key for decrypting a cryptographic token, a signature key for executing an electronic signature, and signature key identification information for identifying the signature key. Furthermore, a signature request is used that includes information necessary for the signature process and information necessary for the verification process. This allows the signature key to be controlled using the results of identity verification using a public key encryption system. As a result, identity verification is performed for each signature request, and inappropriate signature requests can be excluded from the scope of electronic signatures. Furthermore, since the data to be signed, which is the subject of an electronic signature, and the verification information used to verify identity verification are encrypted using the same encryption key, the information necessary for verification and the information necessary for electronic signature are reproduced together. As a result, the verification process and the signing process can be performed consecutively. Since there are no special restrictions on the verification information and any information can be used, the signature system will not become unusable even if a user forgets the verification information. In the present invention, if a signature request is tampered with, it is treated as an error, so that in addition to checking whether or not the signature key is authorized to be used, it is possible to exclude fraudulent signature requests from being subject to electronic signatures.

[0033] FIG. 1 is a diagram showing the overall configuration of an electronic signature system according to the present invention. FIG. 2 is a diagram showing an outline of a setup process and a signing process of a remote signature system according to the present invention. FIG. 3 is a diagram showing an algorithm of a signature key generation process of a remote signature system according to the present invention. FIG. 4 is a diagram showing an algorithm of a signing process of a remote signature system according to the present invention. FIG. 5 is a diagram showing a modified example of a setup process. FIG. 6 is a diagram showing an example of a terminal device. FIG. 7 is a diagram showing an example of a tamper-resistant device. FIG. 8 is a diagram showing an example of a key management server. FIG. 9 is a block diagram showing an example of an editing server. FIG. 10 is a diagram showing a modified example of an electronic signature system according to the present invention.

[0034] FIG. 1 shows the overall configuration of an electronic signature system according to the present invention. Terminal devices 2-1 to 2-n are connected to a network 1. These terminal devices are devices used by users or signers, and may be, for example, personal computers or smartphones. Here, users include not only signers who digitally sign electronic documents, but also those who upload electronic documents to an editing server or those who download electronic documents from an external server to the editing server. Therefore, the terminal devices in this example include not only terminal devices used by signers, but also terminal devices used to upload electronic documents to be signed to the editing server.

[0035] A signature system 3 is connected to the network 1. The signature system 3 has a key management server 4 and one or more tamper-resistant devices 5 connected to the key management server. The key management server 4 is connected to the network and has the function of managing and controlling the tamper-resistant devices 5.

[0036] The tamper-resistant device 5 has a function of securely generating and managing a signing key without leaking it to the outside, and can be, for example, a Hardware Security Module (HSM). The tamper-resistant device includes a subsystem or device having a security management function independent of a key management server. The tamper-resistant device has a key management module, which is a program for managing keys, and performs functions such as generating a signing key, storing the signing key, decrypting a cryptographic token, verifying the decrypted data to be signed, and issuing a digital signature using the signing key.

[0037] Furthermore, a certificate issuing server 6 provided in a certification authority is connected to the network 1. The certificate issuing server 6 generates a certificate issuing request (CSR) in response to a certificate generation request sent from a terminal device, and generates a digital certificate. When generating a key pair constituting a signature key, the terminal device can send a signature key generation request to a key management server via the certificate issuing server.

[0038] Furthermore, an editing server 7 is connected to the network 1. The editing server 7 has a function of managing electronic documents to be signed, and manages electronic documents to be signed, such as electronic documents uploaded from a terminal device and electronic documents downloaded from an external server. When an electronic document is uploaded, the editing server 7 notifies the terminal device of the signer who is to sign the electronic document. Furthermore, the editing server can also embed an electronic signature generated by the signature system 3 into the electronic document to generate a signed electronic document. The generated signed electronic document is stored in the editing server 7.

[0039] 2 shows an overview of the setup process and signing process of the remote signature system according to the present invention. A user desiring setup requests the tamper-resistant device to generate a signature key via a terminal device. In response, the tamper-resistant device generates a signature key using the signature key generation means 10. For example, the signature key generation means 10 generates a key pair consisting of a private key and a public key, and the generated private key is used as the signature key and the public key is used as signature key identification information. Of course, the signature key identification information can be a user name that identifies the user or number information that identifies the terminal device. The generated signature key is stored in the signature key storage unit 12 together with the signature key identification information via the control unit 11. The signature key identification information is sent to the terminal device and is also saved therein.

[0040] The terminal device has a key pair generation means 13 and generates an authentication key pair for executing a public key cryptosystem. The generated private key is sent to the encryption means 14 and functions as an encryption key for encrypting the data to be signed and the verification information. The generated public key is sent to the tamper-resistant device via the network and functions as a decryption key for decrypting the cryptographic token. Therefore, the public key is also referred to as a decryption key. This public key, i.e., the decryption key, is stored in the signature key memory unit 12 in association with the user's previously generated signature key. Therefore, as shown in FIG. 2, the signature key memory unit stores signature key information, including a signature key, a decryption key, and signature key identification information, in a paired relationship for each user. Here, the signature key identification information identifies both the signature key and the decryption key in a paired or paired relationship. Note that when transmitting the public key of the authentication key pair to the tamper-resistant device, it can be encrypted using the public key that pairs with the private key that constitutes the signature key and then transmitted to the tamper-resistant device. In this case, the tamper-resistant device decrypts using the signature key as a decryption key, and stores the decrypted public key as a decryption key in the signature key memory unit.

[0041] Because the terminal device stores the signature key identification information, the terminal device is indirectly linked to its own decryption key and signature key stored in the tamper-resistant device via the signature key identification information. That is, by providing the signature key storage unit 12, each terminal device is assigned both a decryption key for decrypting a cryptographic token and a signature key for executing an electronic signature. Therefore, when a signature request including the signature key identification information is sent from a terminal device, both the decryption key and the signature key specified by the signature key identification information included in the signature request are searched for, and the verification process and the signature process are performed using the searched decryption key and the signature key. Note that the setup work is completed by setting the signature key storage unit 12.

[0042] When signing an electronic signature, the user or signer specifies the electronic document to be signed. Subsequent signal processing is performed automatically. The signature target data generation means 15 of the terminal device performs a hash operation on the specified electronic document to generate signature target data. The generated signature target data is sent to the encryption means 14. The encryption means 14 encrypts the signature target data and verification information using a cryptographic key to generate a cryptographic token. The generated cryptographic token is sent to the signature request generation means 16. In addition to the cryptographic token, the signature request generation means is also supplied with signature key identification information and plaintext verification information. The signature request generation means 16 generates the following signature request: Signature request = signature key identification information + plaintext (verification information) + cryptographic token (encrypted verification information and encrypted signature target data) The generated signature request is sent to the tamper-resistant device via the control unit 17.

[0043] There are no particular restrictions on the verification information, and any information or code sequence conceived by the user can be used. For example, the data to be signed or the signature key identification information can be used as the verification information. Also, any number sequence or character string conceived by the signer can be used. Furthermore, the verification information can be changed for each signature request.

[0044] The verification information can be obtained by performing a hash operation on the reference information to calculate a hash value, and the resulting hash value can be used as the verification information. For example, when using a signature key identification information as the verification information, the signature key identification information may be difficult to use as is because it has a large number of bytes. In such cases, by forming a hash value of the signature key identification information, the verification information with a small number of bytes can be used.

[0045] When the tamper-resistant device receives a signature request, a search means (not shown) is activated, accesses the signature key storage unit 12, and searches for the decryption key and signature key identified by the signature key identification information. The searched decryption key is sent to the decryption means 18, and the signature key is sent to the signature means 19. Next, a cryptographic token is extracted from the signature request and sent to the decryption means. The decryption means 18 decrypts the encrypted verification information and signature target data. The decrypted verification information is sent to the match determination means 20, and the decrypted signature target data is sent to the signature means 19. The match determination means 20 also receives as input the plaintext verification information extracted from the signature request. The match determination means 20 determines whether the decrypted verification information matches the plaintext verification information, and sends the determination result to the signature means 19.

[0046] If the plaintext verification information matches the decrypted verification information, the signature request is determined to be valid, and the digital signature is applied to the data to be signed that has been decrypted using the retrieved signature key. If they do not match, the signature request is treated as an error and is excluded from the digital signature.

[0047] In this way, in the present invention, both the decryption key and the signing key are searched for using the signing key identification information, and both the information used in the verification process and the information used in the signing process are sent to the tamper-resistant device via a single signature request, so the verification process and the signing process can be executed continuously and integrally. Furthermore, after specifying the electronic document to be signed, the signer does not need to input any information. Therefore, all signal processing after specifying the electronic document can be performed automatically. As a result, the processing up to the generation of the signed document can be performed automatically.

[0048] 2, when signature target data is used as verification information, the signature target data output from signature target data generation means 15 is set to be supplied to encryption means 14 and signature request generation means 16. In this case, no verification information supply means is used. Also, when both signature target data and signature key identification information are used as verification information, the signature target data output from signature target data generation means 15 is set to be supplied to encryption means 14 and signature request generation means 16, and the signature key identification information is set to be supplied to encryption means 14 and signature request generation means 16.

[0049] 3 shows the algorithm of the signature key generation process of the remote signature system according to the present invention. A user makes an authentication request to the key management server 4 of the signature system 3 via the terminal device 2. The authentication request is user authentication using a user ID and password. If the user does not have an account, the key management server 4 creates a new account for the user. User authentication can be achieved not only by authenticating a combination of a user ID and password, but also by transmitting a token stored on an IC card to the key management server. After user authentication, an authentication response is sent from the key management server 4 to the terminal device 2.

[0050] If user authentication is successful, the user sends a signing key generation request from the terminal device to the key management server 4. The key management server 4 instructs the tamper-resistant device 5 to generate a signing key. In response to the signing key generation request, the tamper-resistant device generates a key pair consisting of a private key and a public key that will serve as the signing key. The generated private key becomes the signing key, is stored in the tamper-resistant device, and is used for electronic signatures. The public key is also used as signing key identification information. The tamper-resistant device sends a signing key generation notification including the generated public key to the key management server, and the key management server sends the signing key generation notification to the terminal device. The terminal device stores the received public key as signing key identification information.

[0051] In response to receiving the signature key generation notification, the terminal device generates a key pair of a private key and a public key for executing a public key cryptosystem. The generated private key is stored in the terminal device and functions as an encryption key for encrypting the data to be signed and the verification information. As an encryption method, encryption can be performed by performing a signature calculation using the private key. The encrypted data to be signed and the verification information constitute a cryptographic token. The generated public key is also sent to the tamper-resistant device and stored in association with the corresponding signature key. This public key can be encrypted using a public key that functions as signature key identification information and sent to the tamper-resistant device. In this case, it is decrypted using the signature key. The public key stored in the tamper-resistant device functions as a decryption key for decrypting the cryptographic token sent from the terminal device.

[0052] The signature key information, which includes a signature key for issuing an electronic signature, a decryption key for decrypting an encrypted token, and signature key identification information for identifying the signature key and decryption key, is stored for each user in the signature key storage unit 12. If the number of signature keys to be stored becomes large and causes overflow, the signature key information can be encrypted and stored in a database external to the tamper-resistant device.

[0053] As the signing key identification information, various information can be used in addition to the public key corresponding to the private key that constitutes the signing key. For example, not only the same information as the signing key identification information, but also identification information obtained by adding an additional modification to the signing key identification information to distinguish it from the signing key, i.e., identification information equivalent to the signing key identification information, can be used. Also, the name of the user can be used as the signing key identification information, or the tamper-resistant device can assign an identification number to the user, and the identification number assigned to the user can be used as the signing key identification information.

[0054] Once the tamper-resistant device has saved the public key that functions as the decryption key, it sends a setup completion notice to the terminal device. After that, the user can use the terminal device to request a digital signature.

[0055] Next, the user sends an authentication request to the certificate issuing server 6 via the terminal device to obtain an electronic certificate (signature certificate). This user authentication also uses a combination of a user ID and a password. An authentication response is sent from the certificate issuing server to the terminal device.

[0056] If user authentication is successful, the terminal device sends an electronic certificate generation request to the certificate issuing server, including the user ID, the public key paired with the signature key, and other necessary information. The certificate issuing server creates a certificate signing request (CSR) using the received public key and necessary information, and generates an electronic certificate after performing a predetermined review process. The generated electronic certificate is sent to the terminal device. The terminal device stores the received electronic certificate. The electronic certificate is also transferred to the editing server as needed and stored there as well.

[0057] 4 shows an algorithm for digitally signing using a signature key. A terminal device generates data to be signed from an electronic document to be signed. The electronic document may be an electronic document stored in the terminal device or an electronic document sent from an editing server that manages electronic documents. The terminal device performs a predetermined logical operation (hash operation) on the area of ​​the electronic document to be signed to generate a hash value, and the generated hash value is used as the data to be signed.

[0058] The data to be signed in the present invention can be not only data generated directly from an electronic document, but also a message to which additional information such as the date and time of generation, expiration date, etc. has been added to the generated data to be signed. In other words, a message that includes the data to be signed as a part of it can also be used as the data to be signed.

[0059] Next, the terminal device encrypts the signature target data and verification information using the encryption key (stored private key) to generate a cryptographic token. As an example of encryption, the signature target data and verification information may be linked, a signature calculation may be performed on the linked data information, and the obtained signature calculation result may be used as the cryptographic token. Alternatively, the signature target data and verification information may be encrypted separately to form a cryptographic token. Note that a cryptographic token may also be generated by performing a hash calculation on the verification information and encrypting the obtained hash value.

[0060] Next, the terminal device generates a cryptographic token including the signing key identification information, plaintext verification information, and the encrypted verification information and data to be signed. The signature request is a request for a digital signature from the tamper-resistant device. The signature request is sent to the tamper-resistant device via the key management server. Note that when the signing key identification information is used as the verification information, the plaintext verification information is not necessary, and a cryptographic token including the signing key identification information, the encrypted signing key identification information, and the encrypted signature target data is generated.

[0061] When the tamper-resistant device receives a signature request, the retrieval means accesses the signature key storage unit and retrieves the decryption key and signature key associated with the signature key identification information included in the signature request. The retrieved decryption key is supplied to the decryption means, and the signature key is supplied to the signing means.

[0062] The decryption means decrypts the cryptographic token to generate plaintext verification information and plaintext signature target data. The decrypted signature target data is supplied to the signing means, and the verification information is supplied to the match determination means. Next, the match between the decrypted verification information and the plaintext verification information included in the signature request is verified. As an example of verification, a signature calculation is performed on the encrypted verification information using a decryption key to generate a signature value. The match between the obtained signature value and the plaintext verification information is then verified. Note that when signature key identification information is used as the verification information, the match between the plaintext signature key identification information and the decrypted signature key identification information is verified. Furthermore, when verification is performed using a hash value of the signature key identification information, the match between the hash value generated from the plaintext signature key identification information and the decrypted hash value can be verified.

[0063] If the verification result shows that the decrypted verification information matches the plaintext verification information, the tamper-resistant device determines that the received signature request is valid, i.e., that the received signature request is from a person who has valid use rights for the signature key, and that the data to be signed has not been tampered with.

[0064] If the verification result shows a mismatch, the tamper-resistant device determines that the received signature request is invalid and processes it as an error.

[0065] If the signature request is determined to be valid, the tamper-resistant device digitally signs the decrypted signature target data using the retrieved signature key, generating an electronic signature. The signature result, including the generated electronic signature, is sent to the terminal device via the key management server. The terminal device embeds the received electronic signature in the edited electronic document to create a signed electronic document (signed document). A signature timestamp from a timestamp server is added to the generated electronic signature and embedded in the electronic document as a long-term signature, ensuring the long-term validity of the electronic signature. The signed electronic document is stored in the terminal device and, if necessary, is sent to an editing server. The generated electronic signature can be sent to the editing server and processed there.

[0066] FIG. 5 shows a modified example of the setup process. In this example, electronic documents are managed by an editing server. The editing server 7 functions as a management server that manages uploaded electronic documents. Electronic documents to be signed are uploaded to the editing server from terminal devices, and upload information is input. Electronic documents to be signed are also input from external servers. The upload information includes the electronic document to be signed, identification information of the signer to sign, and address information of the signer's terminal device. Uploaded electronic documents are stored and managed by the editing server.

[0067] When the upload information is input, the editing server stores the uploaded electronic document and notifies the terminal device of the user who is to sign that a signature is requested. The user who receives the notification requests user authentication from the editing server via the terminal device. If user authentication is successful, the editing server sends an authentication response to the terminal device.

[0068] The user confirms the electronic document to be signed. When signing the confirmed electronic document, the user requests the editing server to generate the data to be signed via the user's terminal device. This request to the editing server to generate the data to be signed is significant as an expression of the signer's intention to request signature processing. This generation request then triggers the start of the signature processing, and a series of signature processing steps are executed automatically.

[0069] In response to receiving the signature target data generation request, the editing server edits the electronic document to be signed and generates the signature target data from the electronic document, and then downloads the signature target data to the terminal device.

[0070] In response to downloading of the signature target data, the terminal device encrypts the downloaded signature target data and verification information using an encryption key to generate a cryptographic token.

[0071] The terminal device then transmits the generated cryptographic token and signature information including the signature key identification information and the plaintext verification information to the editing server. Here, since the data to be signed is encrypted, it cannot be tampered with.

[0072] The editing server generates a signature request having plaintext signature key identification information and verification information, and a cryptographic token including encrypted signature target data and encrypted verification information, and transmits the generated signature request to the tamper-resistant device.

[0073] The search means of the tamper-resistant device accesses the signature key storage unit and searches for the signature key and decryption key associated with the signature key identification information. The searched decryption key is then used to decrypt the cryptographic token included in the signature request. The plaintext verification information is then compared and verified with the decrypted verification information. If the verification result shows that the two pieces of verification information match, the signature request is determined to be valid, and a digital signature is applied to the decrypted data to be signed. The signature result, including the generated electronic signature, is sent to the editing server via the key management server.

[0074] The editing server embeds the received digital signature into the digital document to create a signed digital document, which is stored in the editing server and transmitted to a terminal device as needed.

[0075] Fig. 6 is a block diagram showing the functional configuration of a terminal device. Note that Fig. 6 shows only the parts related to electronic signatures. The terminal device has a communication means 30, a control unit 31, an input device 32, and a storage unit 33. The communication means 30 is connected to a network and transmits and receives data to a key management server or the like. The control unit 31 has an authentication request unit 34 and transmits an authentication request using a user ID and password to a key management server or the like of the signature system. Next, the user logs in to the signature system and transmits a signature key generation request from a signature key generation request unit 35 to the tamper-resistant device. The signature key identification information (public key of the key pair) generated by the tamper-resistant device is stored in a signature key identification information storage unit 36 ​​of the storage unit via the communication means.

[0076] The digital certificate issuance request unit 37 generates a digital certificate issuance request including the public key received from the tamper-resistant device and sends it to the certificate issuing server. The generated digital certificate is received via communication means and stored in the digital certificate storage unit 38.

[0077] The key pair generation unit 39 generates a key pair for authentication. The generated private key serves to encrypt the data to be signed and the verification information, and is stored in the encryption key storage unit 40. The public key is encrypted using the public key paired with the signature key as the encryption key, and is transmitted to the tamper-resistant device via the communication means.

[0078] Here, the key pair generation means includes not only a means for directly generating a key pair but also a means or function for installing a key pair generated externally and stored in a storage device in a terminal device. For example, storing a key pair generated externally in a storage device such as a USB memory and installing the stored key pair in a terminal device also falls under the category of operating the key pair generation means.

[0079] An electronic document to be signed is stored in an electronic document storage unit 41. When signing the electronic document, the electronic document is read and supplied to a signature target data generation unit 42. The signature target data generation unit generates signature target data from the electronic document. This signature target data generation unit can be configured, for example, by a hash calculation means.

[0080] The generated signature target data is supplied to a cryptographic token generation unit 43. The cryptographic token generation unit 43 encrypts the signature target data and verification information using a cryptographic key to generate a cryptographic token. The generated cryptographic token is supplied to a signature request generation unit 44. The signature request generation unit generates a signature request including signature key identification information, plaintext verification information, a cryptographic token, and necessary information. The generated signature request is transmitted to the tamper-resistant device via communication means 30. Note that when signature key identification information is used as verification information, a signature request including plaintext signature key identification information, a cryptographic token including the encrypted signature key identification information and signature target data, and necessary information is generated.

[0081] The electronic document upload unit 45 creates an electronic signature generation request including the electronic document and the stored electronic certificate stored in the electronic document storage unit 41, and transmits it to the editing server. In addition, for an electronic document that requires a signature from another person, the electronic document upload unit 45 adds the signer's ID and address to the electronic document to be signed and uploads it to the editing server.

[0082] When the tamper-resistant device completes the digital signature, it sends the digital signature to the terminal device. The received digital signature is embedded in the digital document to generate a signed digital document. The generated signed digital document is stored in the signed digital document storage unit 46.

[0083] 7 shows an example of the functional configuration of a tamper-resistant device. The tamper-resistant device has a management unit 50, a processing unit 51, and a storage unit 52. Information signals transmitted from a terminal device or an editing server are input to the management unit 50 via a network and a key management server. The management unit 50 controls each functional unit provided in the processing unit, and controls the execution of designated functions in accordance with the input information signals.

[0084] In response to receiving the signature key generation request, the signature key generation unit 53 operates to generate a key pair consisting of a private key and a public key that will serve as the signature key. The generated key pair is temporarily stored in the storage unit 54. The public key functions as signature key identification information that identifies the signature key and decryption key. This public key is copied and sent to the corresponding terminal device via the management unit.

[0085] When the public key of the authentication key pair is received, the received public key is sent to the storage unit 54. The storage unit forms signature key information by associating the key pair forming the signature key with the received public key. This signature key information includes the signature key, signature key identification information, and decryption key. This signature key information is stored for each signer or user in a signature key storage unit 55 provided in the storage unit 52.

[0086] When a signature request is input, the signature key identification information included in the signature request is input to a search unit 56, the encryption token is input to a decryption unit 57, and the verification information is sent to a verification unit 58. The search unit 56 accesses the signature key storage unit and searches for a decryption key and a signature key associated with the signature key identification information. The searched decryption key is sent to the decryption unit 57. The decryption unit decrypts the encryption token using the input decryption key. The decrypted verification information is sent to the verification unit 58.

[0087] The decrypted verification information and the plaintext verification information are input to the verification unit 58. The verification unit 58 verifies whether these two pieces of verification information match.

[0088] The decrypted signature target data and the retrieved signature key are input to the signature unit 59. If the two pieces of verification information match, a digital signature is applied to the decrypted signature target data using the signature key.

[0089] If the verification results are not consistent, the signature request is treated as an error.

[0090] 8 shows the functional configuration of the key management server. The key management server has a communication means 60, a control unit 61, and a user information database 62. The control unit has a user authentication processing unit 63, and processes authentication requests from terminal devices.

[0091] A signature key generation request sent from a terminal device and a signature request sent from an editing server or a terminal device are supplied to the tamper-resistant device control unit 64, and an instruction corresponding to the specified processing is sent to the tamper-resistant device. Various information such as an electronic signature generated by the tamper-resistant device is sent to the terminal device, editing server, etc. via the tamper-resistant device control unit. The key management server and the tamper-resistant device can be connected via an internal bus or an external bus. Alternatively, they can be connected via a LAN.

[0092] Fig. 9 is a block diagram showing the functional configuration of the editing server. This block diagram corresponds to the algorithm in Fig. 4. The editing server has a communication means 70, a control unit 71, and a storage unit 72. The communication means 70 is connected to a network and transmits and receives information between the terminal device, the key management server, and the tamper-resistant device. A user authentication processing unit 73 processes an authentication request sent from the terminal device using user information stored in a user information storage unit 74.

[0093] Upload information uploaded from a terminal device is input to an upload information receiving unit 75. The upload information is sent to a signature notification unit 76, which transmits a signature notification indicating that a signature has been requested to the terminal device at the address of the signatory included in the upload information. In addition, the electronic document included in the upload information is stored in an electronic document storage unit 77.

[0094] A download request for the signature target data from a signer is input to a download request receiving unit 78. In response to the input download request, a signature target data generating unit 79 operates to generate the signature target data from the electronic document. The generated signature target data is transmitted from a signature target data downloading unit 80 to the terminal device of the corresponding signer.

[0095] The signature information sent from the signer's terminal device is input to the signature request generation unit 81. The signature request generation unit generates a signature request including the cryptographic token included in the signature information and plaintext signature key identification information and verification information. The generated signature request is sent to the tamper-resistant device.

[0096] The editing server includes an editing unit 82. The editing unit 82 edits the electronic document to be signed, and sets the layout method and layout position of the fields of the electronic signature to be formed.

[0097] The digital signature, which is the signature result generated by the tamper-resistant device, is input to a signed digital document generation unit 83. The editing information generated by the editing unit is also input to the signed digital document generation unit, which embeds the digital signature in the stored digital document and generates a signed digital document (signed document). The generated signed digital document is saved in a signed document storage unit 84.

[0098] 10 is a diagram showing a modified example of the digital signature system according to the present invention. In this example, VPN connections 90 and 91 are provided between the key management server 4 and the certificate issuing server 6, and between the key management server 4 and the editing server 7. By providing the VPN connections, the key management server 4 and the certificate issuing server 6 become equivalent to being directly connected to each other, and the key management server 4 and the editing server 7 also become equivalent to being connected to each other. This establishes a secure, encrypted transmission path between the certificate issuing server and the editing server and the key management server.

[0099] Furthermore, the certificate issuing server 6 and editing server 7 are configured as authentication servers with identity authentication functions. A user (terminal device) has an account on the authentication server (certificate issuing server 6 and editing server 7) and exchanges messages with the authentication server via SSL encrypted communication through a login authentication process. As a result, communication between the terminal device 2 and the certificate issuing server 6, and communication between the terminal device 2 and the editing server 7, are protected by SSL encrypted communication.

[0100] In the signature key generation process, the public key of the key pair generated by the tamper-resistant device is sent to the terminal device via the key management server 4, the VPN connection 90, and the certificate issuing server 6. In addition, the cryptographic token created by the terminal device is sent to the tamper-resistant device via the certificate issuing server 6, the VPN connection 90, and the key management server 4.

[0101] Furthermore, in the signing process, the cryptographic token generated by the terminal device is sent to the tamper-resistant device 5 via the editing server 7, VPN connection 91, and key management server. The digital signature generated by the tamper-resistant device is sent to the editing server 7 via the key management server and VPN connection 91. As a result, a secure encrypted transmission path is established between the terminal device that issues a signing instruction to the tamper-resistant device and the key management server that issues a digital signature based on an instruction from the terminal device.

[0102] The present invention is not limited to the above-described embodiments and various modifications and variations are possible. For example, in the above-described embodiments, an electronic signature system including a signature system, an editing server, a certificate issuing server, and a terminal device has been described. However, an independent electronic document management server having the function of managing electronic documents can also be used. That is, electronic documents uploaded from a terminal device can be input to the electronic document management server and managed by the electronic document management server. Upload information can then be transferred from the electronic document management server to the editing server, and the editing server can perform processes such as generating data to be signed and generating a signature request.

[0103] The data to be signed can be data extracted by performing a predetermined logical operation (hash operation) from the area to be signed of the electronic document.

[0104] In the present invention, various forms of signature key identification information can be used. For example, a public key paired with a signature key (private key) can be used as the signature key identification information, and the signature key can be identified between the terminal device and the tamper-resistant device using the public key. Alternatively, a code string for identifying the signature key can be preset between the key management server and the tamper-resistant device, and the signature key can be identified using the preset code string. In this case, the signature key is identified between the terminal device and the key management server using the public key, and the signature key is identified between the key management server and the tamper-resistant device using the preset code string. In this case, the key management server has an identification information conversion means and converts the signature key identification information included in the signature request sent from the terminal device into a corresponding code string and sends it to the tamper-resistant device. The tamper-resistant device identifies the signature key using the converted code string.

Claims

1. A remote signature system comprising: a signature system having one or more tamper-resistant devices configured to generate and manage a signature key and a key management server that controls the tamper-resistant devices; and a terminal device used by a user or signer, wherein the remote signature system digitally signs data to be signed, which data is included in a signature request sent from the terminal device to the tamper-resistant device, using the signature key; the terminal device has a means for generating an authentication key pair having a private key and a public key or a means for installing an externally generated authentication key pair, and a means for encrypting verification information used for verifying identity verification using the private key as an encryption key to generate a cryptographic token; the tamper-resistant device comprises: a signature key generation means for generating a signature key; a signature key storage means for storing, for each user, a signature key, a decryption key for decrypting a cryptographic token, and signature key information including signature key identification information; a means for accessing the signature key storage means and retrieving both the decryption key and the signature key identified by the signature key identification information; a means for decrypting encrypted verification information using the retrieved decryption key; a verification means for verifying validity of a signature request using the decrypted verification information; and a means for digitally signing data to be signed using the retrieved signature key; the private key of the authentication key pair is stored in the terminal device as an encryption key, and the public key is transmitted to the tamper-resistant device and stored in the signature key storage means as a decryption key; When signing the electronic signature, the terminal device encrypts the verification information using the encryption key to generate an encryption token; a signature request including signing key identification information, plaintext verification information before encryption, a cryptographic token including the encrypted verification information, and plaintext signature target data or signature target data encrypted using the cryptographic key is generated and transmitted to a tamper-resistant device; The tamper-resistant device searches for both a decryption key and a signing key using the signing key identification information included in the signature request, decrypts the cryptographic token using the searched decryption key, verifies the match between the decrypted verification information and the plaintext verification information, and, if the decrypted verification information matches the plaintext verification information, electronically signs the data to be signed using the searched signature key.

2. 2. The remote signature system according to claim 1, wherein the verification information is either signature key identification information, data information in which the signature key identification information and the data to be signed are linked, or any information conceived by the user.

3. 3. The remote signature system according to claim 2, wherein a signature key identification information is used as the verification information, and a signature request including a plaintext signature key identification information before encryption, a cryptographic token including the encrypted signature key identification information, and the plaintext signature target data or the encrypted signature target data is generated and transmitted to a tamper-resistant device; The tamper-resistant device verifies whether the decrypted signature key identification information matches the plaintext signature key identification information, and if they match, electronically signs the data to be signed using the signature key. This remote signature system.

4. 4. The remote signature system according to claim 3, wherein an encrypted hash value obtained by encrypting a hash value of the signature key identification information is used as the encrypted signature key identification information; The tamper-resistant device is a remote signature system that verifies whether a hash value obtained by performing a hash calculation on plaintext signature key identification information matches a hash value of decrypted signature key identification information.

5. 3. The remote signature system according to claim 2, wherein data information obtained by concatenating the signature target data and the signature key identification information is used as the verification information, and a signature request having plaintext data information and a cryptographic token including encrypted data information is generated and transmitted to the tamper-resistant device; The tamper-resistant device is a remote signature system that extracts signature key identification information from data information, searches for a decryption key and a signature key using the extracted signature key identification information, decrypts the cryptographic token using the searched decryption key, verifies the consistency between the decrypted data information and the plaintext data information, and, if they match, electronically signs the plaintext signature target data or the decrypted signature target data.

6. 3. A remote signature system according to claim 2, wherein a user inputs verification information of his / her own accord into a terminal device for each signature request, and the user's identity is verified using the verification information input for each signature request.

7. 2. The remote signature system according to claim 1, wherein the terminal device has means for generating signature target data from an electronic document to be signed.

8. 2. The remote signature system according to claim 1, wherein the signature key generation means of the tamper-resistant device generates a key pair of a private key and a public key, uses the generated private key as the signature key, and uses the public key as signature key identification information.

9. 9. The remote signature system according to claim 8, wherein the public key of the authentication key pair generated by the terminal device is encrypted using a public key that forms a pair with the signature key and is then transmitted to the tamper-resistant device.

10. 2. The remote signature system according to claim 1, further comprising: an editing server that manages electronic documents to be signed; and a certificate issuing server that generates electronic certificates.

11. A remote signature system comprising: a signature system having one or more tamper-resistant devices configured to generate and manage a signature key and a key management server that controls the tamper-resistant devices; and a terminal device used by a user or signer, wherein the system uses the signature key to electronically sign data to be signed that is included in a signature request sent from the terminal device to the tamper-resistant device, the terminal device comprises: means for generating an authentication key pair having a private key and a public key, or means for installing an externally generated authentication key pair; means for generating data to be signed from an electronic document to be signed; means for encrypting the data to be signed using the private key as an encryption key to generate a cryptographic token; and means for generating a signature request including a cryptographic token containing plaintext signature key identification information, the plaintext signature target data, and the encrypted signature target data; the tamper-resistant device comprises: a signature key generation means for generating a signature key; a signature key storage means for storing, for each user, a signature key, a decryption key for decrypting a cryptographic token, and signature key information including signature key identification information; a means for accessing the signature key storage means and retrieving the decryption key and signature key identified by the signature key identification information; a means for decrypting encrypted verification information using the retrieved decryption key; a verification means for verifying validity of a signature request using the decrypted verification information; and a means for digitally signing data to be signed using the retrieved signature key; the private key of the authentication key pair is stored in the terminal device as an encryption key, and the public key is transmitted to the tamper-resistant device and stored in the signature key storage means as a decryption key; When signing an electronic signature, a signature request including plaintext signature key identification information, plaintext signature target data, and a cryptographic token including encrypted signature target data is transmitted from the terminal device to the tamper-resistant device; The tamper-resistant device searches for both a decryption key and a signing key using the signing key identification information included in the signature request, decrypts the cryptographic token using the searched decryption key, verifies the match between the decrypted data to be signed and the plaintext data to be signed, and, if they match, electronically signs the data to be signed using the searched signing key.

12. A tamper-resistant device that uses a signature key to digitally sign data to be signed that is generated from an electronic document, the tamper-resistant device comprising: a signature key generating means, a signature key storage means for storing, for each user, a signature key, a decryption key for decrypting an encryption token included in a signature request sent from a terminal device, and signature key information including signature key identification information; a search means for accessing the signature key storage means and searching for a decryption key and a signature key identified by the signature key identification information included in the signature request; a means for decrypting encrypted verification information included in the encryption token included in the signature request using the searched decryption key; a verification means for verifying validity of the signature request using the decrypted verification information; and a means for digitally signing data to be signed using the searched signature key; When signing an electronic signature, a signature request including a cryptographic token including signing key identification information, plaintext data to be signed, plaintext verification information, and encrypted verification information is input to the tamper-resistant device; The tamper-resistant device decrypts the encrypted verification information using the decryption means, verifies the match between the plaintext verification information and the decrypted verification information using the verification means, and, if they match, electronically signs the data to be signed using the searched signature key.

13. 13. The tamper-resistant device according to claim 12, wherein signature target data is used as the verification information, When signing an electronic signature, a signature request including signature key identification information, plaintext data to be signed, and a cryptographic token including encrypted data to be signed is input to the tamper-resistant device; The tamper-resistant device verifies whether the decrypted signature target data matches the plaintext signature target data, and if they match, electronically signs the signature target data using the retrieved signature key.