Document online signature authentication method based on judicial notarization and asymmetric secret key

Abstract

The invention discloses a document online signature authentication method based on judicial notarization and an asymmetric secret key, and relates to the technical field of Internet identity authentication, comprising the following steps: a user logs in through a service front end after completing registration through a mobile phone number; inputting personal identity information of a user, generating an asymmetric secret key pair, encrypting and storing the cut secret keys into a judicial notarization server and a business server respectively, and completing authentication; and the signed document is uploaded and signed, and based on successful signing, the judicial notarization server obtains the approved document and stores the document. According to the method disclosed by the invention, encryption and decryption are carried out by utilizing an asymmetric secret key technology, so that the security in a document transmission process is ensured, and information leakage is prevented; the judicial notarization mechanism participates in document signing, so that the legal potency of the document is ensured, and fraudulent behaviors are prevented; and the private key is segmented and stored in different servers through a key cutting technology, so that the privacy of the user is protected.

Description

Technical Field

[0001] The present invention relates to the technical field of Internet identity authentication, and in particular to an online document signing authentication method based on judicial notarization and asymmetric keys. Background Art

[0002] With the popularization of the Internet and the rapid development of e-commerce, more and more business activities such as contract signing and document authentication have begun to move online. This not only greatly improves work efficiency, but also breaks through geographical restrictions, making remote collaboration and transactions more convenient. However, due to the openness and anonymity of the Internet, there are also many security risks in the process of online signing and authenticating documents. How to ensure the authenticity of documents, prevent fraud and protect privacy has become an urgent problem to be solved.

[0003] Asymmetric encryption algorithm, also known as public key encryption algorithm, is an encryption technology that uses a pair of keys for encryption and decryption. Unlike traditional symmetric encryption algorithms, the public key and private key of an asymmetric encryption algorithm are different and independent of each other. This algorithm can use the private key to sign data, and the public key to verify the validity of the signature, which can ensure the integrity and non-repudiation of the data. Therefore, asymmetric encryption algorithms can establish third-party information, and the application of asymmetric encryption algorithms in online signing and authentication of judicial notarization documents has a bright future.

[0004] The online document signing and authentication method based on judicial notarization and asymmetric key collaboration aims to solve the above problems and provide a safe, reliable and efficient online signing and authentication solution. This method combines the authority of the notary agency and the security of asymmetric key technology, which not only ensures the authenticity of the document but also protects the privacy of the user. Summary of the invention

[0005] In view of the above-mentioned problems, the present invention is proposed.

[0006] Therefore, the technical problem solved by the present invention is: document tampering, fraud, privacy leakage in the process of online signing and authenticating documents and how to solve the problems of user privacy leakage and secondary tampering of documents.

[0007] To solve the above technical problems, the present invention provides the following technical solutions: a method for online document signing and authentication based on judicial notarization and asymmetric keys, comprising: after a user completes registration via a mobile phone number, logging in through a business front end; entering the user's personal identity information, generating an asymmetric key pair, encrypting and storing the cut keys in a judicial notarization server and a business server respectively, and completing the authentication; uploading and signing the document, and based on a successful contract signing, the judicial notarization server obtains the authentic document and stores it as evidence.

[0008] As a preferred solution of the document online signing authentication method based on judicial notarization and asymmetric key described in the present invention, wherein: the user registers by mobile phone number, including: the user U enters the mobile phone number UPhone through the business front end BusW, and the business front end requests the judicial justice server OAS to register the SMS verification code RSC according to the mobile phone number; the judicial notarization server generates a random number RRN and a unique cache record, and randomly sends it to the user via mobile phone SMS, and the unique cache record is represented as:

[0009] CacheRSC=SET(UPhone,RSC,RTS)

[0010] Among them, RTS represents the expiration timestamp; the only cache record is generated by the expiration timestamp and the user's mobile phone number through the judicial notarization cache server REDIS; the user enters the SMS verification code RSC1 on the business front end, sets the user login password UPwd, and submits the registration request; after receiving the registration request, the judicial notarization server obtains CacheRSC=GET(UPhone) from the judicial notarization cache server; if the comparison result of the registered SMS verification code RSC is inconsistent with the SMS verification code RSC1 entered by the user, the registration fails; if the comparison result is consistent, the expiration timestamp RTS is verified, and if the current time DATE-RTS≤5*60*1000, the salt value SALT is generated and the secret key generation algorithm SKGA is called to obtain the SUPwd ciphertext, which is expressed as:

[0011] SUPwd=SKGA(UPhone&UPwd&SALT)

[0012] Finally, UPhone, SALT, and SUPwd are stored in the business server BusS database.

[0013] As a preferred solution of the document online signing authentication method based on judicial notarization and asymmetric key described in the present invention, wherein: the logging in through the business front end includes that the user enters the mobile phone number and the login password through the business front end and spells them into a string US in the format of a key-value pair; encrypts the string using the MD5 encryption algorithm to obtain a MUS ciphertext, which is expressed as:

[0014] MUS=MD5(US)

[0015] The business front-end private key BusWSK is used to encrypt MUS with an asymmetric key to obtain the signature value SignMUS, which is expressed as:

[0016] SignMUS=BusWSK(MUS)

[0017] The business server calls the public key BusSPK to encrypt the string to obtain the PKUS ciphertext; sends the signature value SignMUS, the string US, and the ciphertext PKUS to the business server BusS; after receiving the login request, the business server uses the business front-end public key BusWPK to decrypt the signature value SignMUS to obtain the MUS ciphertext; uses the business server private key BusSSK to decrypt PKUS to obtain US; encrypts US with MD5 to obtain US1, and compares US1 with US; if the comparison results are consistent, the salt value SALT and the ciphertext SUPwd are taken out, and the secret key generation algorithm SKGA is immediately called to obtain the SUPwd1 ciphertext, which is expressed as:

[0018] SUPwd1=SKGA(UPhone&UPwd&SALT)

[0019] SUPwd1 is compared with SUPwd. If they are consistent, a successful login message is returned to the business front end.

[0020] As a preferred solution of the document online signing authentication method based on judicial notarization and asymmetric key described in the present invention, wherein: the user's personal identity information is entered and the authentication is completed, including that the user U enters the personal identity information UDI through the business front-end BusW, and then uses a mobile smart device to cooperate with a camera device to collect the user's facial recognition feature information FR, and performs liveness detection on FR through biometric technology; if the detection is successful, the personal identity information and facial feature information are compared with the second and third departments of the Public Security Bureau. If the comparison results are inconsistent, the verification is terminated. If the comparison results are consistent, the consistent results are returned to the business front-end BusW.

[0021] As a preferred solution of the document online signing authentication method based on judicial notarization and asymmetric key described in the present invention, wherein: the generation of an asymmetric key pair, encrypting and storing the cut keys in the judicial notarization server and the business server respectively and completing the authentication includes: the business front-end BusW uses the key algorithm library KAL to generate an asymmetric key pair AKP that conforms to the asymmetric key algorithm standard and the corresponding public key PK and private key SK; the private key SK is cut by the key cutting algorithm SKCA to obtain SK1 and SK2; SK1 and SK2 are encrypted according to the user password SUPwd and the symmetric key algorithm AES of the front-end key algorithm library KAL to obtain the keys SSK1 and SSK2, respectively, which are expressed as:

[0022] SSK1=AES(SUPwd||SK1)

[0023] SSK2=AES(SUPwd||SK2)

[0024] Arrange the personal identity information UDI, facial recognition feature information FR, public key PK, and secret key SSK1 in ascending alphabetical order according to the request parameter name to obtain a string PAS, which is expressed as:

[0025] PAS=(UDI&PK&SSK1&FR)

[0026] PAS is hashed and encrypted using the MD5 algorithm to obtain the digest value MD5PAS, which is expressed as:

[0027] MD5PAS=MD5(PAS)

[0028] Use the private key BusWSk of the business front-end BusW to sign MD5PAS and obtain the signature value SKPAS, which is expressed as:

[0029] SKPAS=BusWSk(MD5PAS)

[0030] PAS is encrypted using the public key OASPK of the judicial notary server OAS to obtain the encrypted value PKPAS, which is expressed as:

[0031] PKPAS=OASPK(PAS)

[0032] The string PAS, the signed value SKPAS, and the encrypted value PKPAS are sent to the judicial notary server, and SSK2 is sent to the business server. The authentication process is that the judicial notary server OAS uses the business front-end public key BusWPK to perform asymmetric key decryption on the received SKPAS to obtain the digest value MD5PAS. Then the judicial notary server OAS uses the private key OASSK to decrypt PKPAS to obtain PAS.

[0033] PAS is hashed and encrypted using the MD5 algorithm to obtain the ciphertext MD5PAS1, which is expressed as:

[0034] MD5PAS1=MD5(PAS)

[0035] Compare MD5PAS1 and MD5PAS. If they are consistent, store UDI, FR, and SSK1 in the judicial notarization server database, store SSK2 in the business server database, and return the authentication success result to the business front end.

[0036] As a preferred solution of the document online signing authentication method based on judicial notarization and asymmetric key described in the present invention, wherein: the signing document uploading and signing includes: the user uploads the signed file FSD to the signed file server FDFS through the business front-end BusW, and selects the corresponding signatory SIGNER; the file is calculated by the SHA-256 hash algorithm generated by the front-end key algorithm library to obtain the hash value SHA-FSD of the file FSD, which is expressed as:

[0037] SHA-FSD=SHA-256(FSD)

[0038] Afterwards, the private key BusWSK of the business front-end BusW is used to asymmetrically encrypt the file FSD and the signer SIGNER to obtain the signature value Sign0, which is expressed as:

[0039] Sign0 = BusWSk (FSD | SIGNER)

[0040] At the same time, the public key BusSPKD of the business server BusS is used to encrypt the file FSD, the signer SIGNER, and the hash value SHA-FSD to obtain the ciphertext CipherSign, which is expressed as:

[0041] CipherSign=BusSPKD(FSD&SIGNER&SHA-FSD)

[0042] Then, Sign0 and CipherSign are sent to the business server together. After receiving Sign0 and CipherSign, the business server uses the public key BusWPK of the business front-end BusW to decrypt Sign0. If the decryption is successful, CipherSign is encrypted using the private key BusSSK of the business server BusS to obtain plaintext FSD, SIGNER, and SHA-FSD. Then, the SHA-256 hash algorithm generated by the back-end key algorithm library is used to calculate the hash value of the file FSD to obtain the hash value SHA-FSD1, which is expressed as:

[0043] SHA-FSD1=SHA-256(FSD)

[0044] Compare the hash values ​​SHA-FSD and SHA-FSD1. If the comparison results are inconsistent, it is determined that the signed document has been tampered with and the document is invalid. If the comparison results are consistent, FSD and SIGNER are stored in the business server database, and SHA-FSD is stored in the judicial notarization server database, and the file upload is completed. After the file upload is completed, the signatory SIGNER will receive the signing task information. After the signatory SIGNER verifies the document, drags the electronic seal to the corresponding position of the document, and the system obtains the electronic seal Seal01 and the seal position information PosSeal respectively. Drag the handwritten signature to the corresponding position of the document, and the system obtains the handwritten signature Write01 and signature respectively. Location information PosWrite; The entire signing process will be completed in a trusted environment of judicial notarization. Users need to use mobile smart devices with camera devices to capture user facial feature information Fr01 and transmit it to the judicial notarization server OAS; the judicial notarization server compares the user facial feature information Fr01 with the user facial feature value FR stored during authentication; if the comparison results are inconsistent, the signing fails; if the comparison results are consistent, the secret key values ​​SSK1 and SSK2 are obtained from the business server BusS and the judicial notarization server OAS respectively according to the user's unique identifier; SSK1 and SSK2 are decrypted by the AES encryption algorithm to obtain SK1 and SK2, which are expressed as:

[0045] SK1=AES|DEC(SSK1|UPwd)

[0046] SK2=AES|DEC(SSK2|UPwd)

[0047] The obtained SK1 and SK2 are concatenated using the secret key concatenation algorithm CKCA to obtain SK, which is expressed as:

[0048] SK=CKCA(SK1,SK2)

[0049] Use the SHA-256 hash algorithm to encrypt the file FDS, signer SIGNER, electronic seal Seal01, seal location information PosSeal, handwritten signature Write01, signature location information PosWrite, and camera captured facial information Fr01 to obtain the summary value DIGEST-SIGN, which is expressed as:

[0050] DIGEST-SIGN=SHA-256(FDS|SIGNER|Seal01|PosSeal|Write01|PosWrite|Fr01)

[0051] The digest value DIGEST-SIGN is signed with the user's private key SK to obtain the signature value Sign02, which is expressed as:

[0052] Sign02=SK(DIGEST-SIGN)

[0053] Use the judicial notary server public key OASPK to asymmetrically encrypt the file FDS, the signatory SIGNER, the electronic seal Seal01, the seal location information PosSeal, the handwritten signature Write01, the signature location information PosWrite, and the camera captured facial information Fr01 to obtain CipherOAS, which is expressed as:

[0054] CipherOAS=OASPK(FDS,SIGNER,Seal01,PosSeal,Write01,PosWrite,Fr01)

[0055] The obtained Sign02 and CipherOAS are sent to the judicial notarization server OAS.

[0056] As a preferred solution of the document online signing authentication method based on judicial notarization and asymmetric key described in the present invention, wherein: the judicial notarization server obtains the authentic document and stores the evidence, including: the judicial notarization server OAS uses the user public key PK to decrypt Sign02; if the decryption fails, the contract signing fails; if the decryption succeeds, the judicial notarization server private key OASSK is used to decrypt CipherOAS to obtain the plain text FDS, SIGNER, Seal01, PosSeal, Write01, PosWrite, Fr01, and the SHA-256 hash algorithm is called to obtain DIGEST-SIGN1; DIGEST-SIGN1 is compared with DIGEST-SIGN; if the comparison results are inconsistent, the contract signing fails; if the comparison results are consistent, the judicial notarization server OAS retrieves the notarization witness certificate CER, and uses the signature synthesis algorithm SsA to synthesize the signature to obtain the authentic document FinalFile, which is expressed as:

[0057] FinalFile=SsA(CER&FDS&SIGNER&Seal01&PosSeal&Write01&PosWrite)

[0058] The obtained FinalFile is stored in the business server database, SHA-FINAL=SHA-256(FinalFile) is stored in the judicial notarization server database, and OAS-WEB and BusW are notified of the signing completion.

[0059] Another object of the present invention is to provide an online document signing and authentication system based on judicial notarization and asymmetric keys, which can be authenticated and stored by a judicial notarization server, thereby solving the problem of documents being tampered with twice during online signing.

[0060] As a preferred solution of the document online signing and authentication system based on judicial notarization and asymmetric keys described in the present invention, it includes: a user registration and login module, an information entry and authentication module, and a document signing and evidence storage module; the user registration and login module is used for users to log in through the business front end after completing registration via mobile phone number; the information entry and authentication module is used to enter the user's personal identity information, generate an asymmetric key pair, encrypt and store the cut keys in the judicial notarization server and the business server respectively, and complete the authentication; the document signing and evidence storage module is used to upload and sign the signed document, and based on the successful signing, the judicial notarization server obtains the authentic document and stores the evidence.

[0061] A computer device includes a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of a document online signing and authentication method based on judicial notarization and asymmetric keys.

[0062] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of a document online signing and authentication method based on judicial notarization and asymmetric keys.

[0063] The beneficial effects of the present invention are as follows: the online document signing and authentication method based on judicial notarization and asymmetric keys provided by the present invention not only ensures the security of the document transmission process, but also prevents information leakage by utilizing asymmetric key technology for encryption and decryption; the participation of judicial notary agencies in document signing not only ensures the legal effect of the document, but also prevents fraud; through key cutting technology, the private key is divided into two parts and stored in different servers respectively, which further protects user privacy and prevents information leakage; by encrypting the document using a hash algorithm, the integrity of the document content is ensured, and the file content and information are prevented from being tampered with; users can sign and authenticate documents anytime and anywhere through the Internet without going to a notary agency, which not only saves time and cost, but also improves signing efficiency; all operation processes are recorded by the system and can be traced back, which prevents the document content from being tampered with and ensures non-repudiation; the present invention achieves better results in terms of security, reliability and efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0064] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0065] Figure 1An overall flow chart of a method for online document signing and authentication based on judicial notarization and asymmetric keys provided for the first embodiment of the present invention.

[0066] Figure 2 An encryption flow chart of an online document signing and authentication method based on judicial notarization and asymmetric keys provided in the first embodiment of the present invention.

[0067] Figure 3 An overall flow chart of an online document signing and authentication system based on judicial notarization and asymmetric keys provided for the third embodiment of the present invention. DETAILED DESCRIPTION

[0068] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0069] Example 1, reference Figure 1-Figure 2 , as an embodiment of the present invention, provides a method for online document signing and authentication based on judicial notarization and asymmetric keys, comprising:

[0070] S1: After the user completes registration using his / her mobile phone number, he / she logs in through the service front-end.

[0071] Furthermore, user registration through mobile phone number includes: user U enters mobile phone number UPhone through business front-end BusW, and business front-end requests registration SMS verification code RSC from judicial notary server OAS according to mobile phone number; judicial notary server generates random number RRN and unique cache record, and randomly sends it to user through mobile phone SMS, and unique cache record is represented as:

[0072] CacheRSC=SET(UPhone,RSC,RTS)

[0073] Among them, RTS represents the expiration timestamp; the only cache record is generated by the expiration timestamp and the user's mobile phone number through the judicial notarization cache server REDIS; the user enters the SMS verification code RSC1 on the business front end, sets the user login password UPwd, and submits the registration request; after receiving the registration request, the judicial notarization server obtains CacheRSC=GET(UPhone) from the judicial notarization cache server; if the comparison result of the registered SMS verification code RSC is inconsistent with the SMS verification code RSC1 entered by the user, the registration fails; if the comparison result is consistent, the expiration timestamp RTS is verified, and if the current time DATE-RTS≤5*60*1000, the salt value SALT is generated and the secret key generation algorithm SKGA is called to obtain the SUPwd ciphertext, which is expressed as:

[0074] SUPwd=SKGA(UPhone&UPwd&SALT)

[0075] Finally, UPhone, SALT, and SUPwd are stored in the business server BusS database.

[0076] It should be noted that logging in through the business front end includes that the user enters the mobile phone number and login password through the business front end and then composes the string US in the format of a key-value pair; the string is encrypted using the MD5 encryption algorithm to obtain the MUS ciphertext, which is expressed as:

[0077] MUS=MD5(US)

[0078] The business front-end private key BusWSK is used to encrypt MUS with an asymmetric key to obtain the signature value SignMUS, which is expressed as:

[0079] SignMUS=BusWSK(MUS)

[0080] The business server calls the public key BusSPK to encrypt the string to obtain the PKUS ciphertext; sends the signature value SignMUS, the string US, and the ciphertext PKUS to the business server BusS; after receiving the login request, the business server uses the business front-end public key BusWPK to decrypt the signature value SignMUS to obtain the MUS ciphertext; uses the business server private key BusSSK to decrypt PKUS to obtain US; encrypts US with MD5 to obtain US1, and compares US1 with US; if the comparison results are consistent, the salt value SALT and the ciphertext SUPwd are taken out, and the secret key generation algorithm SKGA is immediately called to obtain the SUPwd1 ciphertext, which is expressed as:

[0081] SUPwd1=SKGA(UPhone&UPwd&SALT)

[0082] SUPwd1 is compared with SUPwd. If they are consistent, a successful login message is returned to the business front end.

[0083] It should also be noted that if Figure 2 In the steps shown, user A registers using a mobile phone number and sets a user password. After confirming the mobile phone verification code, a salt value is generated for user A's user password and encrypted into ciphertext using the MD5 encryption algorithm and stored in the database.

[0084] S2: Enter the user's personal identity information, generate an asymmetric key pair, encrypt the split keys and store them in the judicial notary server and business server respectively to complete the authentication.

[0085] Furthermore, entering the user's personal identity information and completing the authentication includes the user U entering the personal identity information UDI through the business front-end BusW, and then using a mobile smart device to cooperate with a camera to collect the user's facial recognition feature information FR, and performing liveness detection on FR through biometric technology; if the detection is successful, the personal identity information and facial feature information are compared with the Second and Third Departments of the Public Security Bureau. If the comparison results are inconsistent, the verification is terminated. If the comparison results are consistent, the consistent results are returned to the business front-end BusW.

[0086] It should be noted that the generation of an asymmetric key pair, the encrypted storage of the split keys in the judicial notarization server and the business server, and the completion of the authentication include: the business front-end BusW uses the key algorithm library KAL to generate an asymmetric key pair AKP that complies with the asymmetric key algorithm standard and the corresponding public key PK and private key SK; the private key SK is split by the key splitting algorithm SKCA to obtain SK1 and SK2; SK1 and SK2 are encrypted according to the user password SUPwd and the symmetric key algorithm AES of the front-end key algorithm library KAL to obtain the keys SSK1 and SSK2, respectively, which are expressed as:

[0087] SSK1=AES(SUPwd||SK1)

[0088] SSK2=AES(SUPwd||SK2)

[0089] Arrange the personal identity information UDI, facial recognition feature information FR, public key PK, and secret key SSK1 in ascending alphabetical order according to the request parameter name to obtain a string PAS, which is expressed as:

[0090] PAS=(UDI&PK&SSK1&FR)

[0091] PAS is hashed and encrypted using the MD5 algorithm to obtain the digest value MD5PAS, which is expressed as:

[0092] MD5PAS=MD5(PAS)

[0093] Use the private key BusWSk of the business front-end BusW to sign MD5PAS and obtain the signature value SKPAS, which is expressed as:

[0094] SKPAS=BusWSk(MD5PAS)

[0095] PAS is encrypted using the public key OASPK of the judicial notary server OAS to obtain the encrypted value PKPAS, which is expressed as:

[0096] PKPAS=OASPK(PAS)

[0097] The string PAS, the signed value SKPAS, and the encrypted value PKPAS are sent to the judicial notary server, and SSK2 is sent to the business server. The authentication process is that the judicial notary server OAS uses the business front-end public key BusWPK to perform asymmetric key decryption on the received SKPAS to obtain the digest value MD5PAS. Then the judicial notary server OAS uses the private key OASSK to decrypt PKPAS to obtain PAS. PAS is hashed and encrypted using the MD5 algorithm to obtain the ciphertext MD5PAS1, which is expressed as:

[0098] MD5PAS1=MD5(PAS)

[0099] Compare MD5PAS1 and MD5PAS. If they are consistent, store UDI, FR, and SSK1 in the judicial notarization server database, store SSK2 in the business server database, and return the authentication success result to the business front end.

[0100] It should also be noted that if Figure 2 In the steps shown, user A enters personal identity information through a mobile device and performs real-name authentication. After the real-name authentication information is passed, it is uploaded to the notary server to generate a pair of public and private keys. The public key is returned to the user's mobile phone, and the private key is cut into private key fragments and returned to the user's mobile phone, the trusted platform, and the notary office for storage.

[0101] S3: The signed document is uploaded and signed. Based on the successful signing, the judicial notarization server obtains the authentic document and stores it as evidence.

[0102] Furthermore, uploading and signing a signed document includes: the user uploads the signed file FSD to the signed file server FDFS through the business front-end BusW, and selects the corresponding signatory SIGNER; the file is calculated using the SHA-256 hash algorithm generated by the front-end key algorithm library to obtain the hash value SHA-FSD of the file FSD, which is expressed as:

[0103] SHA-FSD=SHA-256(FSD)

[0104] Afterwards, the private key BusWSK of the business front-end BusW is used to asymmetrically encrypt the file FSD and the signer SIGNER to obtain the signature value Sign0, which is expressed as:

[0105] Sign0 = BusWSk (FSD | SIGNER)

[0106] At the same time, the public key BusSPKD of the business server BusS is used to encrypt the file FSD, the signer SIGNER, and the hash value SHA-FSD to obtain the ciphertext CipherSign, which is expressed as:

[0107] CipherSign=BusSPKD(FSD&SIGNER&SHA-FSD)

[0108] Then, Sign0 and CipherSign are sent to the business server together. After receiving Sign0 and CipherSign, the business server uses the public key BusWPK of the business front-end BusW to decrypt Sign0. If the decryption is successful, CipherSign is encrypted using the private key BusSSK of the business server BusS to obtain plaintext FSD, SIGNER, and SHA-FSD. Then, the SHA-256 hash algorithm generated by the back-end key algorithm library is used to calculate the hash value of the file FSD to obtain the hash value SHA-FSD1, which is expressed as:

[0109] SHA-FSD1=SHA-256(FSD)

[0110] Compare the hash values ​​SHA-FSD and SHA-FSD1. If the comparison results are inconsistent, it is determined that the signed document has been tampered with and the document is invalid. If the comparison results are consistent, FSD and SIGNER are stored in the business server database, and SHA-FSD is stored in the judicial notarization server database, and the file upload is completed. After the file upload is completed, the signatory SIGNER will receive the signing task information. After the signatory SIGNER verifies the document, drags the electronic seal to the corresponding position of the document, and the system obtains the electronic seal Seal01 and the seal position information PosSeal respectively. Drag the handwritten signature to the corresponding position of the document, and the system obtains the handwritten signature Write01 and signature respectively. Location information PosWrite; The entire signing process will be completed in a trusted environment of judicial notarization. Users need to use mobile smart devices with camera devices to capture user facial feature information Fr01 and transmit it to the judicial notarization server OAS; the judicial notarization server compares the user facial feature information Fr01 with the user facial feature value FR stored during authentication; if the comparison results are inconsistent, the signing fails; if the comparison results are consistent, the secret key values ​​SSK1 and SSK2 are obtained from the business server BusS and the judicial notarization server OAS respectively according to the user's unique identifier; SSK1 and SSK2 are decrypted by the AES encryption algorithm to obtain SK1 and SK2, which are expressed as:

[0111] SK1=AES|DEC(SSK1|UPwd)

[0112] SK2=AES|DEC(SSK2|UPwd)

[0113] The obtained SK1 and SK2 are concatenated using the secret key concatenation algorithm CKCA to obtain SK, which is expressed as:

[0114] SK=CKCA(SK1,SK2)

[0115] Use the SHA-256 hash algorithm to encrypt the file FDS, signer SIGNER, electronic seal Seal01, seal location information PosSeal, handwritten signature Write01, signature location information PosWrite, and camera captured facial information Fr01 to obtain the summary value DIGEST-SIGN, which is expressed as:

[0116] DIGEST-SIGN=SHA-256(FDS|SIGNER|Seal01|PosSeal|Write01|PosWrite|Fr01)

[0117] The digest value DIGEST-SIGN is signed with the user's private key SK to obtain the signature value Sign02, which is expressed as:

[0118] Sign02=SK(DIGEST-SIGN)

[0119] Use the judicial notary server public key OASPK to asymmetrically encrypt the file FDS, the signatory SIGNER, the electronic seal Seal01, the seal location information PosSeal, the handwritten signature Write01, the signature location information PosWrite, and the camera captured facial information Fr01 to obtain CipherOAS, which is expressed as:

[0120] CipherOAS=OASPK(FDS,SIGNER,Seal01,PosSeal,Write01,PosWrite,Fr01)

[0121] The obtained Sign02 and CipherOAS are sent to the judicial notarization server OAS.

[0122] It should be noted that the judicial notary server obtains the authentic document and stores it, including the judicial notary server OAS using the user's public key PK to decrypt Sign02; if the decryption fails, the contract signing fails; if the decryption succeeds, the judicial notary server private key OASSK is used to decrypt CipherOAS to obtain the plain text FDS, SIGNER, Seal01, PosSeal, Write01, PosWrite, Fr01, and the SHA-256 hash algorithm is called to obtain DIGEST-SIGN1; DIGEST-SIGN1 is compared with DIGEST-SIGN; if the comparison results are inconsistent, the contract signing fails; if the comparison results are consistent, the judicial notary server OAS retrieves the notarization witness certificate CER, and uses the signature synthesis algorithm SsA to synthesize the signature to obtain the authentic document FinalFile, which is expressed as:

[0123] FinalFile=SsA(CER&FDS&SIGNER&Seal01&PosSeal&Write01&PosWrite)

[0124] The obtained FinalFile is stored in the business server database, SHA-FINAL=SHA-256(FinalFile) is stored in the judicial notarization server database, and OAS-WEB and BusW are notified of the signing completion.

[0125] It should also be noted that if Figure 2 In the steps shown, when user A needs to sign a document, the user's mobile phone, the trusted platform, and the notary office will combine the stored private key fragments into a private key and return it to the user for comparison with the public key.

[0126] Example 2 is an embodiment of the present invention, which provides a document online signing and authentication method based on judicial notarization and asymmetric keys. In order to verify the beneficial effects of the present invention, scientific demonstration is carried out through economic benefit calculation and simulation experiments.

[0127] First, a simulation experiment platform is built. The hardware equipment includes servers, client devices (computers, mobile phones, etc.), and cameras. The software system includes business front-end, business server, judicial notarization server, key algorithm library, and cache server.

[0128] Secondly, a simulation is carried out. The user enters the mobile phone number and the platform sends a text message verification code; the user receives the verification code, enters the verification code and password and submits the registration request, and the platform stores the user information after verification; the user enters the mobile phone number and password, the platform verifies and logs in the user; the user enters personal identity information, the platform collects facial recognition feature information, the platform compares it with the public security database, and verifies the identity information; the user uploads the contract document, the platform generates a file hash value and encrypts it, and the platform sends the file and encrypted information to the server; after the signer verifies the document, he drags the electronic seal and handwritten signature, the platform collects the signatory's facial feature information, and compares it with the authentication information, the platform generates a signature summary, encrypts and signs it, and the platform sends the signature information to the judicial notarization server; the judicial notarization server verifies the signature information, generates an authentic document and notarizes it, the platform stores the authentic document and notifies the user that the signing is complete.

[0129] Finally, a data comparison was performed based on the prior art and the method provided by the present invention, and a data comparison table as shown in Table 1 was obtained.

[0130]

[0131] It can be seen from the data in Table 1 that the present invention adopts judicial notarization SMS verification code and asymmetric encryption password, which respectively improves the security by 0.5% and 2% compared with the prior art; adopts the method of identity card information + facial recognition, which improves the security by 5% compared with the prior art; in the process of uploading files, the files are encrypted with hash values, which improves the security by 1% compared with the prior art; by adopting electronic seals and handwritten signatures, the security of the present invention is improved by 3% compared with the prior art; by adopting judicial notarization, the credibility of the present invention is improved by 10% compared with the prior art.

[0132] The present invention improves security during user registration, user login, identity authentication, file upload and document signing. The present invention creatively introduces a judicial notarization system during the signing stage, which not only improves the credibility of the signed document, but also effectively prevents the document from being tampered with. At the same time, the present invention also provides process backtracking and non-repudiation, ensuring the integrity and security of contract signing.

[0133] Example 3, reference Figure 3 , as an embodiment of the present invention, provides a document online signing and authentication system based on judicial notarization and asymmetric keys, including a user registration and login module, an information entry and authentication module, and a document signing and notarization module.

[0134] The user registration and login module is used for users to log in through the business front end after completing the registration via mobile phone number; the information entry and authentication module is used to enter the user's personal identity information, generate an asymmetric key pair, encrypt the split keys and store them in the judicial notary server and business server respectively to complete the authentication; the document signing and notarization module is used to upload and sign the signed document. Based on the successful signing, the judicial notary server obtains the authentic document and stores it as evidence.

[0135] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0136] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0137] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering, or processing in another suitable manner as necessary, and then stored in a computer memory.

[0138] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc. It should be noted that the above embodiments are only used to illustrate the technical solution of the present invention and are not limited. Although the present invention is described in detail with reference to the preferred embodiments, it should be understood by those skilled in the art that the technical solution of the present invention can be modified or replaced by equivalents without departing from the spirit and scope of the technical solution of the present invention, which should be included in the scope of the claims of the present invention.

[0139] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A document online signing and authentication method based on judicial notarization and asymmetric key, characterized in that: include: After the user registers with their mobile phone number, they log in through the business front end; Enter the user's personal identity information, generate an asymmetric key pair, encrypt and store the split keys in the judicial notarization server and business server respectively, and complete the authentication; The signed document is uploaded and signed. Based on the successful signing, the judicial notarization server obtains the authentic document and stores it as evidence.

2. The method for online document signing and authentication based on judicial notarization and asymmetric key according to claim 1, characterized in that: The user registers by mobile phone number, including user U inputting mobile phone number UPhone through the service front end BusW, and the service front end requests the judicial notarization server OAS to register SMS verification code RSC according to the mobile phone number; The judicial notarization server generates a random number RRN and a unique cache record, which is randomly sent to the user via SMS. The unique cache record is represented as: CacheRSC=SET(UPhone,RSC,RTS) Among them, RTS represents the expiration timestamp; The unique cache record is generated by the expiration timestamp and the user's mobile phone number through the judicial notarization cache server REDIS; The user enters the SMS verification code RSC1 on the business front end, sets the user login password UPwd, and submits the registration request; After receiving the registration request, the judicial notary server obtains CacheRSC=GET(UPhone) from the judicial notary cache server; If the registration SMS verification code RSC is inconsistent with the SMS verification code RSC1 entered by the user, the registration fails; If the comparison results are consistent, the expiration timestamp RTS is verified. If the current time DATE-RTS≤5*60*1000, the salt value SALT is generated and the key generation algorithm SKGA is called to obtain the SUPwd ciphertext, which is expressed as: SUPwd=SKGA(UPhone&UPwd&SALT) Finally, UPhone, SALT, and SUPwd are stored in the business server BusS database.

3. The method for online document signing and authentication based on judicial notarization and asymmetric key according to claim 2, characterized in that: The logging in through the service front end includes that the user enters the mobile phone number and login password through the service front end and then spells them into a string US in the format of a key-value pair; Use the MD5 encryption algorithm to encrypt the string and get the MUS ciphertext, which is expressed as: MUS=MD5(US) The business front-end private key BusWSK is used to encrypt MUS with an asymmetric key to obtain the signature value SignMUS, which is expressed as: SignMUS=BusWSK(MUS) The business server calls the public key BusSPK to encrypt the string to obtain the PKUS ciphertext; Send the signature value SignMUS, string US, and ciphertext PKUS to the business server BusS; After receiving the login request, the business server uses the business front-end public key BusWPK to decrypt the signed value SignMUS to obtain the MUS ciphertext; Use the business server private key BusSSK to decrypt PKUS and obtain US; Encrypt US with MD5 to get US1, and compare US1 with US; If the comparison results are consistent, the salt value SALT and the ciphertext SUPwd are taken out, and the secret key generation algorithm SKGA is called to obtain the SUPwd1 ciphertext, which is expressed as: SUPwd1=SKGA(UPhone&UPwd&SALT) SUPwd1 is compared with SUPwd. If they are consistent, a successful login message is returned to the business front end.

4. The method for online document signing and authentication based on judicial notarization and asymmetric key according to claim 3, characterized in that: The inputting of user personal identity information and completing authentication includes: the user U inputs personal identity information UDI through the service front-end BusW, and then uses a mobile smart device to cooperate with a camera device to collect the user's facial recognition feature information FR, and performs liveness detection on FR through biometric recognition technology; If the detection is successful, the personal identity information and facial feature information will be compared with the Second and Third Departments of Public Security. If the comparison results are inconsistent, the verification will be terminated. If the comparison results are consistent, the consistent results will be returned to the business front-end BusW.

5. The method for online document signing and authentication based on judicial notarization and asymmetric key according to claim 4, characterized in that: The generating of the asymmetric key pair encrypts and stores the cut keys to the judicial notarization server and the business server respectively and completes the authentication, including: the business front-end BusW uses the key algorithm library KAL to generate an asymmetric key pair AKP that complies with the asymmetric key algorithm standard and the corresponding public key PK and private key SK; The private key SK is split by the key splitting algorithm SKCA to obtain SK1 and SK2; According to the user password SUPwd and the symmetric key algorithm AES of the front-end key algorithm library KAL, SK1 and SK2 are encrypted to obtain the secret keys SSK1 and SSK2, which are expressed as: SSK1=AES(SUPwd||SK1) SSK2=AES(SUPwd||SK2) Arrange the personal identity information UDI, facial recognition feature information FR, public key PK, and secret key SSK1 in ascending alphabetical order according to the request parameter name to obtain a string PAS, which is expressed as: PAS=(UDI&PK&SSK1&FR) PAS is hashed and encrypted using the MD5 algorithm to obtain the digest value MD5PAS, which is expressed as: MD5PAS=MD5(PAS) Use the private key BusWSk of the business front-end BusW to sign MD5PAS and obtain the signature value SKPAS, which is expressed as: SKPAS=BusWSk(MD5PAS) PAS is encrypted using the public key OASPK of the judicial notary server OAS to obtain the encrypted value PKPAS, which is expressed as: PKPAS=OASPK(PAS) Send the string PAS, the signature value SKPAS, and the encrypted value PKPAS to the judicial notarization server, and send SSK2 to the business server; The authentication process is to use the judicial notary server OAS to use the business front-end public key BusWPK to perform asymmetric key decryption on the received SKPAS to obtain the digest value MD5PAS; Then the judicial notary server OAS uses the private key OASSK to decrypt PKPAS and obtain PAS; PAS is hashed and encrypted using the MD5 algorithm to obtain the ciphertext MD5PAS1, which is expressed as: MD5PAS1=MD5(PAS) Compare MD5PAS1 and MD5PAS. If they are consistent, store UDI, FR, and SSK1 in the judicial notarization server database, store SSK2 in the business server database, and return the authentication success result to the business front end.

6. The method for online document signing and authentication based on judicial notarization and asymmetric key according to claim 5, characterized in that: The signing document uploading and signing includes that the user uploads the signing document FSD to the signing document server FDFS through the business front-end BusW, and selects the corresponding signatory SIGNER; The SHA-256 hash algorithm generated by the front-end key algorithm library is used to calculate the file and obtain the hash value SHA-FSD of the file FSD, which is expressed as: SHA-FSD=SHA-256(FSD) Afterwards, the private key BusWSK of the business front-end BusW is used to asymmetrically encrypt the file FSD and the signer SIGNER to obtain the signature value Sign0, which is expressed as: Sign0＝BusWSk ( FSDSIGNER ) At the same time, the public key BusSPKD of the business server BusS is used to encrypt the file FSD, the signer SIGNER, and the hash value SHA-FSD to obtain the ciphertext CipherSign, which is expressed as: CipherSign=BusSPKD(FSD&SIGNER&SHA-FSD) Then send Sign0 and CipherSign together to the business server; After receiving Sign0 and CipherSign, the business server uses the public key BusWPK of the business front-end BusW to decrypt Sign0; If the decryption is successful, the CipherSign is encrypted using the private key BusSSK of the business server BusS to obtain the plaintext FSD, SIGNER, and SHA-FSD; Then use the SHA-256 hash algorithm generated by the backend key algorithm library to calculate the hash value of the file FSD, and get the hash value SHA-FSD1, which is expressed as: SHA-FSD1=SHA-256(FSD) Compare the hash values ​​SHA-FSD and SHA-FSD1. If the comparison results are inconsistent, it is determined that the signed document has been tampered with and the document is invalid; If the comparison results are consistent, the FSD and SIGNER are stored in the business server database, and the SHA-FSD is stored in the judicial notarization server database, and the file upload is completed; After uploading the file, the signatory SIGNER will receive the signing task information. After verifying the file, the signatory SIGNER drags the electronic seal to the corresponding position of the file, and the system obtains the electronic seal Seal01 and the seal position information PosSeal. Drag the handwritten signature to the corresponding position of the file, and the system obtains the handwritten signature Write01 and the signature position information PosWrite. The entire signing process will be completed in a trusted environment of judicial notarization. Users need to use mobile smart devices with camera equipment to capture user facial feature information Fr01 and transmit it to the judicial notarization server OAS; The judicial notarization server compares the user's facial feature information Fr01 with the user's facial feature value FR stored during authentication; If the comparison results are inconsistent, the contract signing fails; If the comparison results are consistent, the secret key values ​​SSK1 and SSK2 are obtained from the business server BusS and the judicial notarization server OAS respectively according to the user's unique identifier; SSK1 and SSK2 are decrypted by the AES encryption algorithm to obtain SK1 and SK2, which are expressed as: SK1=AES|DEC(SSK1|UPwd) SK2=AES|DEC(SSK2|UPwd) The obtained SK1 and SK2 are concatenated using the secret key concatenation algorithm CKCA to obtain SK, which is expressed as: SK=CKCA(SK1,SK2) Use the SHA-256 hash algorithm to encrypt the file FDS, signer SIGNER, electronic seal Seal01, seal location information PosSeal, handwritten signature Write01, signature location information PosWrite, and camera captured facial information Fr01 to obtain the summary value DIGEST-SIGN, which is expressed as: DIGEST-SIGN=SHA-256(FDS|SIGNER|Seal01|PosSeal|Write01|PosWrite|Fr01) The digest value DIGEST-SIGN is signed with the user's private key SK to obtain the signature value Sign02, which is expressed as: Sign02=SK(DIGEST-SIGN) Use the judicial notary server public key OASPK to asymmetrically encrypt the file FDS, the signatory SIGNER, the electronic seal Seal01, the seal location information PosSeal, the handwritten signature Write01, the signature location information PosWrite, and the camera captured facial information Fr01 to obtain CipherOAS, which is expressed as: CipherOAS=OASPK(FDS,SIGNER,Seal01,PosSeal,Write01,PosWrite,Fr01) The obtained Sign02 and CipherOAS are sent to the judicial notarization server OAS.

7. The method for online document signing and authentication based on judicial notarization and asymmetric key according to claim 6, characterized in that: The judicial notarization server obtains the authentic document and stores the evidence, including the judicial notarization server OAS decrypting Sign02 using the user public key PK; If the decryption fails, the contract will fail; If the decryption is successful, use the judicial notary server private key OASSK to decrypt CipherOAS and get the plain text FDS, SIGNER, Seal01, PosSeal, Write01, PosWrite, Fr01. Use the SHA-256 hash algorithm to get DIGEST-SIGN1. Compare DIGEST-SIGN1 with DIGEST-SIGN; If the comparison results are inconsistent, the contract signing fails; If the comparison results are consistent, the judicial notarization server OAS retrieves the notarization witness certificate CER and uses the signature synthesis algorithm SsA to synthesize the signature to obtain the authentic file FinalFile, which is expressed as: FinalFile=SsA(CER&FDS&SIGNER&Seal01&PosSeal&Write01&PosWrite) The obtained FinalFile is stored in the business server database, SHA-FINAL=SHA-256(FinalFile) is stored in the judicial notarization server database, and OAS-WEB and BusW are notified of the signing completion.

8. A system using the document online signing authentication method based on judicial notarization and asymmetric key as claimed in any one of claims 1 to 7, characterized in that: Including user registration and login module, information entry authentication module, document signing and notarization module; The user registration and login module is used for users to log in through the service front end after completing the registration with their mobile phone number; The information entry authentication module is used to enter the user's personal identity information, generate an asymmetric key pair, encrypt and store the cut keys in the judicial notarization server and the business server respectively, and complete the authentication; The document signing and notarization module is used to upload and sign the signed document. Upon successful signing, the judicial notarization server obtains the authentic document and stores the notarization.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the online document signing and authentication method based on judicial notarization and asymmetric keys described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method for online document signing and authentication based on judicial notarization and asymmetric keys described in any one of claims 1 to 7 are implemented.

Images