Electronic signature security management method and system based on block chain

Abstract

The invention discloses an electronic signature security management method and system based on a block chain, and relates to the technical field of information security, and the method comprises the steps: generating a public key and a private key of a user through a quantum resistant encryption algorithm, binding the public key with the identity of the user, recording the public key and the identity of the user on the block chain, and storing the private key through HSM hardware encryption equipment; the method comprises the following steps: standardizing a to-be-signed document to generate a standard document, and calculating the standard document through a Hash algorithm to obtain a document Hash value; the signer signs the document hash value by using a private key and a CRYSTALS-Dillitium signature algorithm, generates an electronic signature and a signature proof, associates the electronic signature, the signature proof, the document hash value and a timestamp with a public key, and records the associated information on the block chain; and the standardized processing rule is written into the smart contract, and after a verifier submits a verification request, document hash value comparison, signature effective state check and signature proof verification are carried out through calling chain data by the smart contract.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a blockchain-based electronic signature security management method and system. Background Art

[0002] In the existing technology, the security of electronic signatures mainly relies on traditional encryption algorithms, such as RSA and ECC. However, these algorithms are at risk of being cracked in a quantum computing environment. The Shor algorithm of a quantum computer can decompose large numbers in polynomial time, thus threatening the security of these algorithms.

[0003] The existing electronic signature system also has deficiencies in private key management. For example, the storage and update mechanism of private keys is not secure enough, which can easily lead to private key leakage. Traditional private key management methods usually rely on software storage, which is vulnerable to malware and hacker attacks, resulting in private keys being stolen or tampered with. The existing system lacks effective risk detection and emergency response mechanisms, and cannot promptly identify and respond to the risk of private key leakage. Summary of the invention

[0004] In view of the above existing problems, the present invention is proposed.

[0005] Therefore, the present invention provides a blockchain-based electronic signature security management method to solve the problems in the prior art that electronic signatures are easily cracked in a quantum computing environment and private key management is insecure.

[0006] In order to solve the above technical problems, the present invention provides the following technical solutions: In a first aspect, the present invention provides a blockchain-based electronic signature security management method, which includes: Use quantum-resistant encryption algorithms to generate the user's public and private keys, bind the public key to the user's identity and record it on the blockchain, and store the private key through an HSM hardware encryption device; Standardize the document to be signed to generate a standard document, calculate the standard document through the hash algorithm, and obtain the document hash value; The signer uses the private key and CRYSTALS-Dilithium signature algorithm to sign the document hash value, generate an electronic signature and signature certificate, associate the electronic signature, signature certificate, document hash value, timestamp with the public key, and record them on the blockchain to form on-chain data; Standardized processing rules are written into smart contracts. After the verifier submits a verification request, the smart contract calls the on-chain data to compare the document hash value, check the validity status of the signature, and verify the signature certificate, and then returns the signature information. Analyze the signature information, identify the risk of private key leakage, and allow the signer to actively report the risk of private key leakage. If the signature information is abnormal, the smart contract will be triggered to automatically revoke the electronic signature operation; After detecting a private key leakage risk event, the public key and private key are frozen, and a new public key and a new private key are generated using the quantum-resistant encryption algorithm. The document hash value is re-signed using the new private key to generate a new electronic signature, which is then associated with the new public key and recorded on the blockchain.

[0007] As a preferred solution of the blockchain-based electronic signature security management method described in the present invention, the following specific steps are used: a quantum-resistant encryption algorithm is used to generate a user's public key and private key, the public key is bound to the user's identity and recorded on the blockchain, and the private key is stored through an HSM hardware encryption device. The user's public key and private key are generated using a quantum-resistant encryption algorithm, and the public key is cryptographically bound to the user's identity identifier through a blockchain smart contract. The user's identity is verified using a decentralized identity verification process. Once the verification is passed, a blockchain transaction is triggered to complete the on-chain storage of the public key and identity. The private key is stored in the HSM hardware encryption device and is only used for signing operations in the internal encryption environment of the HSM hardware encryption device and is not allowed to be transmitted in plain text; When the preset key update conditions are met, the hardware encryption device will autonomously generate a new key pair, and complete the old public key status marking and on-chain registration of the new public key through the blockchain smart contract, and the blockchain network nodes will synchronously update the key status data.

[0008] As a preferred solution of the blockchain-based electronic signature security management method described in the present invention, the document to be signed is standardized to generate a standard document, and the standard document is calculated by a hash algorithm to obtain a document hash value. The specific steps are as follows: Perform format conversion and metadata cleaning on the original document to generate a standardized document with unique content, and define the format conversion and metadata cleaning as document standardization processing rules; Perform one-way hash calculation on the standardized document through the anti-collision hash algorithm to generate a document hash value that uniquely corresponds to the document content; Write standardized processing rules into blockchain smart contracts; After the standardized document is generated, the document hash value is logically associated with the user identity identifier and timestamp to form a traceable hash chain.

[0009] As a preferred solution of the blockchain-based electronic signature security management method described in the present invention, the signatory uses a private key and the CRYSTALS-Dilithium signature algorithm to sign the document hash value, generate an electronic signature and a signature certificate, associate the electronic signature, the signature certificate, the document hash value, and the timestamp with the public key, and then record them on the blockchain to form on-chain data. The specific steps are as follows: The private key is called through the HSM hardware encryption device, and the CRYSTALS-Dilithium signature algorithm is used to encrypt the document hash value to generate an unforgeable electronic signature and structured signature certificate; Link the electronic signature and signature certificate to the standardized document hash value, and bind the timestamp to solidify the signing time; Through blockchain transactions, electronic signatures, signature certificates, document hash values, timestamps and user public keys are logically associated to form on-chain data units; Before the on-chain data unit is written into the blockchain distributed ledger, the smart contract verifies the data integrity and signature algorithm compliance, and the on-chain data unit is stored synchronously by the blockchain node.

[0010] As a preferred solution of the blockchain-based electronic signature security management method described in the present invention, wherein: the standardized processing rules are written into the smart contract, and after the verifier submits the verification request, the smart contract calls the on-chain data to perform document hash value comparison, signature validity status check and signature certification verification, and returns the signature information. The specific steps are as follows: Write document standardization processing rules into smart contract code; After the verifier submits the document to be verified and the associated identifier, the smart contract automatically triggers the verification process and calls the original document hash value and standardized processing rules stored on the chain; Perform the same standardized processing operations as the signing stage on the document to be verified, generate a temporary hash value and compare it with the original hash value on the chain to determine whether the document content has been tampered with; Through smart contracts, the renewal status and revocation mark status of the electronic signature in the on-chain data unit are queried to verify the legitimacy of the signature life cycle status; Cryptographic verification of electronic signatures and signature certificates based on the CRYSTALS-Dilithium signature algorithm to confirm that the signatures are generated by legitimate private keys and have not been forged; The smart contract integrates the comparison results, signature status and verification conclusion, generates signature information including validity identification and risk warning, and returns it to the verifier.

[0011] As a preferred solution of the blockchain-based electronic signature security management method described in the present invention, the signature information is analyzed to identify the risk event of private key leakage, and the signatory is allowed to actively report the risk event of private key leakage. If the signature information is abnormal, the smart contract is triggered to automatically revoke the electronic signature operation. The specific steps are as follows: Through Python programming, dynamic behavior feature analysis is performed on the signature usage frequency, source IP address, and device fingerprint information stored on the chain to generate a risk score; Set a risk threshold. When the risk score exceeds the risk threshold and the signer proactively submits a private key leakage event statement, the smart contract marks it as a high-risk operation and initiates the revocation pre-check process; The pre-check process calls on-chain data to verify the relevance of abnormal signatures. After confirming that the abnormal behavior is logically related to multiple signature operations of the same private key, the smart contract revocation operation is triggered; The smart contract automatically updates the electronic signature status in the on-chain data unit to revoked, freezes the use rights of the associated private key, and sends a risk warning notification to the relevant participants; After the revocation operation is completed, the blockchain retains a complete record of risk events and operation logs.

[0012] As a preferred solution of the blockchain-based electronic signature security management method described in the present invention, after a private key leakage risk event is detected, the public key and private key are frozen, and a new public key and a new private key are generated by reusing the quantum resistant encryption algorithm. The new private key is used to re-sign the document hash value to generate a new electronic signature, and the new electronic signature is associated with the new public key and recorded on the blockchain. The specific steps are as follows: After the smart contract triggers the key freezing instruction, the private key status on the chain is updated to frozen through blockchain transactions, and the HSM hardware encryption device is prohibited from accessing the old private key; The HSM hardware encryption device autonomously generates a new key pair based on a quantum-resistant encryption algorithm. The new private key is generated in a secure isolation environment and is prohibited from being exported in plain text. The new public key is re-bound to the user identity through the smart contract, updated to the blockchain and marked as the current valid key, and the new private key is automatically called to perform CRYSTALS-Dilithium signature algorithm calculation on the hash value of the original document to generate a new electronic signature and associated signature certificate; The new electronic signature, signature certificate, document hash value and timestamp are associated with the new public key to form a new on-chain data unit and written into the blockchain; The blockchain synchronously updates the key version information, the historical signature records are retained but associated with the old private key status, and the key iteration mark and risk warning are returned during verification.

[0013] In a second aspect, the present invention provides an electronic signature security management system based on blockchain, including a key generation module, a document processing module, a signature generation module, an on-chain recording module, a verification module and a risk management module; The key generation module is used to generate the user's public key and private key using a quantum-resistant encryption algorithm, bind the public key to the user's identity and record it on the blockchain, and store the private key through an HSM hardware encryption device; The document processing module is used to perform standardization processing on the document to be signed, generate a standard document, calculate the standard document through a hash algorithm, and obtain a document hash value; The signature generation module is used for the signatory to sign the document hash value using the private key and the CRYSTALS-Dilithium signature algorithm, generate an electronic signature and a signature certificate, associate the electronic signature, the signature certificate, the document hash value, the timestamp with the public key, and record them on the blockchain to form on-chain data; The on-chain recording module is used to write standardized processing rules into smart contracts. After the verifier submits a verification request, the smart contract calls the on-chain data to perform document hash value comparison, signature validity status check and signature proof verification, and returns the signature information; The verification module is used to analyze the signature information, identify the risk of private key leakage, allow the signatory to actively report the risk of private key leakage, and trigger the smart contract to automatically revoke the electronic signature operation if the signature information is abnormal; The risk management module is used to freeze the public key and private key after detecting a private key leakage risk event, re-use the quantum resistant encryption algorithm to generate a new public key and a new private key, use the new private key to re-sign the document hash value to generate a new electronic signature, and associate the new electronic signature with the new public key and record it on the blockchain.

[0014] In a third aspect, the present invention provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: when the computer program is executed by the processor, it implements any step of the blockchain-based electronic signature security management method as described in the first aspect of the present invention.

[0015] In a fourth aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein: when the computer program is executed by a processor, it implements any step of the blockchain-based electronic signature security management method as described in the first aspect of the present invention.

[0016] The beneficial effects of the present invention are as follows: by using quantum-resistant encryption algorithms and CRYSTALS-Dilithium signature algorithms, quantum computing attacks can be effectively resisted to ensure the long-term security of electronic signatures. Combined with blockchain technology, the electronic signatures can be made tamper-proof and transparently stored, thereby enhancing the credibility of the data. The private keys are stored using HSM hardware encryption devices to ensure the security and isolation of the private keys and reduce the risk of leakage. At the same time, automated risk detection and emergency response are achieved through smart contracts, and security incidents such as private key leakage can be responded to in a timely manner, thereby improving the overall security and reliability of the system. In addition, standardized processing rules are written into smart contracts to ensure the consistency of document preprocessing and verification, further optimizing the management process of electronic signatures. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0018] Figure 1 This is a flow chart of the blockchain-based electronic signature security management method in Example 1.

[0019] Figure 2 This is a module diagram of the blockchain-based electronic signature security management system in Example 1. DETAILED DESCRIPTION

[0020] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the accompanying drawings.

[0021] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0022] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The term "in one embodiment" that appears in different places in this specification does not necessarily refer to the same embodiment, nor does it refer to a separate or selective embodiment that is mutually exclusive with other embodiments.

[0023] Example 1, reference Figure 1 and Figure 2 , which is the first embodiment of the present invention, and provides a blockchain-based electronic signature security management method, comprising the following steps: S1. Use quantum-resistant encryption algorithms to generate the user's public and private keys, bind the public key to the user's identity and record it on the blockchain, and store the private key through the HSM hardware encryption device, including the following steps: The user's public key and private key are generated using a quantum-resistant encryption algorithm, and the public key is cryptographically bound to the user's identity identifier through a blockchain smart contract. The decentralized identity verification process is used to verify the authenticity of the user's identity. After the verification is passed, a blockchain transaction is triggered to complete the on-chain storage of the public key and identity. Specifically, the algorithm recommended by the NIST post-quantum cryptography standardization project (such as CRYSTALS-Kyber) is used to generate public and private keys, and the key length is set to 768 bits (meeting the NIST Level 1 security standard). A pair of public keys pk and private keys sk are generated using the selected quantum-resistant encryption algorithm. Based on the W3C DID specification, a user DID identifier is generated, and the authenticity of the user's identity is verified through zero-knowledge proof. Trigger a blockchain transaction, associate the public key with the DID, and the transaction structure is DID-public key-timestamp.

[0024] The private key is stored in the HSM hardware encryption device and is only used for signing operations in the encrypted environment inside the HSM hardware encryption device. It is prohibited to be transmitted in plain text. Specifically, configure the HSM hardware encryption device and set access control policies to ensure that only authorized users can access the private key. Use a FIPS 140-3 Level 3 certified HSM (such as YubiHSM 2) and set a multi-factor authentication policy (such as biometrics + hardware token). Import the generated private key securely into the HSM hardware encryption device. Encrypt the private key and transmit it to the HSM hardware encryption device through a secure channel (TLS 1.3), and store it only in encrypted form in a secure isolation area. When signing is required, call the private key in the HSM hardware encryption device for signing operations to ensure that the private key is not exposed to the external environment in plain text.

[0025] When the preset key update conditions are met, the hardware encryption device will autonomously generate a new key pair, and complete the old public key status mark and the chain registration of the new public key through the blockchain smart contract, and the blockchain network nodes will synchronously update the key status data. The specific key validity period is set to 1 year, or the update is triggered when the HSM detects an abnormal access attempt. When the update conditions are met, the HSM device will autonomously generate a new key pair. The status of the old public key is updated to "expired" or "invalid" through the smart contract, and the new public key is registered. The blockchain network nodes will synchronously update the key status data to ensure that all participants can obtain the latest public key information.

[0026] It should be noted that CRYSTALS-Kyber is based on lattice cryptography and can resist quantum computing attacks. The key length is proportional to security. DID achieves autonomous identity control through distributed ledgers to avoid dependence on centralized authority.

[0027] S2, standardize the document to be signed to generate a standard document, calculate the standard document through a hash algorithm, and obtain the document hash value, including the following steps: The original document is converted and metadata is cleaned to generate a standardized document with unique content. The format conversion and metadata cleaning are defined as document standardization processing rules. Specifically, the original document is converted to PDF / A-3 format using the ApachePDFBox library to ensure cross-platform consistency. Metadata such as document creator and modification time are removed through ExifTool.

[0028] Perform one-way hash calculation on the standardized document through the collision-resistant hash algorithm to generate a document hash value that uniquely corresponds to the document content. Specifically, select a collision-resistant hash function and use SHA3-512 to calculate the document hash value, with an output length of 512 bits. For documents larger than 1GB, calculate them in blocks (4MB per block) and finally merge the hashes.

[0029] Write the standardized processing rules into the blockchain smart contract to ensure that the document preprocessing process is consistent with the on-chain verification rules. Specifically, encode the standardized processing rules into the smart contract so that these rules can be reused during on-chain verification. Write the smart contract using Solidity. Deploy the smart contract to the blockchain and ensure that all participants can access it.

[0030] After the standardized document is generated, the document hash value is logically associated with the user identity identifier and timestamp to form a traceable hash chain. Specifically, the current timestamp is obtained from a trusted timestamp service. Use Python's datetime module. Logically associate the hash value, user identity identifier and timestamp of the standardized document. Record the above information as a transaction on the blockchain.

[0031] It should be noted that collision-resistant hash functions ensure that even if two documents have very similar contents, their hash values ​​will be significantly different, thereby improving security. The hash value provides a unique identifier for the content of the document, which can be used to verify the integrity and authenticity of the document. Associating the document hash value with the user identity identifier and timestamp forms an unalterable record, enhancing the traceability and legal validity of the document. Blockchain technology provides a decentralized trust mechanism to ensure the authenticity and immutability of the record.

[0032] S3. The signer signs the document hash value using the private key and CRYSTALS-Dilithium signature algorithm to generate an electronic signature and signature certificate, associates the electronic signature, signature certificate, document hash value, timestamp and public key, and records them on the blockchain to form on-chain data, including the following steps: The private key is called through the HSM hardware encryption device, and the CRYSTALS-Dilithium signature algorithm is used to encrypt the document hash value to generate an unforgeable electronic signature and structured signature certificate. Specifically, the Dilithium3 mode (security level 128 bits) is selected, and the signature length is 2592 bytes. The HSM signature function is called through the PKCS#11 interface, the input is the document hash value, and the output is the electronic signature and signature certificate.

[0033] The electronic signature and signature certificate are associated with the standardized document hash value, and the timestamp is bound to solidify the signing time. Specifically, the current timestamp is obtained from a trusted timestamp service. The electronic signature, signature certificate, document hash value and timestamp are logically associated.

[0034] Through blockchain transactions, electronic signatures, signature certificates, document hash values, timestamps and user public keys are logically associated to form on-chain data units. Specifically, transactions are sent to smart contracts through the Web3.py library to synchronize electronic signatures and related information to the blockchain.

[0035] Before the on-chain data unit is written into the blockchain distributed ledger, the smart contract verifies the data integrity and signature algorithm compliance, and the blockchain node synchronizes and stores the on-chain data unit. Specifically, verification logic is added to the smart contract to check the validity of the signature and data integrity. Once the transaction is confirmed, the blockchain node will automatically synchronize and store the new on-chain data unit.

[0036] It should be noted that the built-in verification mechanism of the smart contract ensures that only valid signatures and complete data can be recorded on the blockchain. The synchronization mechanism of the blockchain nodes ensures the distribution and consistency of data throughout the network, enhancing the robustness and reliability of the system.

[0037] S4. Standardized processing rules are written into smart contracts. After the verifier submits a verification request, the smart contract calls the on-chain data to compare the document hash value, check the validity status of the signature, and verify the signature certificate, and returns the signature information, including the following steps: Write document standardization processing rules into the smart contract code to ensure the consistency of rule execution and on-chain verification. Specifically, write the PDF / A conversion logic and metadata cleaning steps into the smart contract and call the off-chain service for execution.

[0038] The document to be verified is processed in the same standardized way as the signing stage, a temporary hash value is generated and compared with the original hash value on the chain to determine whether the document content has been tampered with. Specifically, the verifier submits the document to be verified and the document identifier, triggering the contract function. Standardized processing is performed in the off-chain environment to generate a temporary hash. The contract checks whether the temporary hash matches the document hash value stored on the chain.

[0039] The renewal status and revocation mark status of the electronic signature in the on-chain data unit are queried through the smart contract to verify the legitimacy of the signature life cycle status. Specifically, the life cycle field contained in the on-chain data unit is checked.

[0040] Based on the CRYSTALS-Dilithium signature algorithm, the electronic signature and signature certificate are cryptographically verified to confirm that the signature is generated by a legitimate private key and has not been forged. Specifically, the Dilithium verification library (such as the Open Quantum Safe library) is called, the public key, electronic signature and signature certificate are input, and the verification algorithm outputs a Boolean value (true / false) to confirm that the signature has not been tampered with and is generated by a legitimate private key.

[0041] The smart contract integrates the comparison results, signature status and verification conclusion, generates signature information including validity identification and risk warning, and returns it to the verifier. Specifically, if the document has not been tampered with, the signature is valid and has not been revoked, the smart contract will return the "signature is valid" message; if there is any problem, the smart contract will return the corresponding prompt information in JSON format (such as "the document has been tampered with", "the signature has been revoked", etc.).

[0042] It should be noted that the off-chain computing (Oracle) + on-chain verification mode takes into account both processing efficiency and data credibility. Oracle services are used to separate computing-intensive tasks and avoid blockchain performance bottlenecks.

[0043] S5. Analyze the signature information, identify the risk of private key leakage, and allow the signer to actively report the risk of private key leakage. If the signature information is abnormal, the smart contract will be triggered to automatically revoke the electronic signature operation, including the following steps: Through Python programming, the frequency of signature usage, source IP address, and device fingerprint information stored on the chain are dynamically analyzed to generate risk scores. Specifically, Python programming dynamically collects the following features: Spatiotemporal features: IP geographic location and time interval of signature requests (such as 50 signatures initiated by the same IP within 1 hour). Device fingerprint: Device hardware hash (such as TPM chip ID) is collected through WebAuthn. Correlation analysis: Signature behavior correlation detection of the same private key under different DID identifiers. Use the isolated forest to dynamically adjust the risk score threshold and generate a risk score.

[0044] Set a risk threshold. When the risk score exceeds the risk threshold and the signer proactively submits a private key leakage event statement, the smart contract marks it as a high-risk operation and starts the revocation pre-check process. Specifically, for example, industry experience shows that a single-day signature frequency within 200% of the user's historical average is normal. The single-day signature frequency within 200% of the user's historical average is used as the risk threshold. When the risk score exceeds the risk threshold and the signer proactively submits a private key leakage event statement, an off-chain warning notification (email / SMS) is triggered.

[0045] The pre-check process calls on-chain data to verify the relevance of abnormal signatures. After confirming that the abnormal behavior is logically associated with multiple signature operations of the same private key, the smart contract revocation operation is triggered. Specifically, if the same private key is detected to initiate signatures from 3 different countries' IPs within 5 minutes, the smart contract will automatically mark it as a high-risk operation. Trigger the following actions: Freeze the private key access rights in the HSM device (through the PKCS#11 instruction C_SetAttributeValue).

[0046] The smart contract automatically updates the electronic signature status in the on-chain data unit to revoked, freezes the use rights of the associated private key, and sends a risk warning notification to the relevant participants. Specifically, the on-chain public key status is updated to revoked and broadcast to all nodes. A standardized revocation certificate (RFC5280 format) is generated and stored on the chain.

[0047] After the revocation operation is completed, the blockchain retains a complete record of risk events and operation logs.

[0048] It should be noted that auditors can verify the compliance of revocation operations through zk-SNARKs without exposing sensitive data.

[0049] S6. After detecting a private key leakage risk event, freeze the public key and private key, re-use the quantum resistant encryption algorithm to generate a new public key and a new private key, use the new private key to re-sign the document hash value to generate a new electronic signature, associate the new electronic signature with the new public key and record it on the blockchain, including the following steps: After the smart contract triggers the key freezing instruction, the private key status on the chain is updated to frozen through blockchain transactions, and the HSM hardware encryption device is prohibited from accessing the old private key. Specifically, the smart contract updates the old public key status on the chain to deprecated and writes the abolition timestamp. The HSM device physically destroys the old private key (in compliance with the FIPS 140-3 Level 3 erasure standard).

[0050] The HSM hardware encryption device autonomously generates a new key pair based on a quantum-resistant encryption algorithm, ensuring that the new private key is generated in a secure isolation environment and that plain text export is prohibited. Specifically, the HSM device autonomously generates a new CRYSTALS-Dilithium3 key pair (private key length 2560 bits). The key is generated through a secure enclave (such as Intel SGX) to ensure that the key material is never exposed.

[0051] The new public key is re-bound to the user identity through the smart contract, updated to the blockchain and marked as the current valid key, and the new private key is automatically called to perform the CRYSTALS-Dilithium signature algorithm calculation on the hash value of the original document to generate a new electronic signature and associated signature certificate. The new electronic signature, signature certificate, document hash value and timestamp are associated with the new public key to form a new on-chain data unit and written into the blockchain.

[0052] The blockchain synchronously updates the key version information, the historical signature record is retained but associated with the old private key status, and the key iteration mark and risk warning are returned during verification. Specifically, the blockchain node broadcasts the new key status through the Gossip protocol to ensure the consistency of the entire network. The validator client cache update strategy uses the LRU algorithm to retain the last 10 valid public key versions.

[0053] It should be noted that zkProof enables seamless connection between old and new keys, and users do not need to re-sign historical documents. Each key update uses the NIST post-quantum cryptography standardization algorithm to resist quantum computing attacks.

[0054] This embodiment also provides a blockchain-based electronic signature security management system, including: a key generation module, a document processing module, a signature generation module, an on-chain recording module, a verification module, and a risk management module; The key generation module is used to generate the user's public key and private key using a quantum-resistant encryption algorithm, bind the public key to the user's identity and record it on the blockchain, and store the private key through an HSM hardware encryption device; The document processing module is used to standardize the document to be signed, generate a standard document, calculate the standard document through the hash algorithm, and obtain the document hash value; The signature generation module is used by the signer to sign the document hash value using the private key and the CRYSTALS-Dilithium signature algorithm, generate an electronic signature and a signature certificate, associate the electronic signature, signature certificate, document hash value, timestamp and public key, and record them on the blockchain to form on-chain data; The on-chain recording module is used to write standardized processing rules into smart contracts. After the verifier submits a verification request, the smart contract calls the on-chain data to compare the document hash value, check the validity status of the signature, and verify the signature certificate, and return the signature information; The verification module is used to analyze the signature information, identify the risk of private key leakage, and allow the signer to actively report the risk of private key leakage. If the signature information is abnormal, the smart contract will be triggered to automatically revoke the electronic signature operation; The risk management module is used to freeze the public key and private key after detecting a private key leakage risk event, re-use the quantum-resistant encryption algorithm to generate a new public key and a new private key, use the new private key to re-sign the document hash value to generate a new electronic signature, and associate the new electronic signature with the new public key and record it on the blockchain.

[0055] This embodiment also provides a computer device, which is suitable for the case of a blockchain-based electronic signature security management method, including: a memory and a processor; the memory is used to store computer-executable instructions, and the processor is used to execute computer-executable instructions to implement the blockchain-based electronic signature security management method proposed in the above embodiment.

[0056] The computer device may be a terminal, and the computer device includes a processor, a memory, a communication interface, a display screen and an input device connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be achieved through WIFI, an operator network, NFC (near field communication) or other technologies. The display screen of the computer device may be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device may be a touch layer covered on the display screen, or a key, trackball or touchpad provided on the housing of the computer device, or an external keyboard, touchpad or mouse, etc.

[0057] This embodiment also provides a storage medium on which a computer program is stored. When the program is executed by a processor, the method for implementing the electronic signature security management based on blockchain as proposed in the above embodiment is implemented; the storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (Static Random Access Memory, referred to as SRAM), electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, referred to as EEPROM), erasable programmable read-only memory (Erasable Programmable Read Only Memory, referred to as EPROM), programmable read-only memory (Programmable Red-Only Memory, referred to as PROM), read-only memory (Read-Only Memory, referred to as ROM), magnetic storage, flash memory, magnetic disk or optical disk.

[0058] In summary, the present invention effectively resists quantum computing attacks and ensures the long-term security of electronic signatures by using quantum-resistant encryption algorithms and CRYSTALS-Dilithium signature algorithms. Combined with blockchain technology, the electronic signatures can be tamper-proof and transparently stored, enhancing the credibility of the data. The private keys are stored using HSM hardware encryption devices to ensure the security and isolation of the private keys and reduce the risk of leakage. At the same time, automated risk detection and emergency response are achieved through smart contracts, and security incidents such as private key leakage are responded to in a timely manner, thereby improving the overall security and reliability of the system. In addition, standardized processing rules are written into smart contracts to ensure the consistency of document preprocessing and verification, further optimizing the management process of electronic signatures.

[0059] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A blockchain-based electronic signature security management method, characterized by: include, Use quantum-resistant encryption algorithms to generate the user's public and private keys, bind the public key to the user's identity and record it on the blockchain, and store the private key through an HSM hardware encryption device; Standardize the document to be signed to generate a standard document, calculate the standard document through the hash algorithm, and obtain the document hash value; The signer uses the private key and CRYSTALS-Dilithium signature algorithm to sign the document hash value, generate an electronic signature and signature certificate, associate the electronic signature, signature certificate, document hash value, timestamp with the public key, and record them on the blockchain to form on-chain data; Standardized processing rules are written into smart contracts. After the verifier submits a verification request, the smart contract calls the on-chain data to compare the document hash value, check the validity status of the signature, and verify the signature certificate, and then returns the signature information. Analyze the signature information, identify the risk of private key leakage, and allow the signer to actively report the risk of private key leakage. If the signature information is abnormal, the smart contract will be triggered to automatically revoke the electronic signature operation; After detecting a private key leakage risk event, the public key and private key are frozen, and a new public key and a new private key are generated using the quantum-resistant encryption algorithm. The document hash value is re-signed using the new private key to generate a new electronic signature, which is then associated with the new public key and recorded on the blockchain.

2. The blockchain-based electronic signature security management method according to claim 1, characterized in that: Use quantum-resistant encryption algorithms to generate the user's public and private keys, bind the public key to the user's identity and record it on the blockchain, and store the private key through the HSM hardware encryption device. The specific steps are as follows: The user's public key and private key are generated using a quantum-resistant encryption algorithm, and the public key is cryptographically bound to the user's identity identifier through a blockchain smart contract. The user's identity is verified using a decentralized identity verification process. Once the verification is passed, a blockchain transaction is triggered to complete the on-chain storage of the public key and identity. The private key is stored in the HSM hardware encryption device and is only used for signing operations in the internal encryption environment of the HSM hardware encryption device and is not allowed to be transmitted in plain text; When the preset key update conditions are met, the hardware encryption device will autonomously generate a new key pair, and complete the old public key status marking and on-chain registration of the new public key through the blockchain smart contract, and the blockchain network nodes will synchronously update the key status data.

3. The blockchain-based electronic signature security management method according to claim 2, characterized in that: Standardize the document to be signed, generate a standard document, calculate the standard document through the hash algorithm, and obtain the document hash value. The specific steps are as follows: Perform format conversion and metadata cleanup on the original document to generate a standardized document with unique content, and define the format conversion and metadata cleanup as document standardization processing rules; Perform one-way hash calculation on the standardized document through the anti-collision hash algorithm to generate a document hash value that uniquely corresponds to the document content; Write standardized processing rules into blockchain smart contracts; After the standardized document is generated, the document hash value is logically associated with the user identifier and timestamp to form a traceable hash chain.

4. The blockchain-based electronic signature security management method according to claim 3, characterized in that: The signer uses the private key and CRYSTALS-Dilithium signature algorithm to sign the document hash value, generate an electronic signature and signature certificate, associate the electronic signature, signature certificate, document hash value, timestamp with the public key, and record them on the blockchain to form on-chain data. The specific steps are as follows: The private key is called through the HSM hardware encryption device, and the CRYSTALS-Dilithium signature algorithm is used to encrypt the document hash value to generate an unforgeable electronic signature and structured signature certificate; Link the electronic signature and signature certificate to the standardized document hash value, and bind the timestamp to solidify the signing time; Through blockchain transactions, electronic signatures, signature certificates, document hash values, timestamps and user public keys are logically associated to form on-chain data units; Before the on-chain data unit is written into the blockchain distributed ledger, the smart contract verifies the data integrity and signature algorithm compliance, and the on-chain data unit is stored synchronously by the blockchain node.

5. The blockchain-based electronic signature security management method according to claim 4, characterized in that: Standardized processing rules are written into smart contracts. After the verifier submits a verification request, the smart contract calls the on-chain data to compare the document hash value, check the validity status of the signature, and verify the signature certificate, and return the signature information. The specific steps are as follows: Write document standardization processing rules into smart contract code; After the verifier submits the document to be verified and the associated identifier, the smart contract automatically triggers the verification process and calls the original document hash value and standardized processing rules stored on the chain; Perform the same standardized processing operations as the signing stage on the document to be verified, generate a temporary hash value and compare it with the original hash value on the chain to determine whether the document content has been tampered with; Through smart contracts, the renewal status and revocation mark status of the electronic signature in the on-chain data unit are queried to verify the legitimacy of the signature life cycle status; Cryptographic verification of electronic signatures and signature certificates based on the CRYSTALS-Dilithium signature algorithm to confirm that the signatures are generated by legitimate private keys and have not been forged; The smart contract integrates the comparison results, signature status and verification conclusion, generates signature information including validity identification and risk warning, and returns it to the verifier.

6. The blockchain-based electronic signature security management method according to claim 5, characterized in that: Analyze the signature information, identify the risk of private key leakage, and allow the signer to actively report the risk of private key leakage. If the signature information is abnormal, the smart contract will be triggered to automatically revoke the electronic signature operation. The specific steps are as follows: Through Python programming, dynamic behavior feature analysis is performed on the signature usage frequency, source IP address, and device fingerprint information stored on the chain to generate a risk score; Set a risk threshold. When the risk score exceeds the risk threshold and the signer proactively submits a private key leakage event statement, the smart contract marks it as a high-risk operation and initiates the revocation pre-check process; The pre-check process calls on-chain data to verify the relevance of abnormal signatures. After confirming that the abnormal behavior is logically related to multiple signature operations of the same private key, the smart contract revocation operation is triggered; The smart contract automatically updates the electronic signature status in the on-chain data unit to revoked, freezes the use rights of the associated private key, and sends a risk warning notification to the relevant participants; After the revocation operation is completed, the blockchain retains a complete record of risk events and operation logs.

7. The blockchain-based electronic signature security management method according to claim 6, characterized in that: After detecting a private key leakage risk event, freeze the public key and private key, re-use the quantum resistant encryption algorithm to generate a new public key and a new private key, use the new private key to re-sign the document hash value to generate a new electronic signature, associate the new electronic signature with the new public key and record it on the blockchain. The specific steps are as follows: After the smart contract triggers the key freezing instruction, the private key status on the chain is updated to frozen through blockchain transactions, and the HSM hardware encryption device is prohibited from accessing the old private key; The HSM hardware encryption device autonomously generates a new key pair based on a quantum-resistant encryption algorithm. The new private key is generated in a secure isolation environment and is prohibited from being exported in plain text. The new public key is re-bound to the user identity through the smart contract, updated to the blockchain and marked as the current valid key, and the new private key is automatically called to perform CRYSTALS-Dilithium signature algorithm calculation on the hash value of the original document to generate a new electronic signature and signature certificate; The new electronic signature, signature certificate, document hash value and timestamp are associated with the new public key to form a new on-chain data unit and written into the blockchain; The blockchain synchronously updates the key version information, the historical signature records are retained but associated with the old private key status, and the key iteration mark and risk warning are returned during verification.

8. A blockchain-based electronic signature security management system, based on the blockchain-based electronic signature security management method according to any one of claims 1 to 7, characterized in that: Including key generation module, document processing module, signature generation module, on-chain recording module, verification module and risk management module; The key generation module is used to generate the user's public key and private key using a quantum-resistant encryption algorithm, bind the public key to the user's identity and record it on the blockchain, and store the private key through an HSM hardware encryption device; The document processing module is used to perform standardization processing on the document to be signed, generate a standard document, and calculate the standard document through a hash algorithm to obtain a document hash value; The signature generation module is used for the signatory to sign the document hash value using the private key and the CRYSTALS-Dilithium signature algorithm, generate an electronic signature and a signature certificate, associate the electronic signature, the signature certificate, the document hash value, the timestamp with the public key, and record them on the blockchain to form on-chain data; The on-chain recording module is used to write standardized processing rules into smart contracts. After the verifier submits a verification request, the smart contract calls the on-chain data to perform document hash value comparison, signature validity status check and signature proof verification, and returns the signature information; The verification module is used to analyze the signature information, identify the risk of private key leakage, allow the signatory to actively report the risk of private key leakage, and trigger the smart contract to automatically revoke the electronic signature operation if the signature information is abnormal; The risk management module is used to freeze the public key and private key after detecting a private key leakage risk event, re-use the quantum resistant encryption algorithm to generate a new public key and a new private key, use the new private key to re-sign the document hash value to generate a new electronic signature, and associate the new electronic signature with the new public key and record it on the blockchain.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the blockchain-based electronic signature security management method described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the blockchain-based electronic signature security management method described in any one of claims 1 to 7 are implemented.

Images