A method for binding an electronic seal image to a digital certificate and presenting the same

Abstract

The present invention discloses a method for binding an electronic seal image to a digital certificate, comprising the following steps: S1, establishing a seal image management platform, maintaining the binding relationship between the seal image and the digital certificate in the platform; S2, the caller guides the user to use the digital certificate he holds to digitally sign the seal image, and then sends the seal image, digital certificate, and digital signature to the seal image management platform in a secure manner; S3, the seal image management platform verifies the validity of the digital signature, and after the verification is passed, the binding relationship between the digital certificate and the seal image is established on the seal image management platform. The present invention also discloses a method for presenting a seal image, which is based on an asymmetric cryptographic system, and the seal image can only be obtained by signing by a user holding a digital certificate, and the seal image is presented.

Description

Technical Field

[0001] The present invention is applied to the field of public key infrastructure (PKI) system, especially to the fields of electronic signature, information security of electronic seal, data business, etc. Background Art

[0002] Digital signature is the application of asymmetric key encryption technology and digital summary technology, mainly including the sender's information signature and the receiver's information signature authentication.

[0003] As an important technology for signature authentication, digital signature can provide security services such as identity authentication, data integrity, and non-repudiation. At the same time, it is also necessary to ensure the security of information transmission itself and encrypt the digital signature to prevent attackers from impersonating signatures.

[0004] In the traditional electronic signature industry, seal images are closely integrated with digital certificates. The process of making electronic signatures is actually to first make a digital certificate for the user (using USBKey as the medium), and then write the user's seal image into the file storage area of ​​the USBKey (it can be written directly or encrypted). In the scenario of using USBKey certificates for electronic signatures, it is necessary to read the seal image from the USBKey through programs such as controls / COM components, and then complete the subsequent operations of the electronic signature.

[0005] This method has at least the following limitations and disadvantages:

[0006] 1. The seal image cannot be changed frequently. Every time a change is made, the operator needs to bring the USB Key to the seal making system to make the change, which is time-consuming and laborious.

[0007] 2. Multiple seal images cannot be written into the USBKey. Due to the limitation of the USBKey file storage area, only one or a very small number of images can be written into the USBKey, which cannot meet the needs of using different seal images in different scenarios.

[0008] The Chinese patent "Method and device for adding electronic seals to design drawings" (publication number CN104346581A) proposes: "Scan the user's handwritten signature and vectorize the signature to generate an electronic seal of the signature, upload the electronic seal to the information system, and verify the legitimacy of the uploaded electronic seal, and refuse to pass electronic seals that do not match the user's identity." It does not reflect the strong correlation between the user and the handwritten signature (which is essentially a seal image), and cannot prove that the handwritten image is confirmed by the user.

[0009] The Chinese patent "A method and system for implementing mobile phone electronic seal" (publication number CN112199737A) proposes "verification by obtaining the verification information of the mobile device, the user's login account information and the mobile phone hardware identification, and returning the corresponding electronic seal information after successful verification." This method has a relatively low security level and is easy to be hacked.

[0010] The Chinese patent "Electronic Signature Authorization Method and Device, Storage Medium, Electronic Device" (Publication No. CN112905979A) only describes the need to create a seal, but does not explain how to create a seal or bind a seal. Summary of the invention

[0011] In view of the above technical problems, the present invention proposes a method for binding an electronic seal image to a digital certificate and presenting the same.

[0012] To achieve the above object, the technical solution adopted by the present invention is: a method for binding an electronic seal image to a digital certificate, comprising the following steps:

[0013] S1. Establish a seal image management platform to maintain the binding relationship between the seal image and the digital certificate in the platform; the seal image management platform includes an identity authentication module and a seal image management module; the identity authentication module can set the platform's identity certificate and the corresponding private key; the seal image management module saves the binding relationship between the seal image and the digital certificate.

[0014] S2. The caller (such as a control or business system) guides the user to use the digital certificate private key he holds to digitally sign the seal image, and then sends the seal image, digital certificate, and digital signature to the seal image management platform.

[0015] S3. The seal image management platform will verify the validity of the digital signature. After the verification is passed, the binding relationship between the digital certificate and the seal image will be established on the seal image management platform.

[0016] Furthermore, the binding relationship is maintained by: using a hash algorithm to calculate the hash value of the seal image, and establishing a one-to-one correspondence between the hash value and the unique characteristic value of the digital certificate; or, establishing a one-to-one correspondence between the primary key ID of the seal image in the table and the unique characteristic value of the digital certificate.

[0017] Furthermore, methods for verifying the validity of digital signatures include but are not limited to certificate validity period, certificate key usage, certificate chain, certificate blacklist, etc. Digital signature methods include but are not limited to PKCS#1 standard, PKCS#7 standard signature, and SM2 elliptic curve public key cryptography algorithm signature.

[0018] Furthermore, the digital certificate in this case is a USBKey certificate or a mobile digital certificate, and the mobile digital certificate uses a security module integrated in the mobile APP as the medium. The security module complies with the national secret "GM / T 0028-2014 Technical Requirements for Security of Cryptographic Modules".

[0019] In the above process, by utilizing the tamper-proof and non-repudiation characteristics of digital signatures, it can be determined that the binding operation between the digital certificate and the seal image is completed by the holder of the digital certificate.

[0020] The present invention also discloses a method for presenting an electronic seal image. When the seal image needs to be used, the presenting method proposed in this case is specifically as follows:

[0021] B1. The caller (such as a control or business system) applies for a business challenge code from the seal image management platform, and the seal image management platform returns the business challenge code and the seal image management platform identity certificate.

[0022] B2. The caller guides the user (digital certificate holder) to use the digital certificate private key to sign the business challenge code and obtain a digital signature S.

[0023] B3. The caller generates a symmetric key SK, and uses the seal image management platform identity certificate to encrypt the symmetric key to obtain the symmetric key encrypted ciphertext CIPHER_SK.

[0024] B4. The caller sends the digital signature value S, digital certificate (or digital certificate fingerprint), encrypted symmetric key encrypted ciphertext, business challenge code and other information to the seal image management platform to request the seal image.

[0025] B5. The seal image management platform verifies the digital signature S in the previous step. After verification, it uses the platform identity certificate private key to decrypt the symmetric key encrypted ciphertext CIPHER_SK to obtain the symmetric key SK. After the platform queries the seal image IMAGE corresponding to the digital certificate, it uses the symmetric key SK to encrypt the seal image to obtain the seal image ciphertext CIPHER_IMAGE, and returns CIPHER_IMAGE to the caller.

[0026] B6. The caller uses the symmetric key SK to decrypt the seal image ciphertext CIPHER_IMAGE to obtain the seal image IMAGE.

[0027] Furthermore, when applying for a business challenge code, the parameters sent by the caller to the seal image management platform include but are not limited to digital certificates or digital certificate fingerprints, verification codes, etc.

[0028] Furthermore, the verification method of the digital signature S includes but is not limited to the certificate validity period, certificate key usage, certificate chain, certificate blacklist, etc.

[0029] The present invention also discloses another method for presenting an electronic seal image. When the seal image is needed, the presenting method proposed in this case is specifically as follows:

[0030] R1. The caller (such as a control or business system) applies for a business challenge code from the seal image management platform, and the seal image management platform returns the business challenge code and the seal image management platform identity certificate.

[0031] R2. After the caller verifies the identity certificate of the management platform, it guides the user (digital certificate holder) to sign the business challenge code using the digital certificate private key to obtain the digital signature S.

[0032] R3. The caller sends the digital signature S, user digital certificate (or digital certificate fingerprint), business challenge code and other information to the seal image management platform to request the seal image.

[0033] R4. The seal image management platform verifies the digital signature S in the previous step. After verification, it queries the seal image IMAGE corresponding to the digital certificate, and uses the user's digital certificate public key to encrypt the seal image using the digital envelope encryption method to obtain the seal image ciphertext digital envelope ENVELOPED_CIPHER_IMAGE, and returns ENVELOPED_CIPHER_IMAGE to the caller.

[0034] R5. The caller guides the user (digital certificate holder) to use the digital certificate private key to decrypt the seal image ciphertext digital envelope ENVELOPED_CIPHER_IMAGE to obtain the seal image IMAGE.

[0035] Furthermore, when applying for a business challenge code, the parameters sent by the caller to the seal image management platform include but are not limited to a digital certificate or a digital certificate fingerprint and a verification code.

[0036] Furthermore, the verification method of the digital signature S includes but is not limited to the certificate validity period, certificate key usage, certificate chain, certificate blacklist, etc.

[0037] The invention has the following beneficial effects: a strong association is formed between the seal image of the invention and the digital certificate, and when the seal image is called, only the digital certificate strongly bound to the seal image can be called. The seal image presentation method of the invention is based on an asymmetric cryptographic system, and the seal image can only be obtained by signing with a user holding a digital certificate, and the seal image is presented. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 This is a timing diagram of a method for binding an electronic seal image to a digital certificate according to an embodiment of the present invention.

[0039] Figure 2 This is a timing diagram of the electronic seal image presenting method according to an embodiment of the present invention.

[0040] Figure 3 This is a timing diagram of a method for presenting an electronic seal image according to another embodiment of the present invention. DETAILED DESCRIPTION

[0041] To facilitate understanding by those skilled in the art, the present invention is further described below in conjunction with embodiments and drawings.

[0042] Seal image: An image containing text or other identifying information, such as an official seal image or a handwritten signature image, can be called a seal image.

[0043] Digital certificate: A digital certificate is a trusted digital file digitally signed by a third-party certification authority (CA) that is recognized by the state and has authority, credibility and impartiality.

[0044] USBKey certificate: USBKey medium is actually a hardware device that complies with the "GM / T 0027-2014 Intelligent Password Key Technical Specifications". It is often called USBKey because of its shape similar to a USB flash drive.

[0045] Example 1: Sequence diagram of binding electronic seal image to digital certificate Figure 1 As shown in the figure, the method of binding the electronic seal image to the digital certificate is as follows:

[0046] S1. Establish a seal image management platform to maintain the binding relationship between seal images and digital certificates in the platform. Specifically: the platform includes modules such as identity authentication module, seal image management module, open API module, permission management module, log audit module, etc., among which the identity authentication module, seal image management module and open API module are core modules. The identity authentication module can set the platform's identity certificate and the corresponding private key, which can be used by the caller to verify the platform's identity and allow the caller to use the platform's digital certificate to encrypt the generated encryption key. The seal image management module mainly saves the binding relationship between the seal image and the digital certificate. The binding relationship can be in many ways, for example: 1) Use a hash algorithm to calculate the hash value of the seal image, and establish a one-to-one correspondence between the hash value and the unique characteristic value of the digital certificate (such as certificate fingerprint, certificate serial number, etc.). 2) Directly establish a one-to-one correspondence between the primary key ID of the seal image in the table and the unique characteristic value of the digital certificate. The open API module provides an interface access service for the caller to call.

[0047] S2. The caller (such as a control or business system) guides the user to use the USBKey certificate he holds to digitally sign the seal image, and then sends the seal image, digital certificate, and digital signature to the seal image management platform in a secure manner.

[0048] S3. The seal image management platform will verify the validity of the digital signature (the verification methods include but are not limited to the certificate validity period, certificate key usage, certificate chain, certificate blacklist, etc.). After the verification is passed, the binding relationship between the USBKey certificate and the seal image is established on the seal image management platform.

[0049] In the above process, by utilizing the tamper-proof and non-repudiation nature of the digital signature, it can be determined that the binding operation between the USBKey certificate and the seal image is completed by the holder of the USBKey certificate.

[0050] In this case, the same applies to replacing the USBKey certificate with a mobile digital certificate (using a security module that complies with the national cryptographic "GM / T 0028-2014 Technical Requirements for Cryptographic Module Security" as the medium, and the security module is generally integrated in the mobile APP).

[0051] Example 2: The timing diagram of the electronic seal image presentation is as follows Figure 2 As shown, when you need to use a stamp image, the specific steps are as follows:

[0052] B1. The caller (such as a control or business system) applies for a business challenge code from the seal image management platform, and sends parameters including but not limited to the USBKey certificate (or USBKey certificate fingerprint), verification code, etc. The seal image management platform returns the business challenge code and the seal image management platform identity certificate.

[0053] B2. After the caller verifies the identity certificate of the management platform, it guides the user (USBKey certificate holder) to use the USBKey certificate to sign the business challenge code to obtain a digital signature S.

[0054] B3. The caller generates a symmetric key SK, and uses the seal image management platform identity certificate to encrypt the symmetric key to obtain the symmetric key encrypted ciphertext CIPHER_SK.

[0055] B4. The caller sends the digital signature value S, USBKey certificate fingerprint, encrypted symmetric key encrypted ciphertext, business challenge code and other information to the seal image management platform to request the seal image.

[0056] B5. The seal image management platform verifies the digital signature S in the previous step (verification methods include but are not limited to certificate validity period, certificate key usage, certificate chain, certificate blacklist, etc.). After the verification is passed, the platform identity certificate private key is used to decrypt the symmetric key encrypted ciphertext CIPHER_SK to obtain the symmetric key SK. After the platform queries the seal image IMAGE corresponding to the USBKey certificate, it uses the symmetric key SK to encrypt the seal image to obtain the seal image ciphertext CIPHER_IMAGE, and returns CIPHER_IMAGE to the caller.

[0057] B6. The caller uses the symmetric key SK to decrypt the seal image ciphertext CIPHER_IMAGE to obtain the seal image IMAGE.

[0058] At this point, the seal image presentation process is completed.

[0059] Embodiment 3: Another implementation method of the electronic seal image presentation timing diagram as shown Figure 3 As shown, when you need to use a stamp image, the specific steps are as follows:

[0060] R1. The caller (such as a control or business system) applies for a business challenge code from the seal image management platform, and sends parameters including but not limited to the USBKey certificate (or USBKey certificate fingerprint), verification code, etc. The seal image management platform returns the business challenge code and the seal image management platform identity certificate.

[0061] R2. After the caller verifies the identity certificate of the management platform, it guides the user (USBKey certificate holder) to use the USBKey certificate private key to sign the business challenge code to obtain a digital signature S.

[0062] R3. The caller sends the digital signature S, USBKey certificate fingerprint, business challenge code and other information to the seal image management platform to request the seal image.

[0063] R4. The seal image management platform verifies the digital signature S in the previous step. After verification, it queries the seal image IMAGE corresponding to the USBKey certificate, and uses the user's USBKey certificate public key to encrypt the seal image using the digital envelope encryption method to obtain the seal image ciphertext digital envelope ENVELOPED_CIPHER_IMAGE, and returns ENVELOPED_CIPHER_IMAGE to the caller.

[0064] R5. The caller guides the user to use the USBKey certificate private key to decrypt the digital envelope ENVELOPED_CIPHER_IMAGE and obtain the seal image IMAGE.

[0065] The above embodiments are only for illustrating the technical idea of ​​the present invention, and cannot be used to limit the protection scope of the present invention. Any changes made on the basis of the technical solution in accordance with the technical idea proposed by the present invention shall fall within the protection scope of the present invention.

Claims

1. A method for presenting an electronic seal image, characterized in that: The seal image is bound to the digital certificate, including the following steps: S1. Establish a seal image management platform to maintain the binding relationship between the seal image and the digital certificate in the platform; the seal image management platform includes an identity authentication module, a seal image management module, and an open API module; the identity authentication module is used to set the identity certificate and the corresponding private key of the platform; the seal image management module saves the binding relationship between the seal image and the digital certificate; the open API module provides an interface access service for the caller to call; The binding relationship is maintained by: using a hash algorithm to calculate the hash value of the seal image, and establishing a one-to-one correspondence between the hash value and the unique characteristic value of the digital certificate; or, establishing a one-to-one correspondence between the primary key ID of the seal image in the table and the unique characteristic value of the digital certificate; S2. The caller guides the user to use the private key of the digital certificate he holds to digitally sign the seal image, and then sends the seal image, digital certificate, and digital signature to the seal image management platform; S3. The seal image management platform verifies the validity of the digital signature. Once the verification is passed, a binding relationship between the digital certificate and the seal image is established on the seal image management platform; When presenting the seal image, the following steps are included: B1. The caller applies for a business challenge code from the seal image management platform, and the seal image management platform returns the business challenge code and the seal image management platform identity certificate; B2. The caller guides the user to sign the business challenge code using the digital certificate private key to obtain a digital signature S; B3. The caller generates a symmetric key SK, and uses the seal image management platform identity certificate to encrypt the symmetric key to obtain the symmetric key encrypted ciphertext CIPHER_SK; B4. The caller sends the digital signature S, digital certificate or digital certificate fingerprint, encrypted symmetric key encrypted ciphertext, and business challenge code information to the seal image management platform to request the seal image; B5. The seal image management platform verifies the digital signature S. After verification, it uses the seal image management platform identity certificate private key to decrypt the symmetric key encrypted ciphertext CIPHER_SK to obtain the symmetric key SK. After the platform queries the seal image IMAGE corresponding to the digital certificate, it uses the symmetric key SK to encrypt the seal image to obtain the seal image ciphertext CIPHER_IMAGE, and returns CIPHER_IMAGE to the caller; B6. The caller uses the symmetric key SK to decrypt the seal image ciphertext CIPHER_IMAGE and obtain the seal image IMAGE.

2. The electronic seal image presenting method according to claim 1, characterized in that: Methods for verifying the validity of digital signatures include, but are not limited to, certificate validity period, certificate key usage, certificate chain, and certificate blacklist.

3. The electronic seal image presenting method according to claim 1, characterized in that: The digital certificate is a USBKey certificate or a mobile digital certificate. The mobile digital certificate uses a security module integrated in the mobile APP as the medium.

4. The electronic seal image presenting method according to claim 1, characterized in that: When applying for a business challenge code, the parameters sent by the caller to the seal image management platform include but are not limited to the digital certificate or digital certificate fingerprint and verification code.

5. The electronic seal image presenting method according to claim 1, characterized in that: The verification method of the digital signature S includes but is not limited to the certificate validity period, certificate key usage, certificate chain, and certificate blacklist; the digital signature method includes but is not limited to the PKCS#1 standard, PKCS#7 standard signature, and SM2 elliptic curve public key cryptography algorithm signature.

6. A method for presenting an electronic seal image, characterized in that: The seal image is bound to the digital certificate, including the following steps: S1. Establish a seal image management platform to maintain the binding relationship between the seal image and the digital certificate in the platform; the seal image management platform includes an identity authentication module, a seal image management module, and an open API module; the identity authentication module is used to set the identity certificate and the corresponding private key of the platform; the seal image management module saves the binding relationship between the seal image and the digital certificate; the open API module provides an interface access service for the caller to call; The binding relationship is maintained by: using a hash algorithm to calculate the hash value of the seal image, and establishing a one-to-one correspondence between the hash value and the unique characteristic value of the digital certificate; or, establishing a one-to-one correspondence between the primary key ID of the seal image in the table and the unique characteristic value of the digital certificate; S2. The caller guides the user to use the private key of the digital certificate he holds to digitally sign the seal image, and then sends the seal image, digital certificate, and digital signature to the seal image management platform; S3. The seal image management platform verifies the validity of the digital signature. Once the verification is passed, a binding relationship between the digital certificate and the seal image is established on the seal image management platform; When presenting the seal image, the following steps are included: R1. The caller applies for a business challenge code from the seal image management platform, and the seal image management platform returns the business challenge code and the seal image management platform identity certificate; R2. The caller guides the user to sign the business challenge code using the digital certificate private key to obtain a digital signature S; R3. The caller sends the digital signature S, digital certificate or digital certificate fingerprint, and business challenge code information to the seal image management platform to request the seal image; R4. The seal image management platform verifies the digital signature S. After verification, it queries the seal image IMAGE corresponding to the digital certificate, uses the public key of the digital certificate uploaded by the caller to encrypt the seal image in a digital envelope package encryption manner to obtain the seal image ciphertext digital envelope ENVELOPED_CIPHER_IMAGE, and returns ENVELOPED_CIPHER_IMAGE to the caller; R5. The caller guides the user to use the digital certificate private key to decrypt ENVELOPED_CIPHER_IMAGE to obtain the seal image IMAGE.

7. The electronic seal image presenting method according to claim 6, characterized in that: Methods for verifying the validity of digital signatures include, but are not limited to, certificate validity period, certificate key usage, certificate chain, and certificate blacklist.

8. The electronic seal image presenting method according to claim 6, characterized in that: The digital certificate is a USBKey certificate or a mobile digital certificate. The mobile digital certificate uses a security module integrated in the mobile APP as the medium.

9. The electronic seal image presenting method according to claim 6, characterized in that: When applying for a business challenge code, the parameters sent by the caller to the seal image management platform include but are not limited to the digital certificate or digital certificate fingerprint and verification code.

10. The electronic seal image presenting method according to claim 6, characterized in that: The verification method of the digital signature S includes but is not limited to the certificate validity period, certificate key usage, certificate chain, and certificate blacklist.

Images