An electronic signature system applicable to public key cryptography technology and supporting commercial cryptographic algorithms

Abstract

The present invention relates to the field of electronic signature technology, and specifically, to an electronic signature system applicable to public key cryptography and supporting commercial cryptographic algorithms. It includes an infrastructure unit, a user service unit, a signature management unit, and a security protection unit; the infrastructure unit is used to build a system network architecture; the user service unit is used to identify users and provide signature services; the signature management unit is used to control the signature function; and the security protection unit is used to improve system security. The design of the present invention can be applied to multiple languages ​​and multiple document formats, supporting public key cryptography and commercial cryptographic algorithms; it can achieve autonomous control of information security, ensure that documents are anti-counterfeiting, anti-tampering, and anti-repudiation, safe and reliable, and make the signed documents have sufficient legal effect and high authority; it can meet the needs of users to obtain and use electronic signatures, ensure the compliance and data security of user-signed documents, help enterprises transform into informatization, and improve operation and management efficiency.

Description

Technical Field

[0001] The present invention relates to the field of electronic signature technology, and in particular to an electronic signature system applicable to public key cryptography technology and supporting commercial cryptographic algorithms. Background Art

[0002] With the development of the electronic certification service industry, the market for electronic signature application products has developed rapidly, forming a product system of identity authentication, authorization management, electronic signature, information encryption and decryption, trusted data messages, and secure transmission. There are more than 50 related products, including a series of innovative products in emerging fields such as mobile Internet, cloud computing, Internet of Things, and blockchain, which provide strong technical support for the development of the electronic certification service industry. At present, electronic signature products using PKI technology are not uncommon in China, and there are many limitations;

[0003] Many electronic signature products are not closely integrated with PKI technology, or even do not use PKI technology. They do not strictly follow the public key cryptography technology standard system, and the processes are not standardized and the verification is not strict in terms of electronic seal generation and verification, as well as electronic signature data generation and verification, which poses a security risk. Most ordinary electronic signature systems only support the RSA algorithm and not domestic commercial cryptographic algorithms, such as the SM2 algorithm, which is not conducive to the development of my country's information security. They are not adapted to domestic software and hardware, and cannot achieve independent and controllable information security in my country.

[0004] However, there is currently no electronic signature system that is applicable to my country's public key cryptography technology and supports commercial cryptographic algorithms. Summary of the invention

[0005] The purpose of the present invention is to provide an electronic signature system applicable to public key cryptography technology and supporting commercial cryptographic algorithms to solve the problems raised in the above background technology.

[0006] In order to solve the above technical problems, one of the purposes of the present invention is to provide an electronic signature system applicable to public key cryptography technology and supporting commercial cryptographic algorithms, including

[0007] An infrastructure unit, a user service unit, a signature management unit and a security protection unit; the infrastructure unit, the user service unit, the signature management unit and the security protection unit are connected in sequence through network communication; the infrastructure unit is used to build a network architecture that supports the operation of the system and to configure the functions and set parameters of the equipment; the user service unit is used to identify the identity of the user accessing the system and manage the signature service provided to the user; the signature management unit is used to manage and control the specific operation process of using the electronic signature function; the security protection unit is used to improve the security protection performance of the system by authenticating the identity of the user and managing documents;

[0008] The infrastructure unit includes an operating environment module, a technical support module, a server construction module and a client construction module;

[0009] The user service unit includes a user management module, a digital certificate module, a seal module and a document protection module;

[0010] The signature management unit includes a signature moving module, a signature revocation module, a signature fixing module and a signature verification module;

[0011] The security protection unit includes an identity authentication module, a data confidentiality module, an anti-tampering mechanism module and a document verification module.

[0012] As a further improvement of the present technical solution, the operating environment module, the technical support module, the server-side construction module and the client-side construction module are connected in sequence through network communication; the operating environment module is used to reasonably configure the components of the basic equipment so that its performance can provide environmental conditions required for system operation; the technical support module is used to load a variety of related computer technologies to support the smooth operation of the system; the server-side construction module is used to construct and manage the background server of the system; the client-side construction module is used to construct and manage the client of the system so as to provide users with a channel to interact with the system.

[0013] As a further improvement of the present technical solution, the operating environment module includes a technical specification module, a core configuration module, a service configuration module and a performance parameter module; the technical specification module, the core configuration module, the service configuration module and the performance parameter module are connected in sequence through network communication; the technical specification module is used to import and refer to a variety of domestic and international signature specification files in force when building the system, so that the system products can comply with relevant specifications and standards; the core configuration module is used to configure the performance of the core devices such as the CPU, hard disk, memory, network card, server, etc. of the platform device; the service configuration module is used to configure the performance of the CPU, hard disk, memory, network card, server used for middleware services in the platform device; the performance parameter module is used to pre-set various operational performance indicators of the electronic signature service during the system operation.

[0014] Among them, the performance configuration of core equipment includes: CPU preferably has 8 cores or more, hard disk preferably has SCSI / SAS hard disk of 500 or more, memory preferably has 16G or more, and network card preferably has Gigabit network card; servers include but are not limited to: 2 or more electronic signature service systems (each supports approximately 500 concurrent connections), 2 or more MySQL servers, 2 or more Web resource file servers (used to store static resource files such as css, js, and pictures).

[0015] Among them, the performance configuration of the middleware service includes: the CPU is preferably 8 cores or more, the hard disk is preferably 250 SCSI / SAS hard disk or more, the memory is preferably 8G or more, and the network card is preferably a gigabit network card; the servers include but are not limited to: 2 or more Redis, 2 or more MySQL, and 2 or more ActiveMQ.

[0016] Among them, various operational performance parameters include: number of document signature pages, document signature verification volume, response time, signature time, summary time, stamping time, etc.

[0017] As a further improvement of the present technical solution, the technical support module includes a grammar notation module, a plug-in technology module, a cryptographic algorithm module and a hash function module; the grammar notation module, the plug-in technology module, the cryptographic algorithm module and the hash function module are connected in sequence through network communication; the grammar notation module is used to adopt a set of standard flexible notations for describing the representation, encoding, transmission and decoding of data, and to describe the object structure independent of specific computer hardware with formal, unambiguous and precise rules; the plug-in technology module is used to implant the electronic signature system into Microsoft Office products using COM / ActiveX plug-in technology, thereby realizing the function of using electronic signatures in WORD, EXCEL and OFD documents, and through the development language of C++, the system can be applied to multiple languages ​​and multiple document formats; the cryptographic algorithm module loads multiple common cryptographic algorithms such as RSA, SM2, SM3, and adapts the cryptographic algorithms to a variety of domestic software and hardware; the hash function module is used to load hash functions and corresponding algorithms, and the fixed-length string obtained by performing a one-way hash function operation on the original text is used to supplement the public key password and algorithm.

[0018] Among them, in this system, the abstract syntax notation of ASN.1 is preferably used for definition.

[0019] Among them, the client uses COM / ActiveX plug-in technology to embed the electronic signature system into Microsoft Office products. When the user stamps the document, the signature system uses a specific data structure to integrate information such as the digital certificate, electronic seal and document content summary, and signs it with a signature certificate. The user can implement operations such as signing, verification, and parameter setting by clicking the menu button in the toolbar.

[0020] Among them, the object-oriented C++ development language can not only increase the running speed of the product, but also realize the object-oriented modular design concept well.

[0021] In addition, the function of the hash function is that the digital signature makes the hash value of the signed data encrypted by the private key. By using the public key to decrypt the digital signature and comparing the value obtained with the hash value of the original data, the digital signature can be verified.

[0022] As a further improvement of the technical solution, in the cryptographic algorithm module, the implementation processes of various cryptographic algorithms are respectively:

[0023] Implementation process of RSA algorithm:

[0024] Step 1. The implementer finds two large prime numbers p and q;

[0025] Step 2, the implementer calculates n = pq and

[0026] Step 3, the implementer selects a random number e (0<e);

[0027] Step 4. The implementer uses the Euclidean algorithm to calculate

[0028] Step 5. The implementer publishes n and e as public keys in the directory;

[0029] The key point for cryptanalysts to attack the RSA system is how to decompose n. If the decomposition is successful and n=pq, then Then, the secret d is solved from the public e;

[0030] Implementation process of SM2 algorithm:

[0031] First, the equation used by the SM2 algorithm is: 2 =x 3 +ax+b;

[0032] Step 1. Select an element G of Ep(a,b) such that the order n of G is a large prime number.

[0033] Step 2, the order of G refers to the minimum value of n that satisfies nG = O;

[0034] Step 3. Secretly select an integer k, calculate B = kG, and then publish (p, a, b, G, B), where B is the public key and keep k secret, where k is the private key;

[0035] Then, encrypt M: first transform the message M into a point Pm in Ep(a,b), then select a random number r, calculate the ciphertext Cm={rG,Pm+rP), if r makes rG or rP equal to O, then reselect r;

[0036] Then, decrypted Cm: (Pm+rP)-k(rG)=Pm+rkG-krG=Pm.

[0037] As a further improvement of the present technical solution, the server-side construction module includes a background management module, a service center module and a system database module; the background management module, the service center module and the system database module are connected in sequence through network communication; the background management module is responsible for the electronic seal life cycle management and the provision of electronic seal verification services, specifically including administrator management, seal user management, electronic seal production and management, electronic seal verification services, security auditing and system configuration management and other functions; the service center module is used to configure and manage the service items and specific functions of the electronic seal, specifically including system login, USBKey management, seal management, user management, log management, seal installation and recycle bin; the system database module is used to establish an electronic seal system database based on blockchain technology, which is used for distributed storage of various documents and electronic seal data.

[0038] Among them, the functions of the server include but are not limited to: system login (user identity authentication and permission management based on USBKey certificate, users need to use authorized certificates to log in, and during the login process, users need to enter the private key pin code to complete the operation), USBKey management (management of USBKey certificates, including new creation, pending approval, modification, deletion, viewing, etc.), seal management (management of seals, including new creation, pending approval, modification, deletion, viewing, etc.), user management (including management of organization and personnel information), log management (the system has built-in security audit function, which can view and audit the operations of system administrators and operators, and the usage logs of user seals), seal installation (installation of seal client), recycle bin (management of deleted USBKey certificates, seals and users), etc.

[0039] As a further improvement of the present technical solution, the client construction module includes a basic component module, a signature application module and an intelligent key module; the basic component module, the signature application module and the intelligent key module are connected in sequence through network communication; the basic component module is responsible for processing the core functions of the electronic signature client software, including operating the intelligent password key, parsing and verifying the electronic seal, generating and parsing the electronic signature data, verifying the validity of the digital certificate, and interacting with the electronic signature management system; the signature application module is used to provide electronic signature client software functions based on the basic components for specific application scenarios; the intelligent key module is used to save the signer's digital certificate, key and electronic seal through the intelligent password key, execute digital signature, etc.

[0040] Among them, the electronic signature application functions include WORD signature component, FORM signature component, Excel signature component, OFD signature component, PDF signature component and WEB signature component.

[0041] As a further improvement of the present technical solution, the user management module, the digital certificate module, the seal module and the document protection module are connected in sequence through network communication; the user management module is used to register and identify the identity of users who can access the system and allocate corresponding permissions according to the identity of the users; the digital certificate module is used to issue a certificate through a certificate issuing authority to authenticate the identity of the signer and to verify the correspondence between the identification information of the person to be authenticated and the public key, and the digital certificate is public so that anyone can access the relevant information; the seal module is used to provide users with the function of stamping the required electronic seal on the document. When stamping, the user can choose a seal or a saddle seal. The stamped electronic signature will digitally sign the entire text during the background signing process, and the saddle seal will be stamped on each page in the visual presentation form to meet the user's traditional saddle seal contract habits; the document protection module is used to fix the document after the signature is completed so that it cannot be modified.

[0042] As a further improvement of the present technical solution, the signature moving module, the signature revocation module, the signature fixing module and the signature verification module are connected in sequence through network communication; the signature moving module is used to provide the function of moving the position of the signature after stamping, so as to facilitate adjusting the signature to the specified position; the signature revocation module is used to provide the function of revoking the seal after stamping, and when revoking the signature, it is necessary to confirm the identity and password of the original stamped seal or signer; the signature fixing module is used to fix the signature position after determining the signature, and execute the instruction prohibiting the movement of the signature, and the position of the signature cannot be changed after it is fixed, and only the revocation operation can be performed; the signature verification module is used to verify the validity of the document by verifying the document signature.

[0043] As a further improvement of the present technical solution, the identity authentication module, the data confidentiality module, the tamper-proof mechanism module and the document verification module are connected in sequence through network communication; the identity authentication module is used to confirm the identity information of all users participating in online information exchange by loading a variety of real-name authenticated user identity recognition technologies; the data confidentiality module is used to add a variety of data security protection measures compatible with mainstream domestic software and hardware, and improve the security of document data by distributed storage and data encryption; the tamper-proof mechanism module is used to fix the content and signature of the document approved by the signer through pre-programmed program instructions, so that the user cannot deny the document content and deny the signing behavior, and the signature cannot be forged or impersonated by copying or other means, and the signature will become invalid once the document is tampered with; the document verification module is used to provide users with a service function for verifying documents containing electronic signatures. During the verification process, the validity of the user certificate, the validity of the electronic seal, and the validity of the electronic signature need to be verified separately, and the user is informed of each verification result.

[0044] Among them, identity recognition technologies include real-name authentication, fingerprint collection, face recognition, iris recognition, etc.

[0045] Among them, verifying the validity of the certificate does not verify the current validity of the certificate, but verifies the validity of the key corresponding to the certificate at the time of the operation of generating the signature.

[0046] The second object of the present invention is to provide an operation method of an electronic signature system applicable to public key cryptography technology and supporting commercial cryptographic algorithms, comprising:

[0047] First, according to the requirements of the basic architecture, build the PKI infrastructure and adjust the configuration to build the environment requirements to support the operation of the system. Install the corresponding electronic signature software on the client, load a variety of intelligent technologies, syntax, algorithms and plug-ins. When the user uses it, the system first verifies the user's identity, issues a digital seal to the user and generates the corresponding electronic signature. Then the user directly calls the signature software, and the seal can be moved and adjusted after stamping on the document. After the user confirms the signature for the second time, the document and signature are fixed and cannot be tampered with. The signed document data is stored in a distributed manner. When other users use the document, they can verify the validity of the document by verifying the validity of the user certificate, the validity of the electronic seal, and the validity of the electronic signature.

[0048] The third object of the present invention is to provide an operating device for an electronic signature system applicable to public key cryptography technology and supporting commercial cryptographic algorithms, including a processor, a memory, and a computer program stored in the memory and running on the processor, and the processor is used to implement any of the above-mentioned electronic signature systems applicable to public key cryptography technology and supporting commercial cryptographic algorithms when executing the computer program.

[0049] The fourth object of the present invention is to provide a computer-readable storage medium, which stores a computer program, and when the computer program is executed by a processor, it implements any of the above-mentioned electronic signature systems applicable to public key cryptography technology and supporting commercial cryptographic algorithms.

[0050] Compared with the prior art, the present invention has the following beneficial effects:

[0051] 1. This electronic signature system, which is applicable to public key cryptography technology and supports commercial cryptographic algorithms, builds a complete PKI device architecture, loads multiple cryptographic algorithms, security protection measures and plug-in technologies, so that it can be applied to multiple languages ​​and support multiple document formats. It not only supports the internationally commonly used RSA algorithm, but also supports domestically popular algorithms such as SM2 and SM3. The system has strong stability and fast operation speed;

[0052] 2. The electronic signature system, which is applicable to public key cryptography technology and supports commercial cryptographic algorithms, is adapted to mainstream domestic software and hardware to improve its scope of application, cater to the development trend of domestic production of self-controlled software and hardware products, and realize the self-control of information security. It also ensures that documents are anti-forgery, anti-tampering, and anti-repudiation through anti-tampering mechanisms, document verification, and data encryption. It is safe and reliable, improves information security, and makes the signed documents have sufficient legal effect and high authority.

[0053] 3. This electronic signature system that is applicable to public key cryptography technology and supports commercial cryptographic algorithms can meet the needs of enterprises or individuals to obtain and use electronic signatures, signing, verification and multilingual signatures, thereby ensuring the compliance and data security of user-signed documents, helping enterprises to transform into informatization, and improving operational and management efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Figure 1 is a block diagram of an exemplary product architecture of the present invention;

[0055] Figure 2 It is the overall system device structure diagram of the present invention;

[0056] Figure 3 This is one of the local system device structure diagrams of the present invention;

[0057] Figure 4 This is the second structural diagram of the local system device of the present invention;

[0058] Figure 5 This is the third structural diagram of the local system device of the present invention;

[0059] Figure 6 This is the fourth structural diagram of the local system device of the present invention;

[0060] Figure 7 This is the fifth structural diagram of the local system device of the present invention;

[0061] Figure 8 This is the sixth structural diagram of the local system device of the present invention;

[0062] Fig. 9 This is the seventh structural diagram of the local system device of the present invention;

[0063] Fig.10 This is the eighth structural diagram of the local system device of the present invention;

[0064] Fig.11 It is a schematic diagram of the structure of an exemplary electronic computer product platform device of the present invention.

[0065] The meaning of each number in the figure is:

[0066] 1. Server (1); 11. Signature system (11); 12. Timestamp server (12); 13. Database (13); 14. Firewall (14);

[0067] 2. Cloud services (2);

[0068] 3. Client (3); 31. User terminal (31); 32. User (32);

[0069] 4. Third-party server (4); 41. CA system (41); 42. Certificate issuance query server (42);

[0070] 100, infrastructure unit; 101, operating environment module; 1011, technical specification module; 1012, core configuration module; 1013, service configuration module; 1014, performance parameter module; 102, technical support module; 1021, grammar notation module; 1022, plug-in technology module; 1023, cryptographic algorithm module; 1024, hash function module; 103, server construction module; 1031, background management module; 1032, service center module; 1033, system database module; 104, client construction module; 1041, basic component module; 1042, signature application module; 1043, intelligent key module;

[0071] 200, user service unit; 201, user management module; 202, digital certificate module; 203, stamping module; 204, document protection module;

[0072] 300, signature management unit; 301, signature moving module; 302, signature revocation module; 303, signature fixing module; 304, signature verification module;

[0073] 400, security protection unit; 401, identity authentication module; 402, data confidentiality module; 403, anti-tampering mechanism module; 404, document verification module. DETAILED DESCRIPTION

[0074] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0075] Example 1

[0076] like Figure 1-Figure 11 As shown, this embodiment provides an electronic signature system applicable to public key cryptography technology and supporting commercial cryptographic algorithms, including

[0077] The basic structure unit 100, the user service unit 200, the signature management unit 300 and the security protection unit 400 are connected in sequence through network communication; the basic structure unit 100 is used to build a network structure supporting the operation of the system and to configure the functions and set the parameters of the equipment; the user service unit 200 is used to identify the identity of the user accessing the system and to manage the signature service provided to the user; the signature management unit 300 is used to manage and control the specific operation process of using the electronic signature function; the security protection unit 400 is used to improve the security protection performance of the system by authenticating the identity of the user and managing documents;

[0078] The infrastructure unit 100 includes an operating environment module 101, a technical support module 102, a server construction module 103 and a client construction module 104;

[0079] The user service unit 200 includes a user management module 201, a digital certificate module 202, a seal module 203 and a document protection module 204;

[0080] The signature management unit 300 includes a signature moving module 301, a signature revoking module 302, a signature fixing module 303 and a signature verifying module 304;

[0081] The security protection unit 400 includes an identity authentication module 401 , a data confidentiality module 402 , an anti-tampering mechanism module 403 and a document verification module 404 .

[0082] In this embodiment, the operating environment module 101, the technical support module 102, the server construction module 103 and the client construction module 104 are connected in sequence through network communication; the operating environment module 101 is used to reasonably configure the components of the basic equipment so that its performance can provide the environmental conditions required for the operation of the system; the technical support module 102 is used to load a variety of related computer technologies to support the smooth operation of the system; the server construction module 103 is used to construct and manage the background server of the system; the client construction module 104 is used to construct and manage the client of the system so as to provide users with a channel for interacting with the system.

[0083] Furthermore, the operating environment module 101 includes a technical specification module 1011, a core configuration module 1012, a service configuration module 1013 and a performance parameter module 1014; the technical specification module 1011, the core configuration module 1012, the service configuration module 1013 and the performance parameter module 1014 are connected in sequence through network communication; the technical specification module 1011 is used to import and refer to a variety of domestic and international signature specification files in force when building the system, so that the system product can comply with relevant specifications and standards; the core configuration module 1012 is used to configure the performance of the core devices such as the CPU, hard disk, memory, network card, server, etc. of the platform device; the service configuration module 1013 is used to configure the performance of the CPU, hard disk, memory, network card, server used for middleware services in the platform device; the performance parameter module 1014 is used to pre-set various operational performance indicators of the electronic signature service during system operation.

[0084] Among them, the performance configuration of core equipment includes: CPU preferably has 8 cores or more, hard disk preferably has SCSI / SAS hard disk of 500 or more, memory preferably has 16G or more, and network card preferably has Gigabit network card; servers include but are not limited to: 2 or more electronic signature service systems (each supports approximately 500 concurrent connections), 2 or more MySQL servers, 2 or more Web resource file servers (used to store static resource files such as css, js, and pictures).

[0085] Among them, the performance configuration of the middleware service includes: the CPU is preferably 8 cores or more, the hard disk is preferably 250 SCSI / SAS hard disk or more, the memory is preferably 8G or more, and the network card is preferably a gigabit network card; the servers include but are not limited to: 2 or more Redis, 2 or more MySQL, and 2 or more ActiveMQ.

[0086] Among them, various operational performance parameters include: number of document signature pages, document signature verification volume, response time, signature time, summary time, stamping time, etc.

[0087] Furthermore, the technical support module 102 includes a syntax notation module 1021, a plug-in technology module 1022, a cryptographic algorithm module 1023 and a hash function module 1024; the syntax notation module 1021, the plug-in technology module 1022, the cryptographic algorithm module 1023 and the hash function module 1024 are connected in sequence through network communication; the syntax notation module 1021 is used to adopt a set of standard flexible notations for describing the representation, encoding, transmission and decoding of data, and to describe the object structure independent of specific computer hardware with formal, unambiguous and precise rules; the plug-in technology module 1022 is used to adopt COM / Act The iveX plug-in technology embeds the electronic signature system into Microsoft Office products, thereby realizing the function of using electronic signatures in WORD, EXCEL, and OFD documents, and through the C++ development language, the system can be applied to multiple languages ​​and multiple document formats; the cryptographic algorithm module 1023 loads multiple common cryptographic algorithms such as RSA, SM2, SM3, and adapts the cryptographic algorithms to a variety of domestic software and hardware; the hash function module 1024 is used to load hash functions and corresponding algorithms, and the fixed-length string obtained by performing a one-way hash function operation on the original text is used to supplement the public key cryptography and algorithm.

[0088] Among them, in this system, the abstract syntax notation of ASN.1 is preferably used for definition.

[0089] Among them, the client uses COM / ActiveX plug-in technology to embed the electronic signature system into Microsoft Office products. When the user stamps the document, the signature system uses a specific data structure to integrate information such as the digital certificate, electronic seal and document content summary, and signs it with a signature certificate. The user can implement operations such as signing, verification, and parameter setting by clicking the menu button in the toolbar.

[0090] Among them, the object-oriented C++ development language can not only increase the running speed of the product, but also realize the object-oriented modular design concept well.

[0091] In addition, the function of the hash function is that the digital signature makes the hash value of the signed data encrypted by the private key. By using the public key to decrypt the digital signature and comparing the value obtained with the hash value of the original data, the digital signature can be verified.

[0092] Specifically, in the cryptographic algorithm module 1023, the implementation processes of various cryptographic algorithms are respectively:

[0093] Implementation process of RSA algorithm:

[0094] Step 1. The implementer finds two large prime numbers p and q;

[0095] Step 2: The implementer calculates n = pq and

[0096] Step 3. The implementer selects a random number e (0<e);

[0097] Step 4. The implementer uses the Euclidean algorithm to calculate

[0098] Step 5. The implementer publishes n and e as public keys in the directory;

[0099] The key point for cryptanalysts to attack the RSA system is how to decompose n. If the decomposition is successful and n=pq, then Then, the secret d is solved from the public e;

[0100] Implementation process of SM2 algorithm:

[0101] First, the equation used by the SM2 algorithm is: 2 =x 3 +ax+b;

[0102] Step 1. Select an element G of Ep(a,b) such that the order n of G is a large prime number.

[0103] Step 2, the order of G refers to the minimum value of n that satisfies nG = O;

[0104] Step 3. Secretly select an integer k, calculate B = kG, and then publish (p, a, b, G, B), where B is the public key and keep k secret, where k is the private key;

[0105] Then, encrypt M: first transform the message M into a point Pm in Ep(a,b), then select a random number r, calculate the ciphertext Cm={rG,Pm+rP), if r makes rG or rP equal to O, then reselect r;

[0106] Then, decrypted Cm: (Pm+rP)-k(rG)=Pm+rkG-krG=Pm.

[0107] Furthermore, the service-side construction module 103 includes a background management module 1031, a service center module 1032 and a system database module 1033; the background management module 1031, the service center module 1032 and the system database module 1033 are connected in sequence through network communication; the background management module 1031 is responsible for the electronic seal life cycle management and the provision of electronic seal verification services, including administrator management, seal user management, electronic seal production and management, electronic seal verification services, security auditing and system configuration management and other functions; the service center module 1032 is used to configure and manage the service items and specific functions of the electronic seal, including system login, USBKey management, seal management, user management, log management, seal installation and recycle bin; the system database module 1033 is used to establish an electronic seal system database based on blockchain technology, which is used for distributed storage of various documents and electronic seal data.

[0108] Among them, the functions of the server include but are not limited to: system login (user identity authentication and permission management based on USBKey certificate, users need to use authorized certificates to log in, and during the login process, users need to enter the private key pin code to complete the operation), USBKey management (management of USBKey certificates, including new creation, pending approval, modification, deletion, viewing, etc.), seal management (management of seals, including new creation, pending approval, modification, deletion, viewing, etc.), user management (including management of organization and personnel information), log management (the system has built-in security audit function, which can view and audit the operations of system administrators and operators, and the usage logs of user seals), seal installation (installation of seal client), recycle bin (management of deleted USBKey certificates, seals and users), etc.

[0109] Furthermore, the client construction module 104 includes a basic component module 1041, a signature application module 1042 and an intelligent key module 1043; the basic component module 1041, the signature application module 1042 and the intelligent key module 1043 are connected in sequence through network communication; the basic component module 1041 is responsible for processing the core functions of the electronic signature client software, including operating the intelligent password key, parsing and verifying the electronic seal, generating and parsing the electronic signature data, verifying the validity of the digital certificate, and interacting with the electronic signature management system; the signature application module 1042 is used to provide electronic signature client software functions based on the basic components for specific application scenarios; the intelligent key module 1043 is used to save the signer's digital certificate, key and electronic seal, execute digital signatures, etc. through the intelligent password key.

[0110] Among them, the electronic signature application functions include WORD signature component, FORM signature component, Excel signature component, OFD signature component, PDF signature component and WEB signature component.

[0111] Among them, the smart password key is preferably the GM3000 series produced by Beijing Century Longmai Technology Co., Ltd., with the commercial code model SJK1515-G, and supports smart password key products that comply with PKCS#11: Cryptographic Token Interface Standard and GM / T 0016 "Smart Password Key Cryptographic Application Interface Specification".

[0112] In this embodiment, the user management module 201, the digital certificate module 202, the seal module 203 and the document protection module 204 are connected in sequence through network communication; the user management module 201 is used to register and identify the identity of users who can access the system and allocate corresponding permissions according to the identity of the users; the digital certificate module 202 is used to issue a certificate through a certificate issuing authority to authenticate the identity of the signer and to verify the correspondence between the identification information of the person to be authenticated and the public key, and the digital certificate is public so that anyone can access the relevant information; the seal module 203 is used to provide users with the function of stamping the required electronic seal on the document. When the user performs the stamping operation, the seal or the saddle seal can be selected. The stamped electronic seal will digitally sign the entire text during the background signing process, and the saddle seal will be stamped on each page in the visual presentation form to meet the user's traditional saddle seal contract habits; the document protection module 204 is used to fix the document after the signature is completed so that it cannot be modified.

[0113] Among them, the digital certificate can be stored in the USBKey.

[0114] In this embodiment, the signature moving module 301, the signature revocation module 302, the signature fixing module 303 and the signature verification module 304 are connected in sequence through network communication; the signature moving module 301 is used to provide the function of moving the position of the signature after stamping, so as to adjust the signature to the specified position; the signature revocation module 302 is used to provide the function of revoking the seal after stamping, and when revoking the signature, it is necessary to confirm the identity and password of the original stamped seal or signer; the signature fixing module 303 is used to fix the signature position after confirming the signature, and execute the instruction to prohibit moving the signature, and the position of the signature cannot be changed after it is fixed, and only the revocation operation can be performed; the signature verification module 304 is used to verify the validity of the document by verifying the document signature.

[0115] In this embodiment, the identity authentication module 401, the data confidentiality module 402, the tamper-proof mechanism module 403 and the document verification module 404 are connected in sequence through network communication; the identity authentication module 401 is used to confirm the identity information of all users participating in the online information exchange by loading a variety of real-name authentication user identity recognition technologies; the data confidentiality module 402 is used to add a variety of data security protection measures compatible with mainstream domestic software and hardware, and improve the security of document data by distributing and storing data and encrypting data; the tamper-proof mechanism module 403 is used to fix the content and signature of the document approved by the signer through pre-programmed program instructions, so that the user cannot deny the content of the document and deny the signing behavior, and the signature cannot be forged or impersonated by copying or other means, and once the document is tampered with, the signature becomes invalid; the document verification module 404 is used to provide users with a service function for verifying documents containing electronic signatures. During the verification process, the validity of the user certificate, the validity of the electronic seal, and the validity of the electronic signature need to be verified respectively, and the user is informed of each verification result.

[0116] Among them, identity recognition technologies include real-name authentication, fingerprint collection, face recognition, iris recognition, etc.

[0117] Among them, verifying the validity of the certificate does not verify the current validity of the certificate, but verifies the validity of the key corresponding to the certificate at the time of the operation of generating the signature.

[0118] This embodiment also provides an operation method of an electronic signature system applicable to public key cryptography technology and supporting commercial cryptographic algorithms, including:

[0119] First, according to the requirements of the basic architecture, build the PKI infrastructure and adjust the configuration to build the environment requirements to support the operation of the system. Install the corresponding electronic signature software on the client, load a variety of intelligent technologies, syntax, algorithms and plug-ins. When the user uses it, the system first verifies the user's identity, issues a digital seal to the user and generates the corresponding electronic signature. Then the user directly calls the signature software, and the seal can be moved and adjusted after stamping on the document. After the user confirms the signature for the second time, the document and signature are fixed and cannot be tampered with. The signed document data is stored in a distributed manner. When other users use the document, they can verify the validity of the document by verifying the validity of the user certificate, the validity of the electronic seal, and the validity of the electronic signature.

[0120] like Figure 1As shown, this embodiment also provides an exemplary product architecture of an electronic signature system suitable for public key cryptography technology and supporting commercial cryptographic algorithms, including a server 1, a client 3 and a third-party server 4 connected by a cloud service 2, the server 1 includes a signature system 11 and a timestamp server 12, the signature system 11 and the timestamp server 12 are connected to a database 13, and a firewall 14 is provided between the database 13 and the cloud service 2; the client 3 includes a user terminal 31, and a user 32 can access the system platform through the user terminal 31; the third-party server 4 includes a CA system 41 and a certificate issuance query server 42, and the CA system 41 and the certificate issuance query server 42 are used to support the smooth operation of the system.

[0121] like Fig.11 As shown, this embodiment also provides an operating device for an electronic signature system applicable to public key cryptography technology and supporting commercial cryptographic algorithms, the device comprising a processor, a memory, and a computer program stored in the memory and running on the processor.

[0122] The processor includes one or more processing cores. The processor is connected to the memory through a bus. The memory is used to store program instructions. When the processor executes the program instructions in the memory, the above-mentioned electronic signature system applicable to public key cryptography technology and supporting commercial cryptographic algorithms is implemented.

[0123] Optionally, the memory can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk or optical disk.

[0124] In addition, the present invention also provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the above-mentioned electronic signature system applicable to public key cryptography technology and supporting commercial cryptographic algorithms.

[0125] Optionally, the present invention also provides a computer program product comprising instructions, which, when executed on a computer, enables the computer to execute the above-mentioned aspects applicable to public key cryptography technology and an electronic signature system supporting commercial cryptographic algorithms.

[0126] A person skilled in the art will appreciate that all or part of the steps to implement the above embodiments may be accomplished by hardware or by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, and the above-mentioned storage medium may be a read-only memory, a disk, or an optical disk, etc.

[0127] The above shows and describes the basic principles, main features and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited by the above embodiments. The above embodiments and descriptions are only preferred examples of the present invention and are not intended to limit the present invention. Without departing from the spirit and scope of the present invention, the present invention may have various changes and improvements, which fall within the scope of the present invention. The scope of protection of the present invention is defined by the attached claims and their equivalents.

Claims

1. An electronic signature system applicable to public key cryptography technology and supporting commercial cryptographic algorithms, characterized by: It includes a basic architecture unit (100), a user service unit (200), a signature management unit (300) and a security protection unit (400); The infrastructure unit (100), the user service unit (200), the signature management unit (300) and the security protection unit (400) are connected in sequence through network communication; the infrastructure unit (100) is used to build a network architecture supporting the operation of the system and to configure the functions and set parameters of the equipment; the user service unit (200) is used to identify the identity of the user accessing the system and to manage the signature service provided to the user; the signature management unit (300) is used to manage and control the specific operation process of using the electronic signature function; the security protection unit (400) is used to improve the security protection performance of the system by authenticating the identity of the user and managing documents; The infrastructure unit (100) comprises an operating environment module (101), a technical support module (102), a server construction module (103) and a client construction module (104); The user service unit (200) comprises a user management module (201), a digital certificate module (202), a seal stamping module (203) and a document protection module (204); The signature management unit (300) includes a signature moving module (301), a signature revoking module (302), a signature fixing module (303) and a signature verifying module (304); The security protection unit (400) comprises an identity authentication module (401), a data confidentiality module (402), an anti-tampering mechanism module (403) and a document verification module (404); When using the electronic signature system that is applicable to public key cryptography technology and supports commercial cryptographic algorithms, firstly, according to the basic architecture requirements, a PKI infrastructure is built and the environment requirements supporting the operation of the system are constructed by adjusting the configuration. The corresponding electronic signature software is installed on the client, and a variety of intelligent technologies, grammars, algorithms and plug-ins are loaded. When the user uses it, the system first verifies the identity of the user, issues a digital certificate to the user and generates the corresponding electronic signature. Then the user directly calls the signature software, and the seal can be moved and adjusted after stamping on the document. After the user confirms the signature for the second time, the document and the signature are fixed and cannot be tampered with. The document data after the signature is distributed and stored. When other users use the document, they can verify the validity of the document by verifying the validity of the user certificate, the validity of the electronic seal and the validity of the electronic signature. The operating environment module (101), the technical support module (102), the server construction module (103) and the client construction module (104) are connected in sequence through network communication; the operating environment module (101) is used to reasonably configure the components of the basic equipment so that its performance can provide environmental conditions that meet the system operation requirements; the technical support module (102) is used to load a variety of related computer technologies to support the smooth operation of the system; the server construction module (103) is used to construct and manage the background server of the system; the client construction module (104) is used to construct and manage the client of the system so as to provide users with a channel for interacting with the system; The technical support module (102) includes a grammar notation module (1021), a plug-in technology module (1022), a cryptographic algorithm module (1023) and a hash function module (1024); the grammar notation module (1021), the plug-in technology module (1022), the cryptographic algorithm module (1023) and the hash function module (1024) are sequentially connected via network communication; the grammar notation module (1021) is used to adopt a set of standard flexible notations for describing the representation, encoding, transmission and decoding of data, and to describe the object structure independent of specific computer hardware with formal, unambiguous and precise rules; the plug-in technology module (1022) ) is used to implant the electronic signature system into Microsoft Office products by using COM / ActiveX plug-in technology, thereby realizing the function of using electronic signatures in WORD, EXCEL, and OFD documents, and through the development language of C++, the system can be applied to multiple languages ​​and multiple document formats; the cryptographic algorithm module (1023) loads multiple common cryptographic algorithms such as RSA, SM2, and SM3, and adapts the cryptographic algorithms to multiple domestic software and hardware; the hash function module (1024) is used to load the hash function and the corresponding algorithm, and obtain a fixed-length string by performing a one-way hash function operation on the original text, so as to supplement the public key password and algorithm; The identity authentication module (401), the data confidentiality module (402), the anti-tampering mechanism module (403) and the document verification module (404) are sequentially connected via network communication; the identity authentication module (401) is used to confirm the identity information of all users participating in online information exchange by loading a plurality of user identity recognition technologies for real-name authentication; The data confidentiality module (402) is used to add a variety of data security protection measures that are compatible with mainstream domestic software and hardware, and improve the security of document data by distributing and encrypting data; the anti-tampering mechanism module (403) is used to fix the content and signature of the document approved by the signer through pre-programmed program instructions, so that the user cannot deny the content of the document and deny the signing behavior. At the same time, the signature cannot be forged or impersonated by copying or other means, and the signature will become invalid once the document is tampered with; the document verification module (404) is used to provide users with a service function for verifying documents containing electronic signatures. During the verification process, the validity of the user certificate, the validity of the electronic seal, and the validity of the electronic signature need to be verified respectively, and the user is informed of each verification result.

2. The electronic signature system according to claim 1, which is applicable to public key cryptography technology and supports commercial cryptographic algorithms, is characterized in that: The operating environment module (101) includes a technical specification module (1011), a core configuration module (1012), a service configuration module (1013) and a performance parameter module (1014); the technical specification module (1011), the core configuration module (1012), the service configuration module (1013) and the performance parameter module (1014) are connected in sequence through network communication; the technical specification module (1011) is used to import and refer to a variety of domestic and international signature specification files in use when building the system, so that the system product can comply with relevant specifications and standards; the core configuration module (1012) is used to configure the performance of the CPU, hard disk, memory, network card and server of the platform device accordingly; the service configuration module (1013) is used to configure the performance of the CPU, hard disk, memory, network card and server used for middleware services in the platform device accordingly; the performance parameter module (1014) is used to pre-set various operation performance indicators of the electronic signature service during the system operation.

3. The electronic signature system applicable to public key cryptography and supporting commercial cryptographic algorithms according to claim 2, characterized in that: In the cryptographic algorithm module (1023), the implementation processes of various cryptographic algorithms are respectively: the implementation process of the RSA algorithm: Step 1. The implementer finds two large prime numbers p and q; Step 2, the implementer calculates n = pq and φ(n) = (p-1)(q-1); Step 3. The implementer selects a random number e, 0<e; Step 4. The implementer uses the Euclidean algorithm to calculate d = e-1 (modφ(n)); Step 5. The implementer publishes n and e as public keys in the directory; The key point for cryptanalysts to attack the RSA system is how to decompose n. If the decomposition is successful and n=pq, then φ(n)=(p-1)(q-1) can be calculated, and then the secret d can be deciphered from the public e.

4. The electronic signature system according to claim 3, which is applicable to public key cryptography technology and supports commercial cryptographic algorithms, is characterized in that: The server construction module (103) includes a background management module (1031), a service center module (1032) and a system database module (1033); the background management module (1031), the service center module (1032) and the system database module (1033) are connected in sequence through network communication; the background management module (1031) is responsible for the electronic seal life cycle management and the provision of electronic seal verification services, including administrator management, seal user management, electronic seal production and management, electronic seal verification services, security audit and system configuration management; the service center module (1032) is used to configure and manage the service items and specific functions of the electronic seal, including system login, USBKey management, seal management, user management, log management, seal installation and recycling station; the system database module (1033) is used to establish an electronic seal system database based on blockchain technology, which is used for distributed storage of various documents and electronic seal data.

5. The electronic signature system according to claim 4, which is applicable to public key cryptography technology and supports commercial cryptographic algorithms, is characterized in that: The client construction module (104) includes a basic component module (1041), a signature application module (1042) and an intelligent key module (1043); the basic component module (1041), the signature application module (1042) and the intelligent key module (1043) are connected in sequence through network communication; the basic component module (1041) is responsible for processing the core functions of the electronic signature client software, including operating the intelligent password key, parsing and verifying the electronic seal, generating parsed and verifying the electronic signature data, verifying the validity of the digital certificate, and interacting with the electronic signature management system; the signature application module (1042) is used to provide the electronic signature client software function based on the basic components for specific application scenarios; the intelligent key module (1043) is used to save the signer's digital certificate, key and electronic seal through the intelligent password key, and execute the digital signature.

6. The electronic signature system according to claim 1, which is applicable to public key cryptography technology and supports commercial cryptographic algorithms, is characterized in that: The user management module (201), the digital certificate module (202), the seal stamping module (203) and the document protection module (204) are sequentially connected via network communication; the user management module (201) is used to register and identify the identity of users who can access the system and allocate corresponding permissions according to the identity of the users; The digital certificate module (202) is used to issue a certificate through a certificate issuing authority to authenticate the identity of the signer and to verify the corresponding relationship between the identification information of the person to be authenticated and the public key, and the digital certificate is made public so that anyone can view the relevant information; The stamping module (203) is used to provide the user with the function of stamping the required electronic stamp on the document. The user can choose a seal or a saddle stamp when stamping. The electronic signature stamped will be digitally signed on the entire document during the background stamping process, and the saddle stamp will be stamped on each page in the visual presentation form to meet the user's traditional saddle stamp contract habits; the document protection module (204) is used to fix the document after the signature is completed so that it cannot be modified.

7. The electronic signature system according to claim 1, which is applicable to public key cryptography technology and supports commercial cryptographic algorithms, is characterized in that: The signature moving module (301), the signature revocation module (302), the signature fixing module (303) and the signature verification module (304) are connected in sequence through network communication; the signature moving module (301) is used to provide a function of moving the position of the signature after stamping, so as to facilitate adjusting the signature to a specified position; the signature revocation module (302) is used to provide a function of revoking the seal after stamping, and when revoking the seal, it is necessary to confirm the identity and password of the original stamper or signer; the signature fixing module (303) is used to fix the position of the signature after confirming the signature, and execute the instruction of prohibiting the movement of the signature, and after the signature is fixed, its position cannot be changed, and only the revocation operation can be performed; the signature verification module (304) is used to verify the validity of the document by verifying the document signature.

Images