Electronic contract signing method, system, storage medium and device based on symmetric key

Abstract

The present invention provides a method, system, storage medium and device for electronic contract signing based on symmetric keys. When using keys, the used keys are marked to prevent the reuse of keys. The symmetric key algorithm has the characteristics of anti-quantum attack, which fundamentally eliminates the defect of traditional electronic contract signing methods based on PKI, whose security is based on computational security. The present invention adopts a one-time one-pad encryption method with unconditional security.

Description

Technical Field

[0001] The present invention belongs to the technical field of encryption communication of quantum cryptography networks, and specifically relates to a method, system, storage medium and device for electronic contract signing based on symmetric keys. Background Art

[0002] The statements in this section merely provide background information related to the present invention and do not necessarily constitute prior art.

[0003] Electronic contracts, also known as e-commerce contracts, emerged with the development of computer technology and automated office automation. Essentially, they transmit information via electronic pulses, replacing the traditional practice of using paper as the primary credential with a set of electronic information. Generally speaking, an electronic contract can be defined as an agreement between two or more parties, reached electronically via an electronic information network, to establish, modify, or terminate property-related civil rights and obligations. Simply put, an electronic contract is a contract concluded electronically, primarily an agreement reached online by the parties.

[0004] The core technology of the current electronic contract signing system is PKI technology. The core of PKI technology is to use digital certificates for authentication, stamp the seal on the electronic document through electronic signature, and embed the digital signature information of the document in the electronic document, thereby ensuring the authenticity, uniqueness, source confirmation and non-repudiation of the document.

[0005] However, according to the inventors, current electronic contracts are generally implemented based on PKI technology, which authenticates the signatory's identity and uses RSA asymmetric keys for non-repudiation signatures. It is well known that the RSA asymmetric key encryption algorithm is computationally secure. However, with the foreseeable research and development of quantum computers, classical cryptographic systems based on computational complexity face security issues. Therefore, current electronic contract signing methods based on asymmetric key technology present security risks. Summary of the Invention

[0006] In order to solve the above problems, the present invention proposes an electronic contract signing method, system, storage medium and device based on symmetric keys. The present invention adopts a one-time pad encryption method and has unconditional security.

[0007] According to some embodiments, the present invention adopts the following technical solutions:

[0008] A method for electronic contract signing based on symmetric keys, executed from a trusted center or a third party, comprises the following steps:

[0009] Receiving encrypted electronic contracts to be signed, message authentication codes, and signature requests from different electronic contract signatories, wherein the encryption is performed using an unused shared key;

[0010] Receive the signature request, perform identity authentication, determine whether the shared key has been used, and if not, mark the shared key as used. Verify the identity information of the electronic contract signatory and decrypt to obtain the electronic contract to be signed. Otherwise, reject the signature request of the corresponding electronic contract signatory.

[0011] Determine whether the electronic contracts to be signed sent by different electronic contract signatories are the same contract. If so, perform symmetric key signing on the electronic contracts to be signed to generate signed electronic contracts. If not, stop the signing process.

[0012] The signed electronic contract is encrypted and fed back to each electronic contract signatory, and the confirmation of receipt information from each electronic contract signatory is received. If the confirmation information is received, the signing process is completed; if the signature message from any party is not received, the contract signing cancellation message is sent to all electronic contract signatories.

[0013] As an optional implementation method, before signing the electronic contract, each electronic contract signatory first registers his identity, and after reviewing the identity registration information, the identity registration information and shared key of the electronic contract signatory are saved.

[0014] As an optional implementation method, the specific process of receiving encrypted electronic contracts to be signed, message authentication codes and signature requests sent by different electronic contract signatories includes: receiving the ciphertext obtained by the electronic contract signatory using an unused first shared key to encrypt the contract, receiving the message authentication code related to the key calculated by the electronic contract signatory using a second shared key, and receiving the electronic contract signature request sent by the electronic contract signatory.

[0015] As an optional implementation method, the specific process of identity authentication includes: receiving a signature request and a message authentication code sent by the signatory of the electronic contract, decrypting the message authentication code, reading a shared key whose serial number is consistent with the second shared key, verifying and determining the correctness of the message authentication code. If it is correct, the identity authentication is passed, reading the shared key whose serial number is consistent with the first shared key serial number to decrypt the ciphertext and obtain the electronic contract to be signed.

[0016] As a further limitation, a true random number digital signature key library is established for the digital signature of electronic contract data. The keys of the key library are divided according to the length used for each digital signature, and the divided keys are numbered sequentially; the signatories of the electronic contract divide the shared keys according to the length of the shared keys used each time and synchronize the sequential numbers with the trusted center.

[0017] As an optional implementation method, the specific process of symmetric key signing the electronic contract to be signed includes: using a key that has never been used to symmetric key sign the electronic contract to be signed, and obtaining signature data including the timestamp of the signature, the key serial number, the identity identification codes of the electronic contract signatories involved and the trusted center, and the electronic contract information.

[0018] As an optional implementation, if confirmation information is received, the specific process of completing the signing process includes: receiving information from each electronic contract signatory to verify the correctness of the signed electronic contract, and if the information is received within a set time, saving the signed electronic contract.

[0019] As an optional implementation method, if no signature message is received from any party, the specific process of sending a contract signing cancellation signature to all electronic contract signatories includes: using an unused signature key to calculate the relevant message authentication code, sending the verification information related to the message authentication code to the electronic contract signatories involved, and saving the verification information so that the electronic contract signatories can save the verification information as proof that the electronic contract signing has been cancelled.

[0020] A computer-readable storage medium stores a plurality of instructions, wherein the instructions are suitable for being loaded by a processor of a terminal device and executing the steps in the electronic contract signing method based on a symmetric key.

[0021] A terminal device includes a processor and a computer-readable storage medium, wherein the processor is used to implement various instructions; the computer-readable storage medium is used to store multiple instructions, wherein the instructions are suitable for being loaded by the processor and executing the steps in the electronic contract signing method based on symmetric keys.

[0022] An electronic contract signing system based on symmetric keys, comprising:

[0023] The client device, as the execution device of the electronic contract signatory, is configured to encrypt the electronic contract to be signed, generate a message authentication code and a signature request, and exchange information with the trusted center, sending the encrypted electronic contract to be signed, the message authentication code, the signature request and confirmation information, and receiving the signed electronic contract;

[0024] The trusted center, as a third-party trusted institution, is configured to receive encrypted electronic contracts to be signed, message authentication codes, and signature requests sent by different electronic contract signatories, wherein the encryption is performed using an unused shared key;

[0025] Receive the signature request, perform identity authentication, determine whether the shared key has been used, and if not, mark the shared key as used. Verify the identity information of the electronic contract signatory and decrypt to obtain the electronic contract to be signed. Otherwise, reject the signature request of the corresponding electronic contract signatory.

[0026] Determine whether the electronic contracts to be signed sent by different electronic contract signatories are the same contract. If so, perform symmetric key signing on the electronic contracts to be signed to generate signed electronic contracts. If not, stop the signing process.

[0027] The signed electronic contract is encrypted and fed back to each electronic contract signatory, and the confirmation of receipt information from each electronic contract signatory is received. If the confirmation information is received, the signing process is completed; if the signature message from any party is not received, the contract signing cancellation message is sent to all electronic contract signatories.

[0028] As an optional implementation method, before signing an electronic contract, each client device submits an identity registration application to the trusted center through a quantum cryptography network terminal using a quantum secure channel; after the trusted center accepts the identity registration application of the electronic contract signatory, it reviews the materials submitted by the electronic contract signatory separately; after passing the review, the trusted center distributes a shared key to the electronic contract signatory through the quantum secure channel of the quantum cryptography network. The trusted center saves the identity registration information and shared key of the electronic contract signatory in the database, and the client device securely saves the shared key, and together with the shared key in the trusted center database, divides the shared key according to the length of each use of the shared key and synchronizes the sequence numbering.

[0029] As an optional implementation, the trusted center establishes a true random number digital signature key library for digital signature of electronic contract data; the keys of the key library are divided according to the length used for each digital signature, and the divided keys are numbered sequentially.

[0030] As an optional implementation method, when the shared key between the trusted center and the client device is about to be used up, the client device uses the unused shared key to perform mutual identity authentication with the trusted center. After the identity authentication is successful, the trusted center distributes the quantum key to the client device through the quantum secure communication link of the quantum cryptography network. The trusted center and the client device use the unused key to encrypt the newly distributed quantum key, use the ciphertext as the new shared key, and divide the new shared key into keys and number them sequentially.

[0031] Compared with the prior art, the present invention has the following beneficial effects:

[0032] The present invention proposes an electronic contract signing method based on symmetric key signature. The symmetric cryptographic system has the characteristics of small mathematical calculation amount, fast encryption speed and easy processing. At the same time, the symmetric key algorithm has the characteristics of resistance to quantum attacks, which fundamentally eliminates the defect of traditional electronic contract signing methods based on PKI, whose security is based on computational security.

[0033] When using keys, the present invention marks the used keys to prevent the reuse of keys. Therefore, this patent is based on the quantum cryptography network and adopts a one-time encryption method with unconditional security. Through the quantum cryptography network, the encryption parties can easily obtain the shared symmetric key with the help of quantum key distribution.

[0034] To ensure that both parties have received the signed electronic contract (and to prevent the receiving party from denying the contract by concealing it, leaving the unreceived party without proof of contract signing), the present invention requires the signatory to send correct feedback (a random number) to the trusted center. If the trusted center does not receive correct feedback from either or both parties within the agreed timeframe, it will generate and store a signature message canceling the contract. Both parties know that if the trusted center does not receive correct feedback beyond the agreed timeframe, the contract signing will fail, even if the cancellation message is not received due to a network failure. This strictly adheres to the fair exchange protocol, ensuring fairness in electronic contract signing.

[0035] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, preferred embodiments are given below and described in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] The accompanying drawings, which constitute a part of the present invention, are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.

[0037] Figure 1 This is a schematic diagram of the electronic contract signing process in Example 1;

[0038] Figure 2 This is a communication diagram for the parties involved in the electronic contract signing in Example 2. DETAILED DESCRIPTION

[0039] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0040] It should be noted that the following detailed descriptions are illustrative and intended to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which the present invention belongs.

[0041] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present invention. As used herein, unless the context clearly indicates otherwise, the singular form is intended to include the plural form. In addition, it should be understood that when the terms "comprise" and / or "include" are used in this specification, they indicate the presence of features, steps, operations, devices, components and / or combinations thereof.

[0042] Example 1:

[0043] Aiming at the security defects of current electronic contract signing methods, a symmetric key-based electronic contract signing method is proposed.

[0044] A trusted center is established, which is a third-party trusted institution. A true random number digital signature key library is established in the trusted center for the digital signature of electronic contract data. The keys in the key library are divided according to the length used for each digital signature, and the divided keys are sequentially numbered. Before signing the electronic contract, the signatory of the electronic contract submits an identity registration application to the trusted center. After the trusted center accepts the signatory's identity registration application, it reviews the materials submitted by the signatory separately. After passing the review, the trusted center distributes a shared key to the signatory. The trusted center stores the signatory's identity registration information and shared key in the database. The signatory securely stores the shared key and divides the shared key according to the length of the shared key each time it is used, and synchronizes the sequence numbering together with the shared key in the trusted center database.

[0045] In this embodiment, the method for distributing the shared key may adopt an existing distribution method, which will not be described in detail here.

[0046] This embodiment is a two-party electronic contract signing method. It is assumed that the two parties involved in the electronic contract signing are A and B (A and B represent the identity identification codes of the contract signatories respectively, and A and B have completed identity registration in the trusted center in advance), and the contract to be signed by A and B is C (A and B have agreed on the content of C in advance).

[0047] like Figure 1 As shown in the figure, the specific implementation process includes:

[0048] (1) Electronic contract signatory A encrypts electronic contract C, generates a message authentication code, sends an electronic contract signature request to the trusted center, and sends the electronic contract ciphertext, message authentication code and related information to the trusted center.

[0049] A uses the unused shared key K1 with the trusted center to encrypt the contract C and obtain the ciphertext E K1 (C) and uses the unused shared key K2 with the trusted center to calculate the key-related message authentication code HMAC(A||B||TP||EK1 (C)||N1||N2; K2)(TP is the identity identification code of the trusted center, N1 and N2 represent the serial numbers of the keys K1 and K2 respectively, and || represents the data connection operation). A will A, B, TP, N1, N2, E K1 (C) and HMAC(A||B||TP||E K1 (C)||N1||N2; K2) is sent to the trusted center, and an electronic contract signature request is sent to the trusted center, marking the keys K1 and K2 as used.

[0050] (2) Electronic contract signatory B encrypts electronic contract C, generates a message authentication code, sends an electronic contract signature request to the trusted center, and sends the electronic contract ciphertext, message authentication code, and related information to the trusted center.

[0051] B uses the unused shared key K3 with the trusted center to encrypt the contract C and obtain the ciphertext E K3 (C) and uses the unused shared key K4 with the trusted center to calculate the key-related message authentication code HMAC(A||B||TP||E K4 (C)||N3||N4; K4)(TP is the identity identification code of the trusted center, N3 and N4 are the serial numbers of the keys K3 and K4 respectively, || represents the data connection operation), B will A, B, TP, N3, N4, E K3 (C) and HMAC(A||B||TP||E K3 (C)||N3||N4; K4) is sent to the trusted center, and an electronic contract signature request is sent to the trusted center, marking keys K3 and K4 as used.

[0052] (3) The trusted center verifies A’s identity and decrypts the contract C.

[0053] The trusted center receives data A, B, TP, N1, N2, E sent by A K1 (C) and HMAC(A||B||TP||E K1 (C)||N1||N2; K2) and the signature request, read the shared key K2 with A with the serial number N2 from the database. If K2 has been used, refuse to accept the signature request and data sent by A. Otherwise, use K2 to verify HMAC(A||B||TP||E K1 (C) || N1 || N2; K2) is correct. If it is correct, A's identity authentication is successful. The trusted center reads the shared key K1 with the serial number N1 from the database to decrypt E. K1 (C) After obtaining contract C, the trusted center marks keys K1 and K2 as used.

[0054] (4) The trusted center verifies B’s identity and decrypts the contract C.

[0055] The trusted center receives the data A, B, TP, N1, N2, E sent by B K1 (C) and HMAC(A||B||TP||E K1 (C)||N1||N2; K2) and the signature request, read the shared key K4 with A from the database with the serial number N4. If K4 has been used, refuse to accept the signature request and data sent by B. Otherwise, use K4 to verify HMAC(A||B||TP||E K3 (C) || N1 || N2; K4) is correct. If it is correct, B's identity authentication is successful. The trusted center reads the shared key K3 with the serial number N3 from the database to decrypt E. K3 (C) After obtaining contract C, the trusted center marks keys K3 and K4 as used.

[0056] (5) The trusted center confirms that A and B are applying for the same signature request for contract C, and signs the electronic contract to generate a signed electronic contract. Of course, subsequent operations need to be based on the signing of the same contract.

[0057] After receiving the signature requests from A and B, the trusted center confirms that they are the signature requests for the same contract C. It then reads the signature key K with serial number N from the signature key library to sign the contract C with a symmetric key. The signature data obtained is: HMAC(A||B||TP||TS||C||N;K), where TS is the timestamp of the signature, N is the serial number of the signature key K, and DS=

[0058] A||B||TP||TS||C||N||HMAC(A||B||TP||TS||C||N; K) is used as the signed electronic contract data of electronic contract C, and K is marked as used.

[0059] (6) The trusted center sends the signed electronic contract to A and B respectively.

[0060] The trusted center generates random numbers R1 and R2, and uses the unused shared key K5 with A, which is numbered N5, to encrypt the data DS||R1 to generate the ciphertext E. K5 (DS||R1), use the unused shared key K6 with B with the serial number N6 to calculate the key-related hash operation message authentication code HMAC (E K5 (DS||R1)||N5||N6; K6); Use the unused shared key K7 with B with sequence number N7 to encrypt data DS||R2 to generate ciphertext E K7 (DS||R2), use the unused shared key K8 with serial number N8 to calculate the key-related hash operation message authentication code HMAC (E K7(DS||R2)||N7||N8;K8). The trusted center will K5 (DS||R1), N5, N6 and HMAC(E K5 (DS||R1)||N5||N6;K6) is sent to A, and E K7 (DS||R2), N7, N8 and HMAC(E K7 (DS||R2)||N7||N8; K8) is sent to B, and the trusted center marks keys K5, K6, K7, and K8 as used.

[0061] (7) Determine whether A and B have sent confirmation information of the signed contract and whether the electronic contract signing is valid.

[0062] If A and B receive the data sent by the trusted center, they use the shared key to verify the legitimacy of the data and decrypt it to obtain the signed electronic contract data DS and the random number. A or B goes to the trusted center to verify the correctness of DS. If the verification is correct, the signed electronic contract is saved, and the random number R1 or R2 is encrypted using the shared key with the trusted center and sent to the trusted center, and the verification key and decryption key are marked as used.

[0063] (8) If the trusted center receives the correct random numbers sent by A and B, the electronic contract signing process ends and the trusted center saves DS. If the trusted center does not receive or only receives the correct random numbers sent by A or B (assuming it is A) within the specified time, the trusted center uses the unused signature key K9 with serial number N9 to calculate HMAC("CANCELLED"||DS||TS||N9;K9), and sends CDS = "CANCELLED"||DS||TS||N9||HMAC("CANCELLED"||DS||TS||N9;K9) to A and B. At the same time, the trusted center saves the data CDS and marks K9 as a used key. A or B receives the contract cancellation signature data CDS sent by the trusted center and verifies the correctness of the CDS. If it is correct, the trusted center saves the data CDS as proof that the electronic contract signing has been cancelled.

[0064] Example 2:

[0065] like Figure 2 As shown, a symmetric key-based electronic contract signing system is provided. The functions of each component are detailed as follows:

[0066] The Trust Center, a third-party trusted institution, is responsible for digitally signing electronic contracts, registering the identities of electronic contract signatories, authenticating the identities of signatories during electronic contract signing, and serving as a server for electronic contract signing. A true random number digital signature key library is established within the Trust Center for digitally signing electronic contract data. The keys in the key library are divided according to the length used for each digital signature, and the divided keys are sequentially numbered.

[0067] The signatories of an electronic contract, whose executing agency can be a client server, processor, or other device, are the two parties preparing to sign the electronic contract through a trusted center. Before signing the electronic contract, the signatories submit an identity registration application to the trusted center via a quantum cryptography network terminal using a quantum secure channel. After accepting the identity registration application, the trusted center reviews the submitted materials. Upon successful review, the trusted center distributes a shared key to the signatories via the quantum secure channel of the quantum cryptography network. The trusted center stores the signatories' identity registration information and shared key in a database. The signatories securely store the shared key and, along with the shared key in the trusted center's database, divide the shared key into key segments based on the length of each shared key used and synchronize the key numbers accordingly.

[0068] The communication process between the electronic contract signatories and the trusted center includes:

[0069] The electronic contract signatory A uses the shared key K1 with the trusted center to encrypt the contract C to obtain the ciphertext E K1 (C) and uses the shared key K2 with the trusted center to calculate the key-related message authentication code HMAC(A||B||TP||E K1 (C)||N1||N2; K2)(TP is the identity identification code of the trusted center, N1 and N2 represent the serial numbers of the keys K1 and K2 respectively, and || represents the data connection operation). A sends an electronic contract signature request to the trusted center and sends A, B, TP, N1, N2, E K1 (C) and HMAC(A||B||TP||E K1 (C)||N1||N2; K2) is sent to the trusted center.

[0070] The electronic contract signatory B uses the shared key K3 with the trusted center to encrypt the contract C to obtain the ciphertext E K3 (C) and uses the shared key K4 with the trusted center to calculate the key-related message authentication code HMAC(A||B||TP||E K4 (C)||N3||N4; K4)(TP is the identity identification code of the trusted center, N3 and N4 represent the serial numbers of the keys K3 and K4 respectively, and || represents the data connection operation), B sends an electronic contract signature request to the trusted center and sends A, B, TP, N3, N4, EK3 (C) and HMAC(A||B||TP||E K3 (C)||N3||N4; K4) is sent to the trusted center.

[0071] The trusted center receives the signature request and data A, B, TP, N1, N2, E sent by A. K1 (C) and HMAC(A||B||TP||E K1 (C)||N1||N2; K2), read the shared key K2 with A whose serial number is N2 from the database, and verify HMAC(A||B||TP||E K1 (C) || N1 || N2; K2) is correct. If it is correct, A's identity authentication is successful. The trusted center reads the shared key K1 with the serial number N1 from the database to decrypt E. K1 (C) Obtain Contract C.

[0072] The trusted center receives the signature request and data A, B, TP, N3, N4, E from B. K3 (C) and HMAC(A||B||TP||E K3 (C)||N3||N4;K4), read the shared key K4 with B from the database with the serial number N4, and verify HMAC(A||B||TP||E K3 (C) || N3 || N4; K4) is correct. If it is correct, B's identity authentication is successful. The trusted center reads the shared key K3 with the serial number N3 from the database to decrypt E. K3 (C) Obtain Contract C.

[0073] After the trusted center receives the signature requests from A and B and confirms that they are signature requests for the same contract C, it goes to the signature key library to read the unused key K with serial number N to sign the contract C with a symmetric key, and obtains the signature data: HMAC(A||B||TP||TS||C||N;K), where TS is the timestamp of the signature and N is the serial number of the signature key K. DS=A||B||TP||TS||C||N||HMAC(A||B||TP||TS||C||N;K) is used as the signed electronic contract of electronic contract C, and K is marked as used.

[0074] The trusted center generates random numbers R1 and R2, and uses the shared key K5 with A, which is serial number N5, to encrypt the data DS||R1 to generate the ciphertext E. K5 (DS||R1), use the shared key K6 with B with the serial number N6 to calculate the key-related hash operation message authentication code HMAC (E K5 (DS||R1)||N5||N6; K6); Use the shared key K7 with B with the serial number N7 to encrypt the data DS||R2 to generate the ciphertext EK7 (DS||R2), use the shared key K8 with B with the serial number N8 to calculate the key-related hash operation message authentication code HMAC (E K7 (DS||R2)||N7||N8;K8). The trusted center will K5 (DS||R1), N5, N6 and HMAC(E K5 (DS||R1)||N5||N6;K6) is sent to A, and E K7 (DS||R2), N7, N8 and HMAC(E K7 (DS||R2)||N7||N8; K8) is sent to B.

[0075] If A and B receive the data sent by the trusted center, they use the shared key to verify the legitimacy of the data and decrypt it to obtain the signed electronic contract DS and the random number. A or B goes to the trusted center to verify the correctness of DS. If the verification is correct, the signed electronic contract is saved and the random number R1 or R2 is encrypted using the shared key with the trusted center and sent to the trusted center.

[0076] If the trusted center receives the correct random numbers sent by A and B, the electronic contract signing process ends and the trusted center saves DS; if the correct random number is not received or only received from one of A or B (assuming it is A) within the specified time, the trusted center uses the signature key K9 with serial number N9 to calculate HMAC("CANCELLED"||DS||N9; K9), sends CDS = "CANCELLED"||DS||N9||HMAC("CANCELLED"||DS||N9; K9) to A and B, and saves CDS. A and B receive and verify the correctness of CDS. If correct, they save CDS as proof that the electronic contract signing has been cancelled.

[0077] Example 3:

[0078] A computer-readable storage medium stores a plurality of instructions, wherein the instructions are suitable for being loaded by a processor of a terminal device and executing the steps performed by any one of the executing parties in the electronic contract signing method based on a symmetric key provided in Example 1 or Example 2.

[0079] Example 4:

[0080] A terminal device includes a processor and a computer-readable storage medium, the processor being used to implement various instructions; the computer-readable storage medium being used to store multiple instructions, wherein the instructions are suitable for being loaded by the processor and executing the steps performed by any one of the executing parties in the symmetric key-based electronic contract signing method provided in Example 1 or Example 2.

[0081] The terminal device may be a server, a processor, etc., which is not limited here.

[0082] It will be understood by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0083] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowcharts and / or block diagrams. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0084] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0085] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0086] The foregoing description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Those skilled in the art will readily appreciate that various modifications and variations of the present invention are possible. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present invention are intended to be within the scope of protection of the present invention.

[0087] Although the above describes the specific embodiments of the present invention in conjunction with the accompanying drawings, it is not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art on the basis of the technical solution of the present invention without any creative work are still within the scope of protection of the present invention.

Claims

1. A method for electronic contract signing based on symmetric keys, executed from a trusted center or a third party, characterized by: The following steps are involved: Establish a true random number digital signature key library for digital signatures of electronic contract data. Divide the keys in the key library into keys according to the length used for each digital signature and sequentially number the divided keys. The electronic contract signatories divide the shared keys into keys according to the length of each shared key used and synchronize the keys with the trusted center or third party. Receiving encrypted electronic contracts to be signed, message authentication codes, and signature requests from different electronic contract signatories, wherein the encryption is performed using an unused shared key; Receive the signature request, perform identity authentication, determine whether the shared key has been used, and if not, mark the shared key as used. Verify the identity information of the electronic contract signatory and decrypt to obtain the electronic contract to be signed. Otherwise, reject the signature request of the corresponding electronic contract signatory. The specific process of identity authentication includes: receiving a signature request and a message authentication code sent by the electronic contract signatory, decrypting the message authentication code, reading a shared key whose serial number is consistent with the second shared key, verifying and confirming the correctness of the message authentication code. If correct, the identity authentication is passed, and reading the shared key whose serial number is consistent with the serial number of the first shared key to decrypt the ciphertext and obtain the electronic contract to be signed; Determine whether the electronic contracts to be signed sent by different electronic contract signatories are the same contract. If so, perform symmetric key signing on the electronic contracts to be signed to generate signed electronic contracts. If not, stop the signing process. The signed electronic contract is encrypted and fed back to each electronic contract signatory, and the confirmation of receipt information from each electronic contract signatory is received. If the confirmation information is received, the signing process is completed; if the signature message from any party is not received, the contract signing cancellation message is sent to all electronic contract signatories.

2. The method for electronic contract signing based on symmetric keys according to claim 1, wherein: Before signing an electronic contract, each signatory of the electronic contract shall first register their identity. After reviewing the identity registration information, the identity registration information and shared key of the signatory of the electronic contract shall be saved.

3. The method for electronic contract signing based on symmetric keys according to claim 1, wherein: The specific process of receiving the encrypted electronic contracts to be signed, message authentication codes and signature requests sent by different electronic contract signatories includes: receiving the ciphertext obtained by the electronic contract signatory using the unused first shared key to encrypt the contract, receiving the message authentication code related to the key calculated by the electronic contract signatory using the second shared key, and receiving the electronic contract signature request sent by the electronic contract signatory.

4. The method for electronic contract signing based on symmetric keys according to claim 1, wherein: The specific process of symmetric key signing the electronic contract to be signed includes: using a key that has never been used to symmetric key sign the electronic contract to be signed, and obtaining signature data including the timestamp of the signature, the key serial number, the identity identification codes of the electronic contract signatories involved and the trusted center, and the electronic contract information.

5. The method for electronic contract signing based on symmetric keys according to claim 1, wherein: If the confirmation information is received, the specific process of completing the signing process includes: receiving information from each electronic contract signatory to verify the correctness of the signed electronic contract, and if the information is received within the set time, saving the signed electronic contract.

6. The method for signing an electronic contract based on a symmetric key according to claim 1, wherein: If no signature message is received from any party, the specific process of sending the contract signing cancellation signature to all electronic contract signatories includes: using an unused signature key to calculate the relevant message authentication code, sending the verification information related to the message authentication code to the electronic contract signatories involved, and saving the verification information so that the electronic contract signatories can save the verification information as proof that the electronic contract signing has been cancelled.

7. A computer-readable storage medium, characterized in that: There are multiple instructions, which are suitable for being loaded by a processor of a terminal device and executing the steps in a symmetric key-based electronic contract signing method according to any one of claims 1 to 6.

8. A terminal device, characterized in that: The invention comprises a processor and a computer-readable storage medium, wherein the processor is used to implement each instruction; the computer-readable storage medium is used to store multiple instructions, wherein the instructions are suitable for being loaded by the processor and executing the steps in the electronic contract signing method based on a symmetric key according to any one of claims 1 to 6.

9. A symmetric key-based electronic contract signing system, executing the symmetric key-based electronic contract signing method according to claim 1, characterized in that: include: The client device, as the execution device of the electronic contract signatory, is configured to encrypt the electronic contract to be signed, generate a message authentication code and a signature request, and exchange information with the trusted center, sending the encrypted electronic contract to be signed, the message authentication code, the signature request and confirmation information, and receiving the signed electronic contract; The trusted center, as a third-party trusted institution, is configured to receive encrypted electronic contracts to be signed, message authentication codes, and signature requests sent by different electronic contract signatories, wherein the encryption is performed using an unused shared key; Receive the signature request, perform identity authentication, determine whether the shared key has been used, and if not, mark the shared key as used. Verify the identity information of the electronic contract signatory and decrypt to obtain the electronic contract to be signed. Otherwise, reject the signature request of the corresponding electronic contract signatory. Determine whether the electronic contracts to be signed sent by different electronic contract signatories are the same contract, and if so, perform symmetric key signing on the electronic contracts to be signed; if not, stop the signing process; The signed electronic contract is encrypted and fed back to each electronic contract signatory, and the confirmation of receipt information from each electronic contract signatory is received. If the confirmation information is received, the signing process is completed; if the signature message from any party is not received, the contract signing cancellation message is sent to all electronic contract signatories.

10. The electronic contract signing system based on symmetric keys as claimed in claim 9, characterized in that: Before signing an electronic contract, each client device submits an identity registration application to the trusted center through a quantum cryptography network terminal using a quantum secure channel; after the trusted center accepts the identity registration application of the electronic contract signatory, it reviews the materials submitted by the electronic contract signatory separately; after passing the review, the trusted center distributes a shared key to the electronic contract signatory through the quantum secure channel of the quantum cryptography network. The trusted center saves the identity registration information and shared key of the electronic contract signatory in the database, and the client device securely saves the shared key, and together with the shared key in the trusted center database, divides the shared key according to the length of each use of the shared key and synchronizes the sequence numbering.

11. The electronic contract signing system based on symmetric keys according to claim 9, characterized in that: The trusted center establishes a true random number digital signature key library for digital signature of electronic contract data; the keys of the key library are divided according to the length used for each digital signature, and the divided keys are numbered sequentially.

12. The electronic contract signing system based on symmetric keys according to claim 9, characterized in that: When the shared key between the trusted center and the client device is about to be used up, the client device uses the unused shared key to perform mutual identity authentication with the trusted center. After the identity authentication is successful, the trusted center distributes the quantum key to the client device through the quantum secure communication link of the quantum cryptography network. The trusted center and the client device use the unused key to encrypt the newly distributed quantum key, use the ciphertext as the new shared key, divide the new shared key into keys, and number them sequentially.

Images