An electronic document live signing method embedding signature authentication process information

Abstract

The application discloses an electronic file on-site signature method embedded with signature authentication process information, and comprises the following steps: S1, receiving an electronic file needing on-site signature by a document signature system; S2, opening a document signature device by a user to obtain the electronic file needing on-site signature; S3, selecting a signature certificate input operation according to an actual signature scene requirement, and performing corresponding operation; S4, after the user completes the document signature, the document signature device and the document signature system perform time stamp signature on the electronic file embedded with an encrypted certificate file package to complete file reinforcement; S5, the document signature system pushes the reinforced electronic file to related parties generating the electronic file, and the related parties properly save the electronic file; and S6, when the signature validity of the electronic file needs to be proved, the related parties complete automatic evidence provision. The application has the advantages that the integrity, timeliness, confidentiality, authenticity and strong correlation of the electronic file, signature and collected certificate can be ensured.

Description

Technical Field

[0001] This invention belongs to the technical field of electronic signatures, specifically relating to a method for on-site signing of electronic documents that embeds signature authentication process information. Background Technology

[0002] With the popularization of digital security technologies and the increasing acceptance of paperless document signing, the demand for effective electronic document signing is growing, leading to a surge in the development of on-site document signing applications. Simultaneously, the security of effective on-site electronic document signing is becoming increasingly important. Currently, the mainstream method for effective electronic document signing primarily uses digital certificates issued by a Certificate Authority (CA). For the average person, applying for a CA certificate for a single on-site electronic document signing can be costly, technically complex, and have limited reusability. For electronic document signing without a CA certificate, a complete chain of evidence is needed to prove the signature's validity. This requires addressing issues such as evidence collection, proper preservation of evidence documents, the completeness, timeliness, and authenticity of electronic document evidence, and establishing a strong correlation between the evidence, the document, and the signatory.

[0003] Because of these problems, many developers in this field often choose to ignore the issue of ensuring the validity of electronic document signing when faced with the need for on-site electronic document signing, and only provide a basic signing process experience. The disadvantage of this approach is that without the use of CA certificate signing, it is difficult to prove the valid signing of electronic documents, and it is difficult to effectively prove the integrity, timeliness, authenticity and strong relevance of electronic documents. Summary of the Invention

[0004] The main objective of this invention is to overcome the shortcomings and deficiencies of the prior art and provide an on-site signing method for electronic documents that embeds signature authentication process information. This method has the advantages of ensuring the integrity, timeliness, confidentiality, authenticity, and strong relevance of electronic documents, signatures, and collected credentials.

[0005] To achieve the above objectives, the present invention adopts the following technical solution:

[0006] This invention provides a method for on-site signing of electronic documents that embeds signature authentication process information, comprising the following steps:

[0007] S1. The document signature system receives electronic documents that require on-site signing;

[0008] S2. The user opens the document signing device and obtains the electronic document that needs to be signed on-site from the document signing system;

[0009] S3. The user selects the signature credential entry according to the actual signing scenario and performs the corresponding operation. The signature credential entry includes one or more of the following: on-site audio entry, on-site video recording, on-site photo entry, user identity information entry, and user fingerprint entry.

[0010] S4. After the user completes the document signing, the document signing device automatically serializes the vouchers collected during the signing process, and packages and embeds attachments into the signature file and voucher file.

[0011] S5. The document signing device automatically sends the packaged document to the document signing system for solidification.

[0012] S6. After completing the timestamp signature, the informed consent system generates a hardened packet file. The processing is as follows: Hex encoding is performed on the timestamp signature result to generate a timestamp content string; according to the "end" byte sequence number of the protection range of the first half of the file by the timestamp, the insertion position of the timestamp content is found, and then the placeholder content that was originally filled with 0 is rewritten into the timestamp content string by inserting and filling. At this time, the part of the placeholder content that exceeds the length of the timestamp content string is still filled with 0. Finally, the processing of the hardened packet file is completed.

[0013] S7. The document signature system pushes the reinforced and solidified packaged file to the relevant parties who generated the electronic document, and the relevant parties shall keep it properly.

[0014] S8. When it is necessary to prove the validity of an electronic document signature, the relevant party shall submit a solidified package file to the document signature system, generate a verification report of the signed electronic document and export the decrypted signature credential, and complete the automatic issuance of the certificate.

[0015] As a preferred technical solution, in step S2, when obtaining the electronic document that needs to be signed on-site from the document signing system, it is done through document retrieval, document distribution, and document download.

[0016] As a preferred technical solution, in step S3, the on-site audio recording is performed using the audio recording function of the document signing device.

[0017] As a preferred technical solution, in step S3, the on-site video recording is performed by the on-site video recording function of the document signing device.

[0018] As a preferred technical solution, in step S3, the on-site shooting and recording is carried out by taking on-site photos using the on-site photography function of the document signing device. During the photography process, it is optional to add a watermark with anti-counterfeiting mark and shooting time.

[0019] As a preferred technical solution, in step S3, the user identity information entry uses the on-site facial ID card information verification function of the document signing device to verify the identity of the signer, enter the signer's name, ID card number and on-site facial image information, and use an authoritative third-party information database to verify the consistency between the facial image and ID card information to verify the signer's true identity. After the verification is completed, the signer's name, ID card number and facial information are collected as authentication credentials.

[0020] As a preferred technical solution, step S4, which involves packaging the signature file and the credential file and embedding attachments, specifically includes:

[0021] S41. Create an empty file and fill it with data using I / O streams. The data filling process is as follows: First, write the packet preamble and version number as identifiers, then start writing file groups, and finally write the internal index. Each packet file consists of multiple different types of groups and internal indexes. Since the index is written last, the starting sequence number of the group needs to be saved when writing the group.

[0022] S42. The first group written is a signature file, which is of type "file" and consists of four parts, in order of priority: group identifier, group type, data length label of the compressed group file, and file data after Deflate compression.

[0023] S43. The second group to be written is the voucher attachment group. The type of the voucher attachment group is "encrypted file". The following are in order: group flag, group type, group encryption algorithm identifier, data length label after compression and encryption of the group file, and file data after Deflate compression and encryption.

[0024] S44. Finally, write the internal index group. The internal index is used to solve the labeling problem of the group and the fast retrieval problem. Each group has a corresponding internal index. The internal indexes are in the following order: index leader, index number, full path of the group pointed to, and starting number of the corresponding group. The groups in the package file should correspond one-to-one with the index.

[0025] S45. After writing all grouping and indexing information, mark the end of the packet with the end-of-write character, and complete the embedding of the signature file into the credential attachment.

[0026] As a preferred technical solution, in step S42, if there are multiple voucher attachments, multiple voucher attachment groups need to be written.

[0027] As a preferred technical solution, in step S5, the document signing device automatically sends the packaged file to the document signing system for solidification processing, specifically as follows:

[0028] S51. The document signature system first verifies the version and format of the package file, and then uses an index to verify the structural integrity of the package file.

[0029] S52. After confirming that the packet file is complete and usable, the packet file is continued to be written, and the packet file is transformed into the initial solidified packet file. The continuation starts from the last packet end mark of the file and fills the data using I / O stream. The filling process is as follows: first, the packet leader and version number are written as identifiers, and then the group and internal index are written.

[0030] S53. The type of group written is a packet-fixed group. The group consists of the following components in order: group flag, group type, timestamp starting byte number of the protection range of the first half of the file, timestamp ending byte number of the protection range of the first half of the file, timestamp starting byte number of the protection range of the second half of the file, timestamp ending byte number of the protection range of the second half of the file, and fixed-length placeholder content.

[0031] S54. After completing the group writing, write the internal index. The internal index structure is consistent with the internal index structure of the created packet. Then write the end marker to mark the end of the packet.

[0032] S55. After completing the continuation of the initial solidified package file, start generating the original data text of the timestamp signature. According to the interval defined by the timestamp for the protection scope of the first half of the file, "start" and "end", read the content of the initial solidified package file to form the first half of the timestamp protection data. Then, according to the interval defined by the timestamp for the protection scope of the second half of the file, "start" and "end", read the content of the initial solidified package file to form the second half of the timestamp protection data. Combine the two segments of data together in the order of front and back to form the original data text of the timestamp signature.

[0033] S56. Call a third-party timestamp to sign the original data, generate a timestamp signature result, encode the timestamp signature result with Hex, generate a timestamp content string, find the insertion position of the timestamp content according to the "end" byte sequence number of the protection range of the first half of the packet file based on the timestamp, and then use the insertion padding method to rewrite the original placeholder content filled with 0s into the timestamp content string (at this time, the part of the placeholder content length that exceeds the timestamp content string is still filled with 0s). Finally, complete the processing of the solidified packet file.

[0034] As a preferred technical solution, in step S53, the timestamp for the protection range of the first half of the file starts from the first byte of the file;

[0035] The sequence number of the last byte of the protection range of the first half of the file for the timestamp is the sequence number before the first byte of the timestamp content;

[0036] The starting byte sequence number of the protection range of the second half of the file for the timestamp is the sequence number after the ending byte of the timestamp content;

[0037] The timestamp is the sequence number of the last byte of the file whose protection range for the latter half of the file ends and is finally generated.

[0038] The fixed-length placeholder content is first filled with the character 0, and the capacity must be able to hold a complete timestamp signature Hex-encoded string.

[0039] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0040] In this invention, the document viewing, signing, and collection of signature credentials during the on-site electronic document signing process are all completed in an integrated device. When the signed electronic document is finally generated, the collected credential files are encrypted and embedded into the electronic document, and then a reliable timestamp signature is added to the electronic document. This simultaneously strengthens the document and evidence. When evidence is required, only the electronic document with the embedded signature evidence needs to be provided, and the relevant electronic evidence can be automatically exported and the verification report can be automatically generated. This solves the problem of valid signatures and valid evidence for signers without CA certificates on-site, ensuring the integrity, timeliness, confidentiality, authenticity, and strong correlation of electronic documents, signatures, and collected credentials. This makes electronic document signing more convenient and efficient, and reduces application costs. Attached Figure Description

[0041] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0042] Figure 1 This is a flowchart illustrating an on-site signing method for electronic documents that embeds signature authentication process information, according to an embodiment of the present invention.

[0043] Figure 2 This is a schematic diagram of the data structure for packaging signature files, credential files, and embedding attachments according to an embodiment of the present invention;

[0044] Figure 3 This is a schematic diagram illustrating the scope of file protection provided by timestamps in an embodiment of the present invention. Detailed Implementation

[0045] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of the present application, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present application without creative effort are within the scope of protection of the present application.

[0046] In this application, the reference to "embodiment" means that a specific feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a mutually exclusive, independent, or alternative embodiment. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described in this application can be combined with other embodiments.

[0047] like Figure 1 As shown in this embodiment, an on-site signing method for electronic documents that embeds signature authentication process information includes the following steps:

[0048] S1. The document signature system receives electronic documents that require on-site signing;

[0049] S2. The user opens the document signing device and obtains the electronic document that needs to be signed on-site from the document signing system through document retrieval, document distribution, document download, etc.

[0050] S3. Users, according to the actual signing scenario, perform signature verification operations such as audio recording, on-site video recording, on-site photo taking, on-site facial recognition and ID card information verification, and on-site fingerprint entry. Users select the following methods: Audio recording: Proceed to step S4; On-site video recording: Proceed to step S5; On-site video taking: Proceed to step S6; On-site facial recognition and ID card information verification: Proceed to step S7; On-site fingerprint entry: Proceed to step S8; No verification required: Proceed to step S9.

[0051] S4. If the user uses the audio recording function of the document signing device to record audio on-site, and no other evidence collection is required after the audio recording is completed, proceed to step S9; otherwise, proceed to step S3.

[0052] S5. The user uses the on-site video recording function of the document signing device to record on-site video. During the video recording process, the user can choose to add a video watermark with anti-counterfeiting mark and recording time. If no other on-site evidence collection is required after the video recording is completed, proceed to step S9; otherwise, proceed to step S3.

[0053] S6. The user takes a photo on-site using the document signing device. During the photo-taking process, the user can choose to add a watermark with anti-counterfeiting features and the photo-taking time. If no other on-site evidence collection is required after taking the photo, proceed to step S9; otherwise, proceed to step S3.

[0054] S7. The user uses the on-site facial recognition information verification function of the document signing device to verify the identity of the signer, enters the signer's name, ID number and on-site facial image information, uses an authoritative third-party information database to verify the consistency between the facial image and ID information, verifies the signer's true identity, and collects the signer's name, ID number and facial information as authentication credentials after the verification is completed. If no other on-site credentials need to be collected after the authentication credentials are collected, proceed to step S9; otherwise, proceed to step S3.

[0055] S8. If the user uses the on-site fingerprint recording function of the document signing device to enter the fingerprint information of the signer, and no other on-site evidence collection is required after the fingerprint information is entered, proceed to step S9; otherwise, proceed to step S3.

[0056] S9. The signer uses the on-site handwriting signature function of the document signing device to complete the filling, annotation and electronic signature of the electronic document. If it is necessary to affix a fingerprint to the document, an electronic fingerprint can also be affixed.

[0057] S10. After the user completes the document signing, the document signing device and the document signing system automatically serialize the credentials collected during the signing process and merge them into a signature credential file package. Then, a secure encryption algorithm is used to encrypt the credential file package, and the encrypted credential file package is embedded as an attachment into the electronic document; (data structure as follows) Figure 2 (As shown)

[0058] Furthermore, create such Figure 2 The data structure shown, step S10 specifically involves:

[0059] An empty file needs to be created and filled with data using I / O streams. The filling process is as follows: First, a packet preamble and version number are written as identifiers. Then, file groups are written, and finally, the internal index is written, thus completing the creation. Specifically, each packet file consists of multiple groups of different types and an internal index. Since the index is written last, the starting sequence number of the group needs to be saved when writing the group. The first group written is the signature file, which is of type "file" and consists of four parts, in the following order: group identifier, group type, compressed data length marker of the group file, and file data after Deflate compression. Next, the document attachment group is written. The document attachment group is of type "encrypted file," and its structure is similar to that of the signature file group, in the following order: group identifier, group type, encryption algorithm identifier of the group file, compressed and encrypted data length marker of the group file, and file data after Deflate compression and encryption. If there are multiple document attachments, multiple document attachment groups need to be written. Finally, there's the internal index. The internal index solves the problems of group labeling and fast retrieval. Each group has a corresponding index. The index is composed of the following, in order: index leader, index number (unique and non-repeatable), the complete path (string) to the pointed-to group, and the starting index of the corresponding group. Each group within the packet file should correspond one-to-one with its index. After writing all group and index information, a write end marker marks the end of the packet. This process completes the embedding of the signature file into the credential attachment.

[0060] S11. Document Signature System: Uses reliable timestamps to timestamp and sign electronic documents containing encrypted credential packages to strengthen the packaged files, ensuring that the document's creation time is reliable and that the document and its attachments are complete and tamper-proof.

[0061] Furthermore, step S11 specifically includes:

[0062] The document signing system first verifies the version and format of the packaged file, and then uses an index to verify the structural integrity of the packaged file. After confirming that the packaged file is complete and usable, it continues writing to transform the packaged file into the initial fixed packaged file. The writing begins with the last package end-of-file marker and uses I / O streams to fill in the data. The filling process is similar to the creation process: first, a package leader and version number are written as identifiers, and then groups and internal indexes are written.

[0063] like Figure 3As shown, the group written in this embodiment is a packet-fixed group. The group's components, in order of sequence, are: group flag, group type, timestamp starting byte sequence number of the first half of the file's protection range (generally 0, starting from the first byte of the file), timestamp ending byte sequence number of the first half of the file's protection range (i.e., the sequence number before the starting byte of the timestamp content), timestamp starting byte sequence number of the second half of the file's protection range (i.e., the sequence number after the ending byte of the timestamp content), timestamp ending byte sequence number of the second half of the file's protection range (generally the sequence number of the last byte of the last generated file), and fixed-length placeholder content (first filled with the character 0, generally 9000 bytes long, the capacity must be sufficient to hold a complete timestamp signature Hex-encoded string). After writing the group, an internal index is written, its structure being consistent with the internal index structure of the created packet. Then, an end marker is written to mark the end of the packet. After the initial hardened packet file is completed, the generation of the timestamped signature data plaintext begins. Based on the "start" and "end" intervals defined by the timestamps for the protection scope of the first half of the file, the content of the initial hardened packet file is read to form the first half of the timestamped protection data. Then, based on the "start" and "end" intervals defined by the timestamps for the protection scope of the second half of the file, the content of the initial hardened packet file is read to form the first half of the timestamped protection data. The two data segments are combined in sequence to form the timestamped signature data plaintext. Finally, a third-party timestamp is used to sign the data plaintext, generating the timestamped signature result.

[0064] Furthermore, after completing the timestamp signature, the informed consent system generates a reinforced packet file. The processing is as follows: The timestamp signature result is Hex-encoded to generate a timestamp content string. Based on the "end" byte sequence number of the protection range of the first half of the packet file according to the timestamp, the insertion position of the timestamp content is found. Then, using insertion padding, the original placeholder content filled with all zeros is rewritten as the timestamp content string. (At this time, the part of the placeholder content length exceeding the timestamp content string is still filled with zeros.) Finally, the processing of the solidified packet file is completed. S12: The reinforced packet file is pushed to the relevant parties who generated the electronic document, and they are properly stored. S13: When it is necessary to prove the validity of the electronic document signature, the relevant parties submit the reinforced packet file to the document signature system. The system automatically performs: verifying the integrity of the electronic document, verifying the validity of the timestamp signature, generating an electronic document verification report, and exporting the decrypted signature credential, completing the automatic issuance of the certificate.

[0065] In the technical solution of this invention, a closed-loop solution is provided for electronic signatures of users without CA certificates on site, ensuring the integrity, timeliness, confidentiality, authenticity and strong correlation of electronic documents, signatures and collected credentials, making electronic document signing more convenient and efficient, and reducing application costs.

[0066] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and RAMbus dynamic RAM (RDRAM), etc.

[0067] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0068] The above embodiments are preferred embodiments of the present invention, but the embodiments of the present invention are not limited to the above embodiments. Any changes, modifications, substitutions, combinations, or simplifications made without departing from the spirit and principle of the present invention shall be considered equivalent substitutions and shall be included within the protection scope of the present invention.

Claims

1. A method for on-site signing of electronic documents embedding signature authentication process information, characterized in that, Includes the following steps: S1. The document signature system receives electronic documents that require on-site signing; S2. The user opens the document signing device and obtains the electronic document that needs to be signed on-site from the document signing system; S3. The user selects the signature credential entry according to the actual signing scenario and performs the corresponding operation. The signature credential entry includes one or more of the following: on-site audio entry, on-site video recording, on-site photo entry, user identity information entry, and user fingerprint entry. S4. After the user completes the document signing, the document signing device automatically serializes the vouchers collected during the signing process, and packages and embeds attachments into the signature file and voucher file. S41. Create an empty file and fill it with data using I / O streams. The data filling process is as follows: First, write the packet preamble and version number as identifiers, then start writing file groups, and finally write the internal index. Each packet file consists of multiple groups of different types and an internal index. Since the index is written last, the starting sequence number of the group needs to be saved when writing the group. S42. The first group written is a signature file, which is of type "file" and consists of four parts, in order: group identifier, group type, data length label of the compressed group file, and file data after Deflate compression. S43. The second group to be written is the voucher attachment group. The type of the voucher attachment group is "encrypted file". The following are in order: group flag, group type, group encryption algorithm identifier, data length label after compression and encryption of the group file, and file data after Deflate compression and encryption. S44. Finally, write the internal index group. The internal index is used to solve the labeling problem of the group and the fast retrieval problem. Each group has a corresponding internal index. The internal indexes are in the following order: index leader, index number, full path of the group pointed to, and starting number of the corresponding group. The groups in the package file should correspond one-to-one with the index. S45. After writing all grouping and index information, mark the end of the packet with the end-of-write character, and complete the embedding of the signature file into the credential attachment; S5. The document signing device automatically sends the packaged file to the document signing system for solidification processing, specifically as follows: S51. The document signature system first verifies the version and format of the package file, and then uses an index to verify the structural integrity of the package file; S52. After confirming that the package file is complete and usable, continue writing the package file and transform it into the initial solidified package file; The continuation process begins from the last packet end marker in the file and fills the data using I / O streams. The filling process is as follows: first, the packet preamble and version number are written as identifiers, and then the group and internal index are written. S53. The type of group written is a packet-fixed group. The composition of the group, in order of sequence, is as follows: group flag, group type, timestamp starting byte sequence number of the protection range of the first half of the file, timestamp ending byte sequence number of the protection range of the first half of the file, timestamp starting byte sequence number of the protection range of the second half of the file, timestamp ending byte sequence number of the protection range of the second half of the file, and fixed-length placeholder content. S54. After completing the group writing, write the internal index. The internal index structure is consistent with the internal index structure of the created packet. Then write the end marker to mark the end of the packet. S55. After completing the initial solidified package file, start generating the original data text of the timestamp signature. According to the interval defined by the "start" and "end" of the protection range of the first half of the file by the timestamp, read the content of the initial solidified package file to form the first half of the timestamp protection data. Then, according to the interval defined by the "start" and "end" of the protection range of the second half of the file by the timestamp, read the content of the initial solidified package file to form the second half of the timestamp protection data. Combine the two segments of data together in the order of the timestamp signature to form the original data text of the timestamp signature. S56. Call a third-party timestamp to sign the original data and generate a timestamp signature result; The timestamp signature result is Hex encoded to generate a timestamp content string. The insertion position of the timestamp content is found according to the "end" byte sequence number of the protection range of the first half of the packet file based on the timestamp. Then, the placeholder content that was originally filled with 0 is rewritten into the timestamp content string by inserting and filling. At this time, the part of the placeholder content that exceeds the timestamp content string is still filled with 0. Finally, the processing of the solidified packet file is completed. S6. The document signature system pushes the reinforced and solidified packaged file to the relevant parties who generated the electronic document, and the relevant parties shall keep it properly. S7. When it is necessary to prove the validity of an electronic document signature, the relevant party shall submit a solidified package file to the document signature system, generate a verification report of the signed electronic document and export the decrypted signature credential, and complete the automatic issuance of the certificate.

2. The method for on-site signing of electronic documents embedding signature authentication process information according to claim 1, characterized in that, In step S2, when obtaining electronic documents that need to be signed on-site from the document signing system, the process is carried out through document retrieval, document distribution, and document download.

3. The method for on-site signing of electronic documents embedding signature authentication process information according to claim 1, characterized in that, In step S3, the on-site audio recording is performed using the audio recording function of the document signing device.

4. The method for on-site signing of electronic documents embedding signature authentication process information according to claim 1, characterized in that, In step S3, the on-site video recording is performed by the on-site video recording function of the document signing device.

5. The method for on-site signing of electronic documents embedding signature authentication process information according to claim 1, characterized in that, In step S3, the on-site photography and recording is carried out by taking photos on-site using the on-site photography function of the document signing device. During the photography process, you can choose to add a watermark with anti-counterfeiting mark and photo time.

6. The method for on-site signing of electronic documents embedding signature authentication process information according to claim 1, characterized in that, In step S3, the user identity information entry uses the on-site facial recognition ID information verification function of the document signing device to verify the identity of the signer, enter the signer's name, ID number and on-site facial image information, and use an authoritative third-party information database to verify the consistency between the facial image and ID information to verify the signer's true identity. After the verification is completed, the signer's name, ID number and facial information are collected as authentication credentials.

7. The method for on-site signing of electronic documents embedding signature authentication process information according to claim 1, characterized in that, In step S42, if there are multiple document attachments, multiple document attachment groups need to be written.

8. The method for on-site signing of electronic documents embedding signature authentication process information according to claim 1, characterized in that, In step S53, the starting byte sequence number of the timestamp protection range for the first half of the file starts from the first byte of the file; the ending byte sequence number of the timestamp protection range for the first half of the file is the sequence number before the starting byte of the timestamp content; the starting byte sequence number of the timestamp protection range for the second half of the file is the sequence number after the ending byte of the timestamp content; the ending byte sequence number of the timestamp protection range for the second half of the file is finally generated as the sequence number of the last byte of the file; the fixed-length placeholder content is first filled with the character 0, and the capacity must be able to accommodate a complete timestamp signature Hex encoded string.

Images