An Encryption and Decryption Method and System for Electronic Contracts Based on Mutual Authentication

Abstract

The present invention provides an encryption and decryption method and system for electronic contracts based on two-way authentication. The method includes: the client sends a certificate application to the bidding service institution; after the bidding service institution verifies the legality of the client, it sends the certificate application to the CA and the key management platform, signs the certificate data packet returned by the CA and the key management platform using the signature private key, and sends the signed certificate data packet, the signature value, and its own signature certificate to the client; after the client verifies the legality of the signature certificate of the bidding service institution, it uses the signature private key to decrypt the digital envelope in the certificate data packet to obtain a temporary symmetric key, and then signs and encrypts the electronic contract using its own signature private key and the temporary symmetric key, and sends the encrypted electronic contract to the bidding center through the bidding service institution. Since the client and the bidding service institution conduct two-way verification, the security of both parties' identities is ensured, and the contract is protected using a single-use temporary symmetric key, thereby ensuring the security of the contract.

Description

Technical Field

[0001] The present invention relates to the technical field of electronic bidding, and particularly to an electronic contract encryption and decryption method and system based on two-way authentication. Background Art

[0002] The signing of an electronic contract needs to be transmitted through the network. To ensure the security of the electronic contract, both parties signing the contract need to encrypt and protect the electronic contract as required to ensure the security of the contract.

[0003] The existing encryption and decryption methods for electronic contracts mainly include: software encryption and hardware encryption. Software encryption and decryption encrypt the electronic contract through a series of soft algorithms. Although it can protect the content of the contract, it lacks a two-way authentication link and has security vulnerabilities. For hardware encryption, the electronic contract is first stored in a specific encrypted USB flash drive. When the contract is to be signed, the bidder then imports the content of the USB flash drive into a dedicated machine. This method requires a large amount of time and labor costs and is inefficient. Summary of the Invention

[0004] In view of the above problems, embodiments of the present invention provide an electronic contract encryption and decryption method and system based on two-way authentication to overcome or at least partially solve the above problems.

[0005] In a first aspect of an embodiment of the present invention, an electronic contract encryption and decryption method based on two-way authentication is disclosed. The method includes:

[0006] The client sends a certificate application to the bidding service institution, and the certificate application is used to apply for a signature certificate and an encryption certificate;

[0007] The bidding service institution verifies the legitimacy of the client. After the verification passes, the certificate application is sent to the trusted certificate issuing platform CA and the key management platform;

[0008] After the CA and the key management platform verify the certificate application as legal, a certificate data packet is returned to the bidding service institution;

[0009] The bidding service institution signs the certificate data packet with its own signature private key, and packs and sends the signed certificate data packet, the signature value, and its own signature certificate to the client;

[0010] The client verifies the legitimacy of the signature certificate of the bidding service institution by using the stored root certificate. After the verification passes, the client uses the signature private key to decrypt the digital envelope in the certificate data packet to obtain a temporary symmetric key;

[0011] The client signs the electronic contract using its own signature private key, encrypts the signed electronic contract using the temporary symmetric key to obtain an encrypted electronic contract, and sends the encrypted electronic contract to the tender center through the tender service institution.

[0012] Optionally, the certificate data packet further includes an encrypted certificate private key protected by a digital envelope; the next time the client conducts a tender in the following manner:

[0013] The client sends the unique user ID and a service message to the tender service institution, where the service message is used to request a new temporary symmetric key from the tender service institution and inform the tender service institution that the client has completed authentication;

[0014] The tender service institution requests the generation of a new temporary symmetric key from the key management platform according to the unique user ID;

[0015] After the key management platform generates a new temporary symmetric key, it encrypts the new temporary symmetric key using the encrypted certificate public key and returns the encrypted new temporary symmetric key to the client through the tender service institution;

[0016] The client decrypts it using the encrypted certificate private key to obtain the new temporary symmetric key;

[0017] The client signs the electronic contract using its own signature private key, encrypts the signed electronic contract using the new temporary symmetric key to obtain an encrypted electronic contract, and sends the encrypted electronic contract to the tender center through the tender service institution.

[0018] Optionally, before the client sends a certificate application to the tender service institution, the method further includes:

[0019] Register the unique user ID in the tender service institution and obtain a password device;

[0020] Apply to the password device for an asymmetric key for signature, where the asymmetric key includes: a signature public key and a signature private key;

[0021] The password device generates an asymmetric key through a first algorithm and returns it.

[0022] Optionally, the client sending a certificate application to the tender service institution includes:

[0023] Form a data packet with its own signature public key and the unique user ID and send it to the tender service institution for certificate application;

[0024] The tender service institution verifies the legitimacy of the client, including:

[0025] The bidding service institution compares the unique user ID in the data packet with the unique user ID recorded when the client is registered. If the two are consistent, the verification passes.

[0026] Optionally, the client verifies the legality of the signature certificate of the bidding service institution by using the stored root certificate, including:

[0027] Verifying the certificates in the certificate chain of the signature certificate of the bidding service institution in sequence. If it is verified that the root certificate is consistent with the stored root certificate, the verification passes.

[0028] Optionally, the digital envelope is obtained in the following manner:

[0029] The key management platform generates a temporary symmetric key and an encrypted certificate private key;

[0030] Encrypt the encrypted certificate private key by using a second algorithm to obtain a ciphertext;

[0031] Encrypt the temporary symmetric key and the initialization vector used when encrypting the encrypted certificate private key by using the public key of the client signature certificate to obtain a digital envelope.

[0032] Optionally, sending the encrypted electronic contract to the bidding center through the bidding service institution includes:

[0033] The bidding service institution sends the encrypted electronic contract to the key management platform;

[0034] The key management platform decrypts the encrypted electronic contract by using the temporary symmetric key to obtain an electronic contract, calculates the digital signature of the electronic contract, and sends the digital signature and the electronic contract to the bidding center.

[0035] Optionally, the method further includes:

[0036] The bidding service institution requests the temporary symmetric key of the client from the key management platform according to the unique user ID;

[0037] The key management platform encrypts the temporary symmetric key by using the public key of the encryption certificate of the bidding service institution and sends the encrypted temporary symmetric key to the bidding service institution;

[0038] The bidding service institution decrypts the encrypted temporary symmetric key to obtain the temporary symmetric key;

[0039] Use the temporary symmetric key to decrypt the encrypted electronic contract to obtain an electronic contract, and store the electronic contract.

[0040] Optionally, the method further includes:

[0041] The bidding service agency calculates the digital signature of the electronic contract, compares the digital signature with the digital signature received by the bidding center, and determines whether the electronic contract has been tampered with.

[0042] In a second aspect of the embodiments of the present invention, an electronic contract encryption and decryption system based on two-way authentication is disclosed, which is used to execute the electronic contract encryption and decryption method based on two-way authentication described in the first aspect of the embodiments of the present invention. The system includes:

[0043] A client, which is used to send a certificate application to the bidding service agency; verify the legality of the signature certificate of the bidding service agency by using the stored root certificate, and after the verification passes, use the signature private key to decrypt the digital envelope in the certificate data packet to obtain a temporary symmetric key; sign the electronic contract by using its own signature private key, and encrypt the signed electronic contract by using the temporary symmetric key to obtain an encrypted electronic contract, and send the encrypted electronic contract to the bidding center through the bidding service agency;

[0044] A bidding service agency, which is used to verify the legality of the client, and after the verification passes, send the certificate application to the CA and the key management platform; sign the certificate data packet by using its own signature private key, and package and send the signed certificate data packet, the signature value, and its own signature certificate to the client;

[0045] The CA and the key management platform, after verifying the legality of the certificate application, return the certificate data packet to the bidding service agency.

[0046] The embodiments of the present invention have the following advantages:

[0047] In the embodiments of the present invention, an electronic contract encryption and decryption method based on two-way authentication is proposed. First, the client sends a certificate application to the bidding service agency, and the bidding service agency verifies the legality of the client. If the verification passes, the certificate application is sent to the CA and the key management platform; then, after the CA and the key management platform verify the legality of the certificate application, the certificate data packet is returned to the bidding service agency; then, the bidding service agency signs the certificate data packet by using its own signature private key, and packages and sends the signed certificate data packet, the signature value, and its own signature certificate to the client; after that, when the client verifies the legality of the signature certificate of the bidding service agency, the digital envelope in the certificate data packet is decrypted by using the signature private key to obtain a temporary symmetric key; thus, the two-way verification between the client and the bidding service agency is completed. Furthermore, on the premise of ensuring security, the client sends the encrypted electronic contract to the bidding center through the bidding service agency.

[0048] Since the client and the bidding service agency need to conduct two-way verification, the security of both parties' identities is ensured. Only legal recipients and senders can obtain the electronic contract, and the electronic contract is not subject to multiple interactions, thus ensuring the security of the electronic contract. In addition, the temporary symmetric key used to encrypt the electronic contract is protected by a digital envelope, and the temporary symmetric key is only valid once, further preventing the leakage of electronic contract information. Moreover, the private key for signing the electronic contract is only known to the signer. Therefore, by signing the electronic contract with the private key, it effectively prevents the electronic contract from being forged, and the electronic contract signed with the private key can be used as the basis for identity authentication to prevent the repudiation after the electronic contract is sent. Therefore, based on the electronic contract encryption and decryption method based on two-way authentication in this embodiment, it can break through the limitations of space and geography, efficiently realize the signing of remote contracts, and save a large amount of time and labor costs. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following will briefly introduce the drawings required for the description of the embodiments of the present invention. Obviously, the drawings in the following description are only some embodiments of the present invention. For those of ordinary skill in the art, without creative efforts, other drawings can also be obtained based on these drawings.

[0050] Figure 1 is a flowchart of the steps of an electronic contract encryption and decryption method based on two-way authentication provided by an embodiment of the present invention;

[0051] Figure 2 is a schematic diagram of the overall process of an electronic contract encryption and decryption method based on two-way authentication provided by an embodiment of the present invention;

[0052] Figure 3 is a schematic diagram of the bidding process after two-way authentication provided by an embodiment of the present invention;

[0053] Figure 4 is a schematic diagram of the structure of an electronic contract encryption and decryption system based on two-way authentication provided by an embodiment of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0054] In order to make the above objects, features, and advantages of the present invention more obvious and understandable, the following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the drawings in the embodiments of the present invention. Obviously, the described embodiments are some, but not all, of the embodiments of the present invention. All other embodiments obtained by those of ordinary skill in the art without creative efforts based on the embodiments of the present invention belong to the scope of protection of the present invention.

[0055] The applicant has put forward the following core technical conceptions: to protect electronic contracts through an encryption and decryption method for electronic contracts based on two-way authentication, build a key management platform, a trusted certification platform CA, and a secure hardware environment such as cryptographic devices, and use cryptographic technologies such as identity authentication, digital signature, and digital envelope to enhance security, so as to ensure that the content of electronic contracts is not tampered with, the plaintext does not land, and sensitive data is not leaked, etc. During the remote signing process, a two-way authentication system is established to protect against malicious third-party attacks and ensure the legal identities of both parties before sending the electronic contract.

[0056] An embodiment of the present invention provides an encryption and decryption method for electronic contracts based on two-way authentication, as Figure 1 shown, Figure 1 is a step flowchart of an encryption and decryption method for electronic contracts based on two-way authentication provided by an embodiment of the present invention. The method includes steps S101 to S106:

[0057] Step S101: The client sends a certificate application to the tender service institution, and the certificate application is used to apply for a signature certificate and an encryption certificate.

[0058] In this embodiment, the client is a client authorized by the user. The client can verify the legality of the recipient of the electronic contract (i.e., the tender service institution) to achieve the remote transmission and signing of the electronic contract. The tender service institution is an institution authorized by the tender center. The tender service institution can verify the legality of the sender of the electronic contract (i.e., the client) on behalf of the tender center and receive the electronic contract sent by the authenticated legal client. Among them, the tender service institution can be a bank or other third-party institutions.

[0059] Use the client to send a certificate application to the tender service institution. Among them, the signature certificate is used to prove the legality of the client's signature, and the encryption certificate is used to prove the legality of the client's encryption and decryption. For example, when the client signs using its own signature private key, the tender service institution can query the legality of the signature certificate of the signature.

[0060] In an alternative embodiment, before the client sends a certificate application to the tender service institution, it is also necessary to obtain a signature key and a unique user ID, specifically including:

[0061] Register the unique user ID in the tender service institution and obtain a cryptographic device;

[0062] Apply to the cryptographic device for an asymmetric key for signature, and the asymmetric key includes: a signature public key and a signature private key;

[0063] The cryptographic device generates an asymmetric key through a first algorithm and returns it.

[0064] In this application, the first algorithm may refer to the SM2 algorithm. After receiving a key application, the cryptographic device generates a signature public key and a signature private key using the SM2 algorithm. Among them, the signature public key and the signature private key are a pair of asymmetric key pairs, which can be used for encryption and decryption. Specifically, the signature public key can be shared with other data interaction parties (such as tender service institutions, key management platforms, etc.). Then, other data interaction parties use the client's signature public key to encrypt the data to be sent, and the client decrypts the encrypted data using its own signature private key to obtain the decrypted data. Since only the client itself knows the signature private key, the accuracy of data transmission is ensured. In addition, the client can also use the signature private key to sign the electronic contract.

[0065] Further, the client sends a certificate application to the tender service institution, including: forming a data packet with its own signature public key and the unique user ID, and sending it to the tender service institution for certificate application. After receiving the data packet composed of the signature public key and the unique user ID, the tender service institution can verify the legitimacy of the client based on the unique user ID.

[0066] Step S102: The tender service institution verifies the legitimacy of the client. After the verification passes, it sends the certificate application to the trusted certificate authority platform CA and the key management platform.

[0067] In this embodiment, after receiving the client's certificate application, the tender service institution needs to determine the legitimacy of the client. Specifically, the verification of the legitimacy of the client by the tender service institution means that the tender service institution compares the unique user ID in the data packet with the unique user ID recorded when the client was registered. If the two are the same, the verification passes. That is, when the tender service institution receives the certificate application, it uses the unique user ID in the data packet to query the database. If there is a unique user ID in the database that is the same as the unique user ID in the data packet, it means that the unique user ID is legal, that is, the client is legal.

[0068] Therefore, by verifying the legitimacy of the client, the tender service institution can ensure that only users who have been pre-registered in the tender service institution can apply for certificates, effectively preventing malicious third-party attacks.

[0069] After passing the verification, the bidding service agency sends the certificate application to the CA (Certicate Authority, trusted certificate issuing platform) and the key management platform, and uses the CA and the key management platform to help the client apply for a certificate. Among them, the CA is an authoritative agency responsible for issuing and managing digital certificates (such as signature certificates and encryption certificates), and as a trusted third party, it undertakes the responsibility of verifying the legitimacy of the public key in the public key system; the key management platform is used to generate and manage keys to protect the confidentiality, integrity and availability of the keys.

[0070] Step S103: After the CA and the key management platform verify the legitimacy of the certificate application, return the certificate data packet to the bidding service agency.

[0071] In this embodiment, the bidding service agency uses the CA and the key management platform to help the client apply for a certificate, and then the bidding service agency, the CA, and the key management platform have pre-agreed on a key to protect the security of the certificate application. Therefore, after the CA and the key management platform receive the certificate application, they use the pre-agreed key to judge the legitimacy of the certificate application. In addition, the CA and the key management platform can also use the unique user ID to judge the legitimacy of the certificate application.

[0072] After the certificate application is verified to be legal, the CA generates corresponding certificates, namely signature certificates and encryption certificates. At the same time, the key management platform generates and saves relevant keys. The relevant keys refer to the temporary symmetric key for encrypting and decrypting the electronic contract, the public key of the encryption certificate, and the private key of the encryption certificate. Among them, the public key of the encryption certificate and the private key of the encryption certificate are a pair of asymmetric key pairs, and the public key of the encryption certificate and the private key of the encryption certificate are used when the client (the client and the bidding service agency have completed two-way authentication for the first time) needs to bid again to encrypt and decrypt the newly obtained temporary symmetric key. Then the key management platform protects the temporary symmetric key and the private key of the encryption certificate with a digital envelope. Finally, the CA and the key management platform package the signature certificate, the encryption certificate, and the temporary symmetric key and the private key of the encryption certificate saved in the digital envelope into a certificate data packet and send it to the bidding service agency.

[0073] In an alternative embodiment, the digital envelope is obtained in the following manner:

[0074] The key management platform generates a temporary symmetric key and a private key of an encryption certificate; encrypts the private key of the encryption certificate using a second algorithm to obtain a ciphertext; encrypts the temporary symmetric key and the initialization vector used when encrypting the private key of the encryption certificate using the signature public key of the client to obtain a digital envelope.

[0075] Among them, the key management platform generates a 16-byte random number as a temporary symmetric key. The temporary symmetric key is a one-time valid key, that is, it becomes invalid after being used and cannot be used again. The private key of the encryption certificate is encrypted using a second algorithm, which can be to encrypt the private key of the encryption certificate using the CBC mode (Cipher Block Chaining) of the SM4 algorithm, thereby obtaining the ciphertext.

[0076] Specifically, the process of encrypting the private key of the encryption certificate using the CBC model of the SM4 algorithm includes: First, set an initialization vector; then, divide the private key of the encryption certificate into N groups of data, encrypt the result of the XOR operation between the first group of data and the initialization vector to obtain the first group of ciphertext; then, encrypt the result of the XOR operation between the second group of data and the first group of ciphertext to obtain the second group of ciphertext; and so on for the subsequent data to obtain the ciphertext of each group of data. Connect the ciphertexts from the first group to the Nth group in sequence to obtain the ciphertext corresponding to the private key of the encryption certificate.

[0077] After that, the temporary symmetric key and the initialization vector used by the second algorithm when encrypting the private key of the encryption certificate are encrypted using the signature public key of the client to obtain a digital envelope. Among them, the signature public key of the client is obtained from the data packet sent when the client applies for a certificate. Since the signature public key and the signature private key of the client are a pair of asymmetric keys, in subsequent steps, the client can use its own signature private key to decrypt the digital envelope.

[0078] Step S104: The tender service institution signs the certificate data packet using its own signature private key, and packs and sends the signed certificate data packet, the signature value, and its own signature certificate to the client.

[0079] In this embodiment, after receiving the certificate data packet returned by the CA and the key management platform, the tender service institution signs the certificate data packet so that in subsequent steps, the client can verify the legality of the tender service institution's certificate.

[0080] Step S105: The client verifies the legality of the signature certificate of the tender service institution using the stored root certificate. After the verification passes, the client uses the signature private key to decrypt the digital envelope in the certificate data packet to obtain the temporary symmetric key.

[0081] In this embodiment, the root certificate of the CA that issues the signature certificate to the tender service institution is stored in the client. Furthermore, the client can verify the legality of the signature certificate of the tender service institution through the stored root certificate.

[0082] Specifically, the client uses the stored root certificate to verify the legality of the signature certificate of the tender service institution, including: verifying the certificates in the certificate chain of the signature certificate of the tender service institution in sequence. If it is verified that the root certificate is consistent with the stored root certificate, the verification passes. Among them, the certificate chain of the signature certificate refers to starting from the signature certificate of the tender service institution, then a series of intermediate CA certificates, and finally the root certificate.

[0083] Therefore, verifying the certificates in the certificate chain of the signature certificate of the tender service institution in sequence means using the public key of the next certificate in the certificate chain to verify the signature (signature value) of the current certificate, and continuously checking until the end of the certificate chain (i.e., the root certificate). If all verifications are successfully passed, it indicates that the signature certificate of the tender service institution is trustworthy. When verifying the root certificate, the client matches the stored root certificate with the verified root certificate to see if they are consistent.

[0084] After the client successfully verifies the legality of the signature certificate of the tender service institution, it indicates that the tender service institution is trustworthy. At this time, the client and the tender service institution complete mutual authentication. Then, verify the signed certificate data packet to obtain the client's signature certificate, encryption certificate, and digital envelope. Since the digital envelope is encrypted using the client's signature public key, the client can use its own signature private key to decrypt the digital envelope to obtain the temporary symmetric key, ciphertext, and initialization vector, and then decrypt the ciphertext based on the initialization vector and encryption algorithm to obtain the encryption certificate private key.

[0085] Through the methods of the above steps S101 to S105, mutual verification between the client and the tender service institution is achieved, thereby ensuring the legality of both parties before the electronic contract interaction. Only when both the client and the tender service institution are legal will the electronic contract be sent.

[0086] Step S106: The client signs the electronic contract using its own signature private key, and encrypts the signed electronic contract using the temporary symmetric key to obtain an encrypted electronic contract, and sends the encrypted electronic contract to the tender center through the tender service institution.

[0087] In this embodiment, since only the client knows its signature private key for signing, the client signs the electronic contract using its own signature private key, which can effectively prevent the electronic contract from being forged. Moreover, the electronic contract signed with the private key can be used as the basis for identity authentication and as evidence of the signer's signature operation to prevent repudiation after the electronic contract is sent. The signed electronic contract is encrypted using the obtained temporary symmetric key to protect the electronic contract. Then, the encrypted electronic contract is sent to the tender center through the tender service institution. Since the tender service institution and the client have completed two-way authentication, the security of the contract transmission is guaranteed.

[0088] In an alternative embodiment, the step of sending the encrypted electronic contract to the tender center through the tender service institution includes:

[0089] The tender service institution sends the encrypted electronic contract to the key management platform;

[0090] The key management platform decrypts the encrypted electronic contract using the temporary symmetric key to obtain the electronic contract, calculates the digital signature of the electronic contract, and sends the digital signature and the electronic contract to the tender center.

[0091] In this embodiment, the tender service institution does not know the temporary symmetric key used by the client to encrypt the electronic contract. Therefore, the key management platform is used to securely send the electronic contract to the tender center. By calculating the digital signature of the electronic contract, the key management platform effectively performs anti-counterfeiting processing on the electronic contract. The digital signature includes a digital digest and the client's signature. Once the information is tampered with after the electronic contract and the digital signature are sent to the tender center, the tender center can determine that the contract is invalid by calculating the digital digest and verifying the signature, thus ensuring the integrity of the contract.

[0092] In an alternative embodiment, the tender service institution backs up the electronic contract to ensure the security of the electronic contract. Specifically, it includes:

[0093] The tender service institution requests the temporary symmetric key of the client from the key management platform according to the unique user ID;

[0094] The key management platform encrypts the temporary symmetric key using the public key of the encryption certificate of the tender service institution and sends the encrypted temporary symmetric key to the tender service institution;

[0095] The tender service institution decrypts the encrypted temporary symmetric key to obtain the temporary symmetric key;

[0096] Decrypt the encrypted electronic contract using the temporary symmetric key to obtain the electronic contract, and store the electronic contract.

[0097] In this embodiment, the bidding service institution requests the temporary symmetric key of the client from the key management platform. To ensure the security of the temporary key, the key management platform encrypts it using the public key of the encryption certificate of the bidding service institution. After receiving the encrypted temporary symmetric key, the bidding service institution decrypts it using its own private key of the encryption certificate. Since only the bidding service institution itself knows the private key of the encryption certificate, the bidding service institution realizes the secure acquisition of the temporary symmetric key. Then, the encrypted electronic contract is decrypted using the temporary symmetric key to obtain the original text of the electronic contract. Finally, the original text of the electronic contract is stored locally to implement the backup of the electronic contract.

[0098] In an alternative embodiment, it is possible to determine whether the content of the electronic contract has been maliciously tampered with by comparing the electronic contract received by the bidding center with the electronic contract stored by the bidding service institution. The method includes:

[0099] The bidding service institution calculates the digital signature of the electronic contract and compares it with the digital signature received by the bidding center to determine whether the electronic contract has been tampered with. If the digital signature calculated by the bidding service institution is inconsistent with the digital signature of the bidding center, it indicates that the contract has been maliciously tampered with.

[0100] Figure 2 Schematically shows the overall flowchart of the electronic contract encryption and decryption method based on two-way authentication. Specifically, it includes the following processes: First, the client requests the asymmetric keys (i.e., the signature public key and the signature private key) from the key management platform, and then sends a data packet composed of the signature public key and the unique user ID to the bidding service institution for certificate application; then, the bidding service institution verifies the legitimacy of the client. After passing the verification, it sends the certificate application to the CA and the key management platform; after that, after the CA and the key management platform verify the certificate application as legal, they return the certificate data packet to the bidding service institution; the bidding service institution signs the certificate data packet using its own signature private key and sends the signed certificate data packet, the signature value, and its own signature certificate to the client; finally, the client verifies the legitimacy of the signature certificate of the bidding service institution using the stored root certificate. After passing the verification, it uses the signature private key to unlock the digital envelope in the certificate data packet to obtain the temporary symmetric key and the private key of the encryption certificate; thus, the client and the bidding service institution complete the two-way verification. Furthermore, on the premise of ensuring security, the client signs and encrypts the electronic contract using its own signature private key and the temporary symmetric key, and sends the encrypted electronic contract to the bidding center through the bidding service institution; to ensure the security of the electronic contract, the bidding service institution also needs to back up the electronic contract.

[0101] It should be noted that the above embodiments are the processes in which the client uses the bidding service agency to conduct bidding for the first time (i.e., the above steps S102 to S106). Since the client and the bidding service agency do not know whether each other is secure during the first bidding, two-way authentication is required. When the client and the bidding service agency have completed two-way authentication, when the client conducts the next bidding, it does not need to conduct authentication again and can directly request a new temporary symmetric key from the bidding service agency to encrypt and decrypt the electronic contract.

[0102] In an alternative embodiment, as Figure 3 shown, the client conducts bidding in the following manner next time, which specifically includes:

[0103] The client sends the unique user ID and the service message to the bidding service agency. The service message is used to request a new temporary symmetric key from the bidding service agency and tells the bidding service agency that the client has completed authentication;

[0104] The bidding service agency requests the key management platform to generate a new temporary symmetric key according to the unique user ID;

[0105] After the key management platform generates a new temporary symmetric key, it encrypts the new temporary symmetric key using the public key of the encryption certificate and returns the encrypted new temporary symmetric key to the client through the bidding service agency;

[0106] The client decrypts it using the private key of the encryption certificate to obtain the new temporary symmetric key;

[0107] The client signs the electronic contract using its own signature private key and encrypts the signed electronic contract using the new temporary symmetric key to obtain an encrypted electronic contract, and sends the encrypted electronic contract to the bidding center through the bidding service agency.

[0108] In this embodiment, when the client conducts bidding for the first time, the certificate data packet received also includes the private key of the client's encryption certificate protected by a digital envelope; and the public key of the client's encryption certificate is also stored in the key management platform. Therefore, when conducting bidding for the next time, the new temporary symmetric key is encrypted and decrypted using the public key and private key of the encryption certificate, thus ensuring the security of the new temporary symmetric key.

[0109] Specifically, when the bidding service institution receives the unique user ID and business message sent by the client, it can query based on the unique user ID to determine whether two-way authentication with the client has been completed. Then, it uses the unique user ID to request the key management platform to generate a new temporary symmetric key. The key management platform randomly generates a 16-byte random number as the new temporary symmetric key, encrypts the new temporary symmetric key using the pre-stored encryption certificate public key, and returns the encrypted new temporary symmetric key to the client through the bidding service institution. Finally, after obtaining the new temporary symmetric key, the client uses its own signature private key and the new temporary symmetric key to sign and encrypt the electronic contract, and sends the encrypted electronic contract to the bidding center through the bidding service institution; and to ensure the security of the electronic contract, the bidding service institution backs up the electronic contract.

[0110] In this embodiment, for the client and the bidding service institution that have completed two-way verification, there is no need to perform repeated authentication when bidding again, thereby improving the efficiency of the bidding process. At the same time, the new temporary symmetric key used to protect the electronic contract is protected based on the asymmetric key pair (i.e., the encryption certificate private key and the encryption certificate public key) generated by the key management platform, ensuring the security of the new temporary symmetric key.

[0111] In addition, in practical applications, the blockchain is used to record the data transactions between various data interaction entities (such as the client, the bidding service institution, the CA, and the key management platform), that is, the blockchain records the requests initiated by the interaction entities and records the corresponding return results, thereby realizing the traceability of data transactions. For example, the client uploads a data packet composed of the signature public key and the unique user ID to the blockchain for storage. Then, the bidding service institution sends the client's certificate application to the CA and the key management platform through the blockchain. After that, when the bidding service institution sends the signed certificate data packet, the signature value, and its own signature certificate to the client, a data transaction is completed on the blockchain, that is, the return data received by the client in the certificate application sent by the client will be recorded in the blockchain.

[0112] In the embodiment of the present invention, since two-way verification is required between the client and the bidding service institution, the security of the identities of both parties is ensured. Only legal recipients and senders can obtain the electronic contract, and the electronic contract is not subject to multiple interactions, thus ensuring the security of the electronic contract. Moreover, the temporary symmetric key used to encrypt the electronic contract is protected by a digital envelope, and the temporary symmetric key is only valid once, further preventing the leakage of electronic contract information. In addition, the signature private key used to sign the electronic contract is only known to the signer. Therefore, by signing the electronic contract with the signature private key, it effectively prevents the electronic contract from being forged, and the electronic contract signed with the private key can be used as the basis for identity authentication to prevent repudiation after the electronic contract is sent. Therefore, based on the method for encrypting and decrypting electronic contracts based on two-way authentication in this embodiment, it is possible to break through the limitations of space and geography, efficiently implement the signing of remote contracts, and save a large amount of time and labor costs.

[0113] Compared with the existing technologies, the method for encrypting and decrypting electronic contracts based on two-way authentication in this embodiment establishes a two-way authentication system and repairs the security vulnerabilities existing in the existing electronic contract encryption and decryption technologies. This method uses cryptographic technologies such as identity authentication, digital signature, and digital envelope, which are difficult to be cracked unilaterally, and is easy to use, with strong practicality and broad application prospects.

[0114] The embodiment of the present invention provides an electronic contract encryption and decryption system based on two-way authentication, which is used to execute the method for encrypting and decrypting electronic contracts based on two-way authentication described in the above embodiment, as Figure 4 shown Figure 4 is a schematic structural diagram of an electronic contract encryption and decryption system based on two-way authentication provided by the embodiment of the present invention. The system 400 includes:

[0115] A client 410, which is used to send a certificate application to the bidding service institution; verify the legality of the signature certificate of the bidding service institution using the stored root certificate, and after the verification passes, use the signature private key to unlock the digital envelope in the certificate data packet to obtain the temporary symmetric key; sign the electronic contract using its own signature private key, and encrypt the signed electronic contract using the temporary symmetric key to obtain an encrypted electronic contract, and send the encrypted electronic contract to the bidding center through the bidding service institution;

[0116] A bidding service institution 420, which is used to verify the legality of the client, and after the verification passes, send the certificate application to the CA and the key management platform; sign the certificate data packet using its own signature private key, and package and send the signed certificate data packet, the signature value, and its own signature certificate to the client;

[0117] The CA and key management platform 430, after verifying the legality of the certificate application, returns the certificate data packet to the tender service institution.

[0118] Each embodiment in this specification is described in a progressive manner. The key point of each embodiment is the difference from other embodiments. For the same or similar parts among the embodiments, reference can be made to each other.

[0119] The embodiments of the present invention are described with reference to the flowcharts and / or block diagrams of the methods and systems according to the embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal devices to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal devices generate a device for realizing the functions specified in Figure 1 one process or multiple processes and / or blocks Figure 1 one block or multiple blocks.

[0120] These computer program instructions can also be stored in a computer-readable memory that can direct a computer or other programmable data processing terminal device to work in a specific manner, so that the instructions stored in the computer-readable memory generate a manufactured article including an instruction device, and the instruction device realizes the functions specified in Figure 1 one process or multiple processes and / or blocks Figure 1 one block or multiple blocks.

[0121] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device, so that a series of operation steps are executed on the computer or other programmable terminal device to generate a computer-implemented process. Thus, the instructions executed on the computer or other programmable terminal device provide steps for realizing the functions specified in Figure 1 one process or multiple processes and / or blocks Figure 1 one block or multiple blocks.

[0122] Although the preferred embodiments of the embodiments of the present invention have been described, those skilled in the art can make additional changes and modifications once they know the basic creative concepts. Therefore, the appended claims are intended to be construed as including the preferred embodiments and all changes and modifications falling within the scope of the embodiments of the present invention.

[0123] Finally, it should also be noted that in this text, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the term "comprising", "including" or any other variant thereof is intended to cover non-exclusive inclusion, so that a process, method, article or terminal device comprising a series of elements not only includes those elements, but also includes other elements not expressly listed, or elements inherent to such process, method, article or terminal device. Without further limitation, an element defined by the statement "comprising an..." does not exclude the presence of additional identical elements in the process, method, article or terminal device comprising the element.

[0124] The above has introduced in detail a kind of electronic contract encryption and decryption and system based on two-way authentication provided by the present invention. Specific examples are used in this text to elaborate on the principle and implementation manner of the present invention. The description of the above embodiments is only used to help understand the method and its core idea of the present invention; at the same time, for those of ordinary skill in the art, according to the idea of the present invention, there will be changes in the specific implementation manner and application scope. In summary, the content of this specification should not be construed as a limitation to the present invention.

Claims

1. A method for encrypting and decrypting electronic contracts based on two-way authentication, characterized in that The method includes: The client sends a certificate application to the tender service institution, and the certificate application is used to apply for a signature certificate and an encryption certificate; The tender service institution verifies the legitimacy of the client, and after passing the verification, sends the certificate application to the trusted certificate issuing platform CA and the key management platform; After the CA and the key management platform verify the certificate application as legal, they return a certificate data packet to the tender service institution; The tender service institution signs the certificate data packet with its own signature private key, and packs and sends the signed certificate data packet, the signature value, and its own signature certificate to the client; The client verifies the legitimacy of the tender service institution's signature certificate using the stored root certificate, and after passing the verification, uses the signature private key to decrypt the digital envelope in the certificate data packet to obtain a temporary symmetric key; The client signs the electronic contract with its own signature private key, and encrypts the signed electronic contract using the temporary symmetric key to obtain an encrypted electronic contract, and sends the encrypted electronic contract to the tender center through the tender service institution; Wherein, the certificate data packet further includes an encrypted certificate private key protected by a digital envelope; the next time the client bids in the following way: The client sends the unique user ID and the service message to the tender service institution, and the service message is used to request a new temporary symmetric key from the tender service institution and tell the tender service institution that the client has completed authentication; The tender service institution requests the key management platform to generate a new temporary symmetric key according to the unique user ID; After the key management platform generates a new temporary symmetric key, it encrypts the new temporary symmetric key using the public key of the encryption certificate, and returns the encrypted new temporary symmetric key to the client through the tender service institution; The client decrypts it using the private key of the encryption certificate to obtain the new temporary symmetric key; The client signs the electronic contract with its own signature private key, and encrypts the signed electronic contract using the new temporary symmetric key to obtain an encrypted electronic contract, and sends the encrypted electronic contract to the tender center through the tender service institution.

2. The method according to claim 1, wherein Before the client sends a certificate application to the tender service institution, the method further includes: Register the unique user ID in the tender service institution and obtain a password device; Apply to the password device for an asymmetric key for signature, and the asymmetric key includes: a signature public key and a signature private key; The password device generates an asymmetric key through a first algorithm and returns it.

3. The method according to claim 2, characterized in that The client sending a certificate application to the tender service institution includes: Forming a data packet with its own signature public key and the unique user ID, and sending it to the tender service institution for certificate application; The tender service institution verifying the legitimacy of the client includes: The tender service institution compares the unique user ID in the data packet with the unique user ID recorded when the client registered. If the two are the same, the verification passes.

4. The method according to claim 1, wherein The client uses the stored root certificate to verify the legality of the signature certificate of the tender service institution, including: Verify the certificates in the certificate chain of the signature certificate of the tender service institution one by one. If it is verified that the root certificate is consistent with the stored root certificate, the verification passes.

5. The method according to claim 1, wherein The digital envelope is obtained in the following manner: The key management platform generates a temporary symmetric key and an encrypted certificate private key; Encrypt the encrypted certificate private key using a second algorithm to obtain a ciphertext; Encrypt the temporary symmetric key and the initialization vector used when encrypting the encrypted certificate private key using the second algorithm using the public key of the client signature certificate to obtain a digital envelope.

6. The method according to claim 1, characterized in that, Sending the encrypted electronic contract to the tender center through the tender service institution includes: The tender service institution sends the encrypted electronic contract to the key management platform; The key management platform decrypts the encrypted electronic contract using the temporary symmetric key to obtain an electronic contract, calculates the digital signature of the electronic contract, and sends the digital signature and the electronic contract to the tender center.

7. The method according to claim 6, wherein The method further includes: The tender service institution requests the temporary symmetric key of the client from the key management platform according to the unique user ID; The key management platform encrypts the temporary symmetric key using the public key of the encrypted certificate of the tender service institution and sends the encrypted temporary symmetric key to the tender service institution; The tender service institution decrypts the encrypted temporary symmetric key to obtain the temporary symmetric key; Decrypt the encrypted electronic contract using the temporary symmetric key to obtain an electronic contract, and store the electronic contract.

8. The method according to claim 7, characterized in that, The method further includes: The tender service institution calculates the digital signature of the electronic contract and compares the digital signature with the digital signature received by the tender center to determine whether the electronic contract has been tampered with.

9. An electronic contract encryption and decryption system based on mutual authentication, characterized in that For implementing the electronic contract encryption and decryption method based on two-way authentication according to any one of claims 1-8, the system includes: A client, which is used to send a certificate application to the tender service institution; verify the legality of the signature certificate of the tender service institution using the stored root certificate, and after the verification passes, use the signature private key to unlock the digital envelope in the certificate data packet to obtain a temporary symmetric key; sign the electronic contract using its own signature private key, and encrypt the signed electronic contract using the temporary symmetric key to obtain an encrypted electronic contract, and send the encrypted electronic contract to the tender center through the tender service institution; A tender service institution, which is used to verify the legality of the client, and after the verification passes, send the certificate application to the CA and the key management platform; sign the certificate data packet using its own signature private key, and package and send the signed certificate data packet, the signature value, and its own signature certificate to the client; The CA and the key management platform, after verifying the certificate application as legal, return the certificate data packet to the tender service institution; Among them, the certificate data packet further includes an encrypted certificate private key protected by a digital envelope. The client is further configured to send a unique user ID and a service message to the bidding service institution. The service message is used to request a new temporary symmetric key from the bidding service institution and inform the bidding service institution that the client has completed authentication; decrypt using the encrypted certificate private key to obtain the new temporary symmetric key; sign the electronic contract using its own signature private key, and encrypt the signed electronic contract using the new temporary symmetric key to obtain an encrypted electronic contract, and send the encrypted electronic contract to the bidding center through the bidding service institution; The bidding service institution is further configured to request the key management platform to generate a new temporary symmetric key according to the unique user ID; After generating the new temporary symmetric key, the key management platform is further configured to encrypt the new temporary symmetric key using the encrypted certificate public key and return the encrypted new temporary symmetric key to the client through the bidding service institution.

Images