A method and device for multi-terminal synchronous collaborative signature key

Abstract

The present invention discloses a method and device for synchronizing collaborative signature keys among multiple terminals, comprising: a first terminal obtains a corresponding collaborative signature key fragment, a key identifier, and a digital certificate; a second terminal creates a temporary key pair and sends a collaborative signature key synchronization request to a collaborative signature server; the collaborative signature server sends the public key of the temporary key pair of the second terminal to the first terminal; the first terminal generates a symmetric key, encrypts the collaborative signature key fragment and key identifier of the first terminal using the symmetric key, and encrypts the symmetric key using the public key of the temporary key pair; the collaborative signature server receives the synchronization request from the second terminal and sends the encrypted collaborative signature key fragment, key identifier, symmetric key, and digital certificate to the second terminal; the second terminal decrypts the symmetric key using the private key of the temporary key pair, and decrypts the collaborative signature key fragment and key identifier using the symmetric key. This solves the problem of a large amount of redundant data caused by re-applying for certificates.

Description

Technical Field

[0001] The present invention relates to the field of collaborative signature technology, and in particular to a method and device for synchronizing collaborative signature keys among multiple terminals. Background Art

[0002] Collaborative signature technology involves generating and storing separate signature key shards on the user and server sides. Each side uses its own key shard to participate in the signature calculation, ultimately generating the signature result on the user side. Neither side's complete private key is present during collaborative signature key generation, collaborative signing, or collaborative decryption calculations, thus ensuring the security of key shards and cryptographic operations. Typically, the user side refers to mobile devices such as mobile phones and tablets.

[0003] This technology brings a problem, that is, if a user has multiple terminal devices and needs to complete business functions such as signing on multiple devices, since the collaborative signature key shards of the user on one device are dynamically created in conjunction with the server, there will be two situations. One is that there can only be one collaborative signature key under a user account, corresponding to one digital certificate. This is the normal situation. At this time, every time the user changes the device, he needs to re-create the collaborative key and apply for a digital certificate. This is not only inconvenient to use, but also has high system construction and use costs; the other is that there can be multiple collaborative signature keys under one account, corresponding to multiple digital certificates. This situation only exists in theory and has not been designed and implemented in real applications. This is because theoretically, a digital certificate in a system represents a person's identity, and a person cannot have multiple valid digital certificates. Summary of the Invention

[0004] In response to the above technical problems, the present invention provides a method for synchronizing collaborative signature keys among multiple terminals, comprising:

[0005] The user's first terminal obtains the collaborative signature key fragment, key identifier and digital certificate corresponding to the first terminal from the collaborative signature server;

[0006] The user's second terminal creates a temporary key pair and sends the second terminal's device feature code, user ID, and public key of the temporary key pair to the collaborative signature server, as well as a synchronization request for the first terminal's collaborative signature key;

[0007] After obtaining confirmation of the synchronization request from the collaborative signature server and the first terminal, the collaborative signature server sends the public key of the temporary key pair of the second terminal to the first terminal;

[0008] The first terminal generates a symmetric key, and uses the symmetric key to encrypt the collaborative signature key fragment and key identifier corresponding to the first terminal, and uses the public key of the temporary key pair to encrypt the symmetric key; the first terminal sends the encrypted collaborative signature key fragment, key identifier, symmetric key, and digital certificate to the collaborative signature server;

[0009] The collaborative signature server receives the collaborative signature key synchronization request from the second terminal, sends the encrypted collaborative signature key fragment, key identifier, symmetric key, and digital certificate to the second terminal, and binds the key identifier to the device feature code of the second terminal;

[0010] The second terminal uses the private key of the temporary key pair to decrypt the symmetric key, uses the symmetric key to decrypt the collaborative signature key fragment and key identifier, stores the collaborative signature key fragment, key identifier and digital certificate locally, and completes the synchronization of the collaborative signature key.

[0011] Furthermore, after the user's first terminal obtains the collaborative signature key fragment, key identifier, and digital certificate corresponding to the first terminal from the collaborative signature server, the method further includes:

[0012] Storing the collaborative signature key fragment, key identifier and digital certificate locally;

[0013] The collaborative signature server binds the key identifier to the device feature code of the first terminal.

[0014] Furthermore, after the user's first terminal obtains the collaborative signature key fragment, key identifier, and digital certificate corresponding to the first terminal from the collaborative signature server, the method further includes:

[0015] When the user's second terminal requests the collaborative signature server to use the collaborative signature, after the first terminal performs the consent operation, the remaining operations will continue to be performed, otherwise the current operation will be stopped.

[0016] Furthermore, the second terminal of the user creates a temporary key pair, specifically a temporary SM2 key pair.

[0017] Furthermore, after obtaining confirmation of the synchronization request from the collaborative signature server and the first terminal, before the step of the collaborative signature server sending the public key of the temporary key pair of the second terminal to the first terminal, the method further includes:

[0018] After receiving the collaborative signature key from the first terminal, the collaborative signature server generates an initial synchronization request;

[0019] When the collaborative signature server recognizes, based on the user identifier, that a collaborative signature key shard already exists under the user's account, the collaborative signature server caches the initial synchronization request and sets a cache validity period.

[0020] Furthermore, after obtaining confirmation of the synchronization request from the collaborative signature server and the first terminal, the collaborative signature server sends the public key of the temporary key pair of the second terminal to the first terminal, including:

[0021] The first terminal sends a synchronization request for verification of the collaborative signature key to the collaborative signature server;

[0022] After receiving the collaborative signature key synchronization request sent by the first terminal, the collaborative signature server checks the collaborative signature key request under the user's account;

[0023] After obtaining the synchronization request from the second terminal, the collaborative signature server sends the public key of the temporary SM2 key pair of the second terminal to the first user terminal.

[0024] Furthermore, the first terminal generates a symmetric key, and uses the symmetric key to encrypt the collaborative signature key fragment and key identifier corresponding to the first terminal, and uses the public key of the temporary key pair to encrypt the symmetric key, including:

[0025] The first terminal generates an SM4 symmetric key, and uses the SM4 symmetric key to encrypt the collaborative signature key fragment and key identifier corresponding to the first terminal;

[0026] The SM4 symmetric key is encrypted using the public key of the temporary SM2 key pair.

[0027] Furthermore, after the first terminal sends the encrypted collaborative signature key fragment, key identifier, symmetric key, and digital certificate to the collaborative signature server, the method further includes:

[0028] The collaborative signature server checks whether the digital certificate sent by the first user terminal is the same as the valid digital certificate stored in the server. If they are the same, the encryption result is cached and the validity period of the cache is determined to be within the cache time validity period set by the collaborative signature server.

[0029] Furthermore, the second terminal uses the private key of the temporary key pair to decrypt the symmetric key, uses the symmetric key to decrypt the collaborative signature key fragment and the key identifier, and stores the collaborative signature key fragment, the key identifier, and the digital certificate locally, including:

[0030] The second terminal decrypts the SM4 symmetric key using the private key of the temporary SM2 key pair;

[0031] Decrypt the collaborative signature key fragment and key identifier using the SM4 symmetric key;

[0032] After storing the collaborative signature key fragment, key identifier and digital certificate locally, delete the temporary SM2 key pair.

[0033] The present invention also provides a device for synchronizing collaborative signature keys among multiple terminals, comprising:

[0034] A first terminal information acquisition unit, configured for a user's first terminal to obtain a collaborative signature key fragment, a key identifier, and a digital certificate corresponding to the first terminal from a collaborative signature server;

[0035] A synchronization request sending unit, configured for the user's second terminal to create a temporary key pair and send the second terminal's device feature code, user identification, and public key of the temporary key pair, as well as a synchronization request for the first terminal's collaborative signature key, to the collaborative signature server;

[0036] a public key sending unit, configured to, after obtaining confirmation of the synchronization request from the collaborative signature server and the first terminal, send the public key of the temporary key pair of the second terminal to the first terminal;

[0037] An encrypted information sending unit is configured to generate a symmetric key for the first terminal, encrypt the collaborative signature key fragment and key identifier corresponding to the first terminal using the symmetric key, and encrypt the symmetric key using the public key of the temporary key pair; the first terminal sends the encrypted collaborative signature key fragment, key identifier, symmetric key, and digital certificate to the collaborative signature server;

[0038] A device feature code binding unit is configured to, upon receipt of a collaborative signature key synchronization request from a second terminal, send the encrypted collaborative signature key fragment, key identifier, symmetric key, and digital certificate to the second terminal, and bind the key identifier to the device feature code of the second terminal;

[0039] The decryption unit is used for the second terminal to decrypt the symmetric key using the private key of the temporary key pair, use the symmetric key to decrypt the collaborative signature key fragment and key identifier, store the collaborative signature key fragment, key identifier and digital certificate locally, and complete the synchronization of the collaborative signature key.

[0040] The present invention provides a method and device for synchronizing collaborative signature keys across multiple terminals. This method specifically addresses the multi-terminal application problem within collaborative signature systems, without violating the principle of collaborative signature usage, namely, that no party to a collaborative signature can possess or calculate the collaborative signature key fragments of the other party at any time. This method addresses the issues of user terminal certificates being easily lost during collaborative signature applications, and the large amount of redundant data resulting from repeated certificate reapplications when replacing devices. This method reduces the number of certificates used, significantly reducing the cost of using certificates in collaborative signature applications, improving the cost-effectiveness of certificate usage at the issuing center, and reducing the number of historical certificates to maintain. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1This is a flowchart of a method for synchronizing collaborative signature keys among multiple terminals provided by an embodiment of the present invention;

[0042] Figure 2 It is a structural diagram of an apparatus for synchronizing collaborative signature keys of multiple terminals provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0043] The following description sets forth numerous specific details to facilitate a thorough understanding of the present invention. However, the present invention can be implemented in many other ways than those described herein, and those skilled in the art can make similar generalizations without departing from the scope of the present invention. Therefore, the present invention is not limited to the specific implementations disclosed below.

[0044] Example 1

[0045] The present invention provides a method for synchronizing and coordinating signature keys of multiple terminals. Figure 1 The method provided by the present invention is described in detail with reference to the flowchart of FIG. 1 , wherein the method comprises:

[0046] Step S101: A user's first terminal obtains a collaborative signature key fragment, a key identifier, and a digital certificate corresponding to the first terminal from a collaborative signature server.

[0047] At present, many office systems require the use of mobile apps for office work, such as employee attendance clocking in, electronic document signing, and leadership process approval. For multi-terminal users, they need to use the devices around them at any time to handle some office matters such as signing electronic documents. This brings about new needs and problems. The employee may need to apply for certificates repeatedly to ensure the validity of the certificates on the devices used. This leads to an increase in the cost of using the system. To solve this problem, in the present invention, first, the user's first terminal obtains the collaborative signature key fragment, key identifier and digital certificate corresponding to the first terminal from the collaborative signature server, and then stores the collaborative signature key fragment, key identifier and digital certificate locally; the collaborative signature server binds the key identifier to the device feature code of the first terminal. When the user's second terminal requests the collaborative signature server to use the collaborative signature, after the first terminal performs the consent operation, it continues to perform the remaining operations, otherwise stops the current operation.

[0048] In the present invention, the example of a user using two terminals at the same time is used for explanation, but it is not limited to two terminal devices. When there are more than two terminal devices, the method flow is the same. For example, when the user's third terminal applies for a collaborative signature key, the process is the same as that of the second terminal, and it will not be repeated here.

[0049] In step S102, the user's second terminal creates a temporary key pair and sends the second terminal's device feature code, user identification, and public key of the temporary key pair to the collaborative signature server, as well as a synchronization request for the first terminal's collaborative signature key.

[0050] The user's second terminal creates a temporary key pair, specifically a temporary SM2 key pair.

[0051] Step S103: After obtaining confirmation of the synchronization request from the collaborative signature server and the first terminal, the collaborative signature server sends the public key of the temporary key pair of the second terminal to the first terminal.

[0052] After receiving the collaborative signature key from the first terminal, the collaborative signature server generates an initial synchronization request; when the collaborative signature server identifies that a created collaborative signature key shard already exists under the user's account based on the user identifier, the collaborative signature server caches the initial synchronization request and sets a cache validity period.

[0053] The first terminal sends a synchronization request for the collaborative signature key to the collaborative signature server; after the collaborative signature server receives the synchronization request for the collaborative signature key sent by the first terminal, it detects the collaborative signature key request under the user's account; after obtaining the synchronization request of the second terminal, the collaborative signature server sends the public key of the temporary SM2 key pair of the second terminal to the first user terminal.

[0054] In step S104, the first terminal generates a symmetric key, and uses the symmetric key to encrypt the collaborative signature key fragment and key identifier corresponding to the first terminal, and uses the public key of the temporary key pair to encrypt the symmetric key; the first terminal sends the encrypted collaborative signature key fragment, key identifier, symmetric key and digital certificate to the collaborative signature server.

[0055] The first terminal generates an SM4 symmetric key, and uses the SM4 symmetric key to encrypt the collaborative signature key fragment and key identifier corresponding to the first terminal; and uses the public key of the temporary SM2 key pair to encrypt the SM4 symmetric key.

[0056] The collaborative signature server checks whether the digital certificate sent by the first user terminal is the same as the valid digital certificate stored in the server. If they are the same, the encryption result is cached and the validity period of the cache is determined to be within the cache time validity period set by the collaborative signature server.

[0057] In step S105, the collaborative signature server receives the collaborative signature key synchronization request from the second terminal, sends the encrypted collaborative signature key fragment, key identifier, symmetric key and digital certificate to the second terminal, and binds the key identifier to the device feature code of the second terminal.

[0058] At this time, the collaborative signature key identifier is bound to the user identifier and the device feature codes of the first terminal and the second terminal.

[0059] In step S106, the second terminal uses the private key of the temporary key pair to decrypt the symmetric key, uses the symmetric key to decrypt the collaborative signature key fragment and key identifier, stores the collaborative signature key fragment, key identifier and digital certificate locally, and completes the synchronization of the collaborative signature key.

[0060] The second terminal uses the private key of the temporary SM2 key pair to decrypt the SM4 symmetric key; uses the SM4 symmetric key to decrypt the collaborative signature key fragment and key identifier; after storing the collaborative signature key fragment, key identifier and digital certificate locally, deletes the temporary SM2 key pair, and the synchronization of the collaborative signature key is completed.

[0061] Example 2

[0062] In an office system, a mobile office app is configured. Collaborative signature technology is used in the mobile office app to implement employee attendance clocking in, electronic document signing, and leadership process approval. For employees who only have one mobile device, using the mobile office app does not feel inconvenient because their collaborative signature key and digital certificate only exist on that one device, and they do not need to change devices to use the office app. Some company employees have multiple mobile devices, such as tablets and multiple mobile phones. The employee may need to use the device at hand to handle office matters such as signing electronic documents at any time. This creates new needs and problems. The employee may need to apply for certificates repeatedly to ensure the validity of the certificate on the device used.

[0063] Assume that a user has two devices, namely: user terminal A and user terminal B. The user has installed an office app integrated with collaborative signature technology on both terminals. Both terminals use the user's unique account to log in to the office app at the same time.

[0064] Assume that a user first creates a collaborative signature key shard on terminal A and applies for a corresponding digital certificate. At this point, terminal A and the collaborative signature server jointly create the collaborative signature key shard. Terminal A stores the collaborative signature key shard, the key identifier assigned by the server, and the digital certificate. The collaborative signature server stores the collaborative signature key shard. The collaborative signature server creates a key identifier for the key shard and binds the key identifier to the device signature code of terminal A. It also stores a copy of the digital certificate corresponding to the collaborative signature key.

[0065] Then, when the user uses user terminal B and uses the collaborative signature function, the user is reminded that the account has created a digital certificate on terminal A, and the user is guided to synchronize the collaborative signature key and digital certificate on terminal A to the current device B. After the user agrees, user terminal B creates a temporary SM2 key pair and sends the device feature code, user ID, and public key of the temporary SM2 key pair of terminal B to the collaborative signature server, requesting the collaborative signature key of user terminal A under the synchronized login account.

[0066] The collaborative signature server checks the user ID and finds that the created collaborative signature key already exists under the user login account. It then caches the request, records the request as the initial synchronization request, and sets a request cache validity period, such as 2 minutes, to meet the interactive operation time limit. If the set time is exceeded, the cached initial request is cleared.

[0067] After user terminal B successfully uploads the initial request, it prompts and guides the user to operate terminal A to upload information such as the digital certificate, collaborative signature key fragment, etc.

[0068] User A operates User Terminal A to send information such as User Terminal A's collaborative signature key fragment to the collaborative signature server. This process consists of two steps. First, User Terminal A sends a collaborative signature key synchronization request to the collaborative signature server. After receiving the collaborative signature key synchronization request from User Terminal A, the collaborative signature server checks the collaborative signature key synchronization request under the logged-in user name. After finding the request from User Terminal B, it returns User Terminal B's temporary SM2 public key to User Terminal A. Second, User Terminal A generates an SM4 symmetric key, encrypts the collaborative signature key identifier and collaborative signature key fragment stored by User Terminal A using the SM4 symmetric key, then encrypts the SM4 symmetric key using the temporary SM2 public key. The two encrypted results and the corresponding digital certificate are sent to the collaborative signature server. The collaborative signature server first checks whether the digital certificate sent by User Terminal A is the same as the latest valid digital certificate stored on the server. If they are the same, the encrypted result is cached with a validity period equal to the initial request sent by User Terminal B. Otherwise, User Terminal A is notified that the information has expired. After successful transmission, User Terminal A prompts and guides the user to operate User Terminal B to request the transmission of the collaborative signature key and other information.

[0069] The user operates user terminal B again and sends a request to the collaborative signature server to perform collaborative signature key synchronization.

[0070] The collaborative signature server receives the execution synchronization request from user terminal B, checks whether there is a legitimate initial synchronization request from user terminal B and the synchronization encrypted data received from user terminal A, and returns the cached encrypted data and other information to user terminal B. It also binds the collaborative signature key identifier to the device feature code of user terminal B. At this point, the collaborative signature key identifier is bound to the user identifier and the device feature codes of user terminal A and user terminal B.

[0071] User terminal B receives the encrypted data and digital certificate and first uses the temporary SM2 key pair to decrypt the private key to obtain the SM4 symmetric key. It then uses the SM4 symmetric key to decrypt the collaborative signature key identifier and collaborative signature key fragment, which it then stores locally. It then deletes the temporary SM2 key pair and also stores the corresponding digital certificate.

[0072] Synchronizing collaborative signing keys is complete.

[0073] Example 3

[0074] Based on the same inventive concept, the present invention also provides a device 200 for synchronizing collaborative signature keys of multiple terminals, such as Figure 2 As shown, including:

[0075] The first terminal information acquisition unit 210 is used for the user's first terminal to obtain the collaborative signature key fragment, key identifier and digital certificate corresponding to the first terminal from the collaborative signature server;

[0076] The synchronization request sending unit 220 is used for the user's second terminal to create a temporary key pair and send the device feature code, user identification and public key of the temporary key pair of the second terminal and the synchronization request of the collaborative signature key of the first terminal to the collaborative signature server;

[0077] The public key sending unit 230 is configured to send the public key of the temporary key pair of the second terminal to the first terminal after obtaining confirmation of the synchronization request from the collaborative signature server and the first terminal;

[0078] The encrypted information sending unit 240 is configured to generate a symmetric key at the first terminal, encrypt the collaborative signature key fragment and key identifier corresponding to the first terminal using the symmetric key, and encrypt the symmetric key using the public key of the temporary key pair; the first terminal sends the encrypted collaborative signature key fragment, key identifier, symmetric key, and digital certificate to the collaborative signature server;

[0079] The device signature code binding unit 250 is configured to, upon receipt of a collaborative signature key synchronization request from the second terminal, send the encrypted collaborative signature key fragment, key identifier, symmetric key, and digital certificate to the second terminal, and bind the key identifier to the device signature code of the second terminal;

[0080] The decryption unit 260 is used for the second terminal to decrypt the symmetric key using the private key of the temporary key pair, decrypt the collaborative signature key fragment and key identifier using the symmetric key, store the collaborative signature key fragment, key identifier and digital certificate locally, and complete the synchronization of the collaborative signature key.

[0081] The present invention provides a method and device for synchronizing collaborative signature keys across multiple terminals. This method specifically addresses the multi-terminal application problem within collaborative signature systems, without violating the principle of collaborative signature usage, namely, that no party to a collaborative signature can possess or calculate the collaborative signature key fragments of the other party at any time. This method addresses the issues of user terminal certificates being easily lost during collaborative signature applications, and the large amount of redundant data resulting from repeated certificate reapplications when replacing devices. This method reduces the number of certificates used, significantly reducing the cost of using certificates in collaborative signature applications, improving the cost-effectiveness of certificate usage at the issuing center, and reducing the number of historical certificates to maintain.

[0082] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents. Any modifications or equivalents that do not depart from the spirit and scope of the present invention should be included in the scope of the claims of the present invention.

Claims

1. A method for synchronizing collaborative signature keys among multiple terminals, characterized in that: include: The user's first terminal obtains the collaborative signature key fragment, key identifier and digital certificate corresponding to the first terminal from the collaborative signature server; The user's second terminal creates a temporary key pair and sends the second terminal's device feature code, user ID, and public key of the temporary key pair to the collaborative signature server, as well as a synchronization request for the first terminal's collaborative signature key; After obtaining confirmation of the synchronization request from the collaborative signature server and the first terminal, the collaborative signature server sends the public key of the temporary key pair of the second terminal to the first terminal; The first terminal generates a symmetric key, and uses the symmetric key to encrypt the collaborative signature key fragment and key identifier corresponding to the first terminal, and uses the public key of the temporary key pair to encrypt the symmetric key; the first terminal sends the encrypted collaborative signature key fragment, key identifier, symmetric key, and digital certificate to the collaborative signature server; The collaborative signature server receives the collaborative signature key synchronization request from the second terminal, sends the encrypted collaborative signature key fragment, key identifier, symmetric key, and digital certificate to the second terminal, and binds the key identifier to the device feature code of the second terminal; The second terminal uses the private key of the temporary key pair to decrypt the symmetric key, uses the symmetric key to decrypt the collaborative signature key fragment and key identifier, stores the collaborative signature key fragment, key identifier and digital certificate locally, and completes the synchronization of the collaborative signature key.

2. The method according to claim 1, characterized in that After the user's first terminal obtains the collaborative signature key fragment, key identifier, and digital certificate corresponding to the first terminal from the collaborative signature server, the method further includes: Storing the collaborative signature key fragment, key identifier and digital certificate locally; The collaborative signature server binds the key identifier to the device feature code of the first terminal.

3. The method according to claim 1, characterized in that After the user's first terminal obtains the collaborative signature key fragment, key identifier, and digital certificate corresponding to the first terminal from the collaborative signature server, the method further includes: When the user's second terminal requests the collaborative signature server to use the collaborative signature, after the first terminal performs the consent operation, the remaining operations will continue to be performed, otherwise the current operation will be stopped.

4. The method according to claim 1, wherein The user's second terminal creates a temporary key pair, specifically a temporary SM2 key pair.

5. The method according to claim 1, wherein After obtaining confirmation of the synchronization request from the collaborative signature server and the first terminal, before the collaborative signature server sends the public key of the temporary key pair of the second terminal to the first terminal, the method further includes: After receiving the collaborative signature key from the first terminal, the collaborative signature server generates an initial synchronization request; When the collaborative signature server recognizes, based on the user identifier, that a collaborative signature key shard already exists under the user's account, the collaborative signature server caches the initial synchronization request and sets a cache validity period.

6. The method according to claim 1, characterized in that After obtaining confirmation of the synchronization request from the collaborative signature server and the first terminal, the collaborative signature server sends the public key of the temporary key pair of the second terminal to the first terminal, including: The first terminal sends a synchronization request for verification of the collaborative signature key to the collaborative signature server; After receiving the collaborative signature key synchronization request sent by the first terminal, the collaborative signature server checks the collaborative signature key request under the user's account; After obtaining the synchronization request from the second terminal, the collaborative signature server sends the public key of the temporary SM2 key pair of the second terminal to the first user terminal.

7. The method according to claim 1, characterized in that The first terminal generates a symmetric key, encrypts the collaborative signature key fragment and the key identifier corresponding to the first terminal using the symmetric key, and encrypts the symmetric key using the public key of the temporary key pair, including: The first terminal generates an SM4 symmetric key, and uses the SM4 symmetric key to encrypt the collaborative signature key fragment and key identifier corresponding to the first terminal; The SM4 symmetric key is encrypted using the public key of the temporary SM2 key pair.

8. The method according to claim 1, characterized in that After the first terminal sends the encrypted collaborative signature key fragment, key identifier, symmetric key, and digital certificate to the collaborative signature server, the method further includes: The collaborative signature server checks whether the digital certificate sent by the first user terminal is the same as the valid digital certificate stored in the server. If they are the same, the encryption result is cached and the validity period of the cache is determined to be within the cache time validity period set by the collaborative signature server.

9. The method according to claim 1, characterized in that The second terminal uses the private key of the temporary key pair to decrypt the symmetric key, uses the symmetric key to decrypt the collaborative signature key fragment and the key identifier, and stores the collaborative signature key fragment, the key identifier, and the digital certificate locally, including: The second terminal decrypts the SM4 symmetric key using the private key of the temporary SM2 key pair; Decrypt the collaborative signature key fragment and key identifier using the SM4 symmetric key; After storing the collaborative signature key fragment, key identifier and digital certificate locally, delete the temporary SM2 key pair.

10. A device for synchronizing collaborative signature keys among multiple terminals, characterized in that: include: A first terminal information acquisition unit, configured for a user's first terminal to obtain a collaborative signature key fragment, a key identifier, and a digital certificate corresponding to the first terminal from a collaborative signature server; A synchronization request sending unit, configured for the user's second terminal to create a temporary key pair and send the second terminal's device feature code, user identification, and public key of the temporary key pair, as well as a synchronization request for the first terminal's collaborative signature key, to the collaborative signature server; a public key sending unit, configured to, after obtaining confirmation of the synchronization request from the collaborative signature server and the first terminal, send the public key of the temporary key pair of the second terminal to the first terminal; An encrypted information sending unit is configured to generate a symmetric key for the first terminal, encrypt the collaborative signature key fragment and key identifier corresponding to the first terminal using the symmetric key, and encrypt the symmetric key using the public key of the temporary key pair; the first terminal sends the encrypted collaborative signature key fragment, key identifier, symmetric key, and digital certificate to the collaborative signature server; A device feature code binding unit is configured to, upon receipt of a collaborative signature key synchronization request from a second terminal, send the encrypted collaborative signature key fragment, key identifier, symmetric key, and digital certificate to the second terminal, and bind the key identifier to the device feature code of the second terminal; The decryption unit is used for the second terminal to decrypt the symmetric key using the private key of the temporary key pair, use the symmetric key to decrypt the collaborative signature key fragment and key identifier, store the collaborative signature key fragment, key identifier and digital certificate locally, and complete the synchronization of the collaborative signature key.

Images