Method and system for generating multiple digital certificates and computer equipment

Abstract

The invention provides a multi-digital certificate generation method and system and computer equipment, and relates to the technical field of information security, and the method comprises the steps: obtaining basic information; sending a type selection request, wherein the type selection request comprises all certificate types; obtaining feature information based on the currently selected certificate type; the feature information is in one-to-one correspondence with the currently selected certificate type; constructing a digital certificate corresponding to the currently selected certificate type in combination with the basic information and the feature information; judging whether each certificate type correspondingly generates a digital certificate or not; if yes, making of multiple digital certificates of the user is completed, the multiple digital certificates comprise an identity authentication certificate used for authentication and an electronic signature certificate used for signature, different types of digital certificates are clearly distinguished, corresponding secret key information is configured for the digital certificates, and safety and high efficiency are improved.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a method, system and computer equipment for generating multiple digital certificates. Background Art

[0002] In today's information age, the digital transformation of the economy has entered a period of rapid development, and electronic signature technology and applications have penetrated into all areas of the world's economic development. Electronic signature technology, which signs data based on commercial cryptographic technology, has gradually become one of the important methods for verifying user identity and ensuring data and information security.

[0003] Although electronic signature technology has brought many conveniences, the existing electronic signature certificates still have some shortcomings during use. For example, existing electronic signature certificates mostly use various forms of digital certificates to perform electronic signatures and user identity authentication at the same time, which leads to the diversity and complexity of certificate formats, making it easy for electronic signature certificates to be confused in use and significantly reducing their security.

[0004] Therefore, a method, system and computer device for generating multiple digital certificates are needed. Summary of the invention

[0005] This specification provides a method, system and computer device for generating multiple digital certificates. By generating an identity authentication certificate dedicated to authentication and an electronic signature certificate dedicated to signature, each certificate is designed and used for specific security requirements, so as to facilitate certificate specialization and improve the security and compliance of certificate use.

[0006] The present application provides a method for generating a multi-digital certificate using the following technical solution, including:

[0007] Obtain basic information; send a type selection request, the type selection request includes: all certificate types;

[0008] Based on the currently selected certificate type, acquiring characteristic information; the characteristic information corresponds one-to-one with the currently selected certificate type;

[0009] Combining the basic information and the characteristic information, constructing a digital certificate corresponding to the currently selected certificate type;

[0010] Determine whether each of the certificate types corresponds to the generation of a digital certificate; if so, complete the production of multiple digital certificates for the user, the multiple digital certificates include: an identity authentication certificate for authentication and an electronic signature certificate for signing.

[0011] Optionally, the acquiring basic information and sending a type selection request include:

[0012] Obtaining a certificate application instruction submitted by an applicant; the certificate application instruction includes basic information of the user;

[0013] Verify the basic information;

[0014] According to the verification result, a type selection request is sent; the type selection request includes: all certificate types.

[0015] Optionally, the characteristic information includes: key information and identification information;

[0016] The acquiring of characteristic information based on the currently selected certificate type includes:

[0017] Collecting the type selection instruction fed back by the applicant, the type selection instruction including: the currently selected certificate type;

[0018] Based on the currently selected certificate type, sending a corresponding key information acquisition request to acquire the key information corresponding to the currently selected certificate type;

[0019] The identification information is determined according to the currently selected certificate type.

[0020] Optionally, combining the basic information and the characteristic information to construct a digital certificate corresponding to the currently selected certificate type includes:

[0021] Retrieving a corresponding current certificate template according to the currently selected certificate type; the current certificate template includes a number of configuration parameters;

[0022] Matching the configuration parameters in the current certificate template with corresponding configuration values ​​to generate certificate information;

[0023] The certificate information and the key information are encrypted using the issuer's private key to obtain a digital certificate corresponding to the currently selected certificate type.

[0024] Optionally, matching the configuration parameters in the current certificate template with corresponding configuration values ​​to generate certificate information includes:

[0025] Find the name of the issuer as the configuration value of the issuer;

[0026] and / or, retrieving a user name from the basic information as a configuration value of the certificate holder;

[0027] and / or, generating a certificate serial number using a unique number created according to a preset encoding rule;

[0028] and / or, determining the validity period of the certificate according to a preset validity period and the current time;

[0029] and / or, searching for a policy identifier and / or a key usage identifier in the identification information as a configuration value of the identification tag;

[0030] And / or, searching for an algorithm rule of a corresponding preset signature algorithm according to the currently selected certificate type, and using a signature algorithm identifier corresponding to the algorithm rule as a configuration value of the signature algorithm.

[0031] Optionally, the certificate type includes a first certificate type;

[0032] The using the private key of the issuer to encrypt the certificate information and the key information to obtain a digital certificate corresponding to the currently selected certificate type includes:

[0033] The first certificate information and the authentication key information are encrypted using the private key of the issuer to generate the identity authentication certificate.

[0034] Optionally, the certificate type includes a second certificate type;

[0035] The using the issuer's private key to encrypt the certificate information and the key information to obtain a digital certificate corresponding to the currently selected certificate type includes:

[0036] The second certificate information and the signature key information are encrypted using the issuer's private key to generate the electronic signature certificate.

[0037] The present application provides a system for generating multiple digital certificates using the following technical solutions, including:

[0038] The first acquisition module is used to acquire basic information; send a type selection request, and the type selection request includes: all certificate types;

[0039] A characteristic information acquisition module, used to acquire characteristic information based on the currently selected certificate type; the characteristic information corresponds to the currently selected certificate type one by one;

[0040] A certificate construction module, used to construct a digital certificate corresponding to the currently selected certificate type by combining the basic information and the characteristic information;

[0041] The judgment module is used to judge whether each certificate type corresponds to the generation of a digital certificate; if so, the production of multiple digital certificates of the user is completed, and the multiple digital certificates include: an identity authentication certificate for authentication and an electronic signature certificate for signing.

[0042] Optionally, the first acquisition module includes:

[0043] The certificate application instruction acquisition submodule is used to acquire the certificate application instruction submitted by the applicant; the certificate application instruction includes the basic information of the user;

[0044] A basic information verification submodule, used to verify the basic information;

[0045] The type selection request sending submodule is used to send a type selection request according to the verification result; the type selection request includes: all certificate types.

[0046] Optionally, the characteristic information includes: key information and identification information;

[0047] Optionally, the feature information acquisition module includes:

[0048] A type selection instruction collection submodule is used to collect the type selection instruction fed back by the applicant, wherein the type selection instruction includes: the currently selected certificate type;

[0049] A key information acquisition request sending submodule, used to send a corresponding key information acquisition request based on the currently selected certificate type, to obtain the key information corresponding to the currently selected certificate type;

[0050] The identification information determination submodule is used to determine the identification information according to the currently selected certificate type.

[0051] Optionally, the certificate building module includes:

[0052] The current certificate template calling submodule is used to call the corresponding current certificate template according to the currently selected certificate type; the current certificate template includes several configuration parameters;

[0053] A parameter matching submodule, used to match the configuration parameters in the current certificate template with corresponding configuration values ​​to generate certificate information;

[0054] The digital certificate generation submodule is used to encrypt the certificate information and the key information using the issuer's private key to obtain a digital certificate corresponding to the currently selected certificate type.

[0055] Optionally, the parameter matching submodule includes:

[0056] An issuer configuration unit, used to find the name of the issuer as a configuration value of the issuer;

[0057] A certificate holder configuration unit, used to retrieve a user name from the basic information as a configuration value of the certificate holder;

[0058] A serial number configuration unit, used to generate a certificate serial number according to a unique number created according to a preset encoding rule;

[0059] A validity period configuration unit, used to determine the validity period of the certificate according to a preset validity period and the current time;

[0060] An identification configuration unit, used to search the policy identification and / or the key usage identification in the identification information as a configuration value of the identification tag;

[0061] The signature algorithm configuration unit is used to search for the algorithm rule of the corresponding preset signature algorithm according to the currently selected certificate type, and use the signature algorithm identifier corresponding to the algorithm rule as the configuration value of the signature algorithm.

[0062] Optionally, the certificate type includes a first certificate type;

[0063] The digital certificate generation submodule includes:

[0064] The identity authentication certificate generating unit is used to encrypt the first certificate information and the authentication key information using the private key of the issuer to generate the identity authentication certificate.

[0065] Optionally, the certificate type includes a second certificate type;

[0066] The digital certificate generation submodule includes:

[0067] The electronic signature certificate generating unit is used to encrypt the second certificate information and the signature key information using the private key of the issuer to generate the electronic signature certificate.

[0068] This specification also provides a computer device, wherein the computer device includes:

[0069] processor; and,

[0070] A memory storing computer executable instructions, which when executed cause the processor to perform any of the above methods.

[0071] This specification also provides a computer-readable storage medium, wherein the computer-readable storage medium stores one or more programs / instructions, and when the one or more programs / instructions are executed by a processor, any of the above methods is implemented.

[0072] This specification also provides a computer program product, wherein the computer program product includes: a computer program / instructions, and when the computer program / instructions are executed by a processor, any of the above methods is implemented.

[0073] In the present application, basic information is obtained; a type selection request is sent, wherein the type selection request includes: all certificate types; characteristic information is obtained based on the currently selected certificate type; the characteristic information corresponds one-to-one with the currently selected certificate type; a digital certificate corresponding to the currently selected certificate type is constructed by combining the basic information and the characteristic information; it is determined whether a digital certificate is generated for each of the certificate types; if so, the production of multiple digital certificates for the user is completed, wherein the multiple digital certificates include: an identity authentication certificate for authentication and an electronic signature certificate for signing; wherein the identity authentication certificate is mainly used to verify the identity of the user, while the electronic signature certificate is used to ensure the integrity of the data and the reliability of the source; the certificate specificity not only improves the security of certificate use, but also enhances compliance. BRIEF DESCRIPTION OF THE DRAWINGS

[0074] Figure 1 A schematic diagram of the principle of a method for generating multiple digital certificates provided in an embodiment of this specification;

[0075] Figure 2 A schematic diagram of the storage structure of a digital certificate medium for a method for generating multiple digital certificates provided in an embodiment of this specification;

[0076] Figure 3 A schematic diagram of a certificate management framework provided in an embodiment of this specification;

[0077] Figure 4 A schematic diagram of the application function of a method for generating multiple digital certificates provided in an embodiment of this specification;

[0078] Figure 5 A schematic diagram of the principle of a method for signing using multiple digital certificates provided in an embodiment of this specification;

[0079] Figure 6 A flowchart of a method for signing using multiple digital certificates provided in an embodiment of this specification;

[0080] Figure 7 A schematic diagram of the principle of a signature file verification method provided in an embodiment of this specification;

[0081] Figure 8 A flowchart of step 3-B of a signature file verification method provided in an embodiment of this specification;

[0082] Fig. 9 A schematic diagram of the structure of a system for generating multiple digital certificates provided in an embodiment of this specification;

[0083] Fig.10 A schematic diagram of the structure of a system for signing using multiple digital certificates provided in an embodiment of this specification;

[0084] Fig.11 A schematic diagram of the structure of a signature file verification system provided in an embodiment of this specification;

[0085] Fig.12 A schematic diagram of the structure of a computer device provided in an embodiment of this specification;

[0086] Fig.13 A schematic diagram of a computer-readable medium provided in accordance with an embodiment of the present specification. DETAILED DESCRIPTION

[0087] The following description is used to disclose the present invention so that those skilled in the art can implement the present invention. The preferred embodiments described below are only examples, and those skilled in the art can think of other obvious variations. The basic principles of the present invention defined in the following description can be applied to other embodiments, variations, improvements, equivalents, and other technical solutions that do not deviate from the spirit and scope of the present invention.

[0088] The exemplary embodiments of the present invention will now be described more fully with reference to the accompanying drawings. Under the premise of being consistent with the technical concept of the present invention, the features, structures, characteristics or other details described in a particular embodiment do not exclude that they can be combined in one or more other embodiments in a suitable manner.

[0089] The term "and / or" or "and / or" includes all combinations of any one or more of the associated listed items.

[0090] With the construction of basic information systems for informatization and digitization of modern information, the volume of online business such as electronic contracts, electronic certificates, and online office has increased dramatically. Behind these digital businesses, electronic signature technology plays a huge role. It not only accelerates the speed of informatization and greatly improves the efficiency of business transactions, but also ensures the security and reliability of informatization data and information.

[0091] The transformation of the digital economy is in full swing. In the digital economy, the security of data and information continues to be highlighted, and commercial cryptography, as an important cornerstone of data security, plays a huge role. Among them, electronic signature is one of the most important application areas of commercial cryptography technology.

[0092] With the official implementation of the "Electronic Signature Law", it has made clear definitions of electronic signatures and related digital signature certificates, and further strengthened the legal status of electronic signatures.

[0093] However, in actual applications, there are still many problems with electronic signature technology and its application, such as: (1) There is currently no digital certificate specifically used for "signatures". (2) The lack of clear digital certificate specifications makes the application and verification of electronic signatures rather confusing.

[0094] In order to further classify the current digital certificates of users, reduce confusion in electronic signature applications, and avoid various irregular behaviors of electronic signature certificates, the present invention proposes a method, system and electronic device for generating, signing and authenticating multiple digital certificates.

[0095] Specifically, Figure 1 A schematic diagram of a method for generating multiple digital certificates provided in an embodiment of this specification, the method comprising:

[0096] Step 1-A: Obtain basic information; send a type selection request, the type selection request includes: all certificate types;

[0097] Step 1-B: Based on the currently selected certificate type, obtain characteristic information; the characteristic information corresponds to the currently selected certificate type one by one;

[0098] Step 1-C: Combining the basic information and the characteristic information, constructing a digital certificate corresponding to the currently selected certificate type;

[0099] Step 1-D: Determine whether each certificate type corresponds to the generation of a digital certificate; if so, complete the production of the user's multiple digital certificates, the multiple digital certificates include: an identity authentication certificate for authentication and an electronic signature certificate for signing.

[0100] In the current PKI / CA system, digital certificates are functionally divided into signature certificates and encryption certificates. The relevant certificate formats and certificate contents follow the X.509 standard. Encryption certificates are mainly used to encrypt user transmitted information to ensure the authenticity and integrity of the information. Signature certificates are mainly used to authenticate and electronically sign user information to identify the user and ensure the non-repudiation of information.

[0101] However, in addition to signing, traditional signature certificates also need to authenticate user information, which causes obvious confusion in use. Based on this, the present invention will specifically generate an identity authentication certificate for authenticating the user and an electronic signature certificate for electronic signature, specifically:

[0102] Step 1-A: Obtain basic information; send a type selection request, the type selection request includes: all certificate types;

[0103] Step 1-A-1: Obtain the certificate application instruction submitted by the applicant; the certificate application instruction includes the basic information of the user;

[0104] The user refers to the subject to whom the digital certificate is issued. The applicant refers to the user or the user's authorized agent.

[0105] The basic information is used to prove the user's identity. In one embodiment of the present specification, the basic information includes: user name, user ID and user's communication information.

[0106] Specifically, if the user is an individual, the user name is the individual's name; the user ID includes the individual's ID number; and the communication information includes the user's address and contact information.

[0107] If the user is an organization, the user name is the full name of the organization; the user ID is the organizational code of the organization; and the communication information includes the office address and contact information of the organization.

[0108] Contact information includes but is not limited to: zip code, email, telephone number, etc.

[0109] In one embodiment of the present specification, an information filling page is displayed to the applicant, and the applicant can fill in basic information on the information filling page, and select Submit after completing the filling, thereby generating a certificate application request.

[0110] The first step to generate a certificate is to obtain the certificate application instructions submitted by the applicant, including the user's basic information. This step simplifies user operations, improves application efficiency, and provides a direct data source for subsequent information verification and certificate generation.

[0111] Step 1-A-2: Verify the basic information;

[0112] After receiving the certificate application instruction, the basic information in the certificate application instruction is verified to verify its authenticity and validity. Specifically, after obtaining the applicant's permission, the basic information is provided to a trusted third party for identity verification and comparison. Trusted third parties include but are not limited to: industrial and commercial departments, bank credit reporting systems, etc.

[0113] In one embodiment of the present specification, the basic information is encrypted and sent to a selected trusted third party through a secure channel (such as HTTPS); wait for the trusted third party to complete the comparison and return the verification result.

[0114] If the trusted third party finds that the basic information is inconsistent with the information stored by the trusted third party after comparison, it means that the basic information has failed the verification.

[0115] In one embodiment of the present specification, the verification result is fed back to the user. Specifically, if the basic information verification fails, the result of "verification failed" is fed back to the applicant, the applicant is informed of the reason for the verification failure, and guidance is provided to re-fill or modify the information. If the basic information verification passes, the subsequent steps are automatically executed. Preferably, the applicant is informed that the verification is passed.

[0116] By verifying the basic information, its authenticity and validity are verified to ensure the legitimacy and authority of the generated certificate. Through identity verification and comparison by a trusted third party, false information is effectively prevented from being mixed in, ensuring the security and reliability of the digital certificate system.

[0117] Step 1-A-3: Send a type selection request based on the verification result; the type selection request includes: all certificate types;

[0118] If the basic information is verified, the certificate selection page will be displayed to the applicant. The certificate selection page displays all the certificate types available for application for the applicant to choose from. The applicant can determine the order of selection based on actual conditions.

[0119] In one embodiment of the present specification, the certificate type includes but is not limited to: a first certificate type and a second certificate type, wherein the first certificate type is an authentication type and the second certificate type is a signature type.

[0120] In another embodiment of the present specification, the certificate type includes but is not limited to: a first certificate type, a second certificate type, and a third certificate type, wherein the first certificate type is an authentication type, the second certificate type is a signature type, and the third certificate type is an encryption type.

[0121] By showing applicants all certificate types for selection, the flexibility of applicants' choices is increased, meeting the different needs of different applicants. At the same time, this step also promotes applicants' understanding of certificate types and improves applicants' satisfaction.

[0122] Step 1-B: Based on the currently selected certificate type, obtain characteristic information; the characteristic information corresponds to the currently selected certificate type one by one;

[0123] In the process of generating multiple digital certificates, it is essentially generating multiple types of digital certificates. The applicant can independently determine the type of certificate he wants to generate and obtain feature information based on the certificate type currently selected by the user. Technical personnel in this field should know that when generating multiple digital certificates, multiple feature information will be obtained, and each feature information corresponds to a certificate type.

[0124] The characteristic information includes: key information and identification information.

[0125] Step 1-B-1: collecting the type selection instruction fed back by the applicant, the type selection instruction including: the currently selected certificate type;

[0126] In one embodiment of the present specification, the certificate type includes: a first certificate type and a second certificate type. If the applicant selects the first certificate type, it means that the certificate currently applied for by the applicant is an identity authentication certificate for authentication. If the applicant selects the second certificate type, it means that the certificate currently applied for by the applicant is an electronic signature certificate for signing.

[0127] The identity authentication certificate and electronic signature certificate are stored in the same hardware device / software, and both digital certificates must exist in the hardware device / software at the same time. That is to say, when an applicant applies for a digital certificate, both digital certificates must be applied for. However, the applicant can choose the order of application, whether to apply for the identity authentication certificate first and then the electronic signature certificate, or to apply for the electronic signature certificate first and then the identity authentication certificate.

[0128] In this hardware device / software, in addition to storing the identity authentication certificate and the electronic signature certificate, it is also necessary to store the encryption certificate.

[0129] In one embodiment of the present specification, after the identity authentication certificate and the electronic signature certificate are generated, the encryption certificate is automatically generated and stored.

[0130] In another embodiment of the present specification, an encryption certificate is generated based on the user's selection. Specifically, the certificate types include: a first certificate type, a second certificate type, and a third certificate type. If the user selects the first certificate type, it means that the certificate currently applied for by the user is an identity authentication certificate for authentication. If the user selects the second certificate type, it means that the certificate currently applied for by the user is an electronic signature certificate for signing. If the user selects the third certificate type, it means that the certificate currently applied for by the user is an encryption certificate for encryption.

[0131] When the user has prepared the materials required for generating an electronic signature certificate, the user is required to prepare the materials for the identity authentication certificate in a predetermined order (generating the identity authentication certificate first, then generating the electronic signature certificate), which significantly reduces the user experience and the efficiency of certificate generation. The present invention allows the user to select from all available certificate types, so that the system can customize the certificate according to the actual needs of the user. This personalized selection effectively increases the flexibility of multi-digital certificate production, improves the efficiency of multi-digital certificate generation, and optimizes the user experience.

[0132] Step 1-B-2: Based on the currently selected certificate type, send a corresponding key information acquisition request to acquire the key information corresponding to the currently selected certificate type;

[0133] Applicants need to generate a key pair in advance and upload the public key to this system securely.

[0134] In one embodiment of the present specification, the key information includes a public key. In another embodiment of the present specification, the key information includes a public key and related information of the public key.

[0135] In the present invention, it is necessary to generate an identity authentication certificate and an electronic signature certificate respectively. Therefore, two pieces of key information need to be obtained. Specifically, the applicant needs to generate two key pairs in advance, one of which is an authentication key pair, including an authentication public key and a corresponding authentication private key; the other key pair is a signature key pair, including a signature public key and a corresponding signature private key. When making and generating a certificate, it is necessary to collect the authentication key information and signature key information of the certificate applicant.

[0136] The authentication key information includes the authentication public key; or the authentication key information includes the authentication public key and related information of the authentication public key. The signature key information includes the signature public key; or the signature key information includes the signature public key and related information of the signature public key.

[0137] In one embodiment of the present specification, if the currently selected certificate type is the first certificate type, a request for obtaining authentication key information is sent to the applicant, and the applicant is notified to upload authentication key information. If the currently selected certificate type is the second certificate type, a request for obtaining signature key information is sent to the applicant, and the applicant is notified to upload signature key information.

[0138] After obtaining the key information, the key information is format verified and security checked.

[0139] In the present invention, the currently selected certificate type and the corresponding key information are obtained based on the applicant's feedback, ensuring the pertinence and effectiveness of certificate generation. By collecting type selection instructions and sending key information acquisition requests, the information acquisition process is simplified and the efficiency of certificate generation is improved.

[0140] Step 1-B-3: Determine the identification information according to the currently selected certificate type;

[0141] The identification information includes at least one identification content, and the identification content includes: policy identification, key function, and key usage identification.

[0142] The policy identifier is used to mark the certificate policy corresponding to the digital certificate. Preferably, the policy identifier is a policy object identifier (OID), which is used to define the rules for issuing and using certificates. Each CA center can customize the policy object identifier to explain the intended use, security requirements, and the direction of the certificate revocation list of different certificates.

[0143] Key Usage is used to define the purpose of the public key in the certificate, that is, the operations that the public key in the certificate can perform. Preferably, the key usage identifier is a cryptographic usage representation bit, which is specified by a series of OIDs.

[0144] Different certificate types correspond to different identification information. Specifically, if the currently selected certificate type is the first certificate type, the corresponding first identification information is searched. At this time, the policy identifier in the first identification information is the authentication policy identifier, and the key function is the authentication function.

[0145] If the currently selected certificate type is the second certificate type, the corresponding second identification information is searched. At this time, the policy identifier in the second identification information is the signature policy identifier, the key function is the signature function, and the key usage identifier in the second identification information indicates non-repudiation.

[0146] Step 1-C: Combining the basic information and the characteristic information, constructing a digital certificate corresponding to the currently selected certificate type;

[0147] Step 1-C-1: Retrieve the corresponding current certificate template according to the currently selected certificate type; the current certificate template includes several configuration parameters;

[0148] Each certificate type corresponds to a certificate template. The certificate template contains all necessary configuration parameters and reserves fill positions for filling in configuration values.

[0149] If the currently selected certificate type is the first certificate type, the first certificate template corresponding to the first certificate type is retrieved as the current certificate template. If the currently selected certificate type is the second certificate type, the second certificate template corresponding to the second certificate type is retrieved as the current certificate template.

[0150] Certificate templates are the specific implementation of certificate policies in digital certificate management. Therefore, by configuring certificate templates, you can apply the security requirements and rules in the certificate policy to specific digital certificates.

[0151] The certificate template includes several configuration parameters; in one embodiment of the present specification, the configuration parameters include but are not limited to: issuer, certificate holder, certificate attributes, signature algorithm, identification tag, etc.

[0152] The issuer is used to identify the authority that issues the certificate, which is generally a CA center (Certificate Authority). The configuration value of the corresponding configuration parameter is directly determined based on the name of the certificate authority and generally cannot be changed.

[0153] The certificate holder is used to record the relevant information of the user. Specifically, the configuration value of the certificate holder includes: the certificate holder name, i.e. the user name, which is used to clarify the individual or entity to which the certificate belongs.

[0154] The certificate attributes are used to record the relevant information of the currently applied certificate. The configuration values ​​corresponding to the certificate attributes include but are not limited to: certificate serial number and certificate validity period. The certificate serial number is the unique identifier of each certificate. The certificate validity period is used to specify the validity period of the certificate.

[0155] The signature algorithm is an algorithm for generating a certificate signature, which is predetermined. The configuration value of the signature algorithm includes a signature algorithm identifier.

[0156] The identification tag is used to identify the specific type of the digital certificate. In one embodiment of the present specification, the identification tag includes one or more of a policy identifier, a key usage identifier, and a certificate storage area ID.

[0157] Each certificate type corresponds to a certificate template, which ensures the standardization and consistency of the certificate format. At the same time, the reserved filling position facilitates the subsequent filling of configuration values, improving the efficiency of certificate generation.

[0158] Step 1-C-2: matching the configuration parameters in the current certificate template with corresponding configuration values ​​to generate certificate information;

[0159] The name of the issuer is found and used as the configuration value of the issuer to generate the issuer information; wherein the name of the issuer is predetermined and the name of the same issuer is the same.

[0160] Retrieve the user name from the basic information as the configuration value of the certificate holder and generate the certificate holder information;

[0161] Generate the certificate serial number based on the unique number created according to the preset coding rules; determine the certificate validity period based on the preset validity period and current time; where the current time refers to the current date and time, and the preset validity period refers to the total validity period of the certificate. Based on the certificate serial number and certificate validity period, obtain the configuration value corresponding to the certificate's own attributes and generate the certificate's own information.

[0162] The policy identifier and / or the key usage identifier in the identification information is searched and used as the configuration value of the identification tag to generate certificate distinguishing information.

[0163] According to the currently selected certificate type, the algorithm rule of the corresponding preset signature algorithm is searched, and the signature algorithm identifier corresponding to the algorithm rule is used as the configuration value of the signature algorithm; the algorithm information is generated; wherein the algorithm rule of the preset signature algorithm refers to the specific algorithm for generating the certificate signature, such as RSA, DSA or ECDSA.

[0164] Summarize the issuer information, certificate holder information and certificate information as the original information. Summarize the certificate distinguishing information and algorithm information as additional information. Summarize the original information and additional information to construct the certificate information.

[0165] In one embodiment of the present specification, if the currently selected certificate type is the first certificate type, the configuration parameters in the first certificate template are matched with corresponding configuration values ​​to generate first certificate information for constructing an identity authentication certificate.

[0166] If the currently selected certificate type is the second certificate type, the second default information is obtained, and the configuration parameters in the second certificate template are matched with corresponding configuration values ​​to generate second certificate information so as to construct an electronic signature certificate.

[0167] Through the above operations, comprehensive data support is provided for the final generation of the certificate, and the automated processing method greatly improves the efficiency of certificate production and reduces the possibility of human intervention and errors.

[0168] Step 1-C-3: Use the issuer's private key to encrypt the certificate information and the key information to obtain a digital certificate corresponding to the currently selected certificate type.

[0169] The certificate information and key information are encrypted using the issuer's private key, a digital certificate corresponding to the currently selected certificate type is generated, and the digital certificate is stored.

[0170] Specifically, the certificate information and key information are hashed using the default signature algorithm to obtain a first hash result; the first hash result is encrypted using the issuer's private key to obtain the issuer's signature; the certificate information, key information, and the issuer's signature are aggregated to obtain a digital certificate. That is, a digital certificate includes: certificate information, key information, and the issuer's signature.

[0171] In one embodiment of the present specification, after obtaining the first certificate information and the authentication key information, the first certificate information and the authentication key information are encrypted using the private key of the issuer (CA center) to generate an identity authentication certificate, and the identity authentication certificate is stored.

[0172] After obtaining the second certificate information and the signature key information, the second certificate information and the signature key information are encrypted using the private key of the issuer (CA center), an electronic signature certificate is generated, and the electronic signature certificate is stored.

[0173] Apply for an encryption certificate through the Key Management Center (KMC). Store the encryption certificate and / or encryption private key.

[0174] As mentioned above, the digital certificate is stored in a hardware device / software, that is, the digital certificate can be stored in a hardware device (such as a digital certificate medium) or in a software system. Specifically, the digital certificate medium can be a USB Key.

[0175] In order to better preserve and use digital certificates, such as Figure 2 As shown, in one embodiment of the present specification, the digital certificate medium includes a public key area and a private key area, wherein the public key area stores the identity authentication certificate, the electronic signature certificate and the encryption certificate, and the private key area stores the authentication private key, the signature private key and the encryption private key.

[0176] To facilitate query, the completed digital certificate and the corresponding list will be published to the certificate query system.

[0177] By using the issuer's private key to encrypt the certificate information and key information, the security and non-tamperability of the digital certificate are ensured. At the same time, it is stored in the digital certificate medium for users to carry and use.

[0178] Step 1-D: Determine whether each certificate type corresponds to the generation of a digital certificate; if so, complete the production of the user's multiple digital certificates, the multiple digital certificates include: an identity authentication certificate for authentication and an electronic signature certificate for signing.

[0179] Determine whether the applicant has selected all optional certificate types and generate corresponding digital certificates. If a digital certificate is generated for each certificate type, the production of multiple digital certificates is completed.

[0180] In one embodiment of the present specification, if all certificate types have been selected and generated, a completion notification is sent to the applicant. If multiple digital certificates are stored in a digital certificate medium, the applicant is provided with options for obtaining the digital certificate medium. If there are still unselected certificate types, the applicant is reminded to select and generate them, ensuring that the applicant obtains complete certificate services.

[0181] This generation process supports the production of multiple types of digital certificates for the same user, including identity authentication certificates and electronic signature certificates. This multi-certificate support enables users to use different types of certificates in different application scenarios, which not only meets diverse security needs, but also improves overall security.

[0182] In order to avoid the inability to distinguish the corresponding certificate types when uploading multiple key information at the same time, when generating multiple digital certificates, after the applicant selects one of the certificate types to be applied for and completes the production of the digital certificate corresponding to that certificate type, the applicant can select other certificate types to be applied for and then produce other types of digital certificates.

[0183] In order to facilitate the user's management of digital certificates, the user is required to set a PIN (Personal Identification Number) password for the digital certificate.

[0184] In one embodiment of the present specification, an original PIN password may be set for each digital certificate, or the same original PIN password may be set for all digital certificates.

[0185] In one embodiment of this specification, when the hardware device storing the digital certificate is used for the first time, it is initialized and the end user is notified to enter the original PIN password. In another embodiment of this specification, the user is allowed to change or set the original PIN password after the certificate has been deployed to the device.

[0186] By setting a PIN password for each digital certificate, the security of certificate use is enhanced, unauthorized access is prevented, and user privacy and data security are protected.

[0187] like Figure 3 As shown, the following briefly describes the certificate management framework of the CA center:

[0188] The CA center includes the CA center certificate management system, the certificate registration center (RA center) and the certificate query system (OCSP / LDAP). The user end used by the applicant is plugged with a key device, that is, a digital certificate medium.

[0189] Among them, the CA Center Certificate Management System: This is the core system of the CA, responsible for the generation, issuance, revocation, and renewal of certificates throughout their life cycle. It stores all issued certificates and their related information, such as certificate serial number, validity period, public key, private key (although the private key is usually not directly managed by the CA, but kept by the certificate holder), etc.

[0190] Certificate Registration Center (RA Center): RA Center is the interface between CA Center Certificate Management System and the user end, and is responsible for processing user certificate applications. It usually does not directly participate in the certificate issuance process, but will collect user-related information, verify the user's identity, and submit this information to the CA Center Certificate Management System. RA Center establishes information interconnection with CA Center Certificate Management System to transmit certificate applications and review results.

[0191] Certificate query systems (such as OCSP / LDAP): These systems are used to provide online query and verification services for certificates. Among them, OCSP (Online Certificate Status Protocol) allows users to query the validity of certificates (whether they have been revoked) in real time, while LDAP (Lightweight Directory Access Protocol) is usually used to store and retrieve certificates and related information. The certificate query system establishes information interconnection with the CA center certificate management system to obtain the latest certificate status information.

[0192] Key device (digital certificate medium): A physical or virtual device used by the client to store private keys and certificates, such as a USB key, smart card, or software wallet. The key device interacts with the certificate management system through the client software or browser plug-in. However, in some cases, the key device may need to interact with the RA center to complete certain steps in the certificate application process (such as signature application).

[0193] The following combination Figure 4 , briefly describe the generation / application process of multiple digital certificates:

[0194] ① The applicant submits a certificate application to the RA client;

[0195] ②After the RA client receives the certificate application, the data entry staff reviews and enters the user information into the RA registration center;

[0196] ③RA registration center reviews and submits the certificate request;

[0197] ④The CA center applies for encryption keys from the Key Management Center (KMC);

[0198] ⑤The Key Management Center (KMC) returns the encryption key to the CA center;

[0199] ⑥The CA center publishes the certificate to the query system (LDAP);

[0200] ⑦The CA center produces encryption certificates, identity authentication certificates, and electronic signature certificates and notifies the RA registration center;

[0201] ⑧The RA registration center notifies the RA client that the certificate is complete;

[0202] ⑨Return the certificate to the client and give it to the user for use.

[0203] The present invention involves many changes and adjustments for the purpose of certificate standardization to ensure that the system can meet new standards or requirements. In the embodiments of this specification, these changes mainly include:

[0204] (1) Changes to the signing certificate policy and certificate template: The existing certificate policy and template have been adjusted to comply with relevant standards. For example, the information fields, validity period, key algorithm, etc. contained in the certificate have been modified to ensure the security and interoperability of the certificate.

[0205] (2) Add policies and certificate templates for identity authentication certificates / electronic signature certificates: In addition to modifying existing policies, new certificate policies and templates need to be introduced to meet the specific needs of different users or application scenarios.

[0206] (3) Changes to the certificate management process: In the certificate management process, all aspects of the process, including key generation, certificate issuance, and certificate revocation, are adjusted accordingly. When the standards or requirements for new certificates change, the key generation algorithm, certificate format and content, and revocation mechanism are updated.

[0207] (4) Changes to certificate-related management and application interfaces: To support new certificate standards and processes, the CA center needs to update its management system and application interface. This includes API (application programming interface) modifications to ensure that applications can correctly request, verify, and use new certificates.

[0208] (5) Change the format of digital certificate media: In some cases, the storage media of digital certificates (such as USB keys, smart cards, etc.) also need to be adjusted in format to support new certificate standards and functions. This may require updating the driver or firmware of the hardware device, as well as the corresponding software support.

[0209] Since the systems corresponding to the above methods have undergone a lot of changes and adjustments in order to improve security and interoperability rather than change user habits, the operational behavior of end users / applicants is usually not greatly affected.

[0210] Through the above method, the use and security level requirements of each electronic signature authentication certificate are standardized, and the standardization of electronic signature authentication certificates is achieved while ensuring the interoperability of similar certificates.

[0211] When performing digital signatures, a single signature certificate is usually used for identity authentication and electronic signature, which can easily cause confusion in the use of signature certificates. Figure 5 As shown, the present invention provides a method for signing using multiple digital certificates, comprising:

[0212] Step 2-A: Obtain the user's authentication information; the authentication information includes: identity authentication certificate;

[0213] Step 2-B: verifying the user and the identity authentication certificate based on the identity authentication condition to obtain a verification result;

[0214] Step 2-C: Obtain the original document to be signed and the electronic signature certificate based on the verification result;

[0215] Step 2-D: Sign the original document using the electronic signature certificate.

[0216] As mentioned above, in current digital signature applications, a significant problem is the limitations and confusion that may be caused by the use of a single signature certificate. With the increasing complexity of the network environment and the continuous improvement of security requirements, due to the weak reliability of the single certificate model, a single certificate may not be able to fully meet the diverse identity authentication needs, ensure the non-repudiation of signatures, and cope with security challenges in different application scenarios.

[0217] In order to solve the above problems, the present invention proposes an innovative method for signing using multiple digital certificates. The method aims to improve the security, flexibility and traceability of digital signatures by integrating the advantages of multiple digital certificates. Figure 6 As shown, it specifically includes:

[0218] Step 2-A: Obtain user authentication information;

[0219] The authentication information includes: identity authentication certificate;

[0220] The user is the entity to whom the identity certificate is issued or the authorized agent of the entity to whom the identity certificate is issued.

[0221] Step 2-A-1: Obtain the signature instruction submitted by the user;

[0222] When handling some business, the user needs to use the certificate to sign the business document. At this time, the user submits the signature instruction; the present invention obtains the user's signature instruction.

[0223] Step 2-A-2: Based on the signature instruction, display the identity authentication method to the user;

[0224] After obtaining the signature request, multiple identity authentication methods are displayed to the user;

[0225] Identity authentication methods include but are not limited to: PIN code authentication, biometric authentication, and identity certificate authentication. By providing a variety of authentication methods to choose from, the security needs of different users can be met.

[0226] According to the user's selection result, determine the matching authentication method.

[0227] Step 2-A-3: Based on the user's selection result of the identity authentication method, obtain the authentication information corresponding to the user.

[0228] When the user chooses to authenticate through an identity authentication certificate, obtaining authentication information corresponding to the user;

[0229] To verify the user's true identity, the identity authentication certificate in the digital certificate medium must be called through the interface, and the relevant certificate verification process must be performed to confirm the validity of the digital authentication certificate and the authenticity of the user's identity.

[0230] Specifically, if the digital certificate is not stored in the software, the user is reminded to insert the digital certificate medium containing the identity authentication certificate into the device interface, and obtain the identity authentication certificate in the digital certificate medium as authentication information.

[0231] Since multiple certificates are stored in the digital certificate medium, in order to extract the identity authentication certificate, in one embodiment of this specification, the identity authentication certificate is identified by the certificate distinguishing information. Specifically:

[0232] When the user chooses to authenticate through the identity authentication certificate, all available digital certificates are read from the hardware device (digital certificate medium) / software, and each digital certificate is parsed to extract the certificate distinguishing information therein.

[0233] The key function in the certificate distinguishing information is searched, and if the key function is an authentication function, the digital certificate corresponding to the key function is identified as an identity authentication certificate. That is, the digital certificate corresponding to the authentication function is used as the identity authentication certificate.

[0234] Step 2-B: verifying the user and the identity authentication certificate based on the identity authentication condition to obtain a verification result;

[0235] The identity authentication condition includes multiple authentication sub-conditions. If all authentication sub-conditions are met, it is determined that the authentication verification of the user and the identity authentication certificate has passed. If at least one authentication sub-condition is not met, it is determined that the authentication verification of the user and the identity authentication certificate has failed.

[0236] Preferably, the identity authentication condition includes: a password authentication sub-condition and a random number authentication sub-condition;

[0237] The password authentication sub-condition is used to verify the user's right to use the identity authentication certificate; the random number authentication sub-condition is used to verify the validity of the identity authentication certificate.

[0238] By directly calling the identity authentication certificate in the digital certificate medium, the authenticity of the user's identity and the reliability of the certificate are ensured.

[0239] Step 2-B-1: Verify the password of the user based on the password authentication condition;

[0240] Specifically, a PIN password acquisition request is sent to the user; the actual PIN password entered by the user is received; based on the actual PIN password, the user's valid right to use the authentication digital certificate is determined. If the actual PIN password is the same as the original PIN password, it is determined that the actual PIN password entered by the user is correct, and the user has the valid right to use the authentication digital certificate; otherwise, it is determined that the actual PIN password entered by the user is incorrect, and the user does not have the valid right to use the authentication digital certificate.

[0241] By verifying the user's right to use the identity certificate, the certificate can be prevented from being used illegally.

[0242] Step 2-B-2: Extract key information of the identity authentication certificate and perform a first verification on the identity authentication certificate.

[0243] Specifically, the certificate content of the identity authentication certificate is parsed to extract key information, including but not limited to: original information and authentication key information. The original information includes: issuer name and certificate validity period.

[0244] Step 2-B-2-1: Retrieve the original information of the identity authentication certificate and verify the validity of the identity authentication certificate;

[0245] Verify whether the identity authentication certificate is issued by a trusted certificate authority (CA center) based on the issuer name.

[0246] Determine whether the identity authentication certificate is within the validity period. If the "start date" of the certificate validity period is earlier than the current date, and the "end date" of the certificate validity period is later than the current date, then the identity authentication certificate is considered to be within the validity period.

[0247] Step 2-B-2-2: Retrieve the authentication key information of the identity authentication certificate, and verify the authenticity of the user in combination with the random information and random number authentication sub-conditions.

[0248] The random information includes a random number.

[0249] Specifically, a random number is randomly generated and sent to the user (client) as random information; the user (client) signs the random number using the corresponding authentication private key and returns the signature result. Among them, the authentication private key corresponds to the authentication public key in the identity authentication certificate.

[0250] The returned signature is verified using the authentication public key in the identity certificate. If the verification is successful, it is determined that the user (client) does hold the authentication private key that matches the identity certificate, thereby confirming the authenticity and security of the user (client) and the identity certificate.

[0251] By ensuring the validity and authenticity of the identity certificate, it provides the basis for subsequent signing operations.

[0252] Step 2-C: Obtain the original document to be signed and the electronic signature certificate based on the verification result;

[0253] To perform electronic signature, you must use the interface to call the electronic signature certificate in the digital certificate medium and perform the relevant certificate verification process to confirm the validity of the signature certificate, thereby achieving a correct and effective electronic signature.

[0254] Step 2-C-1: Identify and retrieve the electronic signature certificate based on the certificate distinguishing information;

[0255] Specifically, all available digital certificates are read; each digital certificate is parsed to extract certificate distinguishing information therein;

[0256] Find the key function in the certificate distinguishing information and confirm the certificate type based on the key function.

[0257] In one embodiment of the present specification, if the key function is a signature function, the corresponding digital certificate is an electronic signature certificate. That is, the digital certificate corresponding to the signature function is an electronic signature certificate.

[0258] Step 2-C-2: Obtain the original document to be signed;

[0259] The original file may be data document material confirmed by all parties involved.

[0260] Based on the above operations, it is easy to accurately obtain the files and certificates required for signing and prepare for the signing operation.

[0261] Step 2-D: Sign the original document using the electronic signature certificate.

[0262] Step 2-D-1: Search for a preset signature algorithm; hash the original file according to the preset signature algorithm to obtain a summary of the original file;

[0263] In one embodiment of the present specification, a preset signature algorithm is searched based on the second certificate information in the electronic signature certificate.

[0264] Step 2-D-2: Obtain the key information of the electronic signature certificate, encrypt the summary of the original file based on the signature private key, and generate data ciphertext;

[0265] Specifically, the summary of the original file is pushed to the user, and the user applies to sign it using the signature private key.

[0266] Step 2-D-3: Perform integrity check on the summary of the original file, the data ciphertext, and the electronic signature certificate;

[0267] Step 2-D-4: Based on the integrity check result, the data ciphertext and the original file are merged to obtain a target signature file.

[0268] Save the target signature file.

[0269] Sign the original document with an electronic signature certificate to ensure the validity and non-repudiation of the signature.

[0270] The electronic signature provided by the present invention is completed based on the dedicated electronic signature digital certificate function, the process is clearer, the function is simpler, and the versatility of the certificate is improved.

[0271] In one embodiment of the present specification, before authentication and signing, it is checked whether the certificate interface needs to be updated.

[0272] After the signature is completed, in order to verify the authenticity of the target signature file, such as Figure 7 As shown, the present invention provides a method for verifying a signature file, comprising:

[0273] Step 3-A: Obtain the target signature file; search for basic information corresponding to the target signature file; the basic information includes: electronic signature certificate and document information;

[0274] Step 3-B: Perform security verification on the electronic signature certificate; the security verification on the electronic signature certificate includes: performing specificity verification on the electronic signature certificate;

[0275] Step 3-C: If the security verification is passed, the authenticity of the electronic signature certificate is verified;

[0276] Step 3-D: If the authenticity verification passes, the document information is verified for integrity using a preset signature algorithm to obtain a verification result.

[0277] In an era of widespread use of digital signatures, ensuring the authenticity and integrity of signed documents is a key step in maintaining information security and the cornerstone of trust. However, existing verification mechanisms often focus on a single verification dimension, such as only checking the validity of certificates or the integrity of documents, but fail to fully cover the two core aspects of security and authenticity. This limitation may lead to potential security vulnerabilities, making it possible to forge or tamper with signed documents, thereby threatening the reliability of the entire digital signature system.

[0278] In order to comprehensively solve the above problems and improve the accuracy and credibility of signature file verification, the present invention innovatively proposes a comprehensive verification method. This method not only focuses on the security verification of the electronic signature certificate to ensure that the certificate has not been illegally tampered with or expired, but also conducts in-depth authenticity verification to verify the authenticity of the signer's identity and the compliance of the signing process. At the same time, the integrity of the document content is verified in combination with the preset signature algorithm to ensure that the file has not been modified since it was signed.

[0279] The scheme of the present invention specifically includes:

[0280] Step 3-A: Obtain a target signature file; search for basic information corresponding to the target signature file;

[0281] The basic information includes: electronic signature certificate and document information; the document information includes: original file and data ciphertext;

[0282] In one embodiment of the present specification, a target signature file is retrieved from a specified location (such as a database, a file system, or a network), the file is parsed, and the electronic signature certificate, the original file (or its hash value), the data ciphertext, and the preset signature algorithm are extracted to ensure that the subsequent verification process has an accurate data basis, including the signature certificate and the document content to be verified.

[0283] Step 3-B: Performing security verification on the electronic signature certificate based on security verification conditions;

[0284] Before performing certificate verification, the verifier needs to communicate with the authenticator and perform the relevant certificate verification process through the certificate interface to confirm the specificity, validity and legality of the electronic signature certificate.

[0285] Among them, the authenticator is a third-party certificate certification body recognized by the signature business application service provider.

[0286] The security verification condition includes several security verification sub-conditions. When the electronic signature certificate meets all security verification sub-conditions, the electronic signature certificate is deemed to have passed the security verification. When the electronic signature certificate does not meet at least one security verification sub-condition, the electronic signature certificate is deemed to have failed the security verification, and the verification process ends.

[0287] In one embodiment of this specification, Figure 8 As shown, the security verification condition includes one or more of: a specificity verification sub-condition, a path verification sub-condition, a validity verification sub-condition, and a status verification sub-condition.

[0288] Step 3-B-1: Performing exclusivity verification on the electronic signature certificate based on the exclusivity verification sub-condition;

[0289] The specificity verification subcondition is used to verify the specificity of the purpose of the electronic signature certificate.

[0290] Finding certificate distinguishing information of the electronic signature certificate;

[0291] Determine whether the key function in the certificate distinguishing information corresponds to the preset purpose; and / or determine whether the key usage identifier in the certificate distinguishing information corresponds to the preset usage.

[0292] The default usage is signature function and the default usage is non-repudiation.

[0293] In one embodiment of the present specification, the policy object identifier in the certificate distinguishing information of the electronic signature certificate is checked through the certificate interface to determine whether the key function is a signature function, thereby determining whether the digital certificate is a dedicated electronic signature certificate; through the certificate interface, the policy object identifier (OID item) of the electronic signature certificate is checked to determine whether it indicates "signature", and to confirm whether the key usage identifier of the certificate corresponds to non-repudiation.

[0294] If the key function in the certificate distinguishing information corresponds to the preset purpose; and the key usage identifier in the certificate distinguishing information corresponds to the preset usage, it is determined that the electronic signature certificate meets the specificity verification sub-condition, and the specificity verification of the electronic signature certificate passes. If the key function in the certificate distinguishing information does not correspond to the preset purpose, and / or the key usage identifier in the certificate distinguishing information does not correspond to the preset usage, it is determined that the electronic signature certificate does not meet the specificity verification sub-condition, and the specificity verification of the electronic signature certificate fails.

[0295] Based on the above steps, prevent the certificate from being misused or abused and ensure that the certificate is used only for its signing purpose.

[0296] Step 3-B-2: Perform path verification on the electronic signature certificate based on the path verification sub-condition;

[0297] The path verification subcondition is used to verify the trusted certification path of the electronic signature certificate.

[0298] Finding the issuer information of the electronic signature certificate;

[0299] Searching for the root certificate chain of the corresponding issuer based on the issuer information;

[0300] The signature of the issuer in the electronic signature certificate is verified through the root certificate chain.

[0301] In one embodiment of the present specification, the root certificate chain of the corresponding CA center is obtained through the CA center recognized by the business application party. The electronic signature of the CA center when issuing the electronic signature certificate is verified according to the root certificate chain. If the verification is successful, it means that the electronic signature certificate is indeed a legal digital certificate issued by the recognized CA center, the electronic signature certificate meets the path verification sub-condition, and the path verification of the electronic signature certificate passes; otherwise, it means that the electronic signature certificate is a signature certificate of an illegal organization or a CA center that has not obtained the permission of the application party, the electronic signature certificate does not meet the path verification sub-condition, and the path verification of the electronic signature certificate fails. Among them, the business application party is the other party to the signature file.

[0302] In this step, based on the issuer information in the certificate, the certificate is verified step by step from the trusted root certificate chain to ensure the trusted source of the certificate. By establishing a trusted authentication path for the certificate, forged or unauthorized certificates are prevented from being accepted.

[0303] Step 3-B-3: Verify the validity of the electronic signature certificate based on the validity verification sub-condition;

[0304] The validity verification sub-condition is used to verify the validity of the electronic signature certificate.

[0305] Retrieving the certificate validity period from the electronic signature certificate;

[0306] Determine whether the current time is within the validity period of the certificate.

[0307] In one embodiment of the present specification, the business application party obtains a credible, reliable and fair current time; the business application party obtains the expiration date of the electronic signature certificate according to the certificate parsing interface, and can verify the validity of the electronic signature certificate through time comparison.

[0308] The validity period information is extracted from the certificate and compared with the current time. If the current time is confirmed to be within the validity period of the certificate, the electronic signature certificate is deemed to meet the validity verification sub-condition and the validity verification of the electronic signature certificate is passed. If the current time is confirmed to be outside the validity period of the certificate, the electronic signature certificate is deemed to not meet the validity verification sub-condition and the validity verification of the electronic signature certificate is failed. Based on the validity verification, ensure that the electronic signature certificate is used within the validity period to avoid security risks caused by the use of expired certificates.

[0309] Step 3-B-4: Performing status verification on the electronic signature certificate based on the status verification sub-condition;

[0310] The status verification subcondition is used to verify the certificate status of the electronic signature certificate.

[0311] Retrieving certificate distinguishing information from the electronic signature certificate;

[0312] confirming a certificate revocation list based on the certificate distinguishing information;

[0313] Determine whether the electronic signature certificate is in the certificate revocation list.

[0314] In one embodiment of the present specification, the business application party reads the OID item of the electronic signature certificate through an interface and finds the certificate revocation list (CRL) download address corresponding to the certificate; the business application party downloads the corresponding CRL file online through the CRL download address; retrieves the correct CRL file content downloaded previously to confirm whether the signature certificate is in the CRL list; if the certificate is not in the blacklist, it indicates that the signature certificate status has not entered the certificate revocation list, that is, the certificate is valid.

[0315] Check whether the certificate has been revoked through the Certificate Revocation List (CRL) or Online Certificate Status Protocol (OCSP). By verifying the validity status of the certificate in real time, revoked certificates can be discovered and eliminated in a timely manner.

[0316] Step 3-C: If the security verification is passed, the authenticity of the electronic signature certificate is verified;

[0317] If the security verification is passed, the authenticity of the electronic signature certificate is verified based on the authenticity verification condition, including:

[0318] Decrypt the data ciphertext using the electronic signature certificate to obtain a first original plaintext;

[0319] If the first original plaintext cannot be generated, it is determined that the authenticity verification of the electronic signature certificate has failed, and the verification process ends.

[0320] By verifying the authenticity of the electronic signature certificate, it is ensured that the data ciphertext is indeed signed by the certificate holder.

[0321] Step 3-D: If the authenticity verification passes, the document information is verified for integrity using a preset signature algorithm to obtain a verification result.

[0322] The original file is encrypted by the preset signature algorithm to obtain a second original plaintext; in one embodiment of the specification, the preset signature algorithm is extracted by parsing the electronic signature certificate. Specifically, the second certificate information in the electronic signature certificate is obtained, and the preset signature algorithm is searched from the second certificate information.

[0323] Comparing the first original plaintext with the second original plaintext;

[0324] If the first original plaintext is the same as the second original plaintext, the original file is deemed to have passed the integrity verification. Otherwise, it means that the original file has been tampered with, the data original text integrity verification fails, and the verification process ends.

[0325] Based on the above steps, it is easy to ensure that the document has not been tampered with during transmission or storage, and maintain the integrity and credibility of the data.

[0326] Fig. 9 A schematic diagram of a system for generating multiple digital certificates provided in an embodiment of this specification, the system comprising:

[0327] The first acquisition module 910 is used to acquire basic information; send a type selection request, the type selection request includes: all certificate types;

[0328] The characteristic information acquisition module 920 is used to acquire characteristic information based on the currently selected certificate type; the characteristic information corresponds to the currently selected certificate type one by one;

[0329] The certificate construction module 930 is used to construct a digital certificate corresponding to the currently selected certificate type by combining the basic information and the characteristic information;

[0330] The judgment module 940 is used to judge whether each certificate type corresponds to the generation of a digital certificate; if so, the production of multiple digital certificates of the user is completed, and the multiple digital certificates include: an identity authentication certificate for authentication and an electronic signature certificate for signing.

[0331] Optionally, the first acquisition module 910 includes:

[0332] The certificate application instruction acquisition submodule is used to acquire the certificate application instruction submitted by the applicant; the certificate application instruction includes the basic information of the user;

[0333] A basic information verification submodule, used to verify the basic information;

[0334] The type selection request sending submodule is used to send a type selection request according to the verification result; the type selection request includes: all certificate types.

[0335] Optionally, the characteristic information includes: key information and identification information;

[0336] Optionally, the feature information acquisition module 920 includes:

[0337] A type selection instruction collection submodule is used to collect the type selection instruction fed back by the applicant, wherein the type selection instruction includes: the currently selected certificate type;

[0338] A key information acquisition request sending submodule, used to send a corresponding key information acquisition request based on the currently selected certificate type, to obtain the key information corresponding to the currently selected certificate type;

[0339] The identification information determination submodule is used to determine the identification information according to the currently selected certificate type.

[0340] Optionally, the certificate building module 930 includes:

[0341] The current certificate template calling submodule is used to call the corresponding current certificate template according to the currently selected certificate type; the current certificate template includes several configuration parameters;

[0342] A parameter matching submodule, used to match the configuration parameters in the current certificate template with corresponding configuration values ​​to generate certificate information;

[0343] The digital certificate generation submodule is used to encrypt the certificate information and the key information using the issuer's private key to obtain a digital certificate corresponding to the currently selected certificate type.

[0344] Optionally, the parameter matching submodule includes:

[0345] An issuer configuration unit, used to find the name of the issuer as a configuration value of the issuer;

[0346] A certificate holder configuration unit, used to retrieve a user name from the basic information as a configuration value of the certificate holder;

[0347] A serial number configuration unit, used to generate a certificate serial number according to a unique number created according to a preset encoding rule;

[0348] A validity period configuration unit, used to determine the validity period of the certificate according to a preset validity period and the current time;

[0349] An identification configuration unit, used to search the policy identification and / or the key usage identification in the identification information as a configuration value of the identification tag;

[0350] The signature algorithm configuration unit is used to search for the algorithm rule of the corresponding preset signature algorithm according to the currently selected certificate type, and use the signature algorithm identifier corresponding to the algorithm rule as the configuration value of the signature algorithm.

[0351] Optionally, the certificate type includes a first certificate type;

[0352] The digital certificate generation submodule includes:

[0353] The identity authentication certificate generating unit is used to encrypt the first certificate information and the authentication key information using the private key of the issuer to generate the identity authentication certificate.

[0354] Optionally, the certificate type includes a second certificate type;

[0355] The digital certificate generation submodule includes:

[0356] The electronic signature certificate generating unit is used to encrypt the second certificate information and the signature key information using the private key of the issuer to generate the electronic signature certificate.

[0357] Fig.10 A schematic diagram of a system for signing using multiple digital certificates is provided in an embodiment of this specification, and the system includes:

[0358] The second acquisition module 1010 is used to obtain the user's authentication information; the authentication information includes: an identity authentication certificate;

[0359] The identity authentication module 1020 is used to verify the user and the identity authentication certificate based on the identity authentication conditions to obtain a verification result;

[0360] The signature preprocessing module 1030 is used to obtain the original document to be signed and the electronic signature certificate based on the verification result;

[0361] The signing module 1040 is used to sign the original file using the electronic signature certificate.

[0362] Optionally, the second acquisition module 1010 includes:

[0363] A signature instruction acquisition submodule, used to acquire the signature instruction submitted by the user;

[0364] An identity authentication display submodule, used to display an identity authentication method to the user based on the signature instruction;

[0365] The authentication information acquisition submodule is used to acquire the authentication information corresponding to the user based on the selection result of the user for the identity authentication method.

[0366] Optionally, the authentication information acquisition submodule includes:

[0367] A digital certificate reading unit, used for reading all available digital certificates when the user chooses to authenticate through the identity authentication certificate;

[0368] A certificate distinguishing information extraction unit, used to parse each of the digital certificates and extract the certificate distinguishing information therein;

[0369] The identity authentication certificate identification unit is used to find the key function in the certificate distinguishing information and use the digital certificate corresponding to the authentication function as the identity authentication certificate.

[0370] Optionally, the identity verification module includes:

[0371] A password verification submodule, used to verify the password of the user based on the password authentication condition;

[0372] The first verification submodule is used to extract key information of the identity authentication certificate and perform a first verification on the identity authentication certificate.

[0373] Optionally, the key information includes: original information and authentication key information;

[0374] Optionally, the first verification submodule includes:

[0375] A validity verification unit, used to retrieve the original information of the identity authentication certificate and verify the validity of the identity authentication certificate;

[0376] The authenticity verification unit is used to retrieve the authentication key information of the identity authentication certificate and verify the authenticity of the user in combination with the random information.

[0377] Optionally, the signature preprocessing module 1030 includes:

[0378] A first pre-processing unit, configured to identify and retrieve the electronic signature certificate based on the certificate distinguishing information;

[0379] The second pre-processing unit is used to obtain the original file that needs to be signed.

[0380] Optionally, the signature module 1040 includes:

[0381] A first signature submodule, configured to hash the original file according to a preset signature algorithm to obtain a summary of the original file;

[0382] A second signature submodule, configured to encrypt the summary of the original file based on the signature private key to generate a data ciphertext;

[0383] The third signature submodule is used to perform integrity verification on the summary of the original file, the data ciphertext, and the electronic signature certificate;

[0384] The fourth signature submodule is used to merge the data ciphertext and the original file based on the integrity check result to obtain a target signature file.

[0385] Fig.11A structural diagram of a signature file verification system provided in an embodiment of this specification, the system includes:

[0386] The third acquisition module 1110 is used to acquire a target signature file; search for basic information corresponding to the target signature file; the basic information includes: an electronic signature certificate and document information;

[0387] A security verification module 1120, used to perform security verification on the electronic signature certificate;

[0388] The authenticity verification module 1130 is used to verify the authenticity of the electronic signature certificate if the security verification passes;

[0389] The integrity verification module 1140 is used to perform integrity verification on the document information through a preset signature algorithm to obtain a verification result if the authenticity verification passes.

[0390] Optionally, the security verification module 1120 includes:

[0391] A specificity verification submodule, used to verify the specificity of the electronic signature certificate;

[0392] Optionally, the specificity verification submodule includes:

[0393] A first usage verification unit, used to find the certificate distinguishing information of the electronic signature certificate;

[0394] The second purpose verification unit is used to determine whether the key function in the certificate distinction information is a preset purpose; and / or determine whether the key usage in the certificate distinction information is a preset usage.

[0395] Optionally, the security verification module 1120 includes:

[0396] A path verification submodule, used to perform path verification on the electronic signature certificate;

[0397] Optionally, the path verification submodule includes:

[0398] A first path verification unit, used to find the issuer information of the electronic signature certificate;

[0399] A second path verification unit, configured to search for a root certificate chain of a corresponding issuer based on the issuer information;

[0400] The third path verification unit is used to verify the signature of the issuer in the electronic signature certificate through the root certificate chain.

[0401] Optionally, the security verification module 1120 includes:

[0402] A validity verification submodule, used to verify the validity of the electronic signature certificate;

[0403] Optionally, the validity verification submodule includes:

[0404] A first validity verification unit, used to retrieve the certificate validity period from the electronic signature certificate;

[0405] The second validity verification unit is used to determine whether the current time is within the validity period of the certificate.

[0406] Optionally, the security verification module 1120 includes:

[0407] A status verification submodule, used to verify the status of the electronic signature certificate;

[0408] Optionally, the status verification submodule includes:

[0409] A first status verification unit, used to retrieve certificate distinguishing information from the electronic signature certificate;

[0410] A second status verification unit, configured to confirm a certificate revocation list based on the certificate distinguishing information;

[0411] The third status verification unit is used to determine whether the electronic signature certificate is in the certificate revocation list.

[0412] Optionally, the document information includes: original file and data ciphertext;

[0413] Optionally, the authenticity verification module 1130 includes:

[0414] A first authenticity verification submodule, configured to decrypt the data ciphertext using the electronic signature certificate to obtain a first original plaintext;

[0415] The second authenticity verification submodule is used to determine that the authenticity verification of the electronic signature certificate fails if the first original plaintext cannot be generated, and the verification process ends.

[0416] Optionally, the integrity verification module 1140 includes:

[0417] A first integrity verification submodule, used to encrypt the original file by using the preset signature algorithm to obtain a second original plaintext;

[0418] A second integrity verification submodule, used to compare the first original plaintext with the second original plaintext;

[0419] The third integrity verification submodule is configured to determine that the original file has passed the integrity verification if the first original plaintext is identical to the second original plaintext.

[0420] The functions of the device in the embodiment of the present invention have been described in the above method embodiment, so for details not provided in the description of this embodiment, please refer to the relevant description in the above embodiment, and no further description will be given here.

[0421] The embodiments of the present invention may be provided as a method, an apparatus or a computer program product. Therefore, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects.

[0422] Fig.12 The present invention provides a schematic diagram of the structure of a computer device provided in an embodiment of the present invention. Specifically, the present invention provides a computer device that can implement each process and / or box in the aforementioned flowchart and / or block diagram, as well as a combination of processes and / or boxes in the flowchart and / or block diagram, by means of executable instructions of a computer program 1203. The electronic device of the present invention can execute the executable instructions of the computer program 1203 through a processor 1202 of a computer or other programmable data processing device to implement one or more processes and / or boxes. Figure 1 A function specified in one or more boxes.

[0423] The executable instructions of the computer program 1203 may also be stored in a computer-readable memory 1201 that can guide a computer or other programmable data processing device to work in a specific manner, and executed by the processor 1202 to implement corresponding functions.

[0424] Fig.13 A schematic diagram of a computer-readable storage medium provided for an embodiment of the present specification. The present invention may be in the form of a computer program product implemented on one or more computer-readable storage media 1300 (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing a computer program 1203.

[0425] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A method for generating multiple digital certificates, characterized in that: include: Get basic information; Sending a type selection request, the type selection request including: all certificate types; Based on the currently selected certificate type, acquiring characteristic information; the characteristic information corresponds one-to-one with the currently selected certificate type; Combining the basic information and the characteristic information, constructing a digital certificate corresponding to the currently selected certificate type; Determine whether each of the certificate types corresponds to the generation of a digital certificate; if so, complete the production of multiple digital certificates for the user, the multiple digital certificates include: an identity authentication certificate for authentication and an electronic signature certificate for signing.

2. A method for generating multiple digital certificates as claimed in claim 1, characterized in that: The obtaining of basic information; Send a type selection request, including: Obtaining a certificate application instruction submitted by an applicant; the certificate application instruction includes basic information of the user; Verify the basic information; According to the verification result, a type selection request is sent; the type selection request includes: all certificate types.

3. A method for generating multiple digital certificates as claimed in claim 1, characterized in that: The characteristic information includes: key information and identification information; The acquiring of characteristic information based on the currently selected certificate type includes: Collecting the type selection instruction fed back by the applicant, the type selection instruction including: the currently selected certificate type; Based on the currently selected certificate type, sending a corresponding key information acquisition request to acquire the key information corresponding to the currently selected certificate type; The identification information is determined according to the currently selected certificate type.

4. A method for generating multiple digital certificates as claimed in claim 3, characterized in that: The combining the basic information and the characteristic information to construct a digital certificate corresponding to the currently selected certificate type includes: Retrieving a corresponding current certificate template according to the currently selected certificate type; the current certificate template includes a number of configuration parameters; Matching the configuration parameters in the current certificate template with corresponding configuration values ​​to generate certificate information; The certificate information and the key information are encrypted using the issuer's private key to obtain a digital certificate corresponding to the currently selected certificate type.

5. A method for generating multiple digital certificates as claimed in claim 4, characterized in that: The step of matching the configuration parameters in the current certificate template with corresponding configuration values ​​to generate certificate information includes: Find the name of the issuer as the configuration value of the issuer; and / or, retrieving a user name from the basic information as a configuration value of the certificate holder; and / or, generating a certificate serial number using a unique number created according to a preset encoding rule; and / or, determining the validity period of the certificate according to a preset validity period and the current time; and / or, searching for a policy identifier and / or a key usage identifier in the identification information as a configuration value of the identification tag; And / or, searching for an algorithm rule of a corresponding preset signature algorithm according to the currently selected certificate type, and using a signature algorithm identifier corresponding to the algorithm rule as a configuration value of the signature algorithm.

6. A method for generating multiple digital certificates as claimed in claim 4, characterized in that: The certificate type includes a first certificate type; The using the issuer's private key to encrypt the certificate information and the key information to obtain a digital certificate corresponding to the currently selected certificate type includes: The first certificate information and the authentication key information are encrypted using the private key of the issuer to generate the identity authentication certificate.

7. A method for generating multiple digital certificates as claimed in claim 4, characterized in that: The certificate type includes a second certificate type; The using the issuer's private key to encrypt the certificate information and the key information to obtain a digital certificate corresponding to the currently selected certificate type includes: The second certificate information and the signature key information are encrypted using the issuer's private key to generate the electronic signature certificate.

8. A system for generating multiple digital certificates, characterized in that: include: The first acquisition module is used to acquire basic information; Sending a type selection request, the type selection request including: all certificate types; A characteristic information acquisition module, used to acquire characteristic information based on the currently selected certificate type; the characteristic information corresponds to the currently selected certificate type one by one; A certificate construction module, used to construct a digital certificate corresponding to the currently selected certificate type by combining the basic information and the characteristic information; The judgment module is used to judge whether each certificate type corresponds to the generation of a digital certificate; if so, the production of multiple digital certificates of the user is completed, and the multiple digital certificates include: an identity authentication certificate for authentication and an electronic signature certificate for signing.

9. A computer device, characterized in that: The computer equipment includes: processor; and, A memory storing computer executable instructions, which when executed cause the processor to perform the method of any one of claims 1-7.

10. A computer-readable storage medium, wherein: The computer-readable storage medium stores one or more programs, and when the one or more programs are executed by a processor, the method of any one of claims 1 to 7 is implemented.

Images