Block chain-based cross-border signature credible verification method and system

Abstract

The invention relates to the technical field of information security, in particular to a cross-border signature credible verification method and system based on a block chain. The method comprises a signing and issuing process and a verification process, wherein the signing and issuing process comprises the following steps: a business system initiates signing; the electronic signing service node applies for a secret key and a CA certificate, constructs a TDVC signing and issuing structural body and sends the TDVC signing and issuing structural body to the TDVC service node; the TDVC service node and the block chain service node complete uplink of the signature request; the electronic signing service node sends a signing completion notice and the electronic signing file to the service system; the verification process comprises the following steps: a service system sends a TDVC verification structural body or a signature file to a TDVC service node; and after analyzing the information, the TDVC service node interacts with the block chain service node and performs multiple verification, and feeds back a verification result to the business system. The credibility verification of the electronic file can be completed without providing the original text of the electronic file to a third party, and the method is suitable for credibility verification of the cross-border electronic signature file.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and more specifically, to a blockchain-based cross-border signature trusted verification method and system that supports multiple countries / organizations. Background Art

[0002] With the rapid advancement of the current wave of global trade digitalization, cross-border trade business is undergoing an unprecedented transformation. The rapid rise of paperless electronic signature scenarios has greatly improved transaction efficiency and profoundly changed the pattern of traditional signing methods. However, with the widespread use of electronic documents, while the signatories enjoy the convenience, they also face the problem of credible verification of electronic documents, which not only concerns the security and legality of transactions, but also directly affects the healthy development of the cross-border trade ecosystem.

[0003] There are currently two main approaches to the problem of trusted verification of electronic documents:

[0004] The first approach is that the signatories can choose to establish a point-to-point mutual trust mechanism on the signing platform used. This method directly connects the two parties to the transaction and uses encryption algorithms and identity authentication technology to ensure the authenticity and non-tamperability of the electronic signature. However, it is only applicable to electronic signatures for fixed bilateral businesses and is difficult to adapt to the complex and changing transaction scenarios and partnerships in cross-border trade. In addition, as the trade network continues to expand, the maintenance cost of the point-to-point mutual trust mechanism will also rise sharply, thereby limiting the further expansion of the cross-border trade ecosystem.

[0005] In order to overcome the above limitations, another more flexible and effective approach is to introduce a trusted third party as a hub for electronic document exchange. In this approach, the third-party agency provides electronic document transmission, storage, verification and other services to both parties of the transaction. By endorsing and encrypting the signature information, the third party ensures the authenticity, integrity and confidentiality of the electronic document, effectively solving the mutual recognition problem between multiple countries / platforms. However, the introduction of third-party agencies also brings new problems:

[0006] On the one hand, the flow of electronic documents to third parties may lead to breaches of confidentiality agreements, especially when the third-party organization is poorly managed internally or suffers external attacks; on the other hand, with the continuous expansion of the scale of cross-border trade and the increasing frequency of transactions, large amounts of data transmission and processing may also make third parties a business bottleneck, affecting transaction efficiency and customer experience.

[0007] In summary, more secure and reliable solutions still need to be further developed for paperless electronic signature scenarios in cross-border trade business to address the issue of trusted verification of electronic documents in various electronic signature processes. Summary of the invention

[0008] The purpose of the present invention is to provide a blockchain-based cross-border signature trusted verification method and system to solve the problems of poor security and low reliability in the prior art for trusted verification of electronic signature documents in cross-border scenarios.

[0009] In order to achieve the above objectives, the present invention provides a cross-border signature trust verification method based on blockchain, including an issuance process and a verification process:

[0010] The issuance process includes:

[0011] The business system initiates the signing;

[0012] The electronic signature service node applies for the key and CA certificate, builds the TDVC issuance structure and sends it to the TDVC service node;

[0013] TDVC service node and blockchain service node complete the signing request on-chain;

[0014] The electronic signature service node sends the signing completion notification and the electronic signature document to the business system;

[0015] The verification process includes:

[0016] The business system sends the TDVC verification structure or signed document to the TDVC service node;

[0017] After the TDVC service node parses the information, it interacts with the blockchain service node and performs multiple verifications, and then feeds the verification results back to the business system.

[0018] In some embodiments, the issuance process includes:

[0019] The business system initiates the signing process, and the electronic signature service node is responsible for applying for the key and CA certificate and calculating the hash value to be signed;

[0020] The electronic signature service node constructs the TDVC issuance structure and initiates an issuance request to the TDVC service node after the interface authentication is completed;

[0021] The TDVC service node performs multiple validity checks based on the issuance request, and after passing, it calls the TDVC issuance smart contract to the blockchain service node;

[0022] The blockchain service node uploads the TDVC issuance request to the chain and returns the blockchain transaction hash value to the TDVC service node;

[0023] After receiving the blockchain transaction hash value, the electronic signature service node assembles the electronic signature structure, synthesizes the electronic signature document, and sends the signing completion notification and the electronic signature document to the business system.

[0024] In some embodiments, the verification process includes:

[0025] The business system sends the constructed TDVC verification structure or signed document to the TDVC service node;

[0026] The TDVC service node parses the received TDVC verification structure or signature file, extracts the blockchain transaction hash value and signature data information, and forwards the blockchain transaction hash value to the blockchain service node;

[0027] The blockchain service node processes the blockchain transaction hash value and returns the TDVC issuance structure to the TDVC service node;

[0028] The TDVC service node performs multiple verifications based on the TDVC issuance structure and combined with the TDVC verification structure or the information parsed by the signed document, and finally feeds back the verification results to the business system.

[0029] In some embodiments, the TDVC issuance structure constructed in the issuance process includes issuance request general information and signature data information:

[0030] The issuance request general information includes version number, random number, request time, request strategy and extension field;

[0031] The signature data information includes a hash algorithm identifier, a hash value of the data to be signed, a signature identifier, a signature value of the data to be signed, and a subscriber public key certificate.

[0032] In some embodiments, the TDVC service node in the issuance process performs multiple validity checks based on the issuance request, further comprising:

[0033] TDVC service node verifies the validity of the signature certificate.

[0034] In some embodiments, the electronic signature structure constructed in the issuance process is assembled based on PKCS#7, and the blockchain transaction hash value is filled into the extension item of PKCS#7.

[0035] In some embodiments, the TDVC verification structure constructed by the business system in the verification process includes verification request general information and signature data information:

[0036] The verification request general information includes version number, service type, random number, request time, request strategy and blockchain transaction hash value;

[0037] The signature data information includes data to be signed.

[0038] In some embodiments, the TDVC service node in the verification process performs multiple verifications based on the TDVC issuance structure and combined with the information parsed by the TDVC verification structure, further including:

[0039] The TDVC service node verifies the validity of the signature certificate.

[0040] In some embodiments, the TDVC service node in the verification process performs multiple verifications based on the TDVC issuance structure and combined with the information of the signed document parsing, further including:

[0041] The TDVC service node verifies the validity of the signature certificate.

[0042] In some embodiments, the TDVC service node verifies the validity of the signature certificate, further comprising:

[0043] Verify the validity of the certificate through the certificate validity period;

[0044] Confirm the certificate status through the Online Certificate Status Protocol or Certificate Revocation List;

[0045] The certificate trust is verified by verifying the issuer's signature and the certificate chain through the root certificate trust list;

[0046] Enforce mutual recognition certificate policy.

[0047] In some embodiments, the TDVC service node performs multiple verifications based on the TDVC issuance structure and in combination with the TDVC verification structure or the information parsed from the signed document, further comprising:

[0048] The TDVC service node verifies the consistency between the original hash value of the data to be signed parsed by the TDVC verification structure or the signature file and the original hash value of the TDVC issuance structure.

[0049] In some embodiments, the TDVC service node verifies the consistency of the original hash value of the data to be signed parsed by the TDVC verification structure or the signing file with the original hash value of the TDVC issuance structure, further comprising:

[0050] Obtain the corresponding hash algorithm based on the hash algorithm identifier parsed from the TDVC issuance structure;

[0051] Perform a hash operation on the original text of the data to be signed based on the corresponding hash algorithm to obtain a hash value of the original text;

[0052] The obtained original hash value is compared and verified with the hash value of the data to be signed in the TDVC issuance structure to determine whether they are consistent.

[0053] In some embodiments, the TDVC service node performs multiple verifications based on the TDVC issuance structure and in combination with information parsed by the TDVC verification structure, further comprising:

[0054] TDVC service node, verifies the validity of the signature.

[0055] In some embodiments, the TDVC service node performs multiple verifications based on the TDVC issuance structure and in combination with the information parsed from the signed document, further comprising:

[0056] TDVC service node, verifies the validity of the signature.

[0057] In some embodiments, the TDVC service node verifies the validity of the signature, further comprising:

[0058] The validity of the signature is verified through the certificate public key, signature algorithm, hash value of the data to be signed and signature value of the TDVC issuance structure.

[0059] In some embodiments, the TDVC service node verifies the validity of the signature, further comprising:

[0060] The signature value is decrypted through the certificate public key and signature algorithm of the TDVC issuance structure, and the decrypted value is compared and verified with the hash value of the data to be signed to determine whether they are consistent, so as to verify whether the signature is valid.

[0061] In order to achieve the above-mentioned purpose, the present invention provides a cross-border signature trusted verification system based on blockchain, including an electronic signature service node, a TDVC service node, and a blockchain service node:

[0062] The electronic signature service node, TDVC service node, and blockchain service node work together to execute the above-mentioned blockchain-based cross-border signature trusted verification method for the business systems of multiple signatories.

[0063] The present invention provides a blockchain-based cross-border signature trusted verification method and system, which can complete the trusted verification of electronic files without providing the original text of the electronic files to a third party, thereby effectively avoiding the risk of violating the confidentiality agreement. It is suitable for trusted verification of cross-border electronic signature documents and has extremely high scalability and verification efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0064] The above and other features, properties and advantages of the present invention will become more apparent through the following description in conjunction with the accompanying drawings and embodiments, in which the same reference numerals always represent the same features, wherein:

[0065] Figure 1A step diagram of a cross-border signature trusted verification method based on blockchain according to an embodiment of the present invention is disclosed;

[0066] Figure 2 A timing diagram of an issuance process according to an embodiment of the present invention is disclosed;

[0067] Figure 3 A timing diagram of a verification process for a verification structure according to an embodiment of the present invention is disclosed;

[0068] Figure 4 A timing diagram of a verification process for providing a signed document according to an embodiment of the present invention is disclosed. DETAILED DESCRIPTION

[0069] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the invention and are not used to limit the invention.

[0070] In the current practice of cross-border signature verification, the methods of the prior art are difficult to meet the requirements of scalability and high efficiency and reliability. The present invention proposes a cross-border signature trusted verification method and system based on blockchain, which has high scalability and verification efficiency, and is suitable for trusted verification of cross-border electronic signature documents. The present invention designs a blockchain-based trusted verification credential (Verifiable Credentials, VC for short), which is issued and verified by a third-party alliance chain platform recognized by all parties involved in the cross-border signing. Globally, any electronic signature service provider that meets the platform access standards can apply to join the platform, submit a request for the issuance of a trusted verification credential to the platform during the signing process, and complete the trusted verification of electronic documents through the platform. The entire process does not require the original electronic document to be provided to a third party, thereby effectively avoiding the risk of violating the confidentiality agreement.

[0071] Figure 1 The following is a block-chain-based cross-border signature trust verification method step diagram according to an embodiment of the present invention. Figure 1 As shown, the cross-border signature trusted verification method based on blockchain proposed in the present invention includes step S1 issuance process and step S2 verification process:

[0072] The issuance process in step S1 includes:

[0073] The business system initiates the signing;

[0074] The electronic signature service node applies for the key and CA certificate, builds the TDVC issuance structure and sends it to the TDVC service node;

[0075] TDVC service node and blockchain service node complete the signing request on-chain;

[0076] The electronic signature service node sends the signing completion notification and the electronic signature document to the business system;

[0077] The verification process in step S2 includes:

[0078] The business system sends the TDVC verification structure or signed document to the TDVC service node;

[0079] After the TDVC service node parses the information, it interacts with the blockchain service node and performs multiple verifications, and then feeds the verification results back to the business system.

[0080] The cross-border signature trusted verification method based on blockchain proposed in this invention defines a trusted digital verifiable credential (TDVC) service node in the traditional electronic signature process, which mainly provides TDVC issuance and TDVC verification functions. Among them, TDVC issuance occurs in the signing process, and TDVC verification occurs in the verification process.

[0081] Furthermore, the issuance process includes:

[0082] The business system initiates the signing process, and the electronic signature service node is responsible for applying for the key and CA certificate, and calculating the hash value of the data to be signed;

[0083] The electronic signature service node constructs the TDVC issuance structure and initiates an issuance request to the TDVC service node after the interface authentication is completed;

[0084] The TDVC service node performs multiple validity checks based on the issuance request, and after passing, it calls the TDVC issuance smart contract to the blockchain service node;

[0085] The blockchain service node uploads the TDVC issuance request to the chain and returns the blockchain transaction hash value to the TDVC service node;

[0086] After receiving the blockchain transaction hash value, the electronic signature service node assembles the electronic signature structure, synthesizes the electronic signature document, and sends the signing completion notification and the electronic signature document to the business system.

[0087] The present invention also provides a cross-border signature trusted verification system based on blockchain, including an electronic signature service node, a TDVC service node, and a blockchain service node:

[0088] The electronic signature service node, TDVC service node, and blockchain service node work together to execute the blockchain-based cross-border signature trusted verification method provided by the present invention for the business systems of multiple signatories.

[0089] The cross-border signature trusted verification system based on blockchain provided by the present invention can be used as a third-party alliance chain platform to issue and verify cross-border electronic signature documents. The following is combined with the cross-border signature trusted verification system based on blockchain to illustrate the specific process of a cross-border signature trusted verification method based on blockchain proposed by the present invention.

[0090] Figure 2 A timing diagram of the issuance process according to an embodiment of the present invention is disclosed, such as Figure 2 As shown, the issuance process of step S1 specifically includes the following steps:

[0091] Step S11, the business system initiates the signing process;

[0092] Step S12, the electronic signature service node is responsible for applying for a key;

[0093] Step S13, the electronic signature service node is responsible for applying for a CA certificate;

[0094] Step S14, the electronic signature service node calculates the hash value of the data to be signed;

[0095] Step S15, the electronic signature service node constructs a TDVC issuance structure;

[0096] Step S16, after the electronic signature service node performs interface authentication, it initiates a signature request to the TDVC service node;

[0097] Step S17, the TDVC service node verifies the validity of the signature certificate;

[0098] Step S18, the TDVC service node verifies the validity of the signature;

[0099] Step S19, the TDVC service node calls the TDVC to issue the smart contract to the blockchain service node;

[0100] Step S110, the blockchain service node uploads the TDVC issuance request to the blockchain;

[0101] Step S111, the blockchain service node returns the blockchain transaction hash value to the TDVC service node;

[0102] Step S112, the TDVC service node forwards the blockchain transaction hash value to the electronic signature service node;

[0103] Step S113, after receiving the blockchain transaction hash value, the electronic signature service node assembles the electronic signature structure to synthesize the electronic signature document;

[0104] Step S114: The electronic signature service node sends the signed electronic signature document to the business system.

[0105] In the above sequence diagram, the entire issuance process is clearly defined, wherein step S15 to step S113 cover the relevant processing steps of adding a new TDVC service node, while the remaining steps follow the traditional signing process.

[0106] It should be pointed out that the data to be signed mentioned in the present invention refers to the data generated after a hash operation is performed on the electronic document to be (cross-border) signed.

[0107] The issuance process and verification process in the present invention both utilize the data to be signed generated after the hash operation, and do not involve the direct exchange of any original electronic files. This can effectively prevent the risk of leakage of the original electronic file content, and also avoid the data traffic bottleneck and business operation obstacles caused by the third-party platform carrying and transmitting a large number of files.

[0108] In addition, the above hash operation can be marked as the first hash operation, and the SHA-256 algorithm can be specifically adopted. SHA-256 is a secure hash algorithm developed by the National Security Agency of the United States, which operates on messages with a length less than 2^64 bits and generates a 256-bit hash value.

[0109] Furthermore, in step S14, the electronic signature service node calculates the hash value of the data to be signed, which means:

[0110] The data to be signed that has been generated after the hash operation is hashed again to generate the corresponding hash value. The above hash operation can be marked as the second hash operation.

[0111] The second hash operation may be a SHA-256 algorithm, or another hash algorithm different from the first hash operation.

[0112] Furthermore, in step S15, after the electronic signature service node calculates the hash value of the data to be signed in a traditional manner, it assembles the TDVC issuance structure according to the construction defined by TDVC.

[0113] The TDVC issuance structure constructed in the issuance process includes the issuance request general information TDVCIssueReques and the signature data information Data:

[0114] The issuance request general information TDVCIssueReques includes a version number version, a random number nonce, a request time requestTime, a request policy requestPolicy and an extension field extensions;

[0115] The signature data information Data includes a hash algorithm identifier digestAlgorithm, a hash value hashData of the data to be signed, a signature identifier signatureAlgorithm, a signature value signatureData of the data to be signed, and a subscriber public key certificate cert.

[0116] More specifically, the TDVC issuance structure fields are detailed as follows:

[0117] The TDVCIssueRequest sequence contains general information for the issuance request.

[0118] version: version number

[0119] Type: INTEGER (default value is 1)

[0120] Description: Identifies the version number of the request, used to distinguish different versions of the request format.

[0121] nonce: random number

[0122] Type: OCTET STRING

[0123] Description: A random number used to prevent replay attacks and content guessing attacks.

[0124] requestTime: request time

[0125] Type: GeneralizedTime

[0126] Description: Timestamp of the request initiation, recording the time of the request.

[0127] requestPolicy: request policy

[0128] Type: INTEGER (default value is 1)

[0129] Description: Identifies the request strategy, which is used to define the request processing strategy. When the request strategy is 1, TDVC needs to chain the request structure, and the specific implementation of other strategies can be customized.

[0130] extensions: extension field

[0131] Type: SEQUENCE

[0132] Note: The specific implementation can be customized as needed

[0133] Data: This sequence contains information about the signature data.

[0134] digestAlgorithm: hash algorithm identifier

[0135] Type: OBJECT IDENTIFIER

[0136] Description: Identifies the algorithm used to calculate the hash value.

[0137] hashData: hash value of the data to be signed

[0138] Type: OCTET STRING

[0139] Description: The value of the data to be signed after being processed by the hash algorithm.

[0140] signatureAlgorithm: signature algorithm identifier

[0141] Type: OBJECT IDENTIFIER

[0142] Description: Identifies the algorithm used to generate the signature.

[0143] signatureData: the signature value of the data to be signed

[0144] Type: OCTET STRING

[0145] Description: The signature value of the data to be signed after being processed by the signature algorithm.

[0146] cert: subscriber public key certificate

[0147] Type: OCTET STRING

[0148] Description: The subscriber's public key certificate, used to verify the signer's identity.

[0149] In the defined signature data information Data structure, the signature value signatureData of the data to be signed needs to be decrypted according to the signature algorithm corresponding to the signature algorithm identifier signatureAlgorithm and the public key of the subscriber's public key certificate cert. Subsequently, the decrypted data must be calculated by the hash algorithm corresponding to the hash algorithm identifier digestAlgorithm, and ensure that the result matches the hash value hashData of the data to be signed.

[0150] Furthermore, in step S16, the electronic signature service node performs corresponding interface authentication according to the requirements of the TDVC service node. The specific authentication method is customized by the TDVC service node and there is no standard requirement. After the authentication is completed, the electronic signature service node initiates a TDVC issuance request to the TDVC service node.

[0151] Furthermore, the TDVC service node performs multiple validity checks based on the issuance request, including but not limited to step S17 and step S18. These two steps can be performed simultaneously or sequentially, but the specific order is not limited.

[0152] The step S17 verifies the validity of the TDVC signature certificate, and the specific verification content includes:

[0153] Verify the validity of the certificate through the certificate validity period;

[0154] Confirm the certificate status through the Online Certificate Status Protocol (OCSP) or Certificate Revocation List (CRL);

[0155] The certificate trust is verified by verifying the issuer's signature and the certificate chain through the root certificate trust list;

[0156] Implement mutual recognition certificate policy (CP).

[0157] In step S18, TDVC verifies the validity of the signature, and the specific steps include:

[0158] The validity of the signature is verified through the certificate public key, signature algorithm, hash value of the data to be signed and signature value of the TDVC issuance structure.

[0159] More specifically, the signature value is decrypted using the certificate public key and signature algorithm of the TDVC issuance structure, and the obtained decrypted value is compared and verified with the hash value of the data to be signed to determine whether they are consistent, so as to verify whether the signature is valid.

[0160] If both step S17 and step S18 are verified successfully, the TDVC service node calls the TDVC issuance smart contract, the blockchain service puts the entire TDVC issuance structure on the chain, and returns the blockchain transaction hash value (hash) to the TDVC service node, and the TDVC service node returns the received blockchain transaction hash value to the electronic signature service node, corresponding to steps S19 to S112.

[0161] Furthermore, in step S113, after the electronic signature service node receives the blockchain transaction hash value, it assembles the electronic signature structure according to the standard.

[0162] The constructed electronic signature structure is different from the TVDC issuance structure and TVDC verification structure. The constructed electronic signature structure is assembled based on PKCS#7, and the blockchain transaction hash value is filled into the extension of PKCS#7. The blockchain transaction hash value Hash is placed in the unauthenticatedAttributes area under SignerInfo as a ContentInfo object.

[0163] PKCS#7, also known as Cryptographic Message Syntax Standard, is an encryption standard generated by the RSA security system for exchanging digital certificates in a public key encryption system.

[0164] The basic elements of pkcs#7 include:

[0165] SignedData: The data type of the signature, which contains the message body, signature information, certificate, and relevant information of the signer, and is used for digital signature and verification;

[0166] EnvelopedData: Encrypted data type, including encrypted data and the symmetric key used to encrypt the data. The key is encrypted by the recipient's public key and is attached to the structure for transmission of encrypted messages.

[0167] SignedAndEnvelopedData: A data type that combines signature and encryption, which not only signs but also encrypts the message to ensure data integrity and confidentiality;

[0168] Data: a simple data type, representing raw data without encryption or signature;

[0169] DigestedData: A type with a message digest, which is generated using a hash function.

[0170] Ensure the integrity of the message;

[0171] EncryptedData: Encrypted original data, encrypted using a symmetric key, but does not contain the encrypted symmetric key information.

[0172] ContentInfo object: consists of two parts: content OID value (customizable by specific implementation) and specific content data (blockchain transaction hash value). After filling, it is synthesized into an electronic signature document to complete the signing.

[0173] The present invention proposes a blockchain-based cross-border signature trust verification method, wherein the verification process includes:

[0174] The business system sends the constructed TDVC verification structure or signed document to the TDVC service node;

[0175] The TDVC service node parses the received TDVC verification structure or signature file, extracts the blockchain transaction hash value and signature data information, and forwards the blockchain transaction hash value to the blockchain service node;

[0176] The blockchain service node processes the blockchain transaction hash value and returns the TDVC issuance structure to the TDVC service node;

[0177] The TDVC service node performs multiple verifications based on the TDVC issuance structure and combined with the TDVC verification structure or the information parsed by the signed document, and finally feeds back the verification results to the business system.

[0178] More specifically, the verification process of the present invention provides two verification methods: providing a verification structure according to the requirements of the TDVC service and providing a signed document for verification.

[0179] Below through Figure 3 and Figure 4 The two verification processes are explained separately.

[0180] Figure 3 A timing diagram of a verification process for a verification structure according to an embodiment of the present invention is disclosed, such as Figure 3 As shown, the verification process of providing the verification structure in step S2 specifically includes the following steps:

[0181] Step S201, the business system assembles and constructs a TDVC verification structure;

[0182] Step S202: The business system sends the TDVC verification structure to the TDVC service node;

[0183] Step S203: The TDVC service node parses the received TDVC verification structure to extract the blockchain transaction hash value and signature data information;

[0184] Step S204, the TDVC service node forwards the blockchain transaction hash value Txhash to the blockchain service node;

[0185] Step S205: The blockchain service node processes the blockchain transaction hash value and returns the TDVC issuance structure to the TDVC service node;

[0186] Step S206: The TDVC service node verifies the validity of the signature certificate;

[0187] Step S207, the TDVC service node verifies the consistency between the original hash value of the data to be signed parsed by the TDVC verification structure and the original hash value of the TDVC issuance structure;

[0188] Step S208: The TDVC service node verifies the validity of the signature;

[0189] Step S209: The TDVC service node finally feeds back the verification result to the business system.

[0190] The above sequence diagram defines the entire verification process.

[0191] Furthermore, in step S201, the business system assembles the TDVC verification structure according to the TDVC definition, wherein the blockchain transaction hash value is extracted from the PKCS#7 extension field of the electronic signature structure in the signed document, with specific reference to step S113 of the TDVC issuance process.

[0192] More specifically, the TDVC verification structure fields are detailed as follows:

[0193] TDVCRequestInformation This sequence contains general information of the verification request.

[0194] version: version number

[0195] Type: INTEGER (default value is 1)

[0196] Description: Identifies the version number of the request, used to distinguish different versions of the request format.

[0197] serviceType: service type

[0198] Type: INTEGER (value is 2)

[0199] Description: Identifies the type of service, used to determine the specific service category of the verification request.

[0200] Since the verification structure is designed based on rfc3029, serviceType is fixed to 2, which indicates that the TDVC server is an extended form of the vsd server.

[0201] nonce: random number

[0202] Type: OCTET STRING

[0203] Description: A random number used to prevent replay attacks and content guessing attacks.

[0204] requestTime: request time

[0205] Type: GeneralizedTime

[0206] Description: Timestamp of the request initiation, recording the time of the request.

[0207] requestPolicy: request policy

[0208] Type: INTEGER (default value is 1)

[0209] Description: The strategy of the identification request is used to define the processing strategy of the request. When the request strategy is 1, the identification verification needs to obtain the TDVC issuance structure from the blockchain for verification, and the specific implementation of other strategies can be customized.

[0210] extensions: extension field

[0211] Type: SEQUENCE

[0212] Description: Contains the blockchain transaction hash value.

[0213] Fields:

[0214] Txhash: OCTET STRING

[0215] Description: Blockchain transaction hash value.

[0216] Data: This sequence contains information about the signature data.

[0217] message: Base64 of the original data to be signed

[0218] Type: OCTET STRING

[0219] Description: Base64 encoded value of the data to be signed. This field contains the Base64 representation of the data to be signed, which is used for subsequent verification.

[0220] Base64 is one of the most common encoding methods for transmitting 8-bit bytecode on the Internet. Base64 is a method of representing binary data based on 64 printable characters.

[0221] Furthermore, in step S203, the TDVC service node parses the TDVC verification structure, and obtains the blockchain transaction hash value Txhash and the original base64 in the signature data information from the TDVC verification structure.

[0222] Furthermore, the TDVC service node performs multiple verifications based on the TDVC issuance structure and in combination with the information parsed from the TDVC verification structure, including but not limited to steps S206 to S208. The above steps can be performed simultaneously or sequentially, but the specific order is not limited.

[0223] The step S206 verifies the validity of the TDVC signature certificate, and the specific verification content includes:

[0224] Verify the validity of the certificate through the certificate validity period;

[0225] Confirm the certificate status through the Online Certificate Status Protocol (OCSP) or Certificate Revocation List (CRL);

[0226] The certificate trust is verified by verifying the issuer's signature and the certificate chain through the root certificate trust list;

[0227] Implement mutual recognition certificate policy (CP).

[0228] In step S207, the specific verification method includes:

[0229] Obtain the corresponding hash algorithm based on the hash algorithm identifier parsed from the TDVC issuance structure;

[0230] Perform a hash operation on the original base64 of the signature data based on the corresponding hash algorithm to obtain the original hash value;

[0231] The obtained original hash value is compared and verified with the hash value of the data to be signed in the TDVC issuance structure to determine whether they are consistent.

[0232] In step S208, TDVC verifies the validity of the signature, and the specific steps include:

[0233] The validity of the signature is verified through the certificate public key, signature algorithm, hash value of the data to be signed and signature value of the TDVC issuance structure.

[0234] More specifically, the signature value is decrypted using the certificate public key and signature algorithm of the TDVC issuance structure, and the obtained decrypted value is compared and verified with the hash value of the data to be signed to determine whether they are consistent, so as to verify whether the signature is valid.

[0235] If steps S206 to S208 are all verified successfully, the TDVC service node returns the verification results to the business system.

[0236] Figure 4 A timing diagram of a verification process for providing a signed document according to an embodiment of the present invention is disclosed, such as Figure 4 As shown, the verification process of providing the signed document in step S2 specifically includes the following steps:

[0237] Step S211: The business system uploads the signed document to be verified to the TDVC service node;

[0238] Step S212: The TDVC service node receives the signed document, parses the signed document, extracts the electronic signature structure based on PKCS#7 from the signed document, and obtains the blockchain transaction hash value and signature data information from the electronic signature structure;

[0239] Step S213: The TDVC service node forwards the blockchain transaction hash value to the blockchain service node;

[0240] Step S214: The blockchain service node processes the blockchain transaction hash value and returns the TDVC issuance structure to the TDVC service node;

[0241] Step S215: The TDVC service node verifies the validity of the signature certificate;

[0242] Step S216: The TDVC service node verifies the consistency between the original hash value of the data to be signed parsed by the electronic signature structure and the original hash value of the TDVC issuance structure;

[0243] Step S217: The TDVC service node verifies the validity of the signature;

[0244] Step S218: The TDVC service node finally feeds back the verification result to the business system.

[0245] The above sequence diagram defines the entire verification process.

[0246] Furthermore, in step S212, the TDVC service node parses the signature file and obtains the blockchain transaction hash value Txhash and the original base64 of the data to be signed in the signature data information from the electronic signature structure.

[0247] Furthermore, the TDVC service node performs multiple verifications based on the TDVC issuance structure and in combination with the information parsed from the signed document, including but not limited to steps S215 to S217. The above steps can be performed simultaneously or sequentially, but the specific order is not limited.

[0248] The step S215 verifies the validity of the TDVC signature certificate, and the specific verification content includes:

[0249] Verify the validity of the certificate through the certificate validity period;

[0250] Confirm the certificate status through the Online Certificate Status Protocol (OCSP) or Certificate Revocation List (CRL);

[0251] The certificate trust is verified by verifying the issuer's signature and the certificate chain through the root certificate trust list;

[0252] Implement mutual recognition certificate policy (CP).

[0253] In step S216, the specific verification method includes:

[0254] Obtain the corresponding hash algorithm based on the hash algorithm identifier parsed from the TDVC issuance structure;

[0255] Perform a hash operation on the original base64 of the signature data based on the corresponding hash algorithm to obtain the original hash value;

[0256] The obtained original hash value is compared and verified with the hash value of the data to be signed in the TDVC issuance structure to determine whether they are consistent.

[0257] In step S217, TDVC verifies the validity of the signature, and the specific steps include:

[0258] The validity of the signature is verified through the certificate public key, signature algorithm, hash value of the data to be signed and signature value of the TDVC issuance structure.

[0259] More specifically, the signature value is decrypted using the certificate public key and signature algorithm of the TDVC issuance structure, and the obtained decrypted value is compared and verified with the hash value of the data to be signed to determine whether they are consistent, so as to verify whether the signature is valid.

[0260] If steps S215 to S217 are all verified successfully, the TDVC service node returns the verification results to the business system.

[0261] Although the above methods are illustrated and described as a series of actions for simplicity of explanation, it should be understood and appreciated that these methods are not limited by the order of the actions, because according to one or more embodiments, some actions may occur in a different order and / or concurrently with other actions from those illustrated and described herein or not illustrated and described herein but understandable to those skilled in the art.

[0262] The present invention provides a blockchain-based cross-border signature trusted verification method and system, which specifically has the following beneficial effects:

[0263] 1) Clearly defines the structural specifications required for TDVC issuance and verification, ensuring that during the entire issuance and verification process, the access party only needs to assemble the structure according to the established specifications through the business system to efficiently complete the relevant operations, greatly simplifying the operation process and improving efficiency;

[0264] 2) The cross-border electronic signature service platform itself does not directly access business data, thus effectively avoiding the cross-border circulation and leakage risks of important sensitive data;

[0265] 3) In view of the fact that the blockchain transaction hash value is stored in the ContentInfo object of PKCS#7, and considering that standards such as CMS, CAdES, XAdES and PAdES are all inherited standards of PKCS#7 and also include ContentInfo objects, the present invention has a high degree of flexibility and compatibility, can support a variety of different standards, and meet diverse needs.

[0266] As shown in this application and claims, unless the context clearly indicates an exception, the words "a", "an", "an" and / or "the" do not refer to the singular and may also include the plural. Generally speaking, the terms "include" and "comprise" only indicate the inclusion of the steps and elements that have been clearly identified, and these steps and elements do not constitute an exclusive list. The method or device may also include other steps or elements.

[0267] Those skilled in the art will appreciate that information, signals, and data may be represented using any of a variety of different technologies and techniques. For example, data, instructions, commands, information, signals, bits, symbols, and chips cited throughout the above description may be represented by voltage, current, electromagnetic waves, magnetic fields or magnetic particles, optical fields or optical particles, or any combination thereof.

[0268] Those skilled in the art will further appreciate that the various illustrative logic blocks, modules, circuits, and algorithm steps described in conjunction with the embodiments disclosed herein may be implemented as electronic hardware, computer software, or a combination of the two. To clearly illustrate this interchangeability of hardware and software, various illustrative components, blocks, modules, circuits, and steps are generally described above in terms of their functionality. Whether such functionality is implemented as hardware or software depends on the specific application and the design constraints imposed on the overall system. The technician may implement the described functionality in different ways for each specific application, but such implementation decisions should not be interpreted as resulting in a departure from the scope of the present invention.

[0269] The various illustrative logic modules and circuits described in conjunction with the embodiments disclosed herein may be implemented or executed with a general purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic, discrete hardware components, or any combination thereof designed to perform the functions described herein. A general purpose processor may be a microprocessor, but in the alternative, the processor may be any conventional processor, controller, microcontroller, or state machine. The processor may also be implemented as a combination of computing devices, such as a combination of a DSP and a microprocessor, a plurality of microprocessors, one or more microprocessors in cooperation with a DSP core, or any other such configuration.

[0270] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be embodied directly in hardware, in a software module executed by a processor, or in a combination of the two. The software module may reside in a RAM memory, a flash memory, a ROM memory, an EPROM memory, an EEPROM memory, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art. An exemplary storage medium is coupled to a processor so that the processor can read and write information from / to the storage medium. In an alternative, a storage medium may be integrated into a processor. The processor and the storage medium may reside in an ASIC. The ASIC may reside in a user terminal. In an alternative, the processor and the storage medium may reside in a user terminal as discrete components.

[0271] The above embodiments are provided for persons familiar with the art to implement or use the present invention. Personnel familiar with the art can make various modifications or changes to the above embodiments without departing from the inventive concept of the present invention. Therefore, the protection scope of the present invention is not limited to the above embodiments, but should be the maximum scope of the innovative features mentioned in the claims.

Claims

1. A cross-border signature trusted verification method based on blockchain, characterized in that: Including issuance process and verification process: The issuance process includes: The business system initiates the signing; The electronic signature service node applies for the key and CA certificate, builds the TDVC issuance structure and sends it to the TDVC service node; TDVC service node and blockchain service node complete the signing request on-chain; The electronic signature service node sends the signing completion notification and the electronic signature document to the business system; The verification process includes: The business system sends the TDVC verification structure or signed document to the TDVC service node; After the TDVC service node parses the information, it interacts with the blockchain service node and performs multiple verifications, and then feeds the verification results back to the business system.

2. According to claim 1, the cross-border signature trust verification method based on blockchain is characterized in that: The issuance process includes: The business system initiates the signing process, and the electronic signature service node is responsible for applying for the key and CA certificate, and calculating the hash value of the data to be signed; The electronic signature service node constructs the TDVC issuance structure and initiates an issuance request to the TDVC service node after the interface authentication is completed; The TDVC service node performs multiple validity checks based on the issuance request, and after passing, it calls the TDVC issuance smart contract to the blockchain service node; The blockchain service node uploads the TDVC issuance request to the chain and returns the blockchain transaction hash value to the TDVC service node; After receiving the blockchain transaction hash value forwarded by the TDVC service node, the electronic signature service node assembles the electronic signature structure, synthesizes the electronic signature document, and sends the signed electronic signature document to the business system.

3. According to claim 2, the cross-border signature trust verification method based on blockchain is characterized in that: The verification process includes: The business system sends the constructed TDVC verification structure or signed document to the TDVC service node; The TDVC service node parses the received TDVC verification structure or signature file, extracts the blockchain transaction hash value and signature data information, and forwards the blockchain transaction hash value to the blockchain service node; The blockchain service node processes the blockchain transaction hash value and returns the TDVC issuance structure to the TDVC service node; The TDVC service node performs multiple verifications based on the TDVC issuance structure and combined with the TDVC verification structure or the information parsed by the signed document, and finally feeds back the verification results to the business system.

4. The cross-border signature trust verification method based on blockchain according to claim 1 is characterized in that: The TDVC issuance structure constructed in the issuance process includes general issuance request information and signature data information: The issuance request general information includes version number, random number, request time, request strategy and extension field; The signature data information includes a hash algorithm identifier, a hash value of the data to be signed, a signature identifier, a signature value of the data to be signed, and a subscriber public key certificate.

5. The cross-border signature trust verification method based on blockchain according to claim 2 is characterized in that: In the issuance process, the TDVC service node performs multiple validity checks based on the issuance request, further comprising: TDVC service node verifies the validity of the signature certificate.

6. The cross-border signature trust verification method based on blockchain according to claim 2 is characterized in that: In the issuance process, the TDVC service node performs multiple validity checks based on the issuance request, further comprising: The TDVC service node verifies the validity of the signature.

7. The cross-border signature trust verification method based on blockchain according to claim 2 is characterized in that: The electronic signature structure constructed in the issuance process is assembled based on PKCS#7, and the blockchain transaction hash value is filled into the extension item of PKCS#7.

8. The cross-border signature trust verification method based on blockchain according to claim 3 is characterized in that: The TDVC verification structure constructed by the business system in the verification process includes general information of the verification request and signature data information: The verification request general information includes version number, service type, random number, request time, request strategy and blockchain transaction hash value; The signature data information includes data to be signed.

9. The cross-border signature trust verification method based on blockchain according to claim 3 is characterized in that: In the verification process, the TDVC service node performs multiple verifications based on the TDVC issuance structure and combined with the information parsed by the TDVC verification structure, further including: The TDVC service node verifies the validity of the signature certificate.

10. The cross-border signature trust verification method based on blockchain according to claim 3 is characterized in that: In the verification process, the TDVC service node performs multiple verifications based on the TDVC issuance structure and combined with the information parsed by the signed document, further including: The TDVC service node verifies the validity of the signature certificate.

11. The blockchain-based cross-border signature trusted verification method according to any one of claims 5, 9 or 10, characterized in that: The TDVC service node verifies the validity of the signature certificate, further comprising: Verify the validity of the certificate through the certificate validity period; Confirm the certificate status through the Online Certificate Status Protocol or Certificate Revocation List; The certificate trust is verified by verifying the issuer's signature and the certificate chain through the root certificate trust list; Enforce mutual recognition certificate policy.

12. The cross-border signature trust verification method based on blockchain according to claim 8 is characterized in that: The TDVC service node performs multiple verifications based on the TDVC issuance structure and in combination with the TDVC verification structure or the information parsed by the signed document, further comprising: The TDVC service node verifies the consistency between the original hash value of the data to be signed parsed from the TDVC verification structure or the signature file and the original hash value of the TDVC issuance structure.

13. The cross-border signature trust verification method based on blockchain according to claim 12 is characterized in that: The TDVC service node verifies the consistency between the original hash value of the data to be signed parsed by the TDVC verification structure or the signature file and the original hash value of the TDVC issuance structure, further comprising: Obtain the corresponding hash algorithm based on the hash algorithm identifier parsed from the TDVC issuance structure; Perform a hash operation on the original text of the signature data based on the corresponding hash algorithm to obtain a hash value of the original text; The obtained original hash value is compared and verified with the hash value of the data to be signed in the TDVC issuance structure to determine whether they are consistent.

14. The cross-border signature trust verification method based on blockchain according to claim 3 is characterized in that: The TDVC service node performs multiple verification based on the TDVC issuance structure and information parsed by the TDVC verification structure, further comprising: TDVC service node verifies the validity of the signature.

15. The cross-border signature trust verification method based on blockchain according to claim 3 is characterized in that: The TDVC service node performs multiple verifications based on the TDVC issuance structure and in combination with the information parsed from the signed document, further comprising: TDVC service node verifies the validity of the signature.

16. The blockchain-based cross-border signature trusted verification method according to any one of claims 6, 14 or 15, characterized in that: The TDVC service node verifies the validity of the signature, further comprising: The validity of the signature is verified through the certificate public key, signature algorithm, hash value of the data to be signed and signature value of the TDVC issuance structure.

17. The cross-border signature trust verification method based on blockchain according to claim 16 is characterized in that: The TDVC service node verifies the validity of the signature, further comprising: The signature value is decrypted through the certificate public key and signature algorithm of the TDVC issuance structure, and the decrypted value is compared and verified with the hash value of the data to be signed to determine whether they are consistent, so as to verify whether the signature is valid.

18. A cross-border signature trusted verification system based on blockchain, characterized in that: Including electronic signature service nodes, TDVC service nodes, and blockchain service nodes: The electronic signature service node, TDVC service node, and blockchain service node work together to execute the blockchain-based cross-border signature trusted verification method as described in any one of claims 1 to 17 for the business systems of multiple signatories.

Images