Electronic signature method and device, equipment and storage medium

Abstract

The invention discloses an electronic signature method and device, equipment and a storage medium, and relates to the field of electronic signatures, and the method comprises the steps: judging whether security level information exists in document attributes of a to-be-signed original text or not, and if yes, judging whether the security level information is a preset high security level or not; if yes, calling an intranet seal UKey to sign the to-be-signed original text to generate corresponding signature data; if not, the signature request is sent to the server side, a signature result sent by the server side and generated based on an original text signature value obtained by signing the to-be-signed data abstract in the signature request through the external network seal key is obtained, the signature result is verified, and corresponding signature data is generated based on the original text signature value after verification succeeds; and returning the generated signature data to the layout software, so that the layout software completes the signature of the to-be-signed original text based on the signature data. According to the application, the corresponding secret key is automatically selected for signature according to the security level of the file, and the flexibility and security of the electronic signature are realized.

Description

Technical Field

[0001] The present invention relates to the field of electronic signatures, and in particular to an electronic signature method, device, equipment and storage medium. Background Art

[0002] In environments with different security levels, different cryptographic algorithms are often used according to different security requirements. For example, the intranet of a high-security network often uses a more secure high-security cryptographic algorithm, while the extranet of a low-security network uses a relatively low-security general cryptographic algorithm. The password of the intranet cannot be used in the extranet. However, in actual applications, the intranet also needs to process electronic files with low security requirements. After the intranet seals or signs the file, the sealed or signed file needs to flow from the intranet to the extranet. Since the security requirements of the two environments are different, the cryptographic algorithms are different, and the direct transfer of files may cause password application violations. At the same time, since the extranet does not have the cryptographic algorithm of the intranet, it cannot verify the files that are sealed or signed using the cryptographic algorithm of the intranet.

[0003] In general seal or signature applications, UKey (USB Key) is usually used as a key carrier and provides cryptographic capabilities. In environments with different security requirements, different UKeys are used to provide different cryptographic algorithm capabilities. In traditional applications, seal desensitization is usually used to transfer files from the intranet to the extranet, but it is easy to cause the electronic seal or signature to be destroyed and the file to lose security protection, or the seal or signature cannot be verified when the file is received on the extranet. If you use the extranet UKey to seal or sign manually in the intranet, the efficiency is low and it is easy to make mistakes. Summary of the invention

[0004] In view of this, the purpose of the present invention is to provide an electronic signature method, device, equipment and storage medium, which can automatically select the corresponding key for signing according to the security level of the file, thereby achieving the flexibility and security of the electronic signature. The specific scheme is as follows:

[0005] In a first aspect, the present application provides an electronic signature method, which is applied to a client in an electronic signature system, comprising:

[0006] Obtain the original document to be signed and the corresponding document attributes from the formatting software, determine whether there is security level information in the document attributes, and if so, determine whether the security level information is a preset high security level;

[0007] If it is the preset high security level, the intranet seal UKey in the electronic signature system is called to sign the original document to be signed to generate corresponding signature data;

[0008] If it is not the preset high security level, the generated signature request is sent to the server in the electronic signature system, and the signature result generated by the server based on the original signature value obtained by signing the data summary to be signed in the signature request using the external network seal key is obtained, and then the signature result is verified and the corresponding signature data is generated based on the original signature value after the verification is successful; the data summary to be signed is the summary obtained by extracting the original text to be signed and the electronic seal; the electronic seal is a seal that is bound to both the internal network seal certificate and the external network seal certificate;

[0009] The generated signature data is returned to the layout software so that the layout software completes the signature operation on the original document to be signed based on the signature data.

[0010] Optionally, after determining whether the document attribute contains security level information, the method further includes:

[0011] If it does not exist, a prompt message for supplementing the security level information corresponding to the original text to be signed is returned to the layout software, so that the layout software can send the supplemented security level information to the client.

[0012] Optionally, before sending the generated signature request to the server in the electronic signature system, the method further includes:

[0013] The original text to be signed is extracted using a hash algorithm to obtain a summary of the original text to be signed;

[0014] Generate signature information based on the summary of the original text to be signed and the electronic seal, and extract the signature information using the hash algorithm to obtain the summary of the data to be signed;

[0015] Generate request data based on the digest of the data to be signed and the intranet seal certificate corresponding to the intranet seal UKey, and use the intranet seal UKey to sign and protect the request data to obtain a first signature value;

[0016] A signing request is generated based on the request data and the first signature value.

[0017] Optionally, before obtaining the signature result generated by the server based on the original signature value obtained by signing the data digest to be signed in the signature request using the external network seal key, the method further includes:

[0018] The server verifies the first signature value by using the intranet seal certificate in the signature request, and verifies the second signature value in the binding relationship stored in the database of the electronic signature system by using the digital identity certificate of the electronic signature system; the binding relationship is a relationship generated based on the correspondence between the external network seal key index and the intranet seal certificate and the second signature value, and the second signature value is a signature value obtained by signing and protecting the correspondence using the intranet cipher machine in the electronic signature system;

[0019] After the first signature value and the second signature value are both verified, the server determines whether the intranet seal certificate in the signature request is consistent with the intranet seal certificate in the binding relationship;

[0020] If they are consistent, the server obtains the external network seal key index corresponding to the internal network seal certificate, and sends the external network seal key index to the external network cipher machine in the electronic signature system, so that the external network cipher machine uses the external network seal key corresponding to the external network seal key index to sign the data summary to be signed in the signature request to obtain the original signature value.

[0021] Optionally, the obtaining of the signature result generated by the server based on the original signature value obtained by signing the data digest to be signed in the signature request using the external network seal key includes:

[0022] Obtain the signature result generated by the third signature value returned by the server based on the return data and the return data signed and protected by the intranet cipher machine; the return data is the original signature value obtained by signing the summary of the data to be signed in the signature request by the extranet cipher machine using the extranet seal key, and the data obtained by the extranet seal certificate corresponding to the extranet cipher machine.

[0023] Optionally, the verifying the signature result and generating corresponding signature data based on the original signature value after successful verification includes:

[0024] Verifying the third signature value in the signature result by using the digital identity certificate;

[0025] After the third signature value is verified, the original signature value is verified using the external network seal certificate in the signature result;

[0026] After the original signature value is successfully verified, corresponding signature data is generated based on the original signature value and the external network seal certificate.

[0027] Optionally, after verifying the third signature value in the signature result by using the digital identity certificate, the method further includes:

[0028] After the verification of the third signature value fails, the corresponding signature error information is returned to the formatting software to prompt that an error occurs in the signing operation of the original document to be signed.

[0029] In a second aspect, the present application provides an electronic signature device, which is applied to a client in an electronic signature system, including:

[0030] A security level judgment module is used to obtain the original document to be signed and the corresponding document attributes from the formatting software, and judge whether there is security level information in the document attributes, and if so, judge whether the security level information is a preset high security level;

[0031] The first signature data generation module is used to call the intranet seal UKey in the electronic signature system to sign the original document to be signed to generate corresponding signature data if the preset high security level is reached;

[0032] The second signature data generation module is used for sending the generated signature request to the server in the electronic signature system if it is not the preset high security level, obtaining the signature result generated by the server based on the original signature value obtained by signing the data summary to be signed in the signature request using the external network seal key, and then verifying the signature result and generating corresponding signature data based on the original signature value after successful verification; the data summary to be signed is the summary obtained by extracting the original text to be signed and the electronic seal; the electronic seal is a seal bound to both the internal network seal certificate and the external network seal certificate;

[0033] The signature completion module is used to return the generated signature data to the layout software, so that the layout software can complete the signature operation on the original document to be signed based on the signature data.

[0034] In a third aspect, the present application provides an electronic device, including:

[0035] Memory, used to store computer programs;

[0036] A processor is used to execute the computer program to implement the aforementioned electronic signature method.

[0037] In a fourth aspect, the present application provides a computer-readable storage medium for storing a computer program, which implements the aforementioned electronic signature method when executed by a processor.

[0038] In the present application, the original text to be signed and the corresponding document attributes are obtained from the layout software, and it is determined whether there is security level information in the document attributes. If so, it is determined whether the security level information is a preset high security level; if it is the preset high security level, the intranet seal UKey in the electronic signature system is called to sign the original text to be signed to generate corresponding signature data; if it is not the preset high security level, the generated signature request is sent to the server in the electronic signature system, and the signature result generated by the server based on the original signature value obtained by signing the data summary to be signed in the signature request using the external network seal key is obtained, and then the signature result is verified and the corresponding signature data is generated based on the original signature value after the verification is successful; the data summary to be signed is the summary obtained by extracting the original text to be signed and the electronic seal; the electronic seal is a seal that is bound to both the intranet seal certificate and the external network seal certificate; the generated signature data is returned to the layout software, so that the layout software completes the signing operation of the original text to be signed based on the signature data. It can be seen that this application determines the security level information of the original text to be signed by the client in the electronic signature system. If the security level information is the preset high security level, the intranet seal UKey of the high security cryptographic algorithm is called for signing. If the security level information is not the preset high security level, the external network seal key of the general cryptographic algorithm is called for signing by the server in the electronic signature system. The electronic signature system is equivalent to the intranet, that is, the present application can use the external network seal key of the low security level in the high security level intranet to sign the original text to be signed, thereby solving the problem that the files signed in the intranet cannot be transmitted to the external network, and realizing the flexibility of the electronic signature. In addition, the present application avoids the problem of manually using the external network UKey for signing in the intranet by automatically selecting the corresponding key to sign the original text to be signed, thereby improving the efficiency of the electronic signature and realizing the security protection of the signed file. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0040] Figure 1 A flow chart of an electronic signature method disclosed in this application;

[0041] Figure 2 This is a diagram of an electronic signature structure disclosed in this application;

[0042] Figure 3A signature request structure diagram disclosed in this application;

[0043] Figure 4 A schematic diagram of a binding relationship disclosed in this application;

[0044] Figure 5 A binding relationship structure diagram disclosed in this application;

[0045] Figure 6 A signature result structure diagram disclosed in this application;

[0046] Figure 7 A schematic diagram of an electronic signature deployment disclosed in this application;

[0047] Figure 8 This is a flowchart of an electronic signature disclosed in this application;

[0048] Fig. 9 This is a schematic diagram of the structure of an electronic signature device disclosed in this application;

[0049] Fig.10 This is a structural diagram of an electronic device disclosed in this application. DETAILED DESCRIPTION

[0050] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0051] In environments with different security levels, different cryptographic algorithms are often used according to different security requirements. For example, the intranet of a high-security network often uses a high-security cryptographic algorithm with higher security, and the extranet of a low-security network uses a relatively low-security general cryptographic algorithm. The password of the intranet cannot be used in the extranet. To this end, the present application provides an electronic signature method that can automatically select the corresponding key for signature according to the security level of the file, thereby achieving the flexibility and security of the electronic signature.

[0052] See also Figure 1 As shown, an embodiment of the present invention discloses an electronic signature method, which is applied to a client in an electronic signature system, including:

[0053] Step S11, obtaining the original document to be signed and the corresponding document attributes from the layout software, and determining whether there is security level information in the document attributes, and if so, determining whether the security level information is a preset high security level.

[0054] In this embodiment, when the layout software stamps the original text to be signed, it will call the signature interface of the client in the electronic signature system, and transmit the original text to be signed and the document attributes corresponding to the original text to be signed to the client through the signature interface. It should be noted that the layout software requires the security level information to be marked in the document attributes of the original text to be signed, for example, the confidentiality metadata is transmitted in the electronic official document file in OFD (Open Fixed-layout Document) format to mark the security level information.

[0055] In this embodiment, after the client receives the original text to be signed and the corresponding document attributes, it will determine whether there is security level information in the document attributes. If there is security level information in the document attributes, it will further determine whether the security level information is a preset high security level. If there is no security level information in the document attributes, a prompt information for prompting to supplement the security level information corresponding to the original text to be signed is returned to the layout software, so that the layout software sends the supplemented security level information to the client. It can be understood that if the client determines that there is no security level information in the document attributes, an error code requiring additional parameters to be supplemented will be returned to the layout software. After the layout software receives the returned error code, it will call the client's additional parameter query interface to inquire about the additional parameters that need to be provided. After knowing that the additional parameters that need to be provided are security level information, the layout software calls the security level information setting interface, sets the security level information corresponding to the original text to be signed and sends it to the client. After the client receives the security level information corresponding to the original text to be signed, it will perform the next step of judging whether the security level information is a preset high security level.

[0056] Step S12: If it is the preset high security level, the intranet seal UKey in the electronic signature system is called to sign the original text to be signed to generate corresponding signature data.

[0057] In this embodiment, Figure 2 As shown, if the security level information corresponding to the original text to be signed is the preset high security level, the client will call the intranet seal UKey in the electronic signature system to use its own stored intranet seal key and electronic seal to sign the original text to be signed to generate corresponding signature data, wherein the intranet seal key is generated based on a high security cryptographic algorithm.

[0058] Step S13: If it is not the preset high security level, the generated signature request is sent to the server in the electronic signature system, and the signature result generated by the server based on the original signature value obtained by signing the summary of the data to be signed in the signature request using the external network seal key is obtained, and then the signature result is verified and the corresponding signature data is generated based on the original signature value after the verification is successful; the summary of the data to be signed is the summary obtained by extracting the original text to be signed and the electronic seal; the electronic seal is a seal that is bound to both the intranet seal certificate and the external network seal certificate.

[0059] In this embodiment, if the security level information corresponding to the original text to be signed is not the preset high security level, the client will generate a signature request and send the signature request to the server in the electronic signature system. Specifically, for the generation of the signature request, the client can use a hash algorithm to extract the original text to be signed to obtain a summary of the original text to be signed; generate signature information based on the summary of the original text to be signed and the electronic seal, and extract the signature information using the hash algorithm to obtain a summary of the data to be signed; generate request data based on the summary of the data to be signed and the intranet seal certificate corresponding to the intranet seal UKey, and use the intranet seal UKey to sign and protect the request data to obtain a first signature value; generate a signature request based on the request data and the first signature value. It is understandable that the client uses a hash algorithm to extract the hash value of the original text to be signed to obtain a summary of the original text to be signed, and then uses the hash algorithm to extract the hash value of the signature information generated based on the summary of the original text to be signed and the electronic seal to obtain a summary of the data to be signed, and uses the intranet seal UKey to sign the request data generated based on the summary of the data to be signed and the intranet seal certificate to obtain a first signature value, wherein the intranet seal certificate corresponds to the intranet seal UKey. It should be noted that when making an electronic seal, in order to enable the files signed by the intranet (electronic signature system) to be transferred to the external network and meet the requirements of circulation in the intranet, it is necessary to bind at least two electronic seal certificates to the electronic seal at the same time, one for the intranet seal certificate and one for the external network seal certificate. Figure 3 As shown, the client finally generates a signature request based on the request data and the first signature value, that is, the signature request includes the summary of the data to be signed, the intranet seal certificate, and the first signature value. In addition, the signature request also includes other information, for example, the password corresponding to the signature request event, and then the client sends the generated signature request to the server.

[0060] In this embodiment, Figure 2As shown, after the server receives the signature request sent by the client, it will call the external network cipher machine in the electronic signature system to use the external network seal key generated based on the universal cryptographic algorithm to perform a private key signature on the summary of the data to be signed in the signature request to obtain the original signature value, and the server will generate a signature result based on the original signature value sent by the external network cipher machine, and then return the signature result to the client. Among them, for the determination of the external network seal key, the server can use the internal network seal certificate in the signature request to verify the first signature value, and use the digital identity certificate of the electronic signature system to verify the second signature value in the binding relationship stored in the database of the electronic signature system; the binding relationship is based on the correspondence between the external network seal key index and the internal network seal certificate and the relationship generated by the second signature value, and the second signature value is the signature value obtained by signing and protecting the corresponding relationship using the internal network cipher machine in the electronic signature system; after the first signature value and the second signature value are verified, the server determines whether the internal network seal certificate in the signature request is consistent with the internal network seal certificate in the binding relationship; if they are consistent, the server obtains the external network seal key index corresponding to the internal network seal certificate, and sends the external network seal key index to the external network cipher machine in the electronic signature system, so that the external network cipher machine uses the external network seal key corresponding to the external network seal key index to sign the data summary to be signed in the signature request to obtain the original signature value. It should be noted that, if Figure 4 and Figure 5 As shown, the binding relationship stored in the database includes the corresponding relationship obtained by binding the external network seal key index corresponding to the seal key pair assigned by the external network cipher machine with the internal network seal certificate in advance in the electronic signature system by the administrator, other information, and the second signature value obtained by the internal network cipher machine in the electronic signature system for signature protection, wherein the internal network seal certificate corresponds to the internal network seal UKey, and other information includes the password corresponding to the binding relationship. In addition, since the external network seal key is generated and securely stored by the external network cipher machine based on the general cryptographic algorithm, it can only be retrieved and used after passing the security authentication, and the external network seal key is securely stored in the external network cipher machine, and the private key data is not allowed to be exported, so the server needs to call the external network cipher machine to use the external network seal key to perform private key signature on the summary of the data to be signed.

[0061] In this embodiment, the server uses the intranet seal certificate in the signature request to verify the first signature value obtained through the intranet seal UKey signature protection to determine the authenticity of the requester's identity; and uses the digital identity certificate of the electronic signature system to verify the second signature value obtained through the intranet cipher machine signature protection in the binding relationship to determine the authenticity of the binding information. It should be noted that the two verification processes do not distinguish between the order of precedence. After the first signature value and the second signature value are both verified, it is determined whether the intranet seal certificate in the signature request is consistent with the intranet seal certificate in the binding relationship. If they are consistent, the server obtains the external network seal key index corresponding to the intranet seal certificate in the binding relationship, and sends the external network seal key index to the external network cipher machine. After the external network cipher machine receives the external network seal key index, it determines the external network seal key generated based on the universal cryptographic algorithm corresponding to the external network seal key index, and uses the external network seal key to sign the data summary to be signed in the signature request to obtain the original signature value, and then assembles the original signature value and the external network seal certificate corresponding to the external network cipher machine to generate return data and returns it to the server. Figure 6 As shown, the server uses the intranet cipher machine to sign the returned data to obtain the third signature value, and generates a signature result based on the returned data and the third signature value, that is, the signature result includes the original signature value, the external network seal certificate, other information and the third signature value, where the other information includes the password corresponding to the signature result. The server then sends the generated signature result to the client so that the client can verify it.

[0062] In this embodiment, the verification of the signature result and the generation of corresponding signature data based on the original signature value after successful verification may include the client using the digital identity certificate to verify the third signature value in the signature result; after the third signature value is verified, the original signature value is verified using the external network seal certificate in the signature result; after the original signature value is successfully verified, the corresponding signature data is generated based on the original signature value and the external network seal certificate. It can be understood that after the client receives the signature result sent by the server, the digital identity certificate of the electronic signature system is used to verify the third signature value in the signature result obtained by the signature protection of the internal network cipher machine, and after the third signature value is verified, the external network seal certificate in the signature result is used to verify the original signature value obtained by the signature protection of the external network cipher machine. After the original signature value is successfully verified, the client can generate corresponding signature data based on the original signature value and the external network seal certificate. Furthermore, after the verification of the third signature value fails, the client will return the corresponding signature error information to the layout software to prompt that an error has occurred in the signature operation of the original text. Similarly, after the verification of the original text signature value fails, the client will also return the corresponding signature error information to the layout software to prompt that an error has occurred in the signature operation.

[0063] Step S14: Return the generated signature data to the layout software, so that the layout software completes the signature operation on the original document to be signed based on the signature data.

[0064] In this embodiment, for the signature data generated when the security level information corresponding to the original text to be signed is the preset high security level, or for the signature data generated when the security level information corresponding to the original text to be signed is not the preset high security level, the client will return the generated signature data to the layout software, so that the layout software can complete the signing operation on the original text to be signed according to the returned signature data.

[0065] In this embodiment, Figure 7 As shown, the electronic signature system includes a client, a server, an intranet cipher machine, an extranet cipher machine, an intranet seal UKey and a database. Among them, the intranet cipher machine and the extranet cipher machine are both connected to the server, that is, the server can use the intranet cipher machine and the extranet cipher machine for signature protection. The database is connected to the server, and can save the generated binding relationship, signature results, signature data, etc. The intranet seal UKey can be connected to the client through a USB interface, and the intranet seal UKey stores a key and an electronic seal. The client is connected to the server, and can automatically select the corresponding cryptographic device for signing according to the security level information of the original text to be signed through the cooperation of the front and back ends.

[0066] It can be seen that this application determines the security level information of the original text to be signed through the client in the electronic signature system. If the security level information is the preset high security level, the intranet seal UKey of the high security cryptographic algorithm is called for signing. If the security level information is not the preset high security level, the external network seal key generated based on the general cryptographic algorithm is called for signing through the server in the electronic signature system. The electronic signature system is equivalent to the intranet, that is, the present application can use the external network seal key of the low security level in the high security level intranet to sign the original text to be signed, thereby solving the problem that the files signed in the intranet cannot be transmitted to the external network, and realizing the flexibility of the electronic signature. In addition, the present application avoids the problem of manually using the external network UKey for signing in the intranet by automatically selecting the corresponding key to sign the original text to be signed, thereby improving the efficiency of the electronic signature and realizing the security protection of the signed file.

[0067] See also Figure 8 As shown, an embodiment of the present invention discloses an electronic signature method, wherein the layout software opens the original text to be signed, and marks the security level information in the document properties of the original text to be signed, and then initiates the signature of the original text to be signed, that is, by calling the signature interface of the client in the electronic signature system, the original text to be signed and the document properties corresponding to the original text to be signed are transmitted to the client through the signature interface.

[0068] After receiving the original text to be signed and the corresponding document attributes, the client in the electronic signature system will determine whether there is security level information in the document attributes. If there is no security level information in the document attributes, it will return prompt information for supplementing the security level information corresponding to the original text to be signed to the layout software, so that the layout software can supplement the security level information by calling the security level information setting interface, and send the supplemented security level information to the client, and then the client will further determine whether the security level information is a preset high security level. If there is security level information in the document attributes, it will further determine whether the security level information is a preset high security level. If the security level information is a preset high security level, the client will call the intranet seal UKey in the electronic signature system to use the intranet seal key generated by the high-security cryptographic algorithm stored in itself and the electronic seal to sign the original text to be signed to generate the corresponding signature data, and then return the generated signature data to the layout software, so that the layout software can complete the signature operation of the original text to be signed based on the signature data. If the security level information is not the preset high security level, the client will generate a signature request and send the signature request to the server in the electronic signature system.

[0069] After receiving the signature request, the server in the electronic signature system will use the intranet seal certificate in the signature request to verify the first signature value obtained through the intranet seal UKey signature protection. After the first signature value is verified, the digital identity certificate of the electronic signature system will be used to verify the binding relationship of the second signature value obtained through the intranet cipher machine signature protection in the binding relationship, where the binding relationship is located in the database of the electronic signature system, and also includes the corresponding relationship between the external network seal key index and the intranet seal certificate. It should be noted that the verification operation of the first signature value and the second signature value in this application is not in order, and the above verification operation of the first signature value and the second signature value is one of the cases. After the second signature value is verified, the intranet seal certificate in the signature request is compared with the intranet seal certificate in the binding relationship to see if they are consistent. If they are consistent, the external network seal key index corresponding to the intranet seal certificate in the binding relationship is obtained, and the external network seal key index is sent to the external network cipher machine in the electronic signature system, so that the external network cipher machine uses the external network seal key generated based on the universal cryptographic algorithm corresponding to the external network seal key index to sign the data summary to be signed in the signature request to obtain the original signature value, and then assemble the original signature value and the external network seal certificate corresponding to the external network cipher machine to generate return data and return it to the server. The server uses the intranet cipher machine to sign the return data again to obtain the third signature value, and sends the signature result generated based on the return data and the third signature value to the client. In the above steps, if the verification of the first signature value or the second signature value fails, the signature result is directly returned to the client.

[0070] The client in the electronic signature system uses the digital identity certificate to verify the third signature value obtained through the signature protection of the intranet cipher machine in the signature result; after the third signature value is verified, the external network seal certificate in the signature result is used to verify the original text signature value obtained through the signature protection of the external network cipher machine; after the original text signature value is successfully verified, the corresponding signature data is generated based on the original text signature value and the external network seal certificate, and then the generated signature data is returned to the layout software, so that the layout software completes the signature operation of the original text based on the signature data. In the above steps, if the verification of the third signature value or the original text signature value fails, the corresponding signature error information will be returned to the layout software to prompt that an error has occurred in the signature operation of the original text.

[0071] It can be seen that this application determines the security level information of the original text to be signed through the client in the electronic signature system. If the security level information is the preset high security level, the intranet seal UKey of the high security cryptographic algorithm is called for signing. If the security level information is not the preset high security level, the external network seal key generated based on the general cryptographic algorithm is called for signing through the server in the electronic signature system. The electronic signature system is equivalent to the intranet, that is, the present application can use the external network seal key of the low security level in the high security level intranet to sign the original text to be signed, thereby solving the problem that the files signed in the intranet cannot be transmitted to the external network, and realizing the flexibility of the electronic signature. In addition, the present application avoids the problem of manually using the external network UKey for signing in the intranet by automatically selecting the corresponding key to sign the original text to be signed, thereby improving the efficiency of the electronic signature and realizing the security protection of the signed file.

[0072] See also Fig. 9 As shown, an embodiment of the present invention discloses an electronic signature device, which is applied to a client in an electronic signature system, including:

[0073] The security level judgment module 11 is used to obtain the original document to be signed and the corresponding document attributes from the formatting software, and judge whether there is security level information in the document attributes, and if so, judge whether the security level information is a preset high security level;

[0074] The first signature data generating module 12 is used to call the intranet seal UKey in the electronic signature system to sign the original document to be signed, so as to generate corresponding signature data if the preset high security level is reached;

[0075] The second signature data generating module 13 is used for sending the generated signature request to the server in the electronic signature system if it is not the preset high security level, obtaining the signature result generated by the server based on the original signature value obtained by signing the data summary to be signed in the signature request using the external network seal key, and then verifying the signature result and generating corresponding signature data based on the original signature value after successful verification; the data summary to be signed is the summary obtained by extracting the original text to be signed and the electronic seal; the electronic seal is a seal bound to both the internal network seal certificate and the external network seal certificate;

[0076] The signature completion module 14 is used to return the generated signature data to the layout software, so that the layout software completes the signature operation on the original document to be signed based on the signature data.

[0077] It can be seen that this application determines the security level information of the original text to be signed by the client in the electronic signature system. If the security level information is the preset high security level, the intranet seal UKey of the high security cryptographic algorithm is called for signing. If the security level information is not the preset high security level, the external network seal key of the general cryptographic algorithm is called for signing by the server in the electronic signature system. The electronic signature system is equivalent to the intranet, that is, the present application can use the external network seal key of the low security level in the high security level intranet to sign the original text to be signed, thereby solving the problem that the files signed in the intranet cannot be transmitted to the external network, and realizing the flexibility of the electronic signature. In addition, the present application avoids the problem of manually using the external network UKey for signing in the intranet by automatically selecting the corresponding key to sign the original text to be signed, thereby improving the efficiency of the electronic signature and realizing the security protection of the signed file.

[0078] In some specific embodiments, the electronic signature device further includes:

[0079] The prompt information returning unit is used to return prompt information for supplementing the security level information corresponding to the original text to be signed to the layout software if it does not exist, so that the layout software can send the supplemented security level information to the client.

[0080] In some specific embodiments, the electronic signature device further includes:

[0081] The original text extraction unit is used to extract the original text to be signed by using a hash algorithm to obtain a summary of the original text to be signed;

[0082] A signature information extraction unit, used to generate signature information based on the summary of the original text to be signed and the electronic seal, and extract the signature information using the hash algorithm to obtain the summary of the data to be signed;

[0083] A first signature unit, used to generate request data based on the summary of the data to be signed and the intranet seal certificate corresponding to the intranet seal UKey, and use the intranet seal UKey to sign and protect the request data to obtain a first signature value;

[0084] A signature request generating unit is used to generate a signature request based on the request data and the first signature value.

[0085] In some specific embodiments, the electronic signature device further includes:

[0086] A first signature verification unit is used for the server to verify the first signature value by using the intranet seal certificate in the signature request, and to verify the second signature value in the binding relationship stored in the database of the electronic signature system by using the digital identity certificate of the electronic signature system; the binding relationship is a relationship generated based on the correspondence between the external network seal key index and the intranet seal certificate and the second signature value, and the second signature value is a signature value obtained by signing and protecting the correspondence using the intranet cipher machine in the electronic signature system;

[0087] A certificate determination unit, configured to determine, by the server, whether the intranet seal certificate in the signature request is consistent with the intranet seal certificate in the binding relationship after both the first signature value and the second signature value are verified;

[0088] The index acquisition unit is used to, if they are consistent, cause the server to obtain the external network seal key index corresponding to the internal network seal certificate, and send the external network seal key index to the external network cipher machine in the electronic signature system, so that the external network cipher machine uses the external network seal key corresponding to the external network seal key index to sign the data summary to be signed in the signature request to obtain the original signature value.

[0089] In some specific embodiments, the second signature data generating module 13 may specifically include:

[0090] A signature result acquisition unit is used to obtain the signature result generated by the server based on the return data and the third signature value obtained by signing and protecting the return data using the intranet cipher machine; the return data is the original signature value obtained by signing the summary of the data to be signed in the signature request using the external network seal key based on the external network cipher machine and the data obtained by the external network seal certificate corresponding to the external network cipher machine.

[0091] In some specific embodiments, the second signature data generating module 13 may specifically include:

[0092] A second signature verification unit, configured to verify the third signature value in the signature result using the digital identity certificate;

[0093] A third signature verification unit is used to verify the original signature value using the external network seal certificate in the signature result after the third signature value is verified;

[0094] The signature data generating unit is used to generate corresponding signature data based on the original signature value and the external network seal certificate after the original signature value is successfully verified.

[0095] In some specific embodiments, the electronic signature device further includes:

[0096] The error information returning unit is used to return corresponding signature error information to the formatting software after the verification of the third signature value fails, so as to prompt that an error occurs in the signing operation of the original document to be signed.

[0097] Furthermore, the present application also discloses an electronic device. Fig.10 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content in the diagram cannot be regarded as any limitation on the scope of use of the present application.

[0098] Fig.10 A schematic diagram of the structure of an electronic device 20 provided in an embodiment of the present application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the electronic signature method disclosed in any of the aforementioned embodiments. In addition, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0099] In this embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present application, and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0100] In addition, the memory 22, as a carrier for storing resources, can be a read-only memory, a random access memory, a disk or an optical disk, etc. The resources stored thereon can include an operating system 221, a computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0101] The operating system 221 is used to manage and control the hardware devices and computer program 222 on the electronic device 20, which can be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program that can be used to complete the electronic signature method performed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 can further include a computer program that can be used to complete other specific tasks.

[0102] Furthermore, the present application also discloses a computer-readable storage medium for storing a computer program; wherein the computer program, when executed by a processor, implements the electronic signature method disclosed above. The specific steps of the method can refer to the corresponding contents disclosed in the above embodiments, and will not be repeated here.

[0103] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0104] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0105] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0106] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0107] The technical solution provided by the present application is introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for general technicians in this field, according to the idea of ​​the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. An electronic signature method, characterized in that: Clients used in electronic signature systems include: Obtain the original document to be signed and the corresponding document attributes from the formatting software, determine whether there is security level information in the document attributes, and if so, determine whether the security level information is a preset high security level; If it is the preset high security level, the intranet seal UKey in the electronic signature system is called to sign the original document to be signed to generate corresponding signature data; If it is not the preset high security level, the generated signature request is sent to the server in the electronic signature system, and the signature result generated by the server based on the original signature value obtained by signing the data summary to be signed in the signature request using the external network seal key is obtained, and then the signature result is verified and the corresponding signature data is generated based on the original signature value after the verification is successful; the data summary to be signed is the summary obtained by extracting the original text to be signed and the electronic seal; the electronic seal is a seal that is bound to both the internal network seal certificate and the external network seal certificate; The generated signature data is returned to the layout software so that the layout software completes the signature operation on the original document to be signed based on the signature data.

2. The electronic signature method according to claim 1, characterized in that: After determining whether the document attributes contain security level information, the method further includes: If it does not exist, a prompt message for supplementing the security level information corresponding to the original text to be signed is returned to the layout software, so that the layout software can send the supplemented security level information to the client.

3. The electronic signature method according to claim 1 or 2, characterized in that: Before sending the generated signature request to the server in the electronic signature system, the method further includes: The original text to be signed is extracted using a hash algorithm to obtain a summary of the original text to be signed; Generate signature information based on the summary of the original text to be signed and the electronic seal, and extract the signature information using the hash algorithm to obtain the summary of the data to be signed; Generate request data based on the digest of the data to be signed and the intranet seal certificate corresponding to the intranet seal UKey, and use the intranet seal UKey to sign and protect the request data to obtain a first signature value; A signing request is generated based on the request data and the first signature value.

4. The electronic signature method according to claim 3, characterized in that: Before obtaining the signature result generated by the server based on the original signature value obtained by signing the data digest to be signed in the signature request using the external network seal key, it also includes: The server verifies the first signature value by using the intranet seal certificate in the signature request, and verifies the second signature value in the binding relationship stored in the database of the electronic signature system by using the digital identity certificate of the electronic signature system; the binding relationship is a relationship generated based on the correspondence between the external network seal key index and the intranet seal certificate and the second signature value, and the second signature value is a signature value obtained by signing and protecting the correspondence using the intranet cipher machine in the electronic signature system; After the first signature value and the second signature value are both verified, the server determines whether the intranet seal certificate in the signature request is consistent with the intranet seal certificate in the binding relationship; If they are consistent, the server obtains the external network seal key index corresponding to the internal network seal certificate, and sends the external network seal key index to the external network cipher machine in the electronic signature system, so that the external network cipher machine uses the external network seal key corresponding to the external network seal key index to sign the data summary to be signed in the signature request to obtain the original signature value.

5. The electronic signature method according to claim 4, characterized in that: The obtaining of the signature result generated by the server based on the original signature value obtained by signing the data digest to be signed in the signature request using the external network seal key includes: Obtain the signature result generated by the third signature value returned by the server based on the return data and the return data signed and protected by the intranet cipher machine; the return data is the original signature value obtained by signing the summary of the data to be signed in the signature request by the extranet cipher machine using the extranet seal key, and the data obtained by the extranet seal certificate corresponding to the extranet cipher machine.

6. The electronic signature method according to claim 5, characterized in that: The verifying the signature result and generating corresponding signature data based on the original signature value after successful verification includes: Verifying the third signature value in the signature result by using the digital identity certificate; After the third signature value is verified, the original signature value is verified using the external network seal certificate in the signature result; After the original signature value is successfully verified, corresponding signature data is generated based on the original signature value and the external network seal certificate.

7. The electronic signature method according to claim 6, characterized in that: After verifying the third signature value in the signature result by using the digital identity certificate, the method further includes: After the verification of the third signature value fails, the corresponding signature error information is returned to the formatting software to prompt that an error occurs in the signing operation of the original document to be signed.

8. An electronic signature device, characterized in that: Clients used in electronic signature systems include: A security level judgment module is used to obtain the original document to be signed and the corresponding document attributes from the formatting software, and judge whether there is security level information in the document attributes, and if so, judge whether the security level information is a preset high security level; The first signature data generation module is used to call the intranet seal UKey in the electronic signature system to sign the original document to be signed to generate corresponding signature data if the preset high security level is reached; The second signature data generation module is used for sending the generated signature request to the server in the electronic signature system if it is not the preset high security level, obtaining the signature result generated by the server based on the original signature value obtained by signing the data summary to be signed in the signature request using the external network seal key, and then verifying the signature result and generating corresponding signature data based on the original signature value after successful verification; the data summary to be signed is a summary obtained by extracting the original text to be signed and the electronic seal; the electronic seal is a seal bound to both the internal network seal certificate and the external network seal certificate; The signature completion module is used to return the generated signature data to the layout software, so that the layout software can complete the signature operation on the original document to be signed based on the signature data.

9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to execute the computer program to implement the electronic signature method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: Used to store a computer program, which, when executed by a processor, implements the electronic signature method according to any one of claims 1 to 7.

Images