An electronic signature method, device, equipment and storage medium

Abstract

The application discloses an electronic signature method and device, equipment and a storage medium, and relates to the field of electronic signature, and comprises the following steps: judging whether security level information exists in the document attribute of the original text to be signed, and judging whether the security level information is a preset high security level if the security level information exists; if yes, calling an intranet seal UKey to sign the original text to be signed to generate corresponding signature data; if no, sending a signature request to a server, obtaining a signature result generated by the server based on signing data digest in the signature request by using an extranet seal key, verifying the signature result, and generating corresponding signature data based on the original signature value after the verification is successful; and returning the generated signature data to layout software, so that the layout software completes the signature of the original text to be signed based on the signature data. According to the application, the corresponding key is automatically selected for signature according to the security level of the file, and the flexibility and security of the electronic signature are realized.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of electronic signature, and in particular to an electronic signature method, device, equipment and storage medium. BACKGROUND

[0002] In different security level environments, different password algorithms are often used according to different security requirements. For example, a high security level network often uses a high security password algorithm with higher security, a low security level network uses a general password algorithm with relatively low security, and the password of the inner network cannot be used in the outer network. However, in actual application, the inner network also needs to process electronic files with low security requirements. After the inner network signs or signs the file, the signed or signed file needs to flow from the inner network to the outer network. Since the security requirements of the inner and outer networks are different, the password algorithms are different, and direct file transfer may cause password application violations. At the same time, the outer network cannot verify the file signed or signed by the inner network password algorithm because it does not have the password algorithm of the inner network.

[0003] In general signature or signature applications, UKey (USB Key) is often used as a key carrier and provides password capabilities. In different security environments, different UKeys are used to provide different password algorithm capabilities. In traditional applications, the file is often transferred from the inner network to the outer network by using the seal desensitization method, but this method is prone to cause problems such as destruction of electronic signature or signature and loss of file security protection, or the outer network cannot verify the signature or signature when receiving the file. If the outer UKey is manually used for signing or signing in the inner network, the efficiency is low and errors are prone to occur. SUMMARY

[0004] Therefore, the purpose of the present application is to provide an electronic signature method, device, equipment and storage medium, which can automatically select the corresponding key for signing according to the security level of the file, and realize the flexibility and security of electronic signature. The specific scheme is as follows:

[0005] In a first aspect, the present application provides an electronic signature method applied to a client in an electronic signature system, comprising:

[0006] Obtaining the to-be-signed original text and the corresponding document attribute from the layout software, determining whether the security level information exists in the document attribute, and if so, determining whether the security level information is a preset high security level;

[0007] If the security level is the preset high security level, the inner network seal UKey in the electronic signature system is called to sign the to-be-signed original text to generate corresponding signature data;

[0008] If the preset high security level does not exist, the generated signature request is sent to a server in the electronic signature system, a signature result generated based on a plaintext signature value obtained by signing the to-be-signed data digest in the signature request by using an external network seal key is acquired, the signature result is verified, and corresponding signature data is generated based on the plaintext signature value after the verification is successful; the to-be-signed data digest is obtained by extracting the to-be-signed plaintext and an electronic seal; the electronic seal is a seal that is simultaneously bound with an internal network seal certificate and an external network seal certificate;

[0009] The generated signature data is returned to the layout software, so that the layout software completes a signature operation on the to-be-signed plaintext based on the signature data.

[0010] Optionally, after the judgment on whether the security level information exists in the document attribute, the method further includes:

[0011] If the security level information does not exist, prompt information for prompting the supplement of the security level information corresponding to the to-be-signed plaintext is returned to the layout software, so that the layout software sends the supplemented security level information to the client.

[0012] Optionally, before the signature request is sent to the server in the electronic signature system, the method further includes:

[0013] The to-be-signed plaintext is extracted by using a hash algorithm to obtain a to-be-signed plaintext digest;

[0014] Signature information is generated based on the to-be-signed plaintext digest and the electronic seal, and the signature information is extracted by using the hash algorithm to obtain a to-be-signed data digest;

[0015] Request data is generated based on the to-be-signed data digest and the internal network seal certificate corresponding to the internal network seal UKey, and the request data is signed and protected by using the internal network seal UKey to obtain a first signature value;

[0016] The signature request is generated based on the request data and the first signature value.

[0017] Optionally, before the signature result generated based on the plaintext signature value obtained by signing the to-be-signed data digest in the signature request by using the external network seal key is acquired, the method further includes:

[0018] The server verifies the first signature value by using the intranet seal certificate in the seal request, and verifies a second signature value in a binding relationship stored in a database in the electronic seal system by using a digital identity certificate of the electronic seal system; the binding relationship is a relationship generated based on a correspondence between an extranet seal key index and the intranet seal certificate and the second signature value, and the second signature value is a signature value obtained by signing and protecting the correspondence by using an intranet cryptographic machine in the electronic seal system;

[0019] After the first signature value and the second signature value are both verified, the server determines whether the intranet seal certificate in the seal request is consistent with the intranet seal certificate in the binding relationship;

[0020] If consistent, the server acquires the extranet seal key index corresponding to the intranet seal certificate, and sends the extranet seal key index to an extranet cryptographic machine in the electronic seal system, so that the extranet cryptographic machine signs the data digest to be signed in the seal request by using an extranet seal key corresponding to the extranet seal key index, to obtain a plaintext signature value.

[0021] Optionally, the signature result generated based on the plaintext signature value obtained by signing the data digest to be signed in the seal request by using the extranet seal key and returned by the server includes:

[0022] The signature result generated based on the return data and a third signature value obtained by signing and protecting the return data by using the intranet cryptographic machine is acquired, and the return data is data obtained based on the plaintext signature value obtained by signing the data digest to be signed in the seal request by using the extranet seal key and the extranet seal certificate corresponding to the extranet cryptographic machine.

[0023] Optionally, the verification of the signature result and the generation of corresponding seal data based on the plaintext signature value after the verification is successful include:

[0024] The third signature value in the signature result is verified by using the digital identity certificate;

[0025] After the third signature value is verified, the plaintext signature value is verified by using the extranet seal certificate in the signature result;

[0026] After the plaintext signature value is verified successfully, corresponding seal data is generated based on the plaintext signature value and the extranet seal certificate.

[0027] Optionally, after the third signature value in the signature result is verified by using the digital identity certificate, the method further includes:

[0028] After the third signature value fails to be verified, corresponding signature error information is returned to the layout software to prompt that the signature operation on the original text to be signed fails.

[0029] In a second aspect, the present application provides an electronic signature device applied to a client in an electronic signature system, and includes:

[0030] A security level judgment module is configured to acquire an original text to be signed and corresponding document attributes from layout software, judge whether security level information exists in the document attributes, and if so, judge whether the security level information is a preset high security level.

[0031] A first signature data generation module is configured to, if the security level is the preset high security level, call an intranet seal UKey in the electronic signature system to sign the original text to be signed, so as to generate corresponding signature data.

[0032] A second signature data generation module is configured to, if the security level is not the preset high security level, send a generated signature request to a server in the electronic signature system, acquire an original text signature value generated based on the signature request, and then verify the signature result and generate corresponding signature data based on the original text signature value after the verification succeeds; the original text signature value is generated based on a signature result returned by the server and obtained by signing data digest in the signature request by using an extranet seal key; the data digest is obtained by extracting the original text to be signed and an electronic seal; and the electronic seal is a seal that simultaneously binds an intranet seal certificate and an extranet seal certificate.

[0033] A signature completion module is configured to return the generated signature data to the layout software, so that the layout software completes the signature operation on the original text to be signed based on the signature data.

[0034] In a third aspect, the present application provides an electronic device, which includes:

[0035] A memory is configured to save a computer program.

[0036] A processor is configured to execute the computer program to implement the electronic signature method.

[0037] In a fourth aspect, the present application provides a computer readable storage medium configured to save a computer program, and the computer program is executed by a processor to implement the electronic signature method.

[0038] In the application, the original text to be signed and corresponding document attributes are acquired from layout software, it is judged whether there is security level information in the document attributes, if yes, it is judged whether the security level information is a preset high security level, if yes, the original text to be signed is signed by calling an intranet seal UKey in the electronic seal system to generate corresponding seal data, if not, the generated seal request is sent to a server in the electronic seal system, a signature result generated based on an original signature value obtained by signing a data digest in the seal request using an extranet seal key is acquired, then the signature result is verified and corresponding seal data is generated based on the original signature value after successful verification; the data digest to be signed is obtained by extracting the original text to be signed and an electronic seal; the electronic seal is a seal simultaneously binding an intranet seal certificate and an extranet seal certificate; the generated seal data is returned to the layout software, so that the layout software completes the signing operation on the original text to be signed based on the seal data. As can be seen, the security level information of the original text to be signed is judged by the client in the electronic seal system, if the security level information is a preset high security level, the intranet seal UKey of a high security password algorithm is called to sign, if the security level information is not the preset high security level, the extranet seal key of a general password algorithm is called to sign by the server in the electronic seal system, the electronic seal system is equivalent to an intranet, that is, the application can use the extranet seal key of a low security level to sign the original text to be signed in the intranet of a high security level, thereby solving the problem that the file signed in the intranet cannot be transmitted to the extranet, realizing the flexibility of electronic seal, in addition, the application automatically selects the corresponding key to sign the original text to be signed, avoiding the problem of manually using the extranet UKey to sign in the intranet, improving the efficiency of electronic seal, and realizing the security protection of the file after signing. BRIEF DESCRIPTION OF DRAWINGS

[0039] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description are only the embodiments of the present application, and for those skilled in the art, other drawings can be obtained without creative labor based on the provided drawings.

[0040] Figure 1 A flow chart of an electronic seal method disclosed by the present application;

[0041] Figure 2 An electronic seal structure diagram disclosed by the present application;

[0042] Figure 3A signature request structure diagram disclosed by the present application;

[0043] Figure 4 A binding relationship schematic diagram disclosed by the present application;

[0044] Figure 5 A binding relationship structure diagram disclosed by the present application;

[0045] Figure 6 A signature result structure diagram disclosed by the present application;

[0046] Figure 7 An electronic signature deployment schematic diagram disclosed by the present application;

[0047] Figure 8 An electronic signature flow chart disclosed by the present application;

[0048] Figure 9 An electronic signature device structure schematic diagram disclosed by the present application;

[0049] Figure 10 An electronic device structure diagram disclosed by the present application. DETAILED DESCRIPTION

[0050] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work fall within the scope of protection of the present application.

[0051] In different security level environments, different password algorithms are often used according to different security requirements. For example, a high security password algorithm is often used in the inner network of a high security level network, and a general password algorithm with relatively low security is used in the outer network of a low security level network. The password of the inner network cannot be used in the outer network. Therefore, the present application provides an electronic signature method, which can automatically select a corresponding key for signature according to the security level of a file, thereby realizing the flexibility and security of electronic signature.

[0052] Referring to Figure 1 The present application discloses an electronic signature method, which is applied to a client in an electronic signature system and includes the following steps:

[0053] In step S11, the original text to be signed and corresponding document attributes are obtained from a layout software, and it is determined whether security level information exists in the document attributes. If yes, it is determined whether the security level information is a preset high security level.

[0054] In this embodiment, when the layout software seals the original text to be sealed, the client's sealing interface in the electronic seal system is called, and the original text to be sealed and the document properties corresponding to the original text to be sealed are transmitted to the client through the sealing interface. It should be noted that the layout software requires the annotation of security level information in the document properties of the original text to be sealed, for example, the import of secret level metadata in the OFD (Open Fixed-layout Document, open fixed-layout document) format of the electronic official document file to mark the security level information.

[0055] In this embodiment, after the client receives the original text to be sealed and the corresponding document properties, it is determined whether the security level information exists in the document properties. If the security level information exists in the document properties, it is further determined whether the security level information is a preset high security level. If the security level information does not exist in the document properties, prompt information for prompting the supplement of the security level information corresponding to the original text to be sealed is returned to the layout software, so that the layout software sends the supplemented security level information to the client. It can be understood that if the client determines that the security level information does not exist in the document properties, an error code for requiring the supplement of an additional parameter is returned to the layout software. After receiving the returned error code, the layout software calls the additional parameter inquiry interface of the client to inquire the additional parameter to be provided. After knowing that the additional parameter to be provided is the security level information, the layout software calls the security level information setting interface to set the security level information corresponding to the original text to be sealed and sends it to the client. After the client receives the security level information corresponding to the original text to be sealed, the next step of determining whether the security level information is the preset high security level is performed.

[0056] In step S12, if the preset high security level is used, the original text to be sealed is sealed by the internal network seal UKey in the electronic seal system to generate corresponding seal data.

[0057] In this embodiment, as shown in Figure 2 If the security level information corresponding to the original text to be sealed is the preset high security level, the client calls the internal network seal UKey in the electronic seal system to perform a sealing operation on the original text to be sealed by using the internal network seal key and the electronic seal stored by itself, to generate corresponding seal data, wherein the internal network seal key is generated based on a high security password algorithm.

[0058] Step S13: If it is not the preset high security level, the generated signature request is sent to the server of the electronic signature system. The server returns a signature result generated based on the original text signature value obtained by signing the digest of the data to be signed in the signature request using the external network seal key. The signature result is then verified, and the corresponding signature data is generated based on the original text signature value after successful verification. The digest of the data to be signed is a digest obtained by extracting the original text to be signed and the electronic seal. The electronic seal is a seal that is simultaneously bound to an internal network seal certificate and an external network seal certificate.

[0059] In this embodiment, if the security level information corresponding to the original text to be signed is not a preset high security level, the client will generate a signing request and send it to the server in the electronic signature system. Specifically, for generating the signing request, the client can use a hash algorithm to extract the original text to be signed to obtain a digest of the original text to be signed; generate signature information based on the digest of the original text to be signed and the electronic seal, and use the hash algorithm to extract the signature information to obtain a digest of the data to be signed; generate request data based on the digest of the data to be signed and the intranet seal certificate corresponding to the intranet seal UKey, and use the intranet seal UKey to sign and protect the request data to obtain a first signature value; generate a signing request based on the request data and the first signature value. Understandably, the client uses a hash algorithm to extract the hash value of the original text to be signed, obtaining a digest of the original text to be signed. Then, it uses another hash algorithm to extract the hash value of the signature information generated based on the digest of the original text to be signed and the electronic seal, obtaining a data digest to be signed. The client then uses the internal network seal UKey to sign the request data generated based on the data digest to be signed and the internal network seal certificate, obtaining the first signature value. The internal network seal certificate and the internal network seal UKey are corresponding. It should be noted that when creating an electronic seal, to enable documents signed on the internal network (electronic signature system) to circulate to the external network, and to meet the requirements for circulation within the internal network, at least two electronic seal certificates need to be bound to the electronic seal simultaneously: one internal network seal certificate and one external network seal certificate. For example... Figure 3 As shown, the client ultimately generates a signature request based on the request data and the first signature value. That is, the signature request includes the data digest to be signed, the intranet seal certificate, and the first signature value. In addition, the signature request also includes other information, such as the password corresponding to the signature request event. Then the client sends the generated signature request to the server.

[0060] In this embodiment, as Figure 2As shown, after the service end receives the signature request sent by the client, the external network cryptomachine in the electronic signature system will be called to use the external network seal key generated based on the general password algorithm to sign the data digest to be signed in the signature request with a private key to obtain the original text signature value, and the service end will generate a signature result based on the original text signature value sent by the external network cryptomachine, and then return the signature result to the client. Wherein, the determination of the external network seal key can be achieved by the service end verifying the first signature value in the signature request by using the internal network seal certificate, and verifying the second signature value in the binding relationship stored in the database memory in the electronic signature system by using the digital identity certificate of the electronic signature system; the binding relationship is a relationship generated based on the correspondence between the external network seal key index and the internal network seal certificate and the second signature value, and the second signature value is a signature value obtained by signing and protecting the correspondence by using the internal network cryptomachine in the electronic signature system; after the first signature value and the second signature value are verified, the service end determines whether the internal network seal certificate in the signature request is consistent with the internal network seal certificate in the binding relationship; if consistent, the service end obtains the external network seal key index corresponding to the internal network seal certificate, and sends the external network seal key index to the external network cryptomachine in the electronic signature system, so that the external network cryptomachine uses the external network seal key corresponding to the external network seal key index to sign the data digest to be signed in the signature request, to obtain the original text signature value. It should be noted that, as shown in Figure 4 and Figure 5 As shown, the binding relationship stored in the database includes the correspondence obtained by the administrator in the electronic signature system by binding the external network seal key index corresponding to the seal key pair allocated by the external network cryptomachine and the internal network seal certificate, other information, and the second signature value protected by the internal network cryptomachine in the electronic signature system, wherein the internal network seal certificate corresponds to the internal network seal UKey, and the other information includes the password corresponding to the binding relationship. And since the external network seal key is generated by the external network cryptomachine based on the general password algorithm and is securely stored, it can only be called and used after security authentication, the external network seal key is securely stored in the external network cryptomachine, and the private key data is not allowed to be exported, so the service end needs to call the external network cryptomachine to sign the data digest to be signed with a private key by using the external network seal key.

[0061] In the embodiment, the server verifies the first signature value obtained by the intranet seal UKey signature protection by using the intranet seal certificate in the seal request, to determine the authenticity of the requester; and verifies the second signature value in the binding relationship obtained by the intranet password machine signature protection by using the digital identity certificate of the electronic seal system, to determine the authenticity of the binding information. It should be noted that the two verification processes are not distinguished in the order. After the first signature value and the second signature value are verified, it is judged whether the intranet seal certificate in the seal request is consistent with the intranet seal certificate in the binding relationship. If consistent, the server obtains the extranet seal key index corresponding to the intranet seal certificate in the binding relationship, and sends the extranet seal key index to the extranet password machine. After the extranet password machine receives the extranet seal key index, the extranet seal key based on the general password algorithm corresponding to the extranet seal key index is determined, and the extranet seal key is used to sign the data digest to be signed in the seal request, to obtain the original text signature value, and then the original text signature value and the extranet seal certificate corresponding to the extranet password machine are assembled to generate the return data and return to the server. As shown in Figure 6 the server uses the intranet password machine to sign the return data again to obtain the third signature value, and generates the signature result according to the return data and the third signature value, that is, the signature result includes the original text signature value, the extranet seal certificate, other information and the third signature value, wherein the other information includes the password corresponding to the signature result. Then the server sends the generated signature result to the client, so that the client verifies it.

[0062] In this embodiment, the verifying the signature result and generating corresponding seal data based on the original signature value after the verifying succeeds can include that the client verifies the third signature value in the signature result by using the digital identity certificate; after the third signature value is verified, the client verifies the original signature value by using the external network seal certificate in the signature result; and after the original signature value is verified, the client generates corresponding seal data based on the original signature value and the external network seal certificate. It can be understood that after the client receives the signature result sent by the server, the client verifies the third signature value protected by the internal network password machine by using the digital identity certificate of the electronic seal system, and after the third signature value is verified, the client verifies the original signature value protected by the external network password machine by using the external network seal certificate in the signature result. After the original signature value is verified, the client can generate corresponding seal data based on the original signature value and the external network seal certificate. Further, after the third signature value is verified, the client returns corresponding seal error information to the layout software to prompt that the seal operation of the original text to be sealed is wrong. Similarly, after the original signature value is verified, the client also returns corresponding seal error information to the layout software to prompt that the seal operation is wrong.

[0063] In step S14, the generated seal data is returned to the layout software, so that the layout software completes the seal operation on the original text to be sealed based on the seal data.

[0064] In this embodiment, for the seal data generated in the case that the security level information corresponding to the original text to be sealed is the preset high security level, or for the seal data generated in the case that the security level information corresponding to the original text to be sealed is not the preset high security level, the client returns the generated seal data to the layout software, so that the layout software completes the seal operation on the original text to be sealed according to the returned seal data.

[0065] In this embodiment, as shown in Figure 7 The electronic seal system includes a client, a server, an internal network password machine, an external network password machine, an internal network seal UKey and a database. The internal network password machine and the external network password machine are connected to the server, that is, the server can use the internal network password machine and the external network password machine for signature protection. The database is connected to the server and can save the generated binding relationship, signature result, seal data and the like. The internal network seal UKey can be connected to the client through a USB interface, and the internal network seal UKey stores a key and an electronic seal. The client is connected to the server and can automatically select a corresponding password device for seal according to the security level information of the original text to be sealed in a front-end and back-end cooperation manner.

[0066] It can be seen that the electronic signature system is equivalent to an intranet, that is, the electronic signature system can use a low security level extranet seal key to sign the to-be-signed original text in the high security level intranet, thereby solving the problem that the file signed in the intranet cannot be transmitted to the extranet, realizing the flexibility of electronic signature, and in addition, the electronic signature system can automatically select a corresponding key to sign the to-be-signed original text, avoiding the problem of manually using an extranet UKey to sign in the intranet, improving the efficiency of electronic signature, and realizing the security protection of the signed file.

[0067] Referring to Figure 8 As shown in the figure, the embodiment of the application discloses an electronic signature method, wherein the layout software opens the to-be-signed original text, and marks the security level information in the document attribute of the to-be-signed original text, and then initiates the signature of the to-be-signed original text, that is, the signature interface of the client in the electronic signature system is called, and the to-be-signed original text and the document attribute corresponding to the to-be-signed original text are transmitted to the client through the signature interface.

[0068] After the client in the electronic signature system receives the to-be-signed original text and the corresponding document attribute, it will determine whether the security level information exists in the document attribute, if the security level information does not exist in the document attribute, the prompt information for prompting the supplement of the security level information corresponding to the to-be-signed original text is returned to the layout software, so that the layout software supplements the security level information by calling the security level information setting interface, and sends the supplemented security level information to the client, and then the client further determines whether the security level information is a preset high security level. If the security level information exists in the document attribute, it is further determined whether the security level information is a preset high security level. If the security level information is a preset high security level, the client will call the intranet seal UKey in the electronic signature system to sign the to-be-signed original text by using the intranet seal key generated based on the high security password algorithm and the electronic seal stored by itself, to generate corresponding signature data, and then return the generated signature data to the layout software, so that the layout software completes the signature operation of the to-be-signed original text based on the signature data. If the security level information is not a preset high security level, the client will generate a signature request and send the signature request to the server in the electronic signature system.

[0069] The server in the electronic seal system receives the seal request, and uses the intranet seal certificate in the seal request to verify the first signature value protected by the intranet seal UKey signature, and after the first signature value is verified, uses the digital identity certificate of the electronic seal system to verify the second signature value protected by the intranet password machine signature in the binding relationship, wherein the binding relationship is located in the database in the electronic seal system, and also includes the correspondence between the intranet seal certificate and the extranet seal key index. It should be noted that the verification operations of the first signature value and the second signature value in the present application are not in order, and the above-mentioned verification operations of the first signature value and the second signature value are one of the cases. After the second signature value is verified, the intranet seal certificate in the seal request is compared with the intranet seal certificate in the binding relationship. If they are consistent, the extranet seal key index corresponding to the intranet seal certificate in the binding relationship is obtained, and the extranet seal key index is sent to the extranet password machine in the electronic seal system, so that the extranet password machine uses the extranet seal key corresponding to the extranet seal key index generated based on the general password algorithm to sign the data digest in the seal request, to obtain the original text signature value, and then the original text signature value and the extranet seal certificate corresponding to the extranet password machine are assembled to generate return data and return to the server. The server uses the intranet password machine to protect the return data to obtain the third signature value, and sends the signature result generated based on the return data and the third signature value to the client. In the above steps, if the first signature value or the second signature value fails, the signature result is directly returned to the client.

[0070] The client in the electronic seal system uses the digital identity certificate to verify the third signature value protected by the intranet password machine signature in the signature result; after the third signature value is verified, the extranet seal certificate in the signature result is used to verify the original text signature value protected by the extranet password machine signature; after the original text signature value is verified, the corresponding seal data is generated based on the original text signature value and the extranet seal certificate, and then the generated seal data is returned to the format software, so that the format software completes the seal operation on the original text to be sealed based on the seal data. In the above steps, if the third signature value or the original text signature value fails, the corresponding seal error information is returned to the format software to prompt the seal operation error of the original text to be sealed.

[0071] It can be seen that the electronic signature system is equivalent to an intranet, that is, the electronic signature system can use the low security level extranet seal key to sign the to-be-signed original text in the high security level intranet, thereby solving the problem that the file signed in the intranet cannot be transmitted to the extranet, realizing the flexibility of electronic signature, and in addition, the electronic signature system can automatically select the corresponding key to sign the to-be-signed original text, avoiding the problem of manually using the extranet UKey to sign in the intranet, improving the efficiency of electronic signature, and realizing the security protection of the signed file.

[0072] Referring to Figure 9 As shown in the figure, the embodiment of the application discloses an electronic signature device, applied to a client in an electronic signature system, comprising:

[0073] The security level judgment module 11 is configured to obtain the to-be-signed original text and the corresponding document attribute from the layout software, judge whether the security level information exists in the document attribute, and judge whether the security level information is a preset high security level if the security level information exists;

[0074] The first signature data generation module 12 is configured to call the intranet seal UKey in the electronic signature system to sign the to-be-signed original text if the security level information is the preset high security level, so as to generate corresponding signature data.

[0075] The second signature data generation module 13 is configured to send the generated signature request to the server in the electronic signature system if the security level information is not the preset high security level, obtain the signature result generated by the original signature value based on the signature request of the to-be-signed data digest signed by the extranet seal key returned by the server, then verify the signature result and generate corresponding signature data based on the original signature value after the verification is successful; the to-be-signed data digest is an extracted digest of the to-be-signed original text and the electronic seal; the electronic seal is a seal that simultaneously binds the intranet seal certificate and the extranet seal certificate;

[0076] The signature completion module 14 is configured to return the generated signature data to the layout software, so that the layout software completes the signature operation on the to-be-signed original text based on the signature data.

[0077] Therefore, the electronic signature system can use the low security level external network seal key to sign the to-be-signed original text in the high security level internal network, thereby solving the problem that the file signed in the internal network cannot be transmitted to the external network, and realizing the flexibility of the electronic signature. In addition, the electronic signature system automatically selects the corresponding key to sign the to-be-signed original text, thereby avoiding the problem of manually using the external network UKey to sign in the internal network, improving the efficiency of the electronic signature, and realizing the security protection of the signed file.

[0078] In some embodiments, the electronic signature device further comprises:

[0079] The prompt information returning unit is configured to return prompt information for prompting to supplement the security level information corresponding to the to-be-signed original text to the layout software if the security level information corresponding to the to-be-signed original text does not exist, so that the layout software sends the supplemented security level information to the client.

[0080] In some embodiments, the electronic signature device further comprises:

[0081] The original text extracting unit is configured to extract the to-be-signed original text by using a hash algorithm to obtain a to-be-signed original text digest;

[0082] The signature information extracting unit is configured to generate signature information based on the to-be-signed original text digest and the electronic seal, and extract the signature information by using the hash algorithm to obtain a to-be-signed data digest;

[0083] The first signature unit is configured to generate request data based on the to-be-signed data digest and the internal network seal certificate corresponding to the internal network seal UKey, and protect the request data by signing by using the internal network seal UKey to obtain a first signature value;

[0084] The signature request generating unit is configured to generate a signature request based on the request data and the first signature value.

[0085] In some embodiments, the electronic signature device further comprises:

[0086] The first signature verification unit is configured to verify the first signature value by using the intranet seal certificate in the seal request and verify a second signature value in a binding relationship stored in a database in the electronic seal system by using a digital identity certificate of the electronic seal system, wherein the binding relationship is a relationship generated based on a correspondence between an extranet seal key index and the intranet seal certificate and the second signature value, and the second signature value is a signature value obtained by signing and protecting the correspondence by using an intranet password machine in the electronic seal system.

[0087] The certificate determination unit is configured to determine, after the first signature value and the second signature value are both verified, whether the intranet seal certificate in the seal request is consistent with the intranet seal certificate in the binding relationship.

[0088] The index obtaining unit is configured to, if the intranet seal certificate is consistent with the intranet seal certificate, obtain the extranet seal key index corresponding to the intranet seal certificate, and send the extranet seal key index to an extranet password machine in the electronic seal system, so that the extranet password machine signs the data digest to be signed in the seal request by using an extranet seal key corresponding to the extranet seal key index to obtain an original signature value.

[0089] In some embodiments, the second seal data generation module 13 can specifically include:

[0090] The signature result obtaining unit is configured to obtain a signature result returned by the server, which is generated based on return data and a third signature value obtained by signing and protecting the return data by using the intranet password machine, wherein the return data is data obtained based on an original signature value obtained by signing the data digest to be signed in the seal request by using the extranet seal key of the extranet password machine and the extranet seal certificate corresponding to the extranet password machine.

[0091] In some embodiments, the second seal data generation module 13 can specifically include:

[0092] The second signature verification unit is configured to verify the third signature value in the signature result by using the digital identity certificate.

[0093] The third signature verification unit is configured to, after the third signature value is verified, verify the original signature value by using the extranet seal certificate in the signature result.

[0094] The seal data generation unit is configured to, after the original signature value is verified, generate corresponding seal data based on the original signature value and the extranet seal certificate.

[0095] In some embodiments, the electronic signature device further comprises:

[0096] An error information returning unit is configured to return corresponding signature error information to the layout software to prompt that an error occurs in the signature operation on the original text to be signed after the verification on the third signature value fails.

[0097] Further, the embodiment of the present application further discloses an electronic device, Figure 10 is an electronic device 20 structure diagram shown according to an exemplary embodiment, the contents in the figure cannot be considered as any limitation on the use range of the present application.

[0098] Figure 10 An electronic device 20 structure diagram is provided for the embodiment of the present application. The electronic device 20 can specifically include at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25 and a communication bus 26. Wherein, the memory 22 is used for storing a computer program, the computer program is loaded and executed by the processor 21, to realize the related steps in the electronic signature method disclosed in any of the preceding embodiments. In addition, the electronic device 20 in the embodiment can be an electronic computer.

[0099] In the embodiment, the power supply 23 is used for providing working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device, and the communication protocol followed by the communication interface 24 can be any communication protocol applicable to the technical solution of the present application, which is not limited here; the input / output interface 25 is used for obtaining external input data or outputting data to the outside, and the specific interface type can be selected according to the specific application needs, which is not limited here.

[0100] In addition, the memory 22 as a resource storage carrier can be a read-only memory, a random access memory, a magnetic disk or an optical disk, etc., and the resources stored thereon can include an operating system 221, a computer program 222, etc., and the storage mode can be temporary storage or permanent storage.

[0101] Wherein, the operating system 221 is used for managing and controlling each hardware device on the electronic device 20 and the computer program 222, and can be Windows Server, Netware, Unix, Linux, etc. In addition to the computer program capable of completing the electronic signature method executed by the electronic device 20 disclosed in any of the preceding embodiments, the computer program 222 can further include a computer program capable of completing other specific work.

[0102] Furthermore, this application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned disclosed electronic signature method. Specific steps of this method can be found in the corresponding content disclosed in the foregoing embodiments, and will not be repeated here.

[0103] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0104] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0105] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0106] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0107] The technical solutions provided by the present application are described in detail above, and the principles and implementation manners of the present application are described by using specific examples. The above description of the examples is only used to help understand the method of the present application and its core idea; meanwhile, for those skilled in the art, according to the idea of the present application, the specific implementation manners and application ranges will be changed, and the above description of the content of the specification should not be understood as a limitation on the present application.

Claims

1. An electronic signature method, characterized by, A client applied to an electronic seal system, comprising: obtaining a to-be-sealed original text and corresponding document attributes from a layout software, judging whether security level information exists in the document attributes, if yes, judging whether the security level information is a preset high security level; if the preset high security level, calling an intranet seal UKey in the electronic seal system to seal the to-be-sealed original text to generate corresponding seal data; if not the preset high security level, sending a generated seal request to a server in the electronic seal system, obtaining a signature result returned by the server based on an original text signature value generated by sealing a to-be-signed data digest in the seal request using an extranet seal key, then verifying the signature result and generating corresponding seal data based on the original text signature value after successful verification; the to-be-signed data digest is an extracted digest of the to-be-sealed original text and an electronic seal; the electronic seal is a seal that simultaneously binds an intranet seal certificate and an extranet seal certificate; returning the generated seal data to the layout software so that the layout software completes the sealing operation on the to-be-sealed original text based on the seal data.

2. The electronic signing method of claim 1, wherein, After judging whether security level information exists in the document attributes, it further comprises: if not, return prompt information for prompting to supplement security level information corresponding to the to-be-sealed original text to the layout software, so that the layout software sends the supplemented security level information to the client.

3. The electronic signing method of claim 1 or 2, wherein, Before sending the generated seal request to the server in the electronic seal system, it further comprises: extracting the to-be-sealed original text using a hash algorithm to obtain a to-be-sealed original text digest; generating seal information based on the to-be-sealed original text digest and the electronic seal, and extracting the seal information using the hash algorithm to obtain a to-be-signed data digest; generating request data based on the to-be-signed data digest and the intranet seal certificate corresponding to the intranet seal UKey, and sealing the request data using the intranet seal UKey to obtain a first signature value; generating a seal request based on the request data and the first signature value.

4. The electronic signing method of claim 3, wherein, Before obtaining the signature result returned by the server based on the original text signature value generated by sealing the to-be-signed data digest in the seal request using the extranet seal key, it further comprises: the server verifies the first signature value using the intranet seal certificate in the seal request, and verifies a second signature value in a binding relationship stored in a database in the electronic seal system using a digital identity certificate of the electronic seal system; the binding relationship is a relationship generated based on a correspondence relationship between an extranet seal key index and an intranet seal certificate and the second signature value, and the second signature value is a signature value obtained by sealing the correspondence relationship using an intranet password machine in the electronic seal system; After the first signature value and the second signature value are verified, the server determines whether the intranet seal certificate in the seal request is consistent with the intranet seal certificate in the binding relationship; If consistent, the server acquires the extranet seal key index corresponding to the intranet seal certificate, and sends the extranet seal key index to the extranet password machine in the electronic seal system, so that the extranet password machine signs the data digest to be signed in the seal request by using the extranet seal key corresponding to the extranet seal key index, to obtain the original signature value.

5. The electronic signing method of claim 4, wherein, The signature result generated based on the original signature value obtained by signing the data digest to be signed in the seal request by using the extranet seal key returned by the server, includes: The signature result generated based on the return data and the third signature value obtained by signing the return data by using the intranet password machine returned by the server; the return data is data obtained based on the original signature value obtained by signing the data digest to be signed in the seal request by using the extranet seal key of the extranet password machine and the extranet seal certificate corresponding to the extranet password machine.

6. The electronic signing method of claim 5, wherein, The signature result is verified, and after the verification is successful, corresponding seal data is generated based on the original signature value, including: The third signature value in the signature result is verified by using the digital identity certificate; After the third signature value is verified, the original signature value is verified by using the extranet seal certificate in the signature result; After the original signature value is verified successfully, corresponding seal data is generated based on the original signature value and the extranet seal certificate.

7. The electronic signing method of claim 6, wherein, After the third signature value in the signature result is verified by using the digital identity certificate, it further includes: After the third signature value is verified, corresponding seal error information is returned to the format software to prompt that the seal operation of the original text to be sealed is wrong.

8. An electronic signature device, characterized by The client applied to the electronic seal system includes: A security level judgment module is configured to acquire the original text to be sealed and corresponding document attributes from the format software, determine whether the security level information exists in the document attributes, and determine whether the security level information is a preset high security level if the security level information exists in the document attributes; A first seal data generation module is configured to call the intranet seal UKey in the electronic seal system to seal the original text to be sealed if the security level information is the preset high security level, to generate corresponding seal data. The second signature data generation module is configured to, if the preset high security level is not met, send the generated signature request to a server in the electronic signature system, obtain a signature result returned by the server, which is generated based on a signature value of the signature request, the signature value being obtained by signing a data digest in the signature request using an external network seal key, verify the signature result, and generate corresponding signature data based on the signature value after the verification is successful; the data digest is obtained by extracting the original text and an electronic seal; the electronic seal is a seal that is simultaneously bound to an internal network seal certificate and an external network seal certificate; The signature completion module is configured to return the generated signature data to the layout software, so that the layout software completes a signature operation on the original text to be signed based on the signature data.

9. An electronic device, comprising: The computer program is stored in the memory and executed by the processor to implement the electronic signature method according to any one of claims 1 to 7. The computer program is stored in the memory and executed by the processor to implement the electronic signature method according to any one of claims 1 to 7. ​ 10. A computer-readable storage medium, characterized in that, ​

Images