A method for generating and verifying an electronic signature

Abstract

The present disclosure relates to the field of computer processing technology, and provides a method for generating and verifying an electronic signature, which comprises the following steps: obtaining an initial file; performing an anti-counterfeiting operation based on the initial file to obtain first signature information; embedding the first signature information into the initial file to obtain a first intermediate file; performing a signing operation on the first intermediate file based on a digital certificate to obtain a first signature value; embedding the first signature value into the first intermediate file as second signature information to obtain a second intermediate file; performing a signing operation on the second intermediate file based on trusted timestamp information to obtain a second signature value; and embedding the second signature value into the second intermediate file as third signature information to obtain a target file. This embodiment can effectively ensure the legality and anti-counterfeiting capability of the file signature through a multi-level security mechanism, and prevent the file from being forged, tampered with, copied or illegally used.

Description

Technical Field

[0001] The present disclosure relates to the field of computer processing technology, and in particular to a method for generating and verifying an electronic signature. Background Art

[0002] With the rapid development of e-commerce, e-government and other network applications, electronic signatures have been widely used as a digital identity authentication technology.

[0003] Traditional electronic signature systems usually use digital certificates and encryption algorithms to verify the legitimacy of signatures and ensure that documents have not been tampered with. However, existing electronic signature systems have some loopholes, such as: signature certificates are easily stolen, signature content can be forged or tampered with, resulting in threats to the security and reliability of signatures. Therefore, there is an urgent need for a new anti-counterfeiting electronic signature system that can effectively resist various security threats and ensure the legitimacy and anti-counterfeiting capabilities of signatures. Summary of the invention

[0004] The present disclosure provides a method for generating and verifying an electronic signature to at least solve the above technical problems existing in the prior art.

[0005] According to a first aspect of the present disclosure, a method for generating and verifying an electronic signature is provided, which is applied to an electronic signature server, and the method includes:

[0006] Obtaining an initial file, wherein the initial file is a file with a signature requirement;

[0007] Perform an anti-counterfeiting operation based on the initial file to obtain first signature information; embed the first signature information into the initial file to obtain a first intermediate file;

[0008] Performing a signing operation on the first intermediate file based on the digital certificate to obtain a first signature value; embedding the first signature value as second signature information into the first intermediate file to obtain a second intermediate file, wherein the second intermediate file is an initial file having the first signature information and the second signature information;

[0009] The second intermediate file is signed based on the trusted timestamp information to obtain a second signature value; the second signature value is embedded in the second intermediate file as the third signature information to obtain a target file, wherein the target file is an initial file having the first signature information, the second signature information and the third signature information.

[0010] In one possible implementation, the performing of the anti-counterfeiting operation based on the initial file to obtain the first signature information includes:

[0011] Performing a hash operation on the initial file to obtain a first hash value of the initial file;

[0012] generating an anti-counterfeiting image based on the first hash value of the initial file;

[0013] The anti-counterfeiting image is used as the first signature information.

[0014] In one possible implementation, the step of performing a signing operation on the first intermediate file based on the digital certificate to obtain a first signature value includes:

[0015] Performing a hash operation on the first intermediate file to obtain a second hash value;

[0016] Apply for a digital certificate from a digital certification center to perform a signing operation on the second hash value to generate a first signature value.

[0017] In one possible implementation manner, embedding the first signature value as the second signature information into the first intermediate file further includes:

[0018] Acquire auxiliary information of the initial document, wherein the auxiliary information includes information of the signatory, signing time and / or signing location;

[0019] The first signature value and the auxiliary information are embedded in the first intermediate file as second signature information to generate a second intermediate file.

[0020] In one possible implementation, the step of performing a signing operation on the second intermediate file based on the trusted timestamp information to obtain a second signature value includes:

[0021] Performing a hash operation on the second intermediate file to obtain a third hash value;

[0022] Obtain trusted timestamp information from a trusted identity timestamp authentication center to perform a signing operation on the third hash value to generate a second signature value.

[0023] According to a second aspect of the present disclosure, a method for generating and verifying an electronic signature is provided, which is applied to an electronic signature verification terminal, and the method includes:

[0024] Acquire the first signature information to be verified in the target file to be verified, and perform the first signature verification operation, wherein the target file to be verified is an initial file having the first signature information to be verified, the second signature information to be verified, and the third signature information to be verified, and the first signature information to be verified is signature information generated based on the anti-counterfeiting operation;

[0025] Acquire the second signature information to be verified in the target file to be verified, and perform a second signature verification operation, wherein the second signature information to be verified includes the first signature value to be verified, and the first signature value to be verified is signature information obtained based on the digital certificate signature;

[0026] Acquire the third signature information to be verified in the target file to be verified, and perform a third verification operation, wherein the third signature information to be verified includes the second signature value to be verified, and the second signature value to be verified is signature information obtained by signing based on the trusted timestamp information;

[0027] When the first seal verification operation, the second seal verification operation and the third seal verification operation are verified successfully, it is determined that the signature of the target file to be verified is credible.

[0028] In one possible implementation manner, the step of obtaining the first signature information to be verified in the target file to be verified and performing the first signature verification operation includes:

[0029] Scanning the anti-counterfeiting image to be verified in the target document to be verified;

[0030] Extracting a first hash value to be verified based on the anti-counterfeiting image to be verified;

[0031] The first hash value obtained based on the initial file is compared with the first hash value to be verified to determine whether the first seal verification operation is successful.

[0032] In one possible implementation manner, the second signature information to be verified includes the first signature value to be verified, and the step of obtaining the second signature information to be verified in the target file to be verified and performing the second signature verification operation includes:

[0033] Extracting a first signature value to be verified of the target file to be verified;

[0034] Decrypting the first signature value to be verified based on the public key provided by the digital certification center to obtain a second hash value to be verified;

[0035] The second hash value obtained based on the initial file is compared with the second hash value to be verified to determine whether the second seal verification operation is successful.

[0036] In one possible implementation manner, the second signature information to be verified also includes auxiliary information to be verified, and the step of obtaining the second signature information to be verified in the target file to be verified and performing a second signature verification operation further includes:

[0037] Extracting auxiliary information to be verified of the target file to be verified;

[0038] Comparing the auxiliary information to be verified with the auxiliary information of the initial file;

[0039] When the second hash value is successfully compared with the second hash value to be verified, and the auxiliary information to be verified is successfully compared with the auxiliary information, it is determined that the second seal verification operation is successful, wherein the auxiliary information includes the signer information of the initial document, the signing time and / or the signing location.

[0040] In one possible implementation manner, the obtaining the third signature information to be verified in the target file to be verified and performing the third signature verification operation includes:

[0041] Extracting a second signature value to be verified of the target file to be verified;

[0042] According to the second signature value to be verified, obtaining a third hash value to be verified of the target file to be verified;

[0043] The third hash value obtained based on the initial file is compared with the third hash value to be verified to determine whether the third seal verification operation is successful.

[0044] According to a third aspect of the present disclosure, there is provided an electronic signature generation and verification device, which is applied to an electronic signature service end, and the device includes:

[0045] An acquisition module, used to acquire an initial file, wherein the initial file is a file with a signature requirement;

[0046] A first generating module, configured to perform an anti-counterfeiting operation based on the initial file to obtain first signature information; and embed the first signature information into the initial file to obtain a first intermediate file;

[0047] A second generating module is used to perform a signing operation on the first intermediate file based on the digital certificate to obtain a first signature value; embed the first signature value as the second signature information into the first intermediate file to obtain a second intermediate file, wherein the second intermediate file is an initial file having the first signature information and the second signature information;

[0048] The signature completion module is used to sign the second intermediate file based on the trusted timestamp information to obtain a second signature value; embed the second signature value as the third signature information into the second intermediate file to obtain a target file, wherein the target file is an initial file having the first signature information, the second signature information and the third signature information.

[0049] In one possible implementation, the first generating module is specifically used to: perform a hash operation on the initial file to obtain a first hash value of the initial file; generate an anti-counterfeiting image based on the first hash value of the initial file; and use the anti-counterfeiting image as the first signature information.

[0050] In one possible implementation manner, the second generating module is specifically used to: perform a hash operation on the first intermediate file to obtain a second hash value; and apply for a digital certificate from a digital certification center to perform a signing operation on the second hash value to generate a first signature value.

[0051] In one possible implementation mode, the second generation module is further specifically used to: obtain auxiliary information of the initial file, wherein the auxiliary information includes information of the signer, signing time and / or signing location; embed the first signature value and the auxiliary information as second signature information into the first intermediate file to generate a second intermediate file.

[0052] In one possible implementation, the signature completion module is further specifically used to: perform a hash operation on the second intermediate file to obtain a third hash value; obtain trusted timestamp information from a trusted identity timestamp authentication center to sign the third hash value to generate a second signature value.

[0053] According to a fourth aspect of the present disclosure, there is provided an electronic signature generation and verification device, which is applied to an electronic signature verification terminal, and the device includes:

[0054] A first seal verification module is used to obtain first signature information to be verified in a target file to be verified and perform a first seal verification operation, wherein the target file to be verified is an initial file having first signature information to be verified, second signature information to be verified and third signature information to be verified, and the first signature information to be verified is signature information generated based on an anti-counterfeiting operation;

[0055] A second seal verification module is used to obtain second signature information to be verified in the target file to be verified and perform a second seal verification operation, wherein the second signature information to be verified includes a first signature value to be verified, and the first signature value to be verified is signature information obtained based on a digital certificate signature;

[0056] A third seal verification module is used to obtain the third signature information to be verified in the target file to be verified and perform a third seal verification operation, wherein the third signature information to be verified includes the second signature value to be verified, and the second signature value to be verified is the signature information obtained by signing based on the trusted timestamp information;

[0057] The determination module is used to determine that the signature of the target file to be verified is credible when the first seal verification operation, the second seal verification operation and the third seal verification operation are verified successfully.

[0058] In one possible implementation manner, the first seal verification module is specifically used to: scan the anti-counterfeiting image to be verified in the target file to be verified; extract a first hash value to be verified based on the anti-counterfeiting image to be verified; and compare the first hash value obtained based on the initial file with the first hash value to be verified to determine whether the first seal verification operation is successful.

[0059] In one possible implementation manner, the second seal verification module is specifically used to: the second seal information to be verified includes a first signature value to be verified, extract the first signature value to be verified of the target file to be verified; based on the public key provided by the digital certification center, decrypt the first signature value to be verified to obtain a second hash value to be verified; compare the second hash value obtained based on the initial file with the second hash value to be verified to determine whether the second seal verification operation is successful.

[0060] In one possible implementation mode, the second seal verification module is further specifically used for: the second signature information to be verified also includes auxiliary information to be verified, extracting the auxiliary information to be verified of the target file to be verified; comparing the auxiliary information to be verified with the auxiliary information of the initial file; and determining that the second seal verification operation is successful when the second hash value is successfully compared with the second hash value to be verified and the auxiliary information to be verified is successfully compared with the auxiliary information, wherein the auxiliary information includes the signer information, signing time and / or signing location of the initial file.

[0061] In one possible implementation, the third seal verification module is specifically used to: extract the second signature value to be verified of the target file to be verified; obtain the third hash value to be verified of the target file to be verified based on the second signature value to be verified; compare the third hash value obtained based on the initial file with the third hash value to be verified to determine whether the third seal verification operation is successful.

[0062] According to a fifth aspect of the present disclosure, there is provided a system for generating and verifying an electronic signature, including the electronic signature server described in the present disclosure and a method executed by the electronic signature verification terminal described in the present disclosure.

[0063] According to a sixth aspect of the present disclosure, there is provided an electronic device, including:

[0064] at least one processor; and

[0065] a memory communicatively connected to the at least one processor; wherein,

[0066] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method described in the present disclosure.

[0067] According to a sixth aspect of the present disclosure, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to enable the computer to execute the method described in the present disclosure.

[0068] The electronic signature method, apparatus, device, storage medium and system provided by the present invention obtain an initial file; perform an anti-counterfeiting operation based on the initial file to obtain first signature information; embed the first signature information into the initial file to obtain a first intermediate file; perform a signing operation on the first intermediate file based on a digital certificate to obtain a first signature value; embed the first signature value as second signature information into the first intermediate file to obtain a second intermediate file; perform a signing operation on the second intermediate file based on trusted timestamp information to obtain a second signature value; embed the second signature value as third signature information into the second intermediate file to obtain a target file. This embodiment can effectively ensure the legitimacy and anti-counterfeiting ability of file signatures through a multi-level security mechanism to prevent files from being forged, tampered with, copied or illegally used.

[0069] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present disclosure, nor is it intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0070] The above and other objects, features and advantages of the exemplary embodiments of the present disclosure will become readily understood by reading the detailed description below with reference to the accompanying drawings. In the accompanying drawings, several embodiments of the present disclosure are shown in an exemplary and non-limiting manner, in which:

[0071] In the drawings, the same or corresponding reference numerals represent the same or corresponding parts.

[0072] Figure 1 A schematic diagram of an implementation flow of a method for generating an electronic signature provided by an embodiment of the present disclosure is shown;

[0073] Figure 2 A schematic diagram of an implementation flow of an electronic signature verification method provided by an embodiment of the present disclosure is shown;

[0074] Figure 3 A schematic diagram of the structure of an electronic signature generation device provided by an embodiment of the present disclosure is shown;

[0075] Figure 4 A schematic diagram of the structure of an electronic signature verification device provided by an embodiment of the present disclosure is shown;

[0076] Figure 5 A schematic diagram of the structure of an electronic signature system provided by an embodiment of the present disclosure is shown;

[0077] Figure 6 A schematic diagram of the structure of an electronic device provided by an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0078] In order to make the purpose, features, and advantages of the present disclosure more obvious and easy to understand, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present disclosure.

[0079] Figure 1 This is a flow chart of a method for generating an electronic signature provided in an embodiment of the present disclosure. The method can be executed by the electronic signature generation and verification device provided in an embodiment of the present disclosure. The device can be implemented in software and / or hardware and applied to an electronic signature server. The method specifically includes:

[0080] S110: Obtain an initial file.

[0081] The initial file is a file that requires a signature.

[0082] The server in this embodiment may be a server that pre-stores a plurality of electronic signatures authorized by an authorized institution.

[0083] Specifically, this embodiment can upload the initial file to the electronic signature server on any client and / or web page that interacts with the electronic signature server; it can also transmit the initial file to the electronic signature server by wired and / or wireless means via various electronic devices with transmission functions.

[0084] S120: Perform an anti-counterfeiting operation based on the initial file to obtain first signature information; embed the first signature information into the initial file to obtain a first intermediate file.

[0085] The first intermediate file may be an initial file embedded with the first signature information, the first signature information may be an anti-counterfeiting image, and the anti-counterfeiting image may be an image that prevents the initial file from being tampered with or forged. In this embodiment, the relevant data of the anti-counterfeiting image is inserted into any position in the initial file or a specific position set according to the characteristics of the initial file, and saved as a new file, namely the first intermediate file, so that it is convenient for the viewer to open the first intermediate file and see the anti-counterfeiting image at the specific position.

[0086] In the disclosed embodiment, the anti-counterfeiting operation is performed based on the initial file to obtain the first signature information, including: performing a hash operation on the initial file to obtain a first hash value of the initial file; generating an anti-counterfeiting image based on the first hash value of the initial file; and using the anti-counterfeiting image as the first signature information.

[0087] Since the initial file has its own unique hash value, the present embodiment can generate an anti-counterfeiting image based on the unique information of the above file, that is, generate an anti-counterfeiting image through the hash value. Specifically, the present embodiment can perform a hash operation on the initial file by using any hash operation program in the prior art to generate a piece of data with a fixed length and representing the unique characteristics of the initial file, that is, the first hash value. Then, the present embodiment can encode the first hash value representing the unique characteristics of the initial file into the image to generate an anti-counterfeiting image.

[0088] Since the anti-counterfeiting image is non-replicable and unique, it can prevent the original document from being forged or copied. Therefore, the present embodiment uses the anti-counterfeiting image to implement the first layer of security protection mechanism for the original document.

[0089] S130. Perform a signing operation on the first intermediate file based on the digital certificate to obtain a first signature value; embed the first signature value as second signature information into the first intermediate file to obtain a second intermediate file.

[0090] The second intermediate file is an initial file having the first signature information and the second signature information. A digital certificate is an identification mechanism for computers. A signature made by a digital certificate authority (CA) on a signature request file created using a private key.

[0091] Specifically, in this embodiment, a digital certificate can be applied to a digital certificate center CA, and the digital certificate center will sign the first intermediate file through the private key provided by the digital certificate to obtain a string of ciphertext, that is, the first signature value. Finally, the first signature value is embedded in the first intermediate file as the second signature information to obtain the second intermediate file. In this way, the second intermediate file will be an initial file with both the anti-counterfeiting image and the digital certificate signature.

[0092] In the embodiment of the present disclosure, the signing operation on the first intermediate file based on the digital certificate to obtain the first signature value includes: performing a hash operation on the first intermediate file to obtain the second hash value; applying for a digital certificate from a digital certification center to sign the second hash value to generate the first signature value.

[0093] Since the first intermediate file has changed compared to the initial file, its hash value must be different from the first hash value. Therefore, this embodiment performs a hash operation on the first intermediate file by using any hash operation program in the prior art to generate a second hash value. Then, this embodiment can apply for a digital certificate from a digital certificate center CA, and the digital certificate center will encrypt the second hash value of the first intermediate file through the private key provided by the digital certificate to obtain a string of ciphertext, that is, the first signature value. This embodiment signs the first intermediate file through a digital certificate to perform a second layer of security protection mechanism on the initial file.

[0094] In the disclosed embodiment, the method of embedding the first signature value as the second signature information into the first intermediate file also includes: obtaining auxiliary information of the initial file, wherein the auxiliary information includes the signer information, the signing time and / or the signing location; embedding the first signature value and the auxiliary information as the second signature information into the first intermediate file to generate a second intermediate file. In this way, the second intermediate file is the initial file with the anti-counterfeiting image, the digital certificate signature and the auxiliary information embedded at the same time.

[0095] In addition, this embodiment can also obtain the signer information, signing time or signing location of the initial file, and insert at least one of the above information or all of the information together with the first signature value into the first intermediate file to generate a second intermediate file. Because the auxiliary information of each initial file is different, the auxiliary information of the initial file is signed together to improve the integrity of the signature.

[0096] S140. Perform a signing operation on the second intermediate file based on the trusted timestamp information to obtain a second signature value; embed the second signature value into the second intermediate file as third signature information to obtain a target file.

[0097] The target file is an initial file with the first signature information, the second signature information and the third signature information. Trusted timestamp information is issued by the Joint Trust Timestamp Service Center according to the international timestamp standard. It can prove that the data message (various electronic files and electronic data) is an existing, complete, verifiable and legally effective electronic certificate at a certain point in time. Its core service technology is to provide judicial factual information and objective evidence storage function by binding the hash value of the user's electronic data to the authoritative time source.

[0098] In the embodiment of the present disclosure, the signing operation on the second intermediate file based on the trusted timestamp information to obtain the second signature value includes: performing a hash operation on the second intermediate file to obtain the third hash value; obtaining trusted timestamp information from a trusted identity timestamp authentication center to sign the third hash value to generate a second signature value.

[0099] Since the second intermediate file has also changed compared to the first intermediate file, its hash value must also be different from the second hash value. Therefore, this embodiment further performs a hash operation on the second intermediate file using any hash operation program in the prior art to generate a third hash value. Then, this embodiment can obtain trusted timestamp information from a trusted identity timestamp authentication center, perform a signature operation on the third hash value based on the trusted timestamp information, generate a second signature value, and then insert the second signature value into the second intermediate file to generate a target file.

[0100] It should be noted that the first signature information, the second signature information and the third signature information are embedded in different locations in the initial file in this embodiment. In addition, this embodiment will sign the second intermediate file based on the trusted timestamp information, and can implement a third-layer security protection mechanism for the initial file.

[0101] This embodiment is based on a trusted timestamp service, and generates a trusted timestamp for each signature to ensure that the time of the signature operation is accurate and cannot be tampered with. The timestamp is not only used to confirm the time when the signature is generated, but also to prevent the signature from being tampered with after it is generated. The verifier can verify the time stamp to confirm when and where the signature was generated.

[0102] Figure 2 This is a flow chart of an electronic signature verification method provided by an embodiment of the present disclosure. The method can be executed by an electronic signature device provided by an embodiment of the present disclosure. The device can be implemented in software and / or hardware and applied to an electronic signature verification terminal. The method specifically includes:

[0103] S210: Obtain the first signature information to be verified in the target file to be verified, and perform a first signature verification operation.

[0104] The target file to be verified is an initial file having first signature information to be verified, second signature information to be verified and third signature information to be verified. The first signature information to be verified may be an anti-counterfeiting image to be verified; the second signature information to be verified may be a first signature value to be verified and / or auxiliary information to be verified; and the third signature information to be verified may be a second signature value to be verified.

[0105] In the disclosed embodiment, obtaining the first signature information to be verified in the target file to be verified and performing the first seal verification operation include: scanning the anti-counterfeiting image to be verified in the target file to be verified; extracting the first hash value to be verified based on the anti-counterfeiting image to be verified; and comparing the first hash value obtained based on the initial file with the first hash value to be verified to determine whether the first seal verification operation is successful.

[0106] Among them, the first hash value to be verified can be a hash value extracted based on the anti-counterfeiting image to be verified. Since the target file to be verified in this embodiment is an initial file containing a triple verification signature mechanism, including the initial initial file, this embodiment can calculate the first hash value of the initial file based on the generation method of the first hash value provided in the above embodiment. Then, this embodiment compares the first hash value with the first hash value to be verified. If they match, it is determined that the first verification operation is successful; if they do not match, it is determined that the first verification operation has failed, and it is determined that the anti-counterfeiting image to be verified is forged.

[0107] S220: Obtain the second signature information to be verified in the target file to be verified, and perform a second signature verification operation.

[0108] The second signature information to be verified includes the first signature value to be verified.

[0109] In the disclosed embodiment, the second signature information to be verified includes the first signature value to be verified, and the second signature information to be verified in the target file to be verified is obtained to perform a second verification operation, including: extracting the first signature value to be verified of the target file to be verified; decrypting the first signature value to be verified based on the public key provided by the digital certification center to obtain a second hash value to be verified; and comparing the second hash value obtained based on the initial file with the second hash value to be verified to determine whether the second verification operation is successful.

[0110] When the initial file normally generates the second signature information, the applicant will apply for a digital certificate from the digital certificate center and provide a private key to sign the file to obtain the first signature value. The applicant will also be provided with a public key. Therefore, in this embodiment, when verifying the signature information to be verified, the first signature value to be verified can be decrypted by the public key to obtain the second hash value to be verified.

[0111] Similarly, this embodiment can calculate the second Hash value of the initial file based on the method for generating the second Hash value provided in the above embodiment. Then, this embodiment compares the second Hash value with the second hash value to be verified. If they match, it is determined that the second seal verification operation is successful; if they do not match, it is determined that the second seal verification operation fails.

[0112] This embodiment can prevent the electronic signature from being tampered with or forged by verifying the second signature information to be verified in the target file to be verified.

[0113] In the disclosed embodiment, the second signature information to be verified also includes auxiliary information to be verified, so the step of obtaining the second signature information to be verified in the target file to be verified and performing a second seal verification operation also includes: extracting the auxiliary information to be verified of the target file to be verified; comparing the auxiliary information to be verified with the auxiliary information of the initial file; and determining that the second seal verification operation is successful when the second hash value is successfully compared with the second hash value to be verified and the auxiliary information to be verified is successfully compared with the auxiliary information, wherein the auxiliary information includes the signer information, signing time and / or signing location of the initial file.

[0114] Specifically, the second signature information to be verified provided by this embodiment may include auxiliary information to be verified in addition to the first signature value to be verified. In this case, this embodiment also needs to verify the auxiliary information to be verified. Exemplarily, this embodiment can directly extract the auxiliary information of the initial file. By comparing the auxiliary information to be verified with the auxiliary information, it is determined whether the information has been tampered with. Moreover, this embodiment determines that the second seal verification operation is successful only when both the first signature value to be verified and the auxiliary information to be verified are successfully verified, which greatly improves the security of the electronic signature.

[0115] S230: Acquire third signature information to be verified in the target file to be verified, and perform a third signature verification operation, wherein the third signature information to be verified includes the second signature value to be verified.

[0116] The second signature value to be verified is a signature value generated based on the trusted timestamp.

[0117] In the disclosed embodiment, obtaining the third signature information to be verified in the target file to be verified and performing the third seal verification operation includes: extracting the second signature value to be verified of the target file to be verified; obtaining the third hash value to be verified of the target file to be verified based on the second signature value to be verified; and comparing the third hash value obtained based on the initial file with the third hash value to be verified to determine whether the third seal verification operation is successful.

[0118] Since when the initial file normally generates the third signature information, the applicant will obtain the trusted timestamp information from the trusted identity timestamp authentication center to sign the file and obtain the second signature value, this embodiment can decrypt the second signature value to be verified to obtain the third hash value to be verified.

[0119] Similarly, this embodiment can calculate the third hash value of the initial file based on the method for generating the third hash value provided in the above embodiment. Then, this embodiment compares the third hash value with the third hash value to be verified. If they match, it is determined that the third seal verification operation is successful; if they do not match, it is determined that the third seal verification operation fails. This embodiment can ensure that the signature is generated within a legal time through the third seal verification operation.

[0120] S240: When the first seal verification operation, the second seal verification operation, and the third seal verification operation are verified successfully, determine that the signature of the target file to be verified is credible.

[0121] It should be noted that, in this embodiment, the signature of the target file to be verified can be determined to be credible only when the first, second and third seal verification operations are all verified successfully. Otherwise, as long as one of the seal verification operations fails, it means that the signature of the target file to be verified is not credible.

[0122] The electronic signature method of this embodiment greatly improves the security and anti-counterfeiting ability of the electronic signature through a multi-level security protection mechanism. Anti-counterfeiting image embedding and timestamp verification can effectively prevent the signature from being forged or tampered with, while digital certificate encryption can ensure the confidentiality of the signature information.

[0123] Figure 3 : is a structural diagram of a device for generating an electronic signature provided by an embodiment of the present disclosure, which is applied to an electronic signature server, and the device specifically includes:

[0124] The acquisition module 310 is used to acquire an initial file, wherein the initial file is a file with a signature requirement;

[0125] The first generating module 320 is used to perform an anti-counterfeiting operation based on the initial file to obtain first signature information; embed the first signature information into the initial file to obtain a first intermediate file;

[0126] The second generating module 330 is used to perform a signing operation on the first intermediate file based on the digital certificate to obtain a first signature value; embed the first signature value as the second signature information into the first intermediate file to obtain a second intermediate file, wherein the second intermediate file is an initial file having the first signature information and the second signature information;

[0127] The signature completion module 340 is used to sign the second intermediate file based on the trusted timestamp information to obtain a second signature value; embed the second signature value as the third signature information into the second intermediate file to obtain a target file, wherein the target file is an initial file having the first signature information, the second signature information and the third signature information.

[0128] In one possible implementation, the first generation module 320 is specifically used to: perform a hash operation on the initial file to obtain a first hash value of the initial file; generate an anti-counterfeiting image based on the first hash value of the initial file; and use the anti-counterfeiting image as the first signature information.

[0129] In one possible implementation, the second generation module 330 is specifically used to: perform a hash operation on the first intermediate file to obtain the second hash value; and apply for a digital certificate from a digital certification center to sign the second hash value to generate a first signature value.

[0130] In one possible implementation mode, the second generation module 330 is further specifically used to: obtain auxiliary information of the initial file, wherein the auxiliary information includes information of the signer, signing time and / or signing location; embed the first signature value and the auxiliary information as second signature information into the first intermediate file to generate a second intermediate file.

[0131] In one possible implementation, the signature completion module 340 is further specifically used to: perform a hash operation on the second intermediate file to obtain the third hash value; obtain trusted timestamp information from a trusted identity timestamp authentication center to sign the third hash value to generate a second signature value.

[0132] Figure 4 : is a schematic diagram of the structure of an electronic signature verification device provided by an embodiment of the present disclosure, which is applied to an electronic signature verification terminal. The device specifically includes:

[0133] The first seal verification module 410 is used to obtain the first signature information to be verified in the target file to be verified and perform the first seal verification operation, wherein the target file to be verified is an initial file having the first signature information to be verified, the second signature information to be verified and the third signature information to be verified, and the first signature information to be verified is the signature information generated based on the anti-counterfeiting operation;

[0134] The second seal verification module 420 is used to obtain the second signature information to be verified in the target file to be verified, and perform a second seal verification operation, wherein the second signature information to be verified includes the first signature value to be verified, and the first signature value to be verified is the signature information obtained based on the digital certificate signature;

[0135] The third seal verification module 430 is used to obtain the third signature information to be verified in the target file to be verified and perform a third seal verification operation, wherein the third signature information to be verified includes the second signature value to be verified, and the second signature value to be verified is the signature information obtained by signing based on the trusted timestamp information;

[0136] The determination module 440 is configured to determine that the signature of the target file to be verified is credible when the first seal verification operation, the second seal verification operation and the third seal verification operation are verified successfully.

[0137] In one possible implementation manner, the first seal verification module 410 is specifically used to: scan the anti-counterfeiting image to be verified in the target file to be verified; extract a first hash value to be verified based on the anti-counterfeiting image to be verified; and compare the first hash value obtained based on the initial file with the first hash value to be verified to determine whether the first seal verification operation is successful.

[0138] In one possible implementation mode, the second seal verification module 420 is specifically used to: the second seal information to be verified includes a first signature value to be verified, extract the first signature value to be verified of the target file to be verified; based on the public key provided by the digital certification center, decrypt the first signature value to be verified to obtain a second hash value to be verified; compare the second hash value obtained based on the initial file with the second hash value to be verified to determine whether the second seal verification operation is successful.

[0139] In one possible implementation mode, the second seal verification module 420 is further specifically used for: the second signature information to be verified also includes auxiliary information to be verified, extracting the auxiliary information to be verified of the target file to be verified; comparing the auxiliary information to be verified with the auxiliary information of the initial file; and determining that the second seal verification operation is successful when the second hash value is successfully compared with the second hash value to be verified and the auxiliary information to be verified is successfully compared with the auxiliary information, wherein the auxiliary information includes the signer information, signing time and / or signing location of the initial file.

[0140] In one possible implementation, the third seal verification module 430 is specifically used to: extract the second signature value to be verified of the target file to be verified; obtain the third hash value to be verified of the target file to be verified based on the second signature value to be verified; compare the third hash value obtained based on the initial file with the third hash value to be verified to determine whether the third seal verification operation is successful.

[0141] Figure 5 It is a structural diagram of an electronic signature system provided by an embodiment of the present disclosure. The system specifically includes: an electronic signature service end 510 and an electronic signature verification end 520, which can execute the electronic signature generation method and the electronic signature verification method provided by the above embodiments.

[0142] According to an embodiment of the present disclosure, the present disclosure also provides an electronic device and a readable storage medium.

[0143] Figure 6A schematic block diagram of an example electronic device 600 that can be used to implement an embodiment of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or required herein.

[0144] like Figure 6 As shown, the device 600 includes a computing unit 601, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 602 or a computer program loaded from a storage unit 608 into a random access memory (RAM) 603. In the RAM 603, various programs and data required for the operation of the device 600 can also be stored. The computing unit 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0145] A number of components in the device 600 are connected to the I / O interface 605, including: an input unit 606, such as a keyboard, a mouse, etc.; an output unit 607, such as various types of displays, speakers, etc.; a storage unit 608, such as a disk, an optical disk, etc.; and a communication unit 609, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 609 allows the device 600 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0146] The computing unit 601 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 601 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 601 performs the various methods and processes described above, such as the generation and anti-counterfeiting method of the electronic signature. For example, in some embodiments, the generation and anti-counterfeiting method of the electronic signature may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit 608. In some embodiments, part or all of the computer program may be loaded and / or installed on the device 600 via the ROM 602 and / or the communication unit 609. When the computer program is loaded into the RAM 603 and executed by the computing unit 601, one or more steps of the generation and anti-counterfeiting method of the electronic signature described above may be performed. Alternatively, in other embodiments, the computing unit 601 may be configured to execute the sound effect correction method in any other appropriate manner (for example, by means of firmware).

[0147] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0148] The program code for implementing the method of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0149] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0150] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0151] The systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0152] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship of client and server is generated by computer programs running on respective computers and having a client-server relationship with each other. The server may be a cloud server, a server of a distributed system, or a server combined with a blockchain.

[0153] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this disclosure can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved, and this document does not limit this.

[0154] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of the features. In the description of the present disclosure, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0155] The above is only a specific embodiment of the present disclosure, but the protection scope of the present disclosure is not limited thereto. Any person skilled in the art who is familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present disclosure, which should be included in the protection scope of the present disclosure. Therefore, the protection scope of the present disclosure should be based on the protection scope of the claims.

Claims

1. A method for generating and verifying an electronic signature, applied to an electronic signature server, characterized in that: The method comprises: Obtaining an initial file, wherein the initial file is a file with a signature requirement; Perform an anti-counterfeiting operation based on the initial file to obtain first signature information; embed the first signature information into the initial file to obtain a first intermediate file; Performing a signing operation on the first intermediate file based on the digital certificate to obtain a first signature value; embedding the first signature value as second signature information into the first intermediate file to obtain a second intermediate file, wherein the second intermediate file is an initial file having the first signature information and the second signature information; Performing a signing operation on the second intermediate file based on the trusted timestamp information to obtain a second signature value; embedding the second signature value into the second intermediate file as the third signature information to obtain a target file, wherein the target file is an initial file having the first signature information, the second signature information, and the third signature information; The anti-counterfeiting operation is performed based on the initial file to obtain the first signature information, including: Performing a hash operation on the initial file to obtain a first hash value of the initial file; generating an anti-counterfeiting image based on the first hash value of the initial file; The anti-counterfeiting image is used as the first signature information.

2. The method according to claim 1, characterized in that The step of performing a signing operation on the first intermediate file based on the digital certificate to obtain a first signature value includes: Performing a hash operation on the first intermediate file to obtain a second hash value; Apply for a digital certificate from a digital certification center to perform a signing operation on the second hash value to generate a first signature value.

3. The method according to claim 2, characterized in that The step of embedding the first signature value into the first intermediate file as the second signature information further includes: Acquire auxiliary information of the initial document, wherein the auxiliary information includes information of the signatory, signing time and / or signing location; The first signature value and the auxiliary information are embedded in the first intermediate file as second signature information to generate a second intermediate file.

4. The method according to claim 3, characterized in that The step of performing a signing operation on the second intermediate file based on the trusted timestamp information to obtain a second signature value includes: Performing a hash operation on the second intermediate file to obtain a third hash value; Obtain trusted timestamp information from a trusted identity timestamp authentication center to perform a signing operation on the third hash value to generate a second signature value.

5. A method for generating and verifying an electronic signature, applied to an electronic signature verification terminal, wherein the electronic signature is generated based on any one of the methods in claims 1-4, characterized in that: The method comprises: Acquire the first signature information to be verified in the target file to be verified, and perform the first signature verification operation, wherein the target file to be verified is an initial file having the first signature information to be verified, the second signature information to be verified, and the third signature information to be verified, and the first signature information to be verified is signature information generated based on the anti-counterfeiting operation; Acquire the second signature information to be verified in the target file to be verified, and perform a second signature verification operation, wherein the second signature information to be verified includes the first signature value to be verified, and the first signature value to be verified is signature information obtained based on the digital certificate signature; Acquire the third signature information to be verified in the target file to be verified, and perform a third verification operation, wherein the third signature information to be verified includes the second signature value to be verified, and the second signature value to be verified is signature information obtained by signing based on the trusted timestamp information; When the first seal verification operation, the second seal verification operation and the third seal verification operation are verified successfully, it is determined that the signature of the target file to be verified is credible; The step of obtaining the first signature information to be verified in the target file to be verified and performing the first signature verification operation includes: Scanning the anti-counterfeiting image to be verified in the target document to be verified; Extracting a first hash value to be verified based on the anti-counterfeiting image to be verified; The first hash value obtained based on the initial file is compared with the first hash value to be verified to determine whether the first seal verification operation is successful.

6. The method according to claim 5, wherein: If the second signature information to be verified includes the first signature value to be verified, then obtaining the second signature information to be verified in the target file to be verified and performing a second signature verification operation includes: Extracting a first signature value to be verified of the target file to be verified; Decrypting the first signature value to be verified based on the public key provided by the digital certification center to obtain a second hash value to be verified; The second hash value obtained based on the initial file is compared with the second hash value to be verified to determine whether the second seal verification operation is successful.

7. The method according to claim 6, wherein: The second signature information to be verified also includes auxiliary information to be verified, and the obtaining of the second signature information to be verified in the target file to be verified and performing a second signature verification operation also includes: Extracting auxiliary information to be verified of the target file to be verified; Comparing the auxiliary information to be verified with the auxiliary information of the initial file; When the second hash value is successfully compared with the second hash value to be verified, and the auxiliary information to be verified is successfully compared with the auxiliary information, it is determined that the second seal verification operation is successful, wherein the auxiliary information includes the signer information of the initial document, the signing time and / or the signing location.

8. The method according to claim 7, characterized in that The obtaining of the third signature information to be verified in the target file to be verified and performing the third signature verification operation includes: Extracting a second signature value to be verified of the target file to be verified; According to the second signature value to be verified, obtaining a third hash value to be verified of the target file to be verified; The third hash value obtained based on the initial file is compared with the third hash value to be verified to determine whether the third seal verification operation is successful.

Images