Collaborative signature method and device, storage medium and electronic equipment

Abstract

The invention provides a collaborative signature method and device, a storage medium and electronic equipment, and the method comprises the steps: creating collaborative signature key fragments for a user, including a business user side collaborative signature key fragment and a collaborative signature server side collaborative signature key fragment; encrypting the collaborative signature key fragment, storing the encrypted collaborative key fragment of the business user side in the business server side, and receiving the encrypted collaborative signature key fragment of the business user side fed back by the business server side after the login user passes the login authentication; calling a second signature module coupled to the service user side to derive a collaborative signature key fragment of the encryption key pair to decrypt the collaborative signature key fragment; and participating in the collaborative signature through the decrypted collaborative key fragment. When data loss occurs at the business user side, data recovery is carried out from the business server side without creating a new key fragment, so that the generation amount of junk data is reduced, and the working efficiency of the system is ensured.

Description

Technical Field

[0001] The present application relates to the field of data encryption technology, and in particular to a collaborative signature method, device, storage medium and electronic device. Background Art

[0002] Collaborative signature technology refers to the process of generating and saving respective signature key fragments on the client and server, using respective key fragments to participate in the calculation of signature value when signing, and finally generating signature results on the client. This technical solution has broad application prospects in application fields such as electronic contracts. In the process of using collaborative signature technology, no complete private key will appear in the calculation process of collaborative signature key generation, collaborative signature and collaborative decryption at any end, thereby effectively ensuring the security of key fragmentation and cryptographic operations. However, this technical solution faces an important usage problem in the application process, namely the volatility problem, which mainly refers to the client key fragmentation and its corresponding digital certificate are easily lost due to the uninstallation and reinstallation of the client app, device replacement, and system update. There are two main traditional solutions. One is to re-apply for the collaborative signature key and digital certificate for the client, which will cause the signature server to continuously accumulate the legacy old key fragmentation data and discard it as garbage data, occupying system resources; the other is to use external devices such as USBKey to store the client private key and digital certificate, but this method is cumbersome. Therefore, how to provide a collaborative signature method that does not require external equipment, generates less garbage during the signing process, and has a high signature accuracy rate has become a technical problem that urgently needs to be solved in the industry. Summary of the invention

[0003] In view of this, the present invention provides a method, device, storage medium and

[0004] [HZTC-HXJMJJ241010][HS2411175CCN] electronic device to at least or partially solve the above problems.

[0005] In a first aspect, an embodiment of the present application provides a collaborative signing method, including:

[0006] Based on the user's account information, a first signature module coupled to the business server is cooperatively coupled to create a collaborative signature key shard for the user, wherein the collaborative signature key shard includes a business user-side collaborative signature key shard and a signature server-side collaborative signature key shard;

[0007] Encrypting the collaborative signature key shard, and storing the encrypted business user-side collaborative signature key shard on the business service side;

[0008] When the business user terminal performs electronic signature, the login user of the business user terminal is authenticated;

[0009] After the login authentication is passed, the encrypted business user-side collaborative signature key fragment corresponding to the logged-in user is received from the business service end;

[0010] The second signature module coupled to the business user end is called to decrypt the encrypted collaborative signature key shard, so that the business user end obtains the decrypted business user collaborative signature key shard, and jointly calculates the collaborative signature with the signature server collaborative signature key shard created by the signature server.

[0011] Optionally, in an embodiment of the present application, encrypting the collaborative signature key shard includes: deriving a symmetric encryption key based on the user's account information; encrypting the collaborative signature key shard using the symmetric encryption key;

[0012] Correspondingly, the calling of the second signature module coupled to the business user end to decrypt the encrypted collaborative signature key shard includes: deriving a symmetric encryption key corresponding to the user according to the account information of the logged-in user; using the second signature module coupled to the business user end, using the derived symmetric encryption key, decrypting the encrypted business user-end collaborative signature key shard on the business user end, and decrypting the encrypted server-end collaborative signature key shard on the signature server end.

[0013] Optionally, in one embodiment of the present application, before receiving the encrypted business user-side collaborative signature key shard corresponding to the logged-in user fed back by the business service end, the method also includes: detecting whether the collaborative signature key shard data has been configured for the user based on the user's login information.

[0014] Optionally, in one embodiment of the present application, when creating a collaborative signature key for the user,

[0015] [HZTC-HXJMJJ241010][HS2411175CCN]After the key is fragmented, the method further includes:

[0016] generating a digital certificate for the user;

[0017] The digital certificate is stored in the service server.

[0018] Correspondingly, the encrypted business user-side collaborative signature key shard corresponding to the logged-in user fed back by the business service end is received, including: returning the digital certificate stored in the business service end to the business user end; determining the encrypted business user-side collaborative signature key shard corresponding to the logged-in user based on the digital certificate received by the business user end, and receiving the encrypted business user-side collaborative signature key shard.

[0019] Optionally, in an embodiment of the present application, the performing login authentication on the login user of the service user terminal includes: performing login authentication on the login user of the service user terminal according to a digital certificate for the user.

[0020] Optionally, in an embodiment of the present application, generating a digital certificate for the user includes:

[0021] Calculate the signature value in the certificate request data by using the collaborative signature key fragment of the service user and the collaborative signature key fragment of the signature service;

[0022] Generate a certificate request according to the signature value;

[0023] According to the certificate request, in combination with the CA service, a digital certificate for the user is generated, and the digital certificate of the user is stored in the business service end.

[0024] Optionally, in an embodiment of the present application, the user account information includes: user information registered through a service user terminal, or user information pre-assigned by a service service terminal.

[0025] Optionally, in one embodiment of the present application, the method further includes: when it is detected that the user has modified the account information, decrypting the saved encrypted collaborative signature key shard using the symmetric encryption key before the modification, and then re-encrypting the decrypted collaborative signature key shard data using a new symmetric encryption key derived from the modified account information.

[0026] In a second aspect, based on the collaborative signature method described in the first aspect of the present application, an embodiment of the present application further provides a collaborative signature device, including:

[0027] A generation module is configured to be coupled to a business server based on the user's account information

[0028] The first signature module of [HZTC-HXJMJJ241010][HS2411175CCN] creates a collaborative signature key shard for the user, wherein the collaborative signature key shard includes a service user-side collaborative signature key shard and a signature service-side collaborative signature key shard;

[0029] An encryption module is configured to encrypt the collaborative signature key fragments and store the encrypted business user-side collaborative signature key fragments on the business service side;

[0030] The authentication module is configured to perform login authentication on the login user of the business user terminal when the business user terminal performs electronic signature;

[0031] A receiving module is configured to receive the encrypted business user-side collaborative signature key fragment corresponding to the logged-in user fed back by the business service end after the login authentication is passed;

[0032] The signature module is configured to call a second signature module coupled to the business user end to decrypt the encrypted collaborative signature key shard, so that the business user end obtains the decrypted business user collaborative signature key shard, and jointly calculates the collaborative signature with the signature server collaborative signature key shard created by the signature server.

[0033] In a third aspect, an embodiment of the present application further provides a computer storage medium, on which computer executable instructions are stored, and when the computer executable instructions are executed, any one of the collaborative signature methods described in the first aspect of the embodiment of the present application is performed.

[0034] In a fourth aspect, an embodiment of the present application further provides an electronic device, comprising: a processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other through the communication bus;

[0035] The memory is used to store at least one executable instruction, and the executable instruction enables the processor to execute any one of the collaborative signature methods described in the first aspect of the embodiment of the present application.

[0036] The present application provides a collaborative signature method, device, storage medium and electronic device, which, based on the user's account information, collaboratively couples with a first signature module on a business service end to create a collaborative signature key shard for the user, wherein the collaborative signature key shard includes a business user-end collaborative signature key shard and a business service-end collaborative signature key shard; after encrypting the collaborative signature key shard, the encrypted business user-end collaborative signature key shard is stored on the business service end; when the business user end performs an electronic signature, login authentication is performed on the logged-in user of the business user end; after the login authentication is passed, the corresponding encrypted business user-end collaborative signature key shard fed back by the signature server is received

[0037] [HZTC-HXJMJJ241010][HS2411175CCN] sharding; calling the second signature module coupled to the business user end to decrypt the encrypted collaborative signature key shard, so that the business user end obtains the decrypted business user collaborative signature key shard, and the signature server collaborative signature key shard obtained by the signature server supports dual-end collaborative signing. This method stores the created collaborative signature key on the business server end, and the user end only has the functions of collaborative signing and collaborative decryption. Each end can only obtain the plaintext data of the collaborative signature key shard data of the local end, but cannot obtain the collaborative signature key shard data of the opposite end. While ensuring the security of the collaborative signature key shard data of each end, when data is lost on the user end, it only needs to recover the data from the server end, without reapplying for or creating a new collaborative signature key shard, which reduces the amount of junk data generated and ensures the work efficiency of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the embodiments of the present application. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0039] Figure 1 A schematic diagram of a workflow of a collaborative signature method provided in an embodiment of the present application;

[0040] Figure 2 A schematic diagram of the structure of a collaborative signature device provided in an embodiment of the present application.

[0041] Figure 3 A schematic structural diagram of an electronic device is provided for an embodiment of the present application. DETAILED DESCRIPTION

[0042] In order to enable those skilled in the art to better understand the technical solutions in the embodiments of the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments in the embodiments of the present application should fall within the scope of protection of the embodiments of the present application.

[0043] It should be understood that the various steps described in the method implementation of the present application can be performed in different orders and / or in parallel. In addition, the method implementation may include additional steps and / or omit

[0044] [HZTC-HXJMJJ241010][HS2411175CCN] performs the steps shown. The scope of the present application is not limited in this respect.

[0045] Embodiment 1

[0046] The present application embodiment provides a collaborative signature method, such as Figure 1 As shown, Figure 1 A workflow diagram of a collaborative signature method provided in an embodiment of the present application includes:

[0047] Step S101, based on the user's account information, the first signature module coupled to the business service end is collaboratively coupled to create a collaborative signature key shard for the user, the collaborative signature key shard includes a business user end collaborative signature key shard and a signature service end collaborative signature key shard. In the embodiment of the present application, the business service end is a server end for storing and managing the user's registration information, and managing the tasks to be signed, which can be deployed on a business service system server or a cloud server, and the embodiment of the present application does not limit this. The user's account information can be the user's login name information, and the login password information or login password information corresponding to the login name information. In the actual application scenario defined by the embodiment of the present application, the collaborative signature key shard is created based on the user's account information and the first signature module coupled to the business service end, so that the generation process of the signature key shard data is strongly associated with the business user end, and the generation process and storage of the collaborative signature key shard are placed on the business service end. Among them, the business user end is the client (user end) of the collaborative signature system, for example, it can be composed of a collaborative signature system mobile end app installed on the user's mobile phone or other mobile device. In the embodiment of the present application, since the user's account information needs to be saved in the business server, this method can facilitate the business user end to directly obtain the corresponding data consistent with the user's account information from the business server when software is reinstalled, upgraded or equipment is replaced, so as to avoid the need to recreate new collaborative signature key shard data when data is lost or a new device is used for the user's business user end, and to classify the old collaborative signature shard data as garbage data and discard it, so as to save system resources.

[0048] Optionally, in one implementation of the embodiment of the present application, the user's account information includes: user information registered through the business user end, or user information pre-assigned by the business service end. The embodiment of the present application provides these two types of user account information implementation methods at this stage to meet the needs of users in different scenarios. For example, general accounts that are open to ordinary users for registration and can use the system for collaborative signing. The account information of these general accounts can be changed at any time according to the user's situation. Or it can be opened to special pre-assigned accounts such as those used by specific institutions or specific official uses. These accounts are used

[0049] [HZTC-HXJMJJ241010][HS2411175CCN] The account information of all users has been verified and authenticated by real name, and the account information should not be changed simply at will. Therefore, this type of user preferably implements the user and account information in a pre-allocated manner to better meet the regulatory requirements for these users to perform collaborative signing.

[0050] Step S102, encrypt the collaborative signature key shards, and save the encrypted business user-side collaborative signature key shards locally. In this stage of the embodiment of the present application, when encrypting the collaborative signature key shards, the business user-side collaborative signature key shard data generated by the business service end is mainly encrypted, and the encrypted business user-side collaborative signature shard data is saved in an encrypted manner to the server end, and the collaborative signature key shard data is isolated from the collaborative signature server-side collaborative signature key shard data in different system processing units or on different servers, so as to ensure the use security of the collaborative signature key shard data on both ends, and it will not be easily obtained by a third party.

[0051] Furthermore, the method also includes: while encrypting the user-side collaborative signature key shard and saving it on the business service side, the encrypted business user-side collaborative signature key shard is synchronously sent to the corresponding business user side, so that when no data loss occurs, the business user side can directly obtain the business user-side collaborative signature key shard data corresponding to the current user from the locally stored data, for participating in the joint calculation of the collaborative signature, so as to ensure the work efficiency of the system.

[0052] Step S103, when the business user terminal performs electronic signature, the login authentication of the login user of the business user terminal is performed. That is, the username information and login password information of the login user are detected to confirm whether the login user is a user in the system and has an account. Specifically, if the result of the login authentication shows that the login user is an unregistered account, the login user is prompted to register; if the result of the login authentication shows that the user is a registered account that already has an account, the business user terminal collaborative signature key shard data corresponding to the account information is queried on the business service side according to the account information of the login user, so that the user can use it when performing collaborative signature.

[0053] Step S104: After the login authentication is passed, the encrypted business user-side collaborative signature key shard corresponding to the logged-in user is received from the business server. In the actual application scenario of the embodiment of the present application, when data is lost on the business user side, the business user-side key shard data is restored from the business server without reapplying for new collaborative signature key shard data, which saves system overhead and avoids discarding old data as garbage data. At the same time, since the key shard data stored on the business server is encrypted, the security of the business user-side collaborative signature key shard data storage and transmission process is guaranteed.

[0054] [HZTC-HXJMJJ241010][HS2411175CCN]Full sex.

[0055] Step S105, call the second signature module coupled to the business user end to decrypt the encrypted collaborative signature key shard, so that the business user end obtains the decrypted business user collaborative signature key shard, and jointly calculates the collaborative signature with the signature server collaborative signature key shard created by the signature server. In the embodiment of the present application. The collaborative signature server is the server of the collaborative signature system, which is a data processing unit independent of the business server and can be deployed on different servers. In this way, at this stage of the embodiment of the present application, while ensuring that the business user end and the signature server can normally use the collaborative signature key shard plaintext data of the local end to participate in the collaborative signature, the security of the collaborative signature key shard data of the business user end is guaranteed, and it will not be easily obtained by the opposite end or a third party. When performing collaborative signing, the business user end and the collaborative signature server end each use the key shard data of the local end to calculate the collaborative signature component of the local end, and then the business user end calculates the final signature value based on the signature components of the two parties, thereby realizing a complete collaborative signing process.

[0056] Optionally, in an implementation of the embodiment of the present application, the final collaborative signature is obtained by using the collaborative signature key shard data of both ends to perform corresponding hash value calculations to obtain the collaborative signature component of the local end, and then finally calculating the signature value. At this stage of the embodiment of the present application, the use of hash value calculations to obtain the final signature can better ensure the consistency and uniqueness of the collaborative signature and reduce the probability of the final collaborative signature being forged.

[0057] Optionally, in one embodiment of the present application, the collaborative signature key shard is encrypted, including: deriving a symmetric encryption key based on the user's account information; using the symmetric encryption key to encrypt the collaborative signature key shard; correspondingly, calling a second signature module coupled to the business user end to decrypt the encrypted collaborative signature key shard, including: deriving a symmetric encryption key corresponding to the logged-in user according to the account information of the logged-in user; using the second signature module coupled to the business user end, using the derived symmetric encryption key corresponding to the logged-in user, decrypting the encrypted business user-end collaborative signature key shard on the business user end, and decrypting the encrypted server-end collaborative signature key shard on the signature server end. In the actual application scenario of the embodiment of the present application, a symmetric encryption key is generated based on the user's account information, such as the user's login password, and is used to encrypt the created collaborative signature key shard. When the user needs to use the collaborative signature key shard for collaborative signing, the user's login password is obtained again, and the symmetric encryption key regenerated based on the login password is used

[0058] [HZTC-HXJMJJ241010][HS2411175CCN] is used to decrypt the encrypted data of the collaborative signature key shard data obtained by each end, ensuring that the symmetric key used in the encryption and decryption process will not be easily obtained or stolen, and also ensuring the consistency of the password used in the encryption / decryption process. At the same time, this limited encryption / decryption process is also relatively easy to implement, so that the storage and transmission process of the collaborative signature key shard data of each end has strong security.

[0059] Optionally, in one embodiment of the present application, before receiving the encrypted collaborative signature key shard of the corresponding logged-in user fed back by the signature service end, the method further includes: detecting whether the collaborative signature key shard data has been configured for the logged-in user according to the login information of the logged-in user. If not, the collaborative signature key shard data can be configured for the user; if so, the digital certificate stored in the business service end is returned to the business user end. This can better save system resources and reduce the amount of junk data generated.

[0060] Optionally, in one embodiment of the present application, after creating the collaborative signature key shard for the user, the method further includes: generating a digital certificate for the user, and storing the digital certificate in the business service end; correspondingly, receiving the encrypted business user-end collaborative signature key shard corresponding to the logged-in user fed back by the business service end, including: returning the digital certificate stored in the business service end to the business user end; determining the encrypted business user-end collaborative signature key shard corresponding to the logged-in user according to the digital certificate received by the business user end, and receiving the encrypted business user-end collaborative signature key shard. In an embodiment of the present application, a digital certificate is a digital authentication that marks the identity information of the communicating parties in Internet communication, and is used to identify the identity of the other party. Therefore, a digital certificate is also called a digital identification, and in an embodiment of the present application, the issued digital certificate is used as a unique authentication identification for the system to identify the user's identity, which can better ensure that the user's identity will not be stolen. At the same time, the digital certificate saves the information and data of network users in communication in an encrypted or decrypted form, which can ensure the integrity and security of the information and data. Furthermore, in this stage, the embodiment of the present application uses the digital certificate issued to the user as the basis for providing feedback on the stored service user-side system signature key fragments, which is simple and easy to implement and can also ensure the accuracy and integrity of the feedback data.

[0061] Optionally, in an embodiment of the present application, performing login authentication on the login user of the service user terminal includes: performing login authentication on the login user of the service user terminal using a digital certificate for the user. This method is simple and easy to implement, and has good authentication accuracy.

[0062] [HZTC-HXJMJJ241010][HS2411175CCN]

[0063] Optionally, in one embodiment of the present application, the generation of a digital certificate for the user includes: using the collaborative signature key shard of the business user end and the business service end to jointly calculate the signature value in the certificate request data; generating a certificate request based on the signature value; based on the certificate request, in combination with the CA service, generating a digital certificate for the user, and storing the user's digital certificate on the business service end. The method for generating a digital certificate defined in the embodiment of the present application can ensure a strong correlation between the digital certificate and the collaborative signature key shard data, which can not only ensure the uniqueness of the generated digital certificate, but also support mutual verification between the generated collaborative signature key shard data and the digital certificate during the later system operation process, further improving the security of the digital certificate and key shard data defined in the embodiment of the present application, and will not be easily tampered with.

[0064] Optionally, in an embodiment of the present application, the method further includes: when it is detected that the logged-in user modifies the account information, the symmetric encryption key corresponding to the account information before modification is used to decrypt the saved encrypted collaborative signature key shard, and then the symmetric encryption key derived from the modified account information is used to re-encrypt the decrypted collaborative signature key shard data, so as to provide users with more flexible collaborative signature services and further improve user satisfaction.

[0065] The present application provides a collaborative signature method, which creates a collaborative signature key shard for the user based on the user's account information and a first signature module collaboratively coupled to a business service end, wherein the collaborative signature key shard includes a business user-end collaborative signature key shard and a signature service-end collaborative signature key shard; encrypts the collaborative signature key shard, and stores the encrypted business user-end collaborative signature key shard on the business service end; when the business user end performs an electronic signature, performs login authentication on the logged-in user of the business user end; after the login authentication is passed, receives the encrypted business user-end collaborative signature key shard corresponding to the logged-in user fed back by the business service end; calls a second signature module coupled to the business user end to decrypt the encrypted collaborative signature key shard, so that the business user end obtains the decrypted business user-end collaborative signature key shard, and jointly calculates the collaborative signature with the signature service-end collaborative signature key shard created by the signature server. This method places the collaborative signature key creation process on the business server side, and the business user side only has the collaborative signature and collaborative decryption functions. During the working process, each end can only obtain the plaintext data of the collaborative signature key shard data of the local end, but cannot obtain the plaintext data of the collaborative signature key shard data of the other end. While ensuring the security of the collaborative signature key shard data of each end, when data loss occurs on the business user side, only the business server side needs to be restored.

[0066] [HZTC-HXJMJJ241010][HS2411175CCN]Data can be restored without reapplying for or creating new collaborative signature key shards, which reduces the amount of junk data generated and ensures that the system has high work efficiency.

[0067] Embodiment 2

[0068] Based on the collaborative signature method provided in the first embodiment of the present application, the present application also provides a collaborative signature device, such as Figure 2 As shown, Figure 2 A schematic diagram of the structure of a collaborative signature device 20 provided in an embodiment of the present application, wherein the collaborative signature device 20 includes:

[0069] The generating module 201 is configured to create a collaborative signature key shard for the user based on the user's account information in collaboration with a first signature module coupled to the business server, wherein the collaborative signature key shard includes a business user-side collaborative signature key shard and a signature server-side collaborative signature key shard;

[0070] The encryption module 202 is configured to encrypt the collaborative signature key fragment and store the encrypted service user collaborative signature key fragment on the service server;

[0071] The authentication module 203 is configured to perform login authentication on the login user of the business user terminal when the business user terminal performs electronic signature;

[0072] The receiving module 204 is configured to receive the encrypted business user-side collaborative signature key fragment corresponding to the logged-in user fed back by the business service end after the login authentication is passed;

[0073] The signature module 205 is configured to call a second signature module coupled to the business user end to decrypt the encrypted collaborative signature key shard, so that the business user end obtains the decrypted business user collaborative signature key shard, and jointly calculates the collaborative signature with the signature server collaborative signature key shard created by the signature server.

[0074] Optionally, in one embodiment of the present application, the encryption module 202 is also configured to derive a symmetric encryption key based on the user's account information; use the symmetric encryption key to encrypt the collaborative signature key shard; correspondingly, the decryption module 205 is also configured to derive a symmetric encryption key corresponding to the logged-in user based on the account information of the logged-in user; use the second signature module coupled to the business user terminal and the symmetric encryption key corresponding to the logged-in user to decrypt the encrypted business user-side collaborative signature key shard on the business user terminal.

[0075] Optionally, in one embodiment of the present application, the device 20 further includes a detection module (FIG.

[0076] [HZTC-HXJMJJ241010][HS2411175CCN] is not shown), the detection module is configured to detect whether the collaborative signature key shard data has been configured for the user according to the user's login information before receiving the encrypted business user-end collaborative signature key shard feedback corresponding to the signature server.

[0077] Optionally, in one embodiment of the present application, the device 20 also includes a creation module (not shown in the accompanying drawings), which is configured to generate a digital certificate for the user; save the digital certificate on the business service end; correspondingly, the receiving module 204 is also configured to receive the digital certificate saved on the business service end, and based on the received digital certificate, determine the encrypted business user-end collaborative signature key segment corresponding to the logged-in user and receive it to the business user end.

[0078] Optionally, in an embodiment of the present application, the authentication module 203 is further configured to use a digital certificate for the user to perform login authentication on the login user of the service user terminal.

[0079] Optionally, in one embodiment of the present application, the creation module is also configured to use the business user-side collaborative signature key shard and the business service side to jointly calculate the signature value in the certificate request data; generate a certificate request based on the signature value; based on the certificate request, in combination with the CA service, generate a digital certificate for the user, and save the user's digital certificate on the business service side.

[0080] Optionally, in an embodiment of the present application, the user's account information includes: user information registered through a service user terminal, or user information pre-allocated by a service service terminal.

[0081] Optionally, in one embodiment of the present application, the device 20 also includes an update module (not shown in the drawings), which is used to decrypt the saved encrypted collaborative signature key shard based on the user's modified registration information using the unmodified symmetric encryption key when detecting that the user has modified the account information, and then re-encrypt the decrypted collaborative signature key shard data using the symmetric encryption key derived from the modified account information through the generation module 201.

[0082] The present application provides a collaborative signature device, wherein a generation module is set to be based on the user's account information, collaboratively coupled to a first signature module on a business service end, to create a collaborative signature key shard for the user, wherein the collaborative signature key shard includes a business user end collaborative signature key shard and a collaborative signature service end collaborative signature key shard; an encryption module is set to encrypt the collaborative signature key shard, and the encrypted business user end collaborative signature key shard is stored locally; an authentication module is set to perform login authentication on the logged-in user of the business user end when the business user end performs an electronic signature; a receiving module is set to receive the corresponding login user feedback from the business service end after the login authentication is passed.

[0083] [HZTC-HXJMJJ241010][HS2411175CCN] The encrypted business user-side collaborative signature key shard of the user; a signature module is set to call a second signature module coupled to the business user side to decrypt the encrypted collaborative signature key shard, so that the business user side obtains the decrypted business user-side collaborative signature key shard, and jointly calculates the collaborative signature with the signature service-side collaborative signature key shard created by the signature service side. In this way, the generation and storage process of the collaborative signature key is placed on the business service side. The business user side only has the functions of collaborative signature and collaborative decryption. Each end can only obtain the plaintext data of the collaborative signature key shard data of the local end, but cannot obtain the plaintext data of the collaborative signature key shard data of the opposite end. While ensuring the security of the collaborative signature key shard data of each end, when the business user side loses data, it only needs to recover the data from the business service side, without reapplying for or creating a new collaborative signature key shard, which reduces the amount of junk data generated, ensures that the system has high work efficiency, and the device structure is simple and easy to implement.

[0084] Embodiment 3

[0085] An embodiment of the present application also provides a storage medium on which a computer program is stored. When the program is executed by a processor, it implements any one of the collaborative signature methods described in the first embodiment of the present application.

[0086] Embodiment 4:

[0087] The present application also provides an electronic device, such as Figure 3 As shown, Figure 3 A schematic diagram of the structure of an electronic device 30 is provided for an embodiment of the present application. The electronic device 30 includes:

[0088] One or more processors 301, communication interface 302, memory 303 and communication bus 304, the processor 301, memory 303 and communication interface 302 communicate with each other via the communication bus 304;

[0089] Memory 303, used to store one or more programs;

[0090] When the one or more programs are executed by the one or more processors 301, the one or more processors 301 implement any one of the collaborative signature methods described in Embodiment 1 of the present application.

[0091] Thus far, the present application has described specific embodiments of the subject matter. In some cases, the actions recited in the claims can be performed in a different order and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order shown or sequential order to achieve the desired results. In some embodiments, multitasking and parallel processing can be

[0092] [HZTC-HXJMJJ241010][HS2411175CCN] is beneficial.

[0093] In the 1990s, improvements to a technology could be clearly distinguished as hardware improvements (for example, improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the method flow). However, with the development of technology, many improvements to the method flow today can be regarded as direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that an improvement in a method flow cannot be implemented using a hardware entity module. For example, a programmable logic device (PLD) (such as a field programmable gate array (FPGA)) is such an integrated circuit whose logical function is determined by the user's programming of the device. Designers can "integrate" a digital system layer on a PLD by programming it themselves, without having to ask a chip manufacturer to design and produce a dedicated integrated circuit chip. Moreover, nowadays, instead of manually making integrated circuit chips, this kind of programming is mostly implemented by "logic compiler" software, which is similar to the software compiler used when developing and writing programs, and the original code before compilation must also be written in a specific programming language, which is called hardware description language (HDL). There is not only one HDL, but many kinds, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used ones are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also know that it is only necessary to program the method flow slightly in the above-mentioned hardware description languages ​​and program it into the integrated circuit, and then it is easy to obtain the hardware circuit that implements the logic method flow.

[0094] The controller may be implemented in any suitable manner, for example, the controller may take the form of a microprocessor or processor and a computer-readable medium storing a computer-readable program code (such as software or firmware) executable by the (micro)processor, logic gates, switches, an application specific integrated circuit (ASIC), a programmable logic controller, and an embedded

[0095] [HZTC-HXJMJJ241010][HS2411175CCN] microcontroller, examples of controllers include but are not limited to the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20 and SiliconeLabs C8051F320, the memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art also know that in addition to implementing the controller in a purely computer-readable program code, the controller can be implemented in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers by logically programming the method steps. Therefore, this controller can be considered as a hardware component, and the devices for implementing various functions included therein can also be regarded as structures within the hardware component. Or even, the devices for implementing various functions can be regarded as both software modules for implementing the method and structures within the hardware component.

[0096] The system layers, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0097] For the convenience of description, the above device is described in various units according to their functions. Of course, when implementing the present application, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0098] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0099] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, system layers or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0100] [HZTC-HXJMJJ241010][HS2411175CCN]

[0101] The present application may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific transactions or implement specific abstract data types. The present application may also be practiced in distributed computing environments where transactions are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0102] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system layer embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0103] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. A collaborative signature method, characterized in that: include: Based on the user's account information, a first signature module coupled to the business server is collaboratively coupled to create a collaborative signature key shard for the user, wherein the collaborative signature key shard includes a business user-side collaborative signature key shard and a collaborative signature server-side collaborative signature key shard; Encrypting the collaborative signature key shard, and storing the encrypted business user-side collaborative signature key shard locally on the business service end; When the business user terminal performs electronic signature, the login user of the business user terminal is authenticated; After the login authentication is passed, the encrypted business user-side collaborative signature key fragment corresponding to the logged-in user is received from the business service end; The second signature module coupled to the business user end is called to decrypt the encrypted collaborative signature key shard, so that the business user end obtains the decrypted business user collaborative signature key shard, and jointly calculates the collaborative signature with the signature server collaborative signature key shard created by the signature server.

2. The collaborative signature method according to claim 1, characterized in that: The encrypting the collaborative signature key fragments includes: Based on the user's account information, derive a symmetric encryption key; Encrypting the collaborative signature key shard using the symmetric encryption key; Correspondingly, the calling of the second signature module coupled to the service user terminal to decrypt the encrypted collaborative signature key fragment includes: deriving a symmetric encryption key corresponding to the logged-in user according to the account information of the logged-in user; The encrypted business user terminal collaborative signature key fragment is decrypted at the business user terminal using a second signature module coupled to the business user terminal and a derived symmetric encryption key corresponding to the logged-in user.

3. The collaborative signature method according to claim 1, characterized in that: Before receiving the encrypted service user-side collaborative signature key shard corresponding to the logged-in user fed back by the [HZTC-HXJMJJ241010][HS2411175CCN] service service end, the method also includes: detecting whether the collaborative signature key shard data has been configured for the user based on the user's login information.

4. The collaborative signature method according to claim 1, characterized in that: After creating the collaborative signature key shard for the user, the method further includes: generating a digital certificate for the user; storing the digital certificate in a business service end; Correspondingly, receiving the encrypted business user-side collaborative signature key fragment corresponding to the logged-in user fed back by the business service end includes: returning the digital certificate stored in the business service end to the business user end; According to the digital certificate received by the service user terminal, the encrypted service user terminal collaborative signature key fragment corresponding to the logged-in user is determined, and the encrypted service user terminal collaborative signature key fragment is received.

5. The collaborative signature method according to claim 4, characterized in that: The performing login authentication on the login user of the service user terminal includes: The login authentication of the login user of the service user terminal is performed according to the digital certificate for the user.

6. The collaborative signature method according to claim 5, characterized in that: The generating of a digital certificate for the user comprises: Calculate the signature value in the certificate request data by using the collaborative signature key fragment of the service user and the collaborative signature key fragment of the signature service; Generate a certificate request corresponding to the user according to the signature value; According to the certificate request, in combination with the CA service, a digital certificate for the user is generated, and the digital certificate of the user is stored in the business service end.

7. The collaborative signature method according to claim 1, characterized in that: The user's account information includes: user information registered through the service user terminal, or user information pre-allocated by the service service terminal.

8. The collaborative signature method according to claim 1, characterized in that: The method also includes: when it is detected that a user has modified account information, based on the user's modified account information, using the symmetric encryption key corresponding to the account information before modification to decrypt the saved encrypted collaborative signature key shard, and then using a new symmetric encryption key derived from the modified account information to re-encrypt the decrypted collaborative signature key shard data.

9. A collaborative signature device, characterized in that: include: A generation module is configured to create, based on the user's account information, a collaborative signature key shard for the user in collaboration with a first signature module coupled to the business server, wherein the collaborative signature key shard includes a business user-side collaborative signature key shard and a signature server-side collaborative signature key shard; An encryption module is configured to encrypt the collaborative signature key fragment and store the encrypted business user-side collaborative signature key fragment on the business service side; The authentication module is configured to perform login authentication on the login user of the business user terminal when the business user terminal performs electronic signature; A receiving module is configured to receive the encrypted business user-side collaborative signature key fragment corresponding to the logged-in user fed back by the business service end after the login authentication is passed; The signature module calls the second signature module coupled to the business user end to decrypt the encrypted collaborative signature key shard, so that the business user end obtains the decrypted business user collaborative signature key shard, and jointly calculates the collaborative signature with the signature server collaborative signature key shard created by the signature server.

10. A computer storage medium, characterized in that: The computer storage medium stores computer executable instructions, and when the computer executable instructions are executed, the collaborative signature method as described in any one of claims 1-8 is executed.

Images