A method, device, storage medium and electronic device for cooperative signature

Abstract

The application provides a method and device for collaborative signature, a storage medium and an electronic device. A collaborative signature key fragment for a user is created, including a business user end collaborative signature key fragment and a collaborative signature service end collaborative signature key fragment. The collaborative signature key fragment is encrypted, and the encrypted business user end collaborative signature key fragment is stored in a business service end. When a login user passes login authentication, the encrypted business user end collaborative signature key fragment fed back by the business service end is received. A second signature module coupled to the business user end is called to decrypt the collaborative signature key fragment of the encryption key pair. The collaborative signature is participated in through the decrypted collaborative signature key fragment. When data loss occurs in the business user end, data recovery is performed from the business service end, and a new key fragment does not need to be created, so that the generation amount of garbage data is reduced, and the working efficiency of the system is ensured.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data encryption, and in particular to a collaborative signature method and device, a storage medium and an electronic device. BACKGROUND

[0002] The collaborative signature technology refers to generating and saving respective signature key fragments on the client and the server, respectively, participating in the calculation of the signature value using respective key fragments during signature, and finally generating a signature result on the client. This technical solution has a wide application prospect in application fields such as electronic contracts. In the process of using the collaborative signature technology, the complete private key does not appear on either end in the collaborative signature key generation, collaborative signature and collaborative decryption calculation process, thereby effectively ensuring the security of the key fragments and the password operation. However, this technical solution faces an important use problem in the application process, namely, the volatility problem, mainly referring to the fact that the client key fragments and the corresponding digital certificate are easily lost due to the uninstallation and reinstallation of the client app, device replacement, system update and the like. There are mainly two kinds of traditional solutions, one is to reapply for the collaborative signature key and the digital certificate for the client, which will cause the signature server to continuously accumulate the old key fragment data and discard it as garbage data, occupying system resources; the other is to use an external device such as a usbkey to save the user private key and the digital certificate, but this way is cumbersome. Therefore, how to provide a collaborative signature method that does not require an external device and has less garbage generated in the signature process and high signature accuracy has become a technical problem that needs to be solved in the industry. SUMMARY

[0003] Therefore, the embodiments of the present application provide a collaborative signature method, device, storage medium and electronic device to at least or partially solve the above problems.

[0004] In a first aspect, the embodiments of the present application provide a collaborative signature method, comprising:

[0005] Based on the account information of a user, a first signature module coupled to a business service server creates a collaborative signature key fragment for the user, which includes a business user-side collaborative signature key fragment and a signature server-side collaborative signature key fragment;

[0006] The collaborative signature key fragment is encrypted, and the encrypted business user-side collaborative signature key fragment is saved on the business service server;

[0007] When the business user side performs electronic signature, the login user of the business user side is authenticated;

[0008] After the login authentication is passed, the encrypted business user-side collaborative signature key fragment corresponding to the login user is received from the business service end;

[0009] The second signature module coupled to the business user side is called to decrypt the encrypted collaborative signature key fragment, so that the business user side obtains the decrypted business user-side collaborative signature key fragment and the signature service end creates a signature service-side collaborative signature key fragment to jointly calculate the collaborative signature.

[0010] Optionally, in an embodiment of the present application, the encryption of the collaborative signature key fragment includes deriving a symmetric encryption key based on the user's account information, and encrypting the collaborative signature key fragment using the symmetric encryption key.

[0011] Correspondingly, the calling of the second signature module coupled to the business user side to decrypt the encrypted collaborative signature key fragment includes deriving a symmetric encryption key corresponding to the user according to the login user's account information, and using the derived symmetric encryption key to decrypt the encrypted business user-side collaborative signature key fragment at the business user side and the encrypted service end collaborative signature key fragment at the signature service end using the second signature module coupled to the business user side.

[0012] Optionally, in an embodiment of the present application, before receiving the encrypted business user-side collaborative signature key fragment corresponding to the login user from the business service end, the method further includes detecting whether the user has been configured with collaborative signature key fragment data according to the user's login information.

[0013] Optionally, in an embodiment of the present application, after creating the collaborative signature key fragment for the user, the method further includes:

[0014] generating a digital certificate for the user;

[0015] saving the digital certificate in the business service end;

[0016] Correspondingly, receiving the encrypted business user-side collaborative signature key fragment corresponding to the login user from the business service end includes returning the digital certificate saved in the business service end to the business user side, and determining the encrypted business user-side collaborative signature key fragment corresponding to the login user according to the digital certificate received by the business user side, and receiving the encrypted business user-side collaborative signature key fragment.

[0017] Optionally, in an embodiment of the present application, the login authentication of the login user of the service user terminal comprises: performing login authentication of the login user of the service user terminal according to the digital certificate of the user.

[0018] Optionally, in an embodiment of the present application, the generation of the digital certificate of the user comprises:

[0019] The signature value in the certificate request data is calculated by using the service user terminal collaborative signature key fragment and the signature server collaborative signature key fragment jointly;

[0020] The certificate request is generated according to the signature value;

[0021] The digital certificate of the user is generated according to the certificate request in combination with the CA service, and the digital certificate of the user is saved in the service server.

[0022] Optionally, in an embodiment of the present application, the account information of the user comprises: user information registered through the service user terminal, or user information pre-assigned through the service server.

[0023] Optionally, in an embodiment of the present application, the method further comprises: when it is detected that the user modifies the account information, decrypting the saved encrypted collaborative signature key fragment using the symmetric encryption key before the modification, and re-encrypting the decrypted collaborative signature key fragment data using a new symmetric encryption key derived from the modified account information.

[0024] In a second aspect, based on the method for collaborative signature of the first aspect of the present application, an embodiment of the present application further provides a device for collaborative signature, comprising:

[0025] The generation module is configured to create a collaborative signature key fragment for the user based on the account information of the user and a first signature module coupled to the service server, wherein the collaborative signature key fragment comprises a service user terminal collaborative signature key fragment and a signature server collaborative signature key fragment;

[0026] The encryption module is configured to encrypt the collaborative signature key fragment, and save the encrypted service user terminal collaborative signature key fragment in the service server;

[0027] The authentication module is configured to perform login authentication of the login user of the service user terminal when the service user terminal performs electronic signature;

[0028] The receiving module is configured to receive the encrypted service user terminal collaborative signature key fragment corresponding to the login user fed back by the service server after the login authentication is passed.

[0029] The signature module is configured to call a second signature module coupled to the business user end to decrypt the encrypted co-signature key fragment, so that the business user end obtains the decrypted business user end co-signature key fragment, and jointly calculates the co-signature with the signature service end co-signature key fragment created by the signature service end.

[0030] In a third aspect, an embodiment of the present application further provides a computer storage medium, which has stored thereon computer executable instructions, and the computer executable instructions, when executed, perform any of the co-signature methods according to the first aspect of the embodiments of the present application.

[0031] In a fourth aspect, an embodiment of the present application further provides an electronic device, which comprises a processor, a memory, a communication interface and a communication bus, and the processor, the memory and the communication interface complete communication with each other through the communication bus.

[0032] The memory is used to store at least one executable instruction, and the executable instruction causes the processor to perform any of the co-signature methods according to the first aspect of the embodiments of the present application.

[0033] The present application provides a co-signature method, device, storage medium and electronic device. Based on the account information of a user, a first signature module coupled to a business service end creates a co-signature key fragment for the user, which includes a business user end co-signature key fragment and a business service end co-signature key fragment. After encrypting the co-signature key fragment, the encrypted business user end co-signature key fragment is stored in the business service end. When the business user end performs electronic signing, the login user of the business user end is authenticated. After the login authentication is passed, the corresponding encrypted business user end co-signature key fragment fed back by the signature service end is received. A second signature module coupled to the business user end is called to decrypt the encrypted co-signature key fragment, so that the business user end obtains the decrypted business user end co-signature key fragment, and the signature service end co-signature key fragment obtained by the signature service end supports co-signature of both ends. This way, the created co-signature key is stored in the business service end, and the user end only has the functions of co-signature and co-decryption. Each end can only obtain the plaintext data of the co-signature key fragment data of the local end, and cannot obtain the co-signature key fragment data of the opposite end. While ensuring the security of the co-signature key fragment data of each end, when data loss occurs on the user end, data recovery from the service end is only needed, without the need to apply for or create a new co-signature key fragment, which reduces the generation amount of garbage data and ensures the working efficiency of the system. BRIEF DESCRIPTION OF DRAWINGS

[0034] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the accompanying drawings needed to be used in the embodiments or prior art description will be briefly introduced as follows. Obviously, the accompanying drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art based on these drawings.

[0035] Figure 1 A workflow schematic diagram of a method for collaborative signature provided by the embodiments of the present application;

[0036] Figure 2 A structure schematic diagram of a device for collaborative signature provided by the embodiments of the present application.

[0037] Figure 3 A structure schematic diagram of an electronic device provided by the embodiments of the present application. DETAILED DESCRIPTION

[0038] In order to make the technical solutions in the embodiments of the present application better understood, the technical solutions in the embodiments of the present application will be described clearly and completely with reference to the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art should belong to the scope of protection of the present application.

[0039] It should be understood that the steps recorded in the method embodiments of the present application can be executed in different orders and / or in parallel. In addition, the method embodiments can include additional steps and / or omit

[0040] The steps shown are performed. The scope of the present application is not limited in this respect.

[0041] Embodiment one,

[0042] The embodiments of the present application provide a method for collaborative signature, as Figure 1 shown, Figure 1 A workflow schematic diagram of a method for collaborative signature provided by the embodiments of the present application, comprising:

[0043] Step S101, based on the user's account information, a first signature module coupled to the business service end creates a collaborative signature key fragment for the user, which includes a business user end collaborative signature key fragment and a signature service end collaborative signature key fragment. In the embodiment of the application, the business service end is a service end for saving and managing the registration information of the user, and managing the to-be-signed task, which can be deployed on a business service system server or a cloud server, and the embodiment of the application does not limit this. The user's account information can be the login name information of the user, and the login password information or login password information corresponding to the login name information. In the actual application scenario defined in the embodiment of the application, based on the user's account information and the first signature module coupled to the business service end to create a collaborative signature key fragment, the generation process of the signature key fragment data is strongly associated with the business user end, and at the same time, the generation process and saving of the collaborative signature key fragment are placed in the business service end. Among them, the business user end, that is, the client (user end) of the collaborative signature system, for example, can be composed of a collaborative signature system mobile end app installed on a user's mobile phone or other mobile devices. The account information of the user needs to be saved in the business service end, and through this way, when the business user end occurs in the use scenarios such as software reinstallation, upgrade or device replacement, the corresponding data saved in the business service end consistent with the user's account information can be directly obtained, avoiding the loss of data of the business user end for the user or the application scenario of using a new device, and re-creating a new collaborative signature key fragment data, discarding the old collaborative signature key fragment data as garbage data, to save system resources.

[0044] Optionally, in an implementation manner of the embodiment of the application, the user's account information includes: user information registered through the business user end, or user information pre-allocated through the business service end. The embodiment of the application provides these two implementation manners of the user's account information at this stage to meet the needs of users in different scenarios. For example, general accounts that can be used for collaborative signature by the system after being registered by ordinary users, and the account information of these general accounts can be changed at any time according to the user's situation. Or pre-allocated accounts for special use, such as specific institutions or specific officials, and the account information of these users is authenticated and certified through real-name verification, and the account information should not be changed at will, so this type of user is preferably implemented through pre-allocated user and account information to better meet the standard requirements when these users perform collaborative signature.

[0045] The account information of the user is authenticated and certified through real-name verification, and the account information should not be changed at will, so this type of user is preferably implemented through pre-allocated user and account information to better meet the standard requirements when these users perform collaborative signature.

[0046] Step S102, encrypt the collaborative signature key fragments, and save the encrypted business user end collaborative signature key fragments in the local. In this stage of the embodiment of the application, when the collaborative signature key fragments are encrypted, the business user end collaborative signature key fragment data generated by the business service end is mainly encrypted, the encrypted business user end collaborative signature fragment data is saved to the service end in an encrypted manner, and the collaborative signature service end collaborative signature key fragment data is stored in different system processing units or different servers to isolate the storage, so as to ensure the use safety of the collaborative signature key fragment data of the two ends and prevent the collaborative signature key fragment data from being easily obtained by a third party.

[0047] Further, the method further includes: saving the encrypted user end collaborative signature key fragments in the business service end, and synchronously sending the encrypted business user end collaborative signature key fragments to the corresponding business user end, so that the business user end directly obtains the business user end collaborative signature key fragment data corresponding to the current user from the locally stored data when no data loss occurs, and participates in the joint calculation of the collaborative signature, so as to ensure the working efficiency of the system.

[0048] Step S103, when the business user end performs electronic signature, the login user of the business user end is authenticated. That is, the username information and the login password information of the login user are detected, and it is confirmed whether the login user is a user in the system and has an account. Specifically, if the result of the login authentication shows that the login user is an unregistered account, the login user is prompted to register a user; if the result of the login authentication shows that the user is a registered account that has an account, the business service end is queried according to the account information of the login user to obtain the business user end collaborative signature key fragment data corresponding to the account information, so as to be used by the user when performing collaborative signature.

[0049] Step S104, after the login authentication passes, the encrypted business user end collaborative signature key fragments corresponding to the login user are received. In the actual application scenario of the embodiment of the application, when the data loss occurs in the business user end, the business user end key fragment data is recovered from the business service end, without the need to apply for new collaborative signature key fragment data, the system overhead is saved, and the old data is avoided to be discarded as garbage data. At the same time, since the key fragment data saved in the business service end is encrypted, the safety of the business user end collaborative signature key fragment data in the saving and transmission process is ensured.

[0050] Step S105, calling the second signature module coupled to the business user end to decrypt the encrypted collaborative signature key fragment, so that the business user end obtains the decrypted business user end collaborative signature key fragment, and the signature service end creates a signature service end collaborative signature key fragment to jointly calculate the collaborative signature. In the embodiment of the present application, the collaborative signature service end is the service end of the collaborative signature system, which is an independent data processing unit from the business service end, and can be deployed on different servers. In this way, the security of the business user end collaborative signature key fragment data is ensured, and the data cannot be easily obtained by the opposite end or third party, while ensuring that the business user end and the signature service end can normally use the collaborative signature key fragment plaintext data of the local end to participate in the collaborative signature. When performing collaborative signature, the business user end and the collaborative signature service end each use the key fragment data of the local end to calculate the collaborative signature component of the local end, and then the business user end calculates the final signature value according to the signature components of the two parties, thereby realizing the complete collaborative signature process.

[0051] Optionally, in an implementation manner of the embodiment of the present application, the final collaborative signature is obtained by using the respective collaborative signature key fragment data of the two ends to calculate the corresponding hash value, and then calculating the signature value. In this stage of the embodiment of the present application, the use of hash value calculation to obtain the final signature can better ensure the consistency and uniqueness of the collaborative signature, and reduce the probability of the final collaborative signature being forged.

[0052] Optionally, in an embodiment of the present application, the method for encrypting the collaborative signature key fragment comprises: deriving a symmetric encryption key based on the account information of the user; encrypting the collaborative signature key fragment using the symmetric encryption key; and correspondingly, calling the second signature module coupled to the business user end to decrypt the encrypted collaborative signature key fragment, comprising: deriving a symmetric encryption key corresponding to the logged-in user according to the account information of the logged-in user; and using the second signature module coupled to the business user end to decrypt the encrypted business user end collaborative signature key fragment using the derived symmetric encryption key corresponding to the logged-in user, and decrypting the encrypted service end collaborative signature key fragment at the signature service end. In the actual application scenario of the embodiment of the present application, the symmetric encryption key is generated based on the account information of the user, such as the login password of the user, and is used to encrypt the created collaborative signature key fragment. When the user needs to use the collaborative signature key fragment for collaborative signature, the login password of the user is obtained again, the symmetric encryption key is generated again based on the login password, and is used to decrypt the encrypted data of the collaborative signature key fragment data of each end obtained by the user, so as to ensure that the symmetric key used in the encryption and decryption process cannot be easily obtained or stolen, and to ensure the consistency of the password used in the encryption and decryption process. At the same time, such a limited encryption and decryption process is also relatively easy to implement, and the collaborative signature key fragment data saving and transmission process of each end has strong security.

[0053] Optionally, in an embodiment of the present application, before receiving the encrypted business user end collaborative signature key fragment corresponding to the logged-in user fed back by the signature service end, the method further comprises: detecting whether the collaborative signature key fragment data has been configured for the logged-in user according to the login information of the logged-in user. If not, the collaborative signature key fragment data can be configured for the user; and if yes, the digital certificate saved in the business service end is returned to the business user end. In order to better save system resources and reduce the generation amount of garbage data.

[0054] Optionally, in an embodiment of the present application, after the collaborative signature key fragment for the user is created, the method further comprises: generating a digital certificate for the user, and saving the digital certificate in a business service end; correspondingly, receiving the encrypted business user end collaborative signature key fragment corresponding to the login user fed back by the business service end, comprising: returning the digital certificate saved in the business service end to the business user end; determining the encrypted business user end collaborative signature key fragment corresponding to the login user according to the digital certificate received by the business user end, and receiving the encrypted business user end collaborative signature key fragment. In the embodiment of the present application, the digital certificate is a digital authentication for marking the identity information of each communication party in Internet communication, by which the identity of the opposite party is identified. Therefore, the digital certificate is also called digital identity, and in the embodiment of the present application, the digital certificate issued is used as a unique authentication identifier for identifying the identity of the user by the system, which can better ensure that the identity of the user cannot be stolen. At the same time, the digital certificate saves the information and data in the form of encryption or decryption in the communication of the network user, which can ensure the integrity and security of the information and data. Further, in this stage of the embodiment of the present application, the digital certificate issued to the user is used as the basis for feeding back the stored business user end system signature key fragment, which is simple to implement and can also ensure the accuracy and integrity of the feedback data.

[0055] Optionally, in an embodiment of the present application, the login authentication of the login user of the business user end comprises: using the digital certificate for the user to perform the login authentication of the login user of the business user end. The method is simple to implement, and the accuracy of the authentication is good.

[0056] Optionally, in an embodiment of the present application, the generation of the digital certificate for the user comprises: using the business user end collaborative signature key fragment and the business service end to jointly calculate the signature value in the certificate request data; generating a certificate request according to the signature value; generating the digital certificate for the user in combination with a CA service according to the certificate request, and saving the digital certificate for the user in the business service end. Through the generation mode of the digital certificate defined in the embodiment of the present application, the strong correlation between the digital certificate and the collaborative signature key fragment data can be ensured, the uniqueness of the generated digital certificate can be ensured, and the generated collaborative signature key fragment data and the digital certificate can be mutually checked in the working process of the system in the later stage, further improving the security of the digital certificate and the key fragment data defined in the embodiment of the present application, and the digital certificate cannot be easily tampered with.

[0057] Optionally, in an embodiment of the present application, the method further comprises: when it is detected that the login user modifies the account information, using the symmetric encryption key corresponding to the account information before the modification to decrypt the saved encrypted collaborative signature key fragment, and using the symmetric encryption key derived from the modified account information to re-encrypt the decrypted collaborative signature key fragment data. This provides more flexible collaborative signature service for the user, and further improves the user's use satisfaction.

[0058] The present application provides a collaborative signature method, based on the account information of a user, a first signature module coupled to a business service end, creating a collaborative signature key fragment for the user, the collaborative signature key fragment including a business user end collaborative signature key fragment and a signature service end collaborative signature key fragment; encrypting the collaborative signature key fragment, and saving the encrypted business user end collaborative signature key fragment in the business service end; when the business user end performs electronic signature, performing login authentication on the login user of the business user end; after the login authentication passes, receiving the encrypted business user end collaborative signature key fragment corresponding to the login user fed back by the business service end; calling a second signature module coupled to the business user end to decrypt the encrypted collaborative signature key fragment, so that the business user end obtains the decrypted business user end collaborative signature key fragment, and jointly calculates the collaborative signature with the signature service end collaborative signature key fragment created by the signature service end. This way places the collaborative signature key creation process in the business service end, and the business user end only has the functions of collaborative signature and collaborative decryption. In the working process, each end can only obtain the plaintext data of the collaborative signature key fragment data of the local end, and cannot obtain the plaintext data of the collaborative signature key fragment of the opposite end. While ensuring the security of the collaborative signature key fragment data of each end, when data loss occurs in the business user end, data recovery from the business service end is only needed, without the need to apply for or create a new collaborative signature key fragment, which reduces the generation amount of garbage data, and ensures high working efficiency of the system.

[0059] Embodiment two,

[0060] Based on the collaborative signature method provided in Embodiment One of the present application, the present application further provides a collaborative signature device, as shown in Figure 2 Figure 2 A structural schematic diagram of a collaborative signature device 20 provided in an embodiment of the present application, the collaborative signature device 20 comprising:

[0061] A generation module 201 configured to, based on the account information of a user, create a collaborative signature key fragment for the user in cooperation with a first signature module coupled to a business service end, the collaborative signature key fragment including a business user end collaborative signature key fragment and a signature service end collaborative signature key fragment; ​

[0062] The encryption module 202 is configured to encrypt the collaborative signature key fragment, and save the encrypted business user end collaborative signature key fragment in the business service end.

[0063] The authentication module 203 is configured to perform login authentication on the login user of the business user end when the business user end performs electronic signature.

[0064] The receiving module 204 is configured to receive the encrypted business user end collaborative signature key fragment corresponding to the login user fed back by the business service end after the login authentication is passed.

[0065] The signature module 205 is configured to call the second signature module coupled to the business user end to decrypt the encrypted collaborative signature key fragment, so that the business user end obtains the decrypted business user end collaborative signature key fragment and jointly calculates the collaborative signature with the signature service end collaborative signature key fragment created by the signature service end.

[0066] Optionally, in an embodiment of the present application, the encryption module 202 is further configured to derive a symmetric encryption key based on the account information of the user, and encrypt the collaborative signature key fragment using the symmetric encryption key. Correspondingly, the decryption module 205 is further configured to derive the symmetric encryption key corresponding to the login user according to the account information of the login user, and use the second signature module coupled to the business user end to decrypt the encrypted business user end collaborative signature key fragment using the symmetric encryption key corresponding to the login user.

[0067] Optionally, in an embodiment of the present application, the device 20 further comprises a detection module (not shown in the figure) configured to detect whether the collaborative signature key fragment data has been configured for the user according to the login information of the user before receiving the encrypted business user end collaborative signature key fragment corresponding to the signature service end feedback.

[0068] Optionally, in an embodiment of the present application, the device 20 further comprises a creation module (not shown in the figure) configured to generate a digital certificate for the user, and save the digital certificate in the business service end. Correspondingly, the receiving module 204 is further configured to receive the digital certificate saved in the business service end, and determine the encrypted business user end collaborative signature key fragment corresponding to the login user according to the received digital certificate and receive the business user end.

[0069] Optionally, in an embodiment of the present application, the authentication module 203 is further configured to perform login authentication on the login user of the business user terminal using the digital certificate of the user.

[0070] Optionally, in an embodiment of the present application, the creation module is further configured to use the business user terminal to jointly sign the key fragment and the business service terminal to jointly calculate the signature value in the certificate request data; generate a certificate request according to the signature value; generate a digital certificate for the user in combination with the CA service according to the certificate request, and save the digital certificate of the user in the business service terminal.

[0071] Optionally, in an embodiment of the present application, the account information of the user includes user information registered through the business user terminal, or user information pre-assigned through the business service terminal.

[0072] Optionally, in an embodiment of the present application, the device 20 further includes an update module (not shown in the figure) for, when detecting that the user modifies the account information, using the symmetric encryption key before the modification to decrypt the saved encrypted jointly signed key fragment, and then using the symmetric encryption key derived from the modified account information by the generation module 201 to re-encrypt the decrypted jointly signed key fragment data.

[0073] The present application provides a jointly signed device, which is provided with a generation module based on the account information of a user, a first signature module coupled to a business service terminal, a creation of a jointly signed key fragment for the user, the jointly signed key fragment including a business user terminal jointly signed key fragment and a jointly signed service terminal jointly signed key fragment; an encryption module for encrypting the jointly signed key fragment, and saving the encrypted business user terminal jointly signed key fragment locally; an authentication module for performing login authentication on a login user of the business user terminal when the business user terminal performs electronic signature; and a receiving module for receiving the feedback of the business service terminal corresponding to the login user after the login authentication passes.

[0074] The household encrypted business user end cooperative signature key fragments are set; a signature module is arranged to call a second signature module coupled to the business user end to decrypt the encrypted cooperative signature key fragments, so that the business user end obtains the decrypted business user end cooperative signature key fragments, and the business user end cooperative signature key fragments are combined with the signature service end cooperative signature key fragments created by the signature service end to calculate the cooperative signature. In this way, the generation and saving process of the cooperative signature key is placed in the business service end, the business user end only has the functions of cooperative signature and cooperative decryption, and each end can only obtain the plaintext data of the cooperative signature key fragment data of the end, and cannot obtain the plaintext data of the cooperative signature key fragment data of the opposite end, so that the security of the cooperative signature key fragment data of each end is ensured, when the data of the business user end is lost, data recovery can be performed from the business service end, without the need of applying for or creating a new cooperative signature key fragment, the generation amount of garbage data is reduced, the system has high working efficiency, and the device structure is simple and easy to implement.

[0075] Embodiment three,

[0076] The embodiment of the application further provides a storage medium having a computer program stored thereon, and the program is executed by a processor to implement any one of the methods of the cooperative signature according to the embodiment one of the application.

[0077] Embodiment four,

[0078] The embodiment of the application further provides an electronic device, such as Figure 3 as shown in the figure, Figure 3 A structure schematic diagram of an electronic device 30 is provided for the embodiment of the application, and the electronic device 30 comprises:

[0079] One or more processors 301, a communication interface 302, a memory 303 and a communication bus 304, the processor 301, the memory 303 and the communication interface 302 complete communication with each other through the communication bus 304;

[0080] The memory 303 is used for storing one or more programs;

[0081] When the one or more programs are executed by the one or more processors 301, the one or more processors 301 implement any one of the methods of the cooperative signature according to the embodiment one of the application.

[0082] So far, the specific embodiments of the present subject matter have been described. In some cases, the actions recorded in the claims can be executed in different orders and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multi-task processing and parallel processing can be advantageous.

[0083] In the 1990s, it was quite obvious to distinguish whether an improvement in a technology was in hardware (e.g., improvement in circuit structures of diodes, transistors, switches, etc.) or in software (improvement in method flow). However, as technology has evolved, many improvements in method flow today can be considered as direct improvements in hardware circuit structures. Designers almost always obtain the corresponding hardware circuit structures by programming the improved method flow into hardware circuits. Therefore, it cannot be said that an improvement in a method flow cannot be implemented by hardware entity modules. For example, a programmable logic device (PLD) (e.g., a field programmable gate array (FPGA)) is an integrated circuit whose logic function is determined by user programming of the device. A designer programs a digital system layer "integrated" on a PLD by himself / herself, without having to ask a chip manufacturer to design and manufacture a special integrated circuit chip. Moreover, instead of manually manufacturing an integrated circuit chip, this programming is now mostly implemented by "logic compiler" software, which is similar to a software compiler used when developing a program, and the original code before compilation also has to be written in a specific programming language, which is called a hardware description language (HDL), and there are many types of HDLs, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc., and the most commonly used are VHDL (Very-High-Speed Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should be aware that, as long as the method flow is logically programmed in the above-mentioned hardware description languages and programmed into an integrated circuit, a hardware circuit implementing the logical method flow can be easily obtained.

[0084] The controller can be implemented in any suitable way, e.g. the controller can take the form of a microprocessor or processor and a computer readable medium storing computer readable program code, e.g. software or firmware, executable by the (micro)processor, logic gates, switches, an application specific integrated circuit (ASIC), a programmable logic controller and an embedded microcontroller

[0085] Examples of controllers in the form of microcontrollers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91 SAM, Microchip PIC18F26K20 and Silicone Labs C8051F320. The memory controller can also be implemented as part of the control logic of the memory. The skilled person will also realize that in addition to implementing the controller in pure computer readable program code, it is well possible to implement the controller in the form of logic gates, switches, an application specific integrated circuit, a programmable logic controller and an embedded microcontroller to perform the same functions by means of logical programming of the method steps. Such a controller can thus be regarded as a hardware component, while the means comprised therein for performing the various functions can be regarded as structures within the hardware component. Or even, the means for performing the various functions can be regarded as both a software module implementing the method and as a structure within the hardware component.

[0086] The system layers, devices, modules or units illustrated by the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer can be a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0087] For the sake of description, the above devices are described in functional division and are described respectively. Of course, the functions of the units can be implemented in the same or more software and / or hardware in the implementation of the present application.

[0088] It should also be noted that the terms "comprising", "comprising" or any other variant thereof are intended to cover non-exclusive inclusion, so that processes, methods, articles or devices including a series of elements not only include those elements, but also include other elements not explicitly listed, or inherent to such processes, methods, articles or devices. Without more limitations, the element defined by the statement "comprising a" does not exclude the presence of additional identical elements in the process, method, article or device including the element.

[0089] Those skilled in the art will appreciate that embodiments of the present application can be readily used as a method, a system, or a computer program product. Accordingly, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present application can take the form of a computer program product on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage devices, etc.) embodying computer readable program code.

[0090] The present application can be described in the general context of computer- executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform particular tasks or implement particular abstract data types. The present application can also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules can be located in both local and remote computer storage media including memory storage devices.

[0091] Each of the embodiments described in this specification has been described taking a progressive approach, with the same or similar parts between embodiments referring to each other, and each embodiment focusing on the differences from other embodiments. In particular, for system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts refer to the part of the method embodiment.

[0092] The above merely provides embodiments of the present application but does not serve to limit the present application. Those skilled in the art can make various modifications and changes to the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the scope of the claims of the present application.

Claims

1. A method of co-signing, characterized by, The method comprises: based on the account information of a user, a first signature module coupled to a business service end creates a co-signature key fragment for the user, the co-signature key fragment comprising a business user end co-signature key fragment and a co-signature service end co-signature key fragment; encrypting the co-signature key fragment, and saving the encrypted business user end co-signature key fragment in the business service end locally; when the business user end performs electronic signing, performing login authentication on the login user of the business user end; after the login authentication is passed, receiving the encrypted business user end co-signature key fragment corresponding to the login user fed back by the business service end; calling a second signature module coupled to the business user end to decrypt the encrypted co-signature key fragment, so that the business user end obtains the decrypted business user end co-signature key fragment and jointly calculates a co-signature with the co-signature service end co-signature key fragment created by the signature service end.

2. The method of collaborative signing of claim 1, wherein, The encryption of the co-signature key fragment comprises: deriving a symmetric encryption key based on the account information of the user; encrypting the co-signature key fragment using the symmetric encryption key; Correspondingly, the decryption of the encrypted co-signature key fragment by the second signature module coupled to the business user end comprises: deriving a symmetric encryption key corresponding to the login user according to the account information of the login user; decrypting the encrypted business user end co-signature key fragment in the business user end using the derived symmetric encryption key corresponding to the login user by the second signature module coupled to the business user end.

3. The method of collaborative signing of claim 1, wherein, Before receiving the encrypted business user end co-signature key fragment corresponding to the login user fed back by the business service end, the method further comprises: detecting whether the co-signature key fragment data has been configured for the user according to the login information of the user.

4. The method of collaborative signing of claim 1, wherein, After creating the co-signature key fragment for the user, the method further comprises: generating a digital certificate for the user; and saving the digital certificate in the business service end; Correspondingly, receiving the encrypted business user end co-signature key fragment corresponding to the login user fed back by the business service end comprises: returning the digital certificate saved in the business service end to the business user end; According to the digital certificate received by the business user end, the encrypted business user end co-signature key fragment corresponding to the login user is determined, and the encrypted business user end co-signature key fragment is received.

5. The method of collaborative signing of claim 4, wherein, The login authentication of the login user of the business user end comprises: performing login authentication on the login user of the business user end according to the digital certificate for the user.

6. The method of collaborative signing of claim 5, wherein, The generation of the digital certificate for the user comprises: jointly calculating a signature value in the certificate request data using the business user end co-signature key fragment and the co-signature service end co-signature key fragment; generating a certificate request corresponding to the user according to the signature value; According to the certificate request, a digital certificate for the user is generated in combination with a CA service, and the digital certificate for the user is saved in a business service end.

7. The method of collaborative signing of claim 1, wherein, The account information of the user includes user information registered through a business user end or user information pre-assigned through a business service end.

8. The method of collaborative signing of claim 1, wherein, The method further includes, when it is detected that the user modifies the account information, decrypting the saved encrypted collaborative signature key fragments using a symmetric encryption key corresponding to the unmodified account information according to the account information modified by the user, and re-encrypting the decrypted collaborative signature key fragment data using a new symmetric encryption key derived from the modified account information.

9. An apparatus for co-signing, the apparatus comprising: The method comprises: A generation module configured to create a collaborative signature key fragment for the user based on account information of the user and a first signature module coupled to a business service end, wherein the collaborative signature key fragment includes a business user end collaborative signature key fragment and a signature service end collaborative signature key fragment; An encryption module configured to encrypt the collaborative signature key fragment and save the encrypted business user end collaborative signature key fragment in the business service end; An authentication module configured to perform login authentication on a login user of the business user end when the business user end performs electronic signing; A receiving module configured to receive the encrypted business user end collaborative signature key fragment corresponding to the login user fed back by the business service end after the login authentication is passed; A signature module configured to call a second signature module coupled to the business user end to decrypt the encrypted collaborative signature key fragment, so that the business user end obtains the decrypted business user end collaborative signature key fragment and jointly calculates a collaborative signature with the signature service end collaborative signature key fragment created by the signature service end.

10. A computer storage medium, characterized in that The computer storage medium stores computer executable instructions, and the computer executable instructions are executed to perform the collaborative signature method in any one of claims 1-8.

Images