Safe and efficient online signature system based on light application platform

Abstract

The invention discloses a safe and efficient online signature system based on a light application platform, relates to the technical field of data encryption transmission, and solves the technical problem of user privacy leakage caused by low encryption strength due to single encryption in the prior art. A signature request is generated through a management end, a front-end frame, a rear-end frame and a data transmission protocol are selected, a data transmission channel is constructed to connect the management end and a user end, and identity verification information of the user end is verified to obtain an identity verification state; generating a public key and a private key, and sending the public key and the signature request to the user side based on the identity verification state; after a signature request is received, a signature permission is granted to a user based on the signature request to obtain a signature image; dual encryption is performed on the signature image through the public key and the temporary key, and the signature image is integrated and sent to a management end after encryption is completed; and decrypting the public key and the temporary key, and adding the decrypted signature image to the signature file to complete the signature task.

Description

Technical Field

[0001] The present invention belongs to the field of data encryption transmission, and specifically relates to a safe and efficient online signature system based on a light application platform. Background Art

[0002] With the popularity of online conferencing and remote work, the demand for services that require online signatures, such as meeting signatures and remote approval, has also increased. Although it is convenient to use WeChat applets for electronic signatures, there are difficulties and security risks in transferring files between internal and external networks. Being able to complete users' online signature tasks safely and efficiently has become an important issue that needs to be urgently addressed.

[0003] The invention patent with application number CN2018114864816 discloses an application online signing method and system. The invention sends an application signing request to the signing end at the management end, verifies the legitimacy of the user's identity based on the identity authentication information, certificate ID and data certificate in the signature request, and after the verification, the user completes the signature to obtain the signature file, and completes the signature by applying the signature file; when the user end transmits the signature file to the management end, the invention extracts the first designated position of the signature application file, and encrypts it using the SM2 algorithm, and applies the signature application file after decryption at the management end. During the data transmission process, a single encryption may be attacked, resulting in the data transmission channel being intercepted and the user's signature image being leaked, making it impossible to complete the online signing task safely and efficiently.

[0004] The present invention provides a safe and efficient online signature system based on a light application platform to solve the above technical problems. Summary of the invention

[0005] The present invention aims to solve at least one of the technical problems existing in the prior art; to this end, the present invention proposes a secure and efficient online signature system based on a light application platform, which is used to solve the technical problem in the prior art that the user's privacy is leaked due to the low encryption strength caused by a single encryption.

[0006] To achieve the above-mentioned object, the first aspect of the present invention provides a secure and efficient online signature system based on a light application platform, comprising: a task management module, a data transmission module and a data encryption module;

[0007] Task management module: used to generate signature requests;

[0008] Data transmission module: used to build a data transmission channel between the management end and the user end, verify the user end's identity authentication information to obtain the identity authentication status, and send the signature request to the user end through the data transmission channel based on the identity authentication status;

[0009] Data encryption module: used to grant the user end signature authority based on the signature request to obtain the signature image, transmit the signature image to the management end through the data transmission channel; decrypt the signature image and add it to the signature file.

[0010] The present invention constructs a data transmission channel linking the management end and the user end by constructing a front-end framework, a back-end framework and a data transmission protocol, verifies the identity of the user through the login verification information and the identity verification information of the user end to obtain the identity verification status, can ensure the security and integrity of the data during the transmission process, and improve the security of the system; the management end generates a signature request, and generates a public key and a private key, transmits the public key and the signature request to the server, the server verifies the signature authority of the user end, after the verification, the server transmits it to the user end, the user signs, the user end intercepts and obtains the signature image, generates a temporary key to encrypt the signature image, encrypts the temporary key through the public key, forms double encryption, greatly increases the security and defense strength of the system, after the encryption is completed, it is integrated and sent to the management end, the management end decrypts the public key through the private key to obtain the temporary key, decrypts the signature image through the decrypted temporary key, and adds the decrypted signature image to the signature file to complete the signature, ensuring the security and integrity of the data.

[0011] Preferably, the step of constructing a data transmission channel between the management end and the user end includes:

[0012] Build the initial data channel, build the front-end framework and the back-end framework, select the WebSocket protocol as the data transmission protocol, and connect the management end and the user end.

[0013] Preferably, the verifying the identity authentication information of the user terminal to obtain the identity authentication status includes:

[0014] A1: extract the login verification information and identity verification information of the user end; the login verification information includes the login ID and the login user end ID; the identity verification information includes the signature ID and the management end ID;

[0015] A2: Determine whether the user ID and the management ID conform to the data transmission protocol; if yes, jump to A3; if no, mark the identity authentication status as verification failure;

[0016] A3: Determine whether the login ID is the same as the signature ID; if yes, mark the identity verification status as passed; if no, mark the identity verification status as failed.

[0017] Preferably, the step of granting the user terminal signature authority based on the signature request to obtain the signature image includes:

[0018] Extract the signature request; the signature request includes the request signature and the initiation authority;

[0019] The management end sends a signature request to the server. The server verifies the initiating authority. After the verification, it generates a public key and a private key, and transmits the public key and the signature request together to the user end. The user end opens the signature authority and captures the signature image after completing the signature.

[0020] Preferably, the step of transmitting the signature image to the management end through the data transmission channel includes:

[0021] Extract signature image;

[0022] Generate a temporary key corresponding to the signature image, encrypt the signature image with the temporary key, encrypt the temporary key with the public key, and send the encrypted signature image and the encrypted temporary key to the management end through the HTTPS protocol.

[0023] Preferably, the decrypting the signature image and adding it to the signature file comprises:

[0024] Extract signature image;

[0025] The public key is decrypted by the private key to obtain a temporary key, the signature image is decrypted by the decrypted temporary key, and the decrypted signature image is added to the signature file to complete the signature.

[0026] Compared with the prior art, the present invention has the following beneficial effects:

[0027] 1. The present invention generates a signature request through the management end, selects the front-end framework, the back-end framework and the data transmission protocol, builds a data transmission channel to connect the management end and the user end, verifies the identity authentication information of the user end to obtain the identity authentication status, and if the identity authentication is passed, the signature request and the public key are sent to the user end through the data transmission channel, ensuring the stability and reliability of the system, and the light application platform is easy to expand and integrate; after the user end receives the signature request, it grants the user signature authority based on the signature request to obtain a signature image; the signature image is doubly encrypted by the public key and the temporary key, and after the encryption is completed, it is integrated and sent to the management end; the management end decrypts the public key by the private key, decrypts the signature image by the decrypted temporary key, and adds the decrypted signature image to the signature file to complete the signature, ensuring the security and integrity of the data during the transmission process, improving the security of the system, ensuring instant feedback of user operations, and improving user satisfaction.

[0028] 2. The present invention encrypts the signature image by setting a public key and a secret key, transmits the public key and the signature request together to the user end, and performs double encryption on the user's signature image in combination with a temporary key to prevent leakage of user privacy. The signature image and the temporary key are encrypted separately. Even if one of them is cracked, the other remains safe, which greatly improves the security of the system and ensures the security and integrity of the data. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0030] Figure 1 The following is a flowchart of an embodiment of the present invention.

[0031] Figure 2 It is a system composition diagram of the present invention.

[0032] Figure 3 The complete flowchart of obtaining the identity authentication status in one embodiment of the present invention. DETAILED DESCRIPTION

[0033] The technical scheme of the present invention will be clearly and completely described below in conjunction with the embodiments. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0034] See also Figure 1-Figure 3 , the first aspect of the present invention provides a secure and efficient online signature system based on a light application platform, including: a task management module, a data transmission module and a data encryption module;

[0035] Task management module: used to generate signature requests.

[0036] For example, the management end has a document that requires user A to sign online, and sends it to user A through a sharing link of the WeChat applet. In this case, user A is the user end; a signature request that requires A to sign is generated on the management end.

[0037] Data transmission module: used to build a data transmission channel between the management end and the user end, verify the user end's identity authentication information to obtain the identity authentication status, and send the signature request to the user end through the data transmission channel based on the identity authentication status.

[0038] Exemplarily, an initial data channel is constructed, Vue.js is selected as the user-side framework, SpringCloud is selected as the management-side framework, and the WebSocket protocol is selected as the data transmission protocol, and a data transmission channel connecting the management side and the user side is constructed.

[0039] It should be noted that choosing Spring Cloud as the management framework can handle the communication between the management end and multiple user ends by establishing multiple databases. Each database is independent, and there is no coupling between services, which has good scalability and reusability.

[0040] In another preferred embodiment, if the online signature service is a one-way transmission from the user end to the management end, the data transmission protocol can use HTTP or HTTPS protocol; in this embodiment, the WebSocket protocol is selected as the data transmission protocol to realize real-time interactive transmission between the management end and the user end, and the data transmission speed is faster.

[0041] Extract the login ID and login user ID authorized by the user terminal in WeChat, as well as the signature ID and management terminal ID uploaded by the management terminal. The login user terminal ID and the management terminal ID are the device communication IDs of both ends. Determine whether the user terminal ID and the management terminal ID comply with the data transmission protocol. Determine whether the login terminal ID and the management terminal ID comply with the WebSocket protocol and can achieve two-way intercommunication transmission. Then continue to determine whether the login ID is the same as the signature ID. The login ID and the signature ID can be selected as the user name or mobile phone number. In this embodiment, it is the user name. The login ID and the signature ID are both user A, and the identity authentication status is marked as verified.

[0042] After the verification is passed, the management end sends a signature request to the server through the API. After receiving the signature request, the server parses the signature request to obtain the request signature and initiation permission, verifies the initiation permission, and verifies whether the token of the management end meets the sending permission. After the verification is passed, the public key and private key are generated, and the public key and the signature request are transmitted to the user end through the data transmission channel. After receiving the signature permission, the user end opens the signature interface, and user A signs on the signature interface. After clicking confirm, the user end takes a screenshot of the signature interface to obtain the signature image.

[0043] It should be noted that the public key and the private key are a pair of public and private keys, the public key is used for encryption, and the private key is used for decryption. In this embodiment, the public key is used to encrypt the temporary key to form a secondary encryption, which provides double protection for the user's signature image to prevent the user's signature image from being leaked, and the public key requires the private key for decryption. During the transmission process, the private key is not transmitted at the management end, and the public key and the signature image are bound for transmission. If there is an external attack transmission channel, the use of public and private keys can greatly increase the defense strength.

[0044] Data encryption module: used to grant the user end signature authority based on the signature request to obtain the signature image, transmit the signature image to the management end through the data transmission channel; decrypt the signature image and add it to the signature file.

[0045] Exemplarily, an AES temporary key is generated on the user side, the signature image is encrypted by the AES temporary key, and the AES temporary key is encrypted by the public key, and the public key is integrated with the signature request and sent to the management side via the HTTPS protocol.

[0046] On the management side, the public key is decrypted by the private key to obtain the AES temporary key, the signature image is decrypted by the AES temporary key to obtain the signature image, and the decrypted signature image is added to the signature file to complete the signature.

[0047] Working principle of the present invention:

[0048] The present invention generates a signature request at the management end, constructs a front-end framework, a back-end framework and a data transmission channel of a data transmission protocol to connect the management end and the user end; verifies the identity of the user through the login verification information and identity verification information of the user end to obtain the identity verification status; after the identity verification is passed, the management end sends a signature request to the server, the server verifies the initiation authority of the management end, generates a public key and a private key after the verification is passed, integrates the signature request with the public key and sends it to the user end; after the user end receives the signature authority, generates a corresponding temporary key, encrypts the signature image through the temporary key, and encrypts the temporary key through the public key, sends the encrypted signature image and the encrypted temporary key to the management end, the management end decrypts the public key through the private key to obtain the temporary key, decrypts the signature image through the decrypted temporary key to obtain the signature image, and adds the decrypted signature image to the signature file to complete the signature.

[0049] The above embodiments are only used to illustrate the technical method of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical method of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical method of the present invention.

Claims

1. A secure and efficient online signature system based on a light application platform, characterized by: include: Task management module, data transmission module and data encryption module; Task management module: used to generate signature requests; Data transmission module: used to build a data transmission channel between the management end and the user end, verify the identity authentication information of the user end to obtain the identity authentication status, and send the signature request to the user end through the data transmission channel based on the identity authentication status; Data encryption module: used to grant the user end signature authority based on the signature request to obtain the signature image, and transmit the signature image to the management end through the data transmission channel; Decrypt the signature image and add it to the signature file.

2. According to claim 1, the secure and efficient online signature system based on the light application platform is characterized in that: The step of constructing a data transmission channel between the management end and the user end includes: Build the initial data channel, build the front-end framework and the back-end framework, select the WebSocket protocol as the data transmission protocol, and connect the management end and the user end.

3. According to claim 1, the secure and efficient online signature system based on the light application platform is characterized in that: The authentication status of the authentication information of the authentication client is obtained, including: A1: extract the login verification information and identity verification information of the user end; the login verification information includes the login ID and the login user end ID; the identity verification information includes the signature ID and the management end ID; A2: Determine whether the user ID and the management ID conform to the data transmission protocol; if yes, jump to A3; if no, mark the identity authentication status as verification failure; A3: Determine whether the login ID is the same as the signature ID; if yes, mark the identity verification status as passed; if no, mark the identity verification status as failed.

4. According to claim 1, the secure and efficient online signature system based on the light application platform is characterized in that: Granting the user terminal signature authority based on the signature request to obtain the signature image includes: Extract the signature request; the signature request includes the request signature and the initiation authority; The management end sends a signature request to the server. The server verifies the initiating authority. After the verification, it generates a public key and a private key, and transmits the public key and the signature request together to the user end. The user end opens the signature authority and captures the signature image after completing the signature.

5. According to claim 1, the secure and efficient online signature system based on the light application platform is characterized in that: The step of transmitting the signature image to the management end through the data transmission channel includes: Extract signature image; Generate a temporary key corresponding to the signature image, encrypt the signature image with the temporary key, encrypt the temporary key with the public key, and send the encrypted signature image and the encrypted temporary key to the management end through the HTTPS protocol.

6. The secure and efficient online signature system based on a light application platform according to claim 1 is characterized in that: The decrypting the signature image and adding it to the signature file comprises: Extract signature image; The public key is decrypted by the private key to obtain a temporary key, the signature image is decrypted by the decrypted temporary key, and the decrypted signature image is added to the signature file to complete the signature.

Images