Localized digital signing terminal supporting plug and play

Abstract

The invention provides a plug-and-play supported localized digital signature terminal, which comprises a file preview module for acquiring an incoming file, previewing the file, adapting to a layout file, positioning a signature position, calling a handwriting signature acquisition terminal device to acquire an electronic signature handwriting time sequence feature sequence or fingerprint stamping image data, and sending the electronic signature handwriting time sequence feature sequence or fingerprint stamping image data to the file preview module; electronic signature strokes are obtained, and a synthesis module synthesizes the signature strokes or / and the stamped images into signatures or / and signatures locally, echoes and adds the signatures or / and signatures to the signing position of the layout file; the cryptographic module adopts a national cryptographic algorithm to calculate digital signatures and encrypted data packets for electronic files, signature handwriting data and stamped data, and the auxiliary module stores, certificates and counts signature contents and signature operation logs in a local terminal; and the identity assistance and authentication module binds the electronic signature handwriting data with the identity information of the signer or / and verifies the identity of the signer according to the handwriting data.

Description

Technical Field

[0001] The invention relates to the technical field of artificial intelligence and information security, and in particular to a localized digital signature terminal supporting plug-and-play. Background Art

[0002] With the development of increasingly extensive application needs in the information society, the signing and management of electronic documents are receiving more and more attention. Signing scenarios involve the convenience and security of signing documents. As one of the inherent biological characteristics of the actor, electronic signature plays an increasingly important role in judicial activities. Electronic signatures can be generally understood as "digital fingerprints" stamped on electronic documents, generally including basic signature information, such as electronic signature trajectory information, time information, pen state information and other user behavior characteristics (pen pressure, pen speed, signature style, etc.). Based on these data, the question of "are you you" is verified through handwriting authentication algorithms.

[0003] Traditional signing is to access the signing service provided on the server and let the server complete the document signing function. However, due to network communication problems and the information security issues that may be caused by the transmission of the content of the document to be signed on the network.

[0004] For example, the publication number: CN110943844A, named "A method and system for secure signing of electronic documents based on local services of web clients", discloses a method and system for secure signing of electronic documents based on local services of web clients, involving the field of electronic signature services for electronic documents, especially using a private key based on the public key cryptography PKI standard to avoid the need for Ukey. By deploying specific WEB script commands on the server side, the WEB browser can obtain a module for secure electronic document signing when accessing specific content, thereby replacing the traditional signing method that requires Ukey or mobile terminal cooperation. Users only need to use a web browser to securely implement electronic signing.

[0005] Publication number: CN113806815A, name “A file signing method and system” The client transmits the received target file identification and the account information of the signer to the cloud server; the cloud server obtains the authentication information according to the account information of the signer, and generates a signing instruction according to the target file identification and the authentication information, and transmits the signing instruction to the signing server; the signing server parses the signing instruction to obtain the target file identification and the signing information; the signing server retrieves the corresponding target transferred storage file from the multiple transferred storage files stored in the storage service according to the target file identification; the signing server synthesizes the seal image to the corresponding seal position in the target transferred storage file to obtain the initial signed file; the signing server calculates the signature value according to the initial signed file and the certificate information, and adds the calculated signature value to the initial signed file to obtain the target signed file.

[0006] Although the signature of the existing technology is to sign the file through the terminal device, the terminal device is only a handwriting collection device, but the signing task is completed by the server. The signature data needs to be transmitted to the server through the public network for file signing synthesis. In order to realize the electronic signature on various electronic documents, complex deployment is required, including signing terminals, servers, transmission channels, etc. Some private customers are unwilling to hand over their signature information to a third party, which may easily lead to the leakage of user signature privacy data and network congestion caused by large-scale data transmission. It is unable to cope with business scenarios where customers do not want to transfer private files to the network environment, and it is unable to solve the actual scenarios where customers are unwilling or unable to connect with the server through development but have signing needs.

[0007] Existing electronic signature solutions mostly rely on complex information systems, which are not only costly, but also complex to deploy and maintain. For example, if you need to electronically sign / stamp electronic documents such as contracts, you need to collect a large amount of high-precision signature handwriting data and synthesize the signature on the document to be signed in order to obtain sufficient information for handwriting verification and comparison in the later stage. It is necessary to perform complex calculations and processing on the electronic signature data obtained by the collection device. Therefore, it is necessary to deploy a special electronic signature server to process, encrypt, and synthesize the collected handwriting data, generate a signed document, and then return it to the signing terminal to show it to the signatory. The electronic signature platform has high deployment costs and is complex to use and maintain. In addition, when the collected electronic signature data is transmitted to the electronic signature platform for signature synthesis, there may be a risk of data leakage, and there is a risk of leakage of personal privacy data and company secrets. At the same time, the interaction and transmission of a large amount of signature data and signed documents between the signature server and the signature terminal increases the burden on the network and affects the user experience. Therefore, there is an urgent need for a simple, secure, low-cost and easy-to-deploy electronic signature solution. Summary of the invention

[0008] In view of this, the present invention aims at the existing problem that signing files through terminal devices requires the signature data to be transmitted to the server through the public network for file signing synthesis, which requires complex deployment and privacy data leakage. The present invention proposes a localized digital signature terminal that supports plug-and-play, and the collection of electronic signatures and file synthesis to generate signed files are all completed on the local terminal.

[0009] According to one aspect of the present application, a plug-and-play localized digital signature terminal is proposed, including a signing module, a synthesis module, an encryption module, an identity auxiliary authentication module, and an auxiliary module, wherein the file preview module obtains the file to be signed transmitted by the local interface, previews and adapts the layout file and locates the signing position; the signing module obtains the electronic signature handwriting feature sequence or / and fingerprint imprint or / and electronic seal image data collected by the terminal device, processes the handwriting feature sequence, and echoes the generated signature strokes; the synthesis module locally synthesizes the signature strokes or / and the imprint image into a signature or / and a seal and adds it to the signing position of the layout file to form a signature file; the encryption module calculates the digital signature value and the encrypted data packet according to the signature file and the signature handwriting data / imprint data, and encrypts the signature file; the auxiliary module stores the encrypted signature file and the encrypted data packet locally through the submission interface, and at the same time counts the signature content and the signing operation log; the identity assistance and authentication module binds the electronic signature handwriting data with the signer's identity information or verifies the signer's identity according to the signature handwriting data.

[0010] Further preferably, the file preview module obtains the file to be signed through an interface or browser plug-in, the file preview module obtains the file to be signed manually uploaded through the desktop shortcut window, automatically obtains the file to be signed at the local file address location, obtains the file to be signed through the local Http service, and establishes a long connection with the signing module through the WebSocket service.

[0011] Further preferably, the signing terminal includes front-end services and back-end services, wherein the front-end services include FTTP services, Websocket services, FTP services, network printing services, and local file services; the FTTP services provide interface and page level services, the Websocket services provide interface level services, and the local file services select the files to be signed through the signing terminal; in the back-end services, HTTP push and Websocket push partially push relevant business data according to the type of front-end services, and the FTTP push signature data is saved to the signing terminal or the directory specified by the business terminal.

[0012] Further preferably, when it is necessary to affix an electronic seal to an encrypted signature document, the identity auxiliary authentication module verifies through the legal person authorization verification management platform whether the electronic signature of the signature document is the electronic signature of a registered corporate legal person or an authorized manager of the legal person. If so, the electronic seal image registered and bound to the legal person in the electronic seal database is called and synthesized into the signing position of the encrypted signature document.

[0013] Further preferably, a lightweight model is constructed in the signing module to extract the deep features of the handwritten electronic signature, and a downsampling module is added to the lightweight model to downsample the handwritten electronic signature to reduce the length of the electronic signature handwriting time series feature data.

[0014] Further preferably, the lightweight model includes a feature normalization module, a multi-level deep separable convolution layer, a maximum pooling layer, and a soft alignment module. The signing module obtains the electronic signature handwriting time series data collected by different devices, unifies the electronic signature format, and obtains the normalized value of each feature of all handwriting sampling points. The multi-level deep separable convolution layer extracts the local features of each electronic signature according to the normalized value. The maximum pooling layer fuses the local features to obtain the deep features of the electronic signature. The soft alignment module aligns the corresponding dimensional features according to the deep features of the electronic signature, and obtains the user's electronic signature strokes according to the aligned deep features.

[0015] Further preferably, the encrypting of the signature file includes, the encryption module uses the SM9+SM4 combined encryption algorithm to encrypt the signature file, including, calling the SM4 algorithm to encrypt the source data of the file to be signed to obtain a key, calling the SM9 algorithm to encrypt the SM4 key to obtain a document summary, calculating the SM9 digital signature value according to the document summary, using the digital SM9 signature value to sign the signature file, and obtaining an encrypted signature file.

[0016] Further preferably, the preview module has built-in PDF and OFD document parsers, the document parser determines the type of file to be signed, and parses the file to obtain a layout file, the synthesis module adds a signature field to the layout file to be signed according to the located signature position, obtains the signature strokes and / or the fingerprint image and / or the electronic seal image generated by the signature module according to the signature handwriting data, and synthesizes the signature information in the signature field.

[0017] It is further preferred that the signature information structure of the synthesized electronic signature strokes and the seal is the same, including solidifying the signature and / or the sealed file and the original hash value in the first field of the signature information, the identification ID of the cryptographic public key as the second field of the signature information, the signing timestamp as the third field of the signature information, and calculating the signature value based on the above signing information fields as the fourth field; calculating the signature value based on the original hash, the identification ID of the cryptographic public key, and the signing timestamp using the national secret algorithm SM9 and placing the trusted timestamp in the last field.

[0018] In order to reduce the high cost and complex deployment process of electronic signatures, a digital handwriting signature terminal product that supports plug-and-play localized applications is provided. The present invention adopts a lightweight model design of local integrated signing, synthesis, encryption modules and signature modules. It only needs to access the existing system, install and run the corresponding application program, and the terminal can be called locally to complete the signing, stamping, and other signing operations.

[0019] The risk of data leakage during the transmission and storage of electronic signatures. The signature content of the present invention is all synthesized in the local signing terminal, avoiding the hidden danger of data leakage during the transmission and storage of electronic signatures. By integrating signing hardware of different modules, the signature board, card reader, fingerprint collection, panoramic camera, sound collection, timestamp, password and other modules can be integrated into the signing device to meet the customized usage scenarios of various projects. It solves the signing problem caused by the imperfect user information system or the chaotic internal system management. For some users who lack information systems, the use and management of internal systems are chaotic, and the overall transformation of the system is difficult to promote, through relatively cheap and fast access methods, we can quickly respond to customer needs, solve customer signing needs, and ensure that the corresponding local signing operation has the same judicial effect as the online signing through encrypted evidence storage. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Further details, features and advantages of the present application are disclosed in the following description of exemplary embodiments in conjunction with the attached drawings.

[0021] Figure 1 This is a schematic diagram of the plug-and-play electronic signature terminal structure in an exemplary embodiment of the present application; Figure 2 This is a schematic diagram of a signing terminal and a business terminal in an exemplary embodiment of the present application; Figure 3 This is an example diagram of the implementation of the corporate legal person's signing and stamping of an electronic seal in the exemplary embodiment of this application. DETAILED DESCRIPTION

[0022] The embodiments of the present application will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present application are shown in the accompanying drawings, it should be understood that the present application can be implemented in various forms and should not be construed as being limited to the embodiments described herein. Instead, these embodiments are provided to provide a more thorough and complete understanding of the present application. It should be understood that the drawings and embodiments of the present application are only for exemplary purposes and are not intended to limit the scope of protection of the present application.

[0023] It should be understood that the various steps described in the method implementation of the present application can be performed in different orders and / or performed in parallel. In addition, the method implementation may include additional steps and / or omit the steps shown. The scope of the present application is not limited in this respect.

[0024] The term "including" and its variations used in this document are open inclusions, that is, "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one other embodiment"; the term "some embodiments" means "at least some embodiments". Relevant definitions of other terms will be given in the description below. It should be noted that the concepts of "first", "second", etc. mentioned in this application are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0025] It should be noted that the modifications of "one" and "plurality" mentioned in the present application are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0026] The names of the messages or information exchanged between multiple devices in the embodiments of the present application are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0027] The archiving of various electronic documents and the signing of electronic contracts all require electronic signatures, fingerprints, electronic seals, etc. to prove the authenticity and initiative of the signing behavior. The signature and seal of electronic documents in the existing technology collects the electronic signature handwriting data and seal data through the signing terminal, and transmits the data to a unified signature, seal, and seal service platform for data processing and integration with the electronic document. In order to ensure that the authenticity of the electronic signature can be verified later, a certain amount of handwriting data needs to be collected. Due to the large amount of electronic signature handwriting feature sequence data, the large amount of seal image and signature image data, and the complexity of encryption processing, the existing technology usually uses a unified signature, seal, and seal service platform to complete the signing synthesis of electronic documents.

[0028] The present invention provides a local electronic document signature terminal supporting plug-and-play, and its main features are as follows: Plug and Play: This signing terminal device only needs to be connected to the business system that needs to sign documents and install the corresponding local signing application driver, and it can be quickly started and used.

[0029] Local signature: All signature contents are synthesized on the local signing terminal, avoiding the risk of data leakage during network transmission and cloud storage, as well as network congestion and waste of resources.

[0030] Low cost: Relatively cheap hardware devices and simple deployment methods reduce users' total cost of ownership.

[0031] The plug-and-play signing terminal device has a USB interface or other standard interface, and supports plug-and-play functions with desktop computers, business system terminals and servers, and electronic signature collection terminals; including functions for reading files to be signed, displaying the signing interface, synthesizing the signed content, and saving the signed files. Connect the signing terminal device to the computer or server through a USB interface or other standard interface. Obtain the electronic file to be signed through an interface or browser plug-in, and the plug-and-play signing terminal displays the signing interface. The user enters or selects the signing content on the signing interface, and the local plug-and-play signing terminal synthesizes the signed content with the electronic file to generate the signed file. The signed file is saved in the local business system server and local terminal, and the user can print, save and further process the signed file. The signing terminal device has a built-in encryption module to ensure the security of the signing process; the signing terminal device has a built-in lightweight network model, and the processing of handwriting feature data and the signature content are synthesized locally without network transmission, avoiding personal privacy data leakage and network congestion.

[0032] like Figure 1 Shown is a schematic diagram of the plug-and-play electronic signature terminal structure in an exemplary embodiment of the present application.

[0033] The plug-and-play signing terminal in the embodiment of the present application includes: a signing module, a synthesis module, an encryption module, an identity auxiliary authentication module, and an auxiliary module.

[0034] The signing module collects the user's electronic signature data and fingerprint data, and echoes the signature image according to the signature handwriting timing data; the file preview module receives the electronic file to be signed from the business system through the local interface and adapts the file format; the synthesis module synthesizes the signature image or fingerprint at the specified position of the file; the encryption module encrypts and digitally signs the electronic file of the signature handwriting timing data, fingerprint data, and signature synthesis, and generates an encrypted data packet; the auxiliary module stores the signed electronic files and encrypted data packets and completes log statistics; all signature contents are synthesized, encrypted and stored on the local terminal.

[0035] The synthesis module locally synthesizes the signature data, imprint data, electronic seal and the document to be signed, and the encryption module uses the national secret algorithm to encrypt the signed document and signature data.

[0036] The signing terminal file preview module obtains the files to be signed from the connected business system and terminal device through the local access interface, previews the files, adapts the relevant layout files and locates the signing position; the signing module obtains the electronic signature handwriting time feature sequence or fingerprint imprint image data collected from the electronic signature terminal, processes the electronic signature handwriting time feature sequence and generates signature strokes, and the synthesis module locally synthesizes the signature strokes and / or the imprint image to the located layout file signing position; the password module uses the national secret algorithm to calculate the digital signature and encrypt the data packet for the electronic file, signature handwriting data and imprint data, and the auxiliary module stores, records and counts the signature content and signing operation log in the local terminal.

[0037] A lightweight model is configured in the signing module. The lightweight model includes a downsampling module, a Soft-DTW module, a depthwise separable convolutional layer, a maximum pooling layer, and an echo module.

[0038] In the signing module, the deep features of the preprocessed handwritten electronic signature are extracted through a lightweight model, and a downsampling module is added to the lightweight model to downsample the handwritten electronic signature handwriting feature sequence, thereby reducing the length of the time series in the handwriting feature sequence and reducing the computational complexity of the subsequent soft dynamic time warping (Soft-DTW) alignment process. When the same electronic document is signed on different signing terminals, the electronic signature handwriting time series data extracted from different acquisition devices is unified to obtain the normalized value of each time series feature of all handwriting sampling points after downsampling; the multi-level deep separable convolution layer in the lightweight network model extracts the local features of each signature handwriting through the normalized value of each time series feature, and the maximum pooling layer fuses various local features to extract the deep features of the signature handwriting; the soft alignment module (Soft-DTW) aligns the corresponding dimensional feature sequence data of the electronic signature handwriting signed by different devices according to the deep features, and the echo module echoes the aligned signature handwriting feature sequence data to obtain the stroke trajectory of the user's electronic signature.

[0039] The synthesis module synthesizes the acquired echoed electronic signature handwriting data and fingerprint data image into a signed signature and a seal locally and adds it to the designated signature position of the layout file. The password module encrypts the handwriting data, fingerprint data and the synthesized file using the national secret algorithm. The identity auxiliary verification module is used to confirm the identity of the signer or bind it to the identity. The identity auxiliary verification module obtains the signed handwriting feature sequence number and compares it with the locally stored handwriting data. If no matching handwriting data is found, it sends an instruction requiring the signer to submit the signer's identity feature information such as identity mark / fingerprint / face, and binds the signature and seal data to the signer's identity feature information. When it is detected that the locally stored electronic signature handwriting data is consistent with the signed signature handwriting data, the identity feature information bound to the matching handwriting data can be further verified to confirm the signer of the signature. The verification of the signer's identity feature information (including: identity mark, fingerprint, portrait, etc.) can include ID card comparison, liveness detection, fingerprint comparison, and portrait comparison. The auxiliary module includes a local storage module, an evidence service module, and a log statistics module.

[0040] The following example illustrates a synthesis method of the terminal signing file. Without changing the file structure of the original file, a signature field is added to the signature position of the positioning format file, including: adding electronic signature handwriting, fingerprints and signature fields of electronic signature information. Among them, the signature information structure of the electronic signature handwriting and fingerprints is the same, mainly including: original text HASH, the HASH value calculated according to the data after the signature information is removed from the file signing as the original text HASH, the hash value calculated by the file after the signature or / and the fingerprint and the original text hash value are solidified in the first field of the signature information; the identification ID of the cryptographic public key is used as the second field of the signature information, and the cryptographic public key can be obtained through the identification ID for subsequent signature verification; the third field of the signature information is the signing timestamp. The signature value calculated according to the above signing information field is stored in the fourth field, such as the signature value calculated according to the above signing information field with SM9. Finally, the trusted timestamp is calculated, and the obtained trusted timestamp is placed in the last field. The information formed by integrating the above fields is used as the signing information.

[0041] The above is just one method of constructing signature information. The placement of signature information, identification ID, signature timestamp, signature value, etc. can be adjusted as needed.

[0042] The signing terminal can be configured with: electronic screen, timestamp chip, encryption chip, network module, power module, ID card reader, fingerprint reader, camera, sound collection, speaker, high-speed scanner, etc.

[0043] The PC and the signing terminal transmit the signed and signed files through the Websocket interface.

[0044] Configure the local signing application module on the PC, and the signing terminal supports manual uploading of pushed files through the desktop shortcut window; supports automatic acquisition of files to be signed through the local file address location and pushes them to the signing terminal; supports acquisition of files to be signed through local Http service and pushes them to the signing terminal; through the WebSocket service and the signing terminal long connection, multiple signing terminals can sign the same document at the same time; supports acquisition and push through other PC-side electronic data acquisition methods such as interfaces or browser plug-ins.

[0045] The plug-and-play signature terminal and the electronic signature collection device exchange data through the human-machine interface device HID. HID is a device used for human-machine interaction. Its main function is to convert the user's input (such as key presses, mouse movements, etc.) into a digital signal that the computer can understand, or to convert the computer's output signal into a form that the user can perceive (such as vibration feedback, etc.). The signing terminal uses the HID protocol as the underlying data transmission link, and establishes a set of data control and transmission protocols on this basis. The protocol message structure is: message header | message control identifier | message data identifier | message length | message data.

[0046] The signing terminal device is installed with devices including Android, Windows or other operating systems. The signing terminal device contains an electronic screen timestamp chip that supports signing (such as Beidou timing chip), a password module, a network module, and a power module.

[0047] The electronic screen of the signing terminal is used to display the content to be signed and complete the corresponding operations of signing and collection; the timestamp chip provides timestamp services in offline scenarios, and online timestamps can be obtained through cloud services in networked scenarios; the password module provides encryption and decryption algorithm capabilities for the acquired signature data and signature synthesis data; the network module can include wireless, wired and mobile networks. Used for connection with PC-side programs or servers; the power module includes direct plug-in type and internal battery to ensure that the signing is completed by independent use of the device. The signing terminal device can also be equipped with modular components such as ID card reader, fingerprint scanner, high-speed scanner, camera, sound collection equipment, speakers, etc., which can be selected according to actual conditions.

[0048] The file preview module is responsible for browsing and operating layout files, adapting layout files, finding and locating the location to be signed, the location to be stamped, and the location to write the password, and adapting to standard layout file formats such as PDF and OFD.

[0049] The signing module previews the received document to be signed, and echoes the collected electronic signature data to generate a signature handwriting image, which is synthesized into the signature position of the electronic document to be signed. The synthesis module has built-in PDF and OFD document parsers. When receiving the synthesis instruction issued by the signing module, the built-in document parser first determines the file type, then parses the file, and generates a signature handwriting image from the digital handwriting data of the echo unit, draws the image to the specified position of the file, and displays the signature content.

[0050] The password module calls the encryption algorithm to encrypt the electronic signature handwriting data, uses the SM9+SM4 combined encryption algorithm, calls the SM4 algorithm to encrypt the source data, and the SM9 algorithm encrypts the SM4 secret key to ensure data security and encryption efficiency. Calculate the document summary, the password module further calculates the SM9 signature value, and embeds the signature value into the electronic file with the signature handwriting, and finally completes the file synthesis.

[0051] The identity auxiliary module is used to collect and obtain the auxiliary identity information of the signing user offline. The auxiliary identity information can include ID card reading, identity fingerprint comparison, and ID card head portrait face recognition. It is used in scenarios with high security requirements to enhance the validity of signed documents.

[0052] The operation entity identifier is set to a value used to uniquely identify the operation entity, including the name or identifier of the operation entity, which can be a person's name or an organization's name; the value indicating the type of identity card used by the operation entity is the operation entity identity card type; the hash value obtained by hashing the operation entity identity card information is used as the operation entity identity card hash value. The identity card hash value is usually used to protect privacy and security to avoid directly storing sensitive information.

[0053] The handwriting duration, handwriting feature data, encrypted handwriting data hash value, and handwriting image are generated. The time difference between the first pen start and the last pen lift in the signing process is recorded as the handwriting duration. The handwriting feature data includes but is not limited to the sampling point horizontal coordinate, vertical coordinate, pen pressure, and the time difference between each sampling point (x, y, p, t). The handwriting feature data is encrypted to generate the handwriting data hash value.

[0054] The evidence storage service module is responsible for solidifying the user's signing behavior and signed documents, calculating the hash value of the document before signing, the signed information, and the document after signing, and generating an encrypted data package in combination with the timestamp and the signature value obtained by the encryption module. The encrypted data package is stored locally. When connected to the Internet, the evidence data package can be submitted to the cloud evidence storage service, and the evidence data can be further consolidated through cloud evidence storage.

[0055] The log statistics module records the signing operation behavior of users in the signing terminal.

[0056] like Figure 2The figure shows a schematic diagram of the signing terminal and the business end in the exemplary embodiment of the present application. Loading the signing terminal driver on the business PC end can provide more abundant input and output methods, and can be connected to the signing terminal through a network card, USB interface, etc. Free signing can be performed through the business PC end without verifying the identity of the signer. The electronic signature can be printed through the local virtual printer, and the electronic signature can be bound to the local directory; the signature can be entered through the browser plug-in, floating label, file drag and drop to select the upload method, complete the notification download, input and output the electronic signature, and identity authentication can be performed.

[0057] The signing terminal includes front-end services and back-end services, among which the front-end services include FTTP services, Websocket services, FTP services, network printing services, local file services, and photo signing.

[0058] Pre-services include FTTP, which provides interface and page-level services. The service provision is completed by the signing terminal, which does not require a driver and supports free signing and fixed signing with identity.

[0059] Websocket service provides interface-level services, which can be independently provided by the signing terminal without the need for a driver, and can realize free signing and fixed signing with identity.

[0060] FTP service can be independently provided by the signing terminal, without the need for driver services, and supports free signing without identity.

[0061] Network printing service, driven by the signed terminal network printing driver.

[0062] Local file service, select files from the signing terminal, support free signing, no identity.

[0063] Take a photo to sign, support free signing, no identity required.

[0064] Post-services include: HTTP push, which partially pushes relevant business data based on the input type of the front-end service.

[0065] Websocket push, depending on the input type of the front-end service, some pushes can push back related business data.

[0066] FTTP push, the signature data is saved to the designated directory of the signing terminal, such as a USB flash drive. Save to the designated directory of the business terminal, and print the signature directly through the network printer.

[0067] Free signature: After the user starts the preview module to preview the document to be signed, he can freely decide to sign, fingerprint or seal at any position on any page of the document.

[0068] Fixed signature: The signing terminal pre-sets the pages to be signed and the signing position for a specific document to be signed. When the user signs a specific document, he or she signs according to the preset signing position.

[0069] With identity: When signing through the signing terminal, the signer is required to do identity authentication. According to the set identity authentication type, fingerprint recognition, face recognition, ID card reading, etc. can be used for identity authentication. Without identity: When signing, the signer's identity information will not be required for identity authentication.

[0070] like Figure 3 The figure shows an example of the implementation of the corporate legal person signing and affixing an electronic seal in the exemplary embodiment of this application. The document to be signed is received from the business system through the file docking module, and the identity of the document to be signed is authenticated. The legal person authorization verification management platform verifies whether the signer is the corporate legal person or the manager authorized by the legal person. If the identity verification is successful, the electronic seal of the legal person unit in the electronic seal database is called.

[0071] The reader signing module previews the received document to be signed, and echoes the collected electronic signature data, generates a signature handwriting image, and synthesizes it into the signature position of the electronic document to be signed. The electronic signature and seal platform recognizes the electronic signature handwriting. If it is an electronic signature signed by a corporate legal person or a manager authorized by the legal person, it agrees to call the electronic seal. The fingerprint stamping module calls the electronic seal and synthesizes the electronic seal image into the signature position of the document to be signed. Auxiliary modules can also be set to count the electronic document certificates that have been signed, and the file service module obtains the signed electronic document that has been signed.

[0072] The present invention synthesizes signature content locally to ensure data security and privacy protection, and has a plug-and-play and lightweight model design, which simplifies the deployment and use process. It uses national secret encryption files and signature data, complies with the requirements of the National Electronic Signature Law, and the signature has judicial effect, which is suitable for small and medium-sized enterprises and individual users.

Claims

1. A localized digital signature terminal supporting plug-and-play, characterized in that: It includes a signing module, a synthesis module, an encryption module, an identity auxiliary authentication module, and an auxiliary module, wherein the file preview module obtains the file to be signed transmitted by the local interface, previews, adapts the layout file and locates the signing position; the signing module obtains the electronic signature handwriting feature sequence or / and fingerprint imprint or / and electronic seal image data collected by the terminal device, processes the handwriting feature sequence, and echoes the generated signature strokes; the synthesis module locally synthesizes the signature strokes or / and the imprint image into a signature or / and a seal and adds it to the signing position of the layout file to form a signature file; the encryption module calculates the digital signature value and the encrypted data packet according to the signature file and the signature handwriting data / imprint data, and encrypts the signature file; the auxiliary module stores the encrypted signature file and the encrypted data packet locally through the submission interface, and at the same time counts the signature content and the signing operation log; the identity assistance and authentication module binds the electronic signature handwriting data with the signer's identity information or verifies the signer's identity according to the signature handwriting data.

2. The localized digital signature terminal according to claim 1, characterized in that: The file preview module obtains the file to be signed through an interface or a browser plug-in. The file preview module obtains the file to be signed manually uploaded through the desktop shortcut window, automatically obtains the file to be signed at the local file address location, obtains the file to be signed through the local Http service, and establishes a long connection with the signing module through the WebSocket service.

3. The localized digital signature terminal according to claim 1, characterized in that: The signing terminal includes front-end services and back-end services. The front-end services include FTTP services, Websocket services, FTP services, network printing services, and local file services. The FTTP service provides interface and page-level services, the Websocket service provides interface-level services, and the local file service selects the file to be signed through the signing terminal; in the back-end services, HTTP push and Websocket push partially push relevant business data according to the type of front-end services, and the FTTP push signature data is saved to the signing terminal or the specified directory of the business terminal.

4. The localized digital signature terminal according to claim 1, characterized in that: When it is necessary to affix an electronic seal to an encrypted signature document, the identity auxiliary authentication module verifies whether the electronic signature of the signature document is the electronic signature of a registered corporate entity or an authorized manager of the legal entity through the legal entity authorization verification management platform. If so, the electronic seal image registered and bound to the legal entity in the electronic seal database is called and synthesized into the signing position of the encrypted signature document.

5. The localized digital signature terminal according to any one of claims 1 to 4, characterized in that: A lightweight model is constructed in the signing module to extract the deep features of the handwritten electronic signature, and a downsampling module is added to the lightweight model to downsample the handwritten electronic signature to reduce the length of the electronic signature handwriting time series feature data.

6. The localized digital signature terminal according to claim 5, characterized in that: The lightweight model includes a feature normalization module, a multi-level deep separable convolution layer, a maximum pooling layer, and a soft alignment module. The signing module obtains the electronic signature handwriting time series data collected by different devices, unifies the electronic signature format, and obtains the normalized value of each feature of all handwriting sampling points. The multi-level deep separable convolution layer extracts the local features of each electronic signature according to the normalized value. The maximum pooling layer fuses the local features to obtain the deep features of the electronic signature. The soft alignment module aligns the corresponding dimensional features according to the deep features of the electronic signature, and obtains the user's electronic signature strokes based on the aligned deep features.

7. The localized digital signature terminal according to any one of claims 1 to 4, characterized in that: The encryption of the signature file includes: the encryption module uses the SM9+SM4 combined encryption algorithm to encrypt the signature file, including calling the SM4 algorithm to encrypt the source data of the file to be signed to obtain a key, calling the SM9 algorithm to encrypt the SM4 key to obtain a document summary, calculating the SM9 digital signature value according to the document summary, and using the digital SM9 signature value to sign the signature file to obtain an encrypted signature file.

8. The localized digital signature terminal according to any one of claims 1 to 4, characterized in that: The preview module has built-in PDF and OFD document parsers. The document parser determines the type of file to be signed and parses the file to obtain a layout file. The synthesis module adds a signature field to the layout file to be signed according to the located signature position, obtains the signature strokes and / or fingerprint images and / or electronic seal images generated by the signature module according to the signature handwriting data, and synthesizes the signature information in the signature field.

9. The localized digital signature terminal according to claim 8, characterized in that: The structure of the signature information of the synthesized electronic signature strokes and the seal is the same, including solidifying the signature and / or seal-printed file and the original hash value in the first field of the signature information, the identification ID of the cryptographic public key as the second field of the signature information, the signing timestamp as the third field of the signature information, and calculating the signature value based on the above signing information fields as the fourth field; calculating the signature value based on the original hash, the identification ID of the cryptographic public key, and the signing timestamp using the national secret algorithm SM9 and placing the trusted timestamp in the last field.

Images