Electronic signature authentication certificate identification and verification method and device with dominant identification and electronic equipment

Abstract

The invention provides an electronic signature authentication certificate identification and verification method and device with a dominant identifier and electronic equipment, and relates to the technical field of information security, and the method comprises the steps that a registration institution obtains an electronic signature authentication certificate request sent by an applicant; the registration mechanism determines the type of the electronic signature authentication certificate based on the electronic signature authentication certificate request, and identifies the identity of an applicant; when the identity authentication of the applicant is normal, the certificate authority embeds a dominant identification extension item in the electronic signature authentication certificate based on the electronic signature authentication certificate type; and the certificate issuing mechanism carries out digital signature on the electronic signature authentication certificate containing the dominant identifier extension item to obtain the electronic signature authentication certificate with the dominant identifier. According to the method, the key information is borne through the self-contained field in the explicit identification extension item, so that a verifier can complete legal conformity judgment only by analyzing the certificate, and the risk that an external file cannot be accessed is avoided.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to an electronic signature authentication certificate identification with an explicit identification and a verification method, device and electronic equipment. Background Art

[0002] ITU-T X.509 is an internationally recognized standard that defines the format for public key certificates (digital certificates). It binds identities to public keys through digital signatures and plays a fundamental role in public key infrastructure (PKI). Digital certificates provide information security services such as integrity, authenticity, confidentiality, and non-repudiation, and are widely used for various purposes, including identity authentication, encrypted communications, and electronic signatures.

[0003] The basic structure of a digital certificate includes the version number, serial number, signature algorithm ID, issuer name, validity period, subject name, subject public key information, and optional extension fields (such as certificate policy and key usage). The purpose, legal applicability, security level, and authentication method of a digital certificate are generally determined using a common verification method, namely, verifying the certificate policy, key usage, and other extensions in the certificate.

[0004] Electronic signature authentication certificates are issued by electronic authentication service organizations that have obtained an "Electronic Certification Service License." They comply with the "Electronic Signature Law of the People's Republic of China" and other laws and regulations. These legally binding digital certificates, used to sign electronic data messages, represent a specific application of PKI digital certificate technology in the legal validity of electronic signatures. In practice, there's a need to verify the purpose and validity of electronic signature authentication certificates. Currently, electronic signature authentication certificates still use the existing PKI certificate format and verification methods.

[0005] The existing electronic signature authentication certificate content format and verification method have the following deficiencies: 1. Verification requires obtaining external files other than the certificate content, such as certificate policies, for interpretation. However, there is a risk that external files may be inaccessible. 2. The certificate policy is a summary document of certificates, lacking verification independence and intuitiveness; 3. In applications, it is difficult for all parties to intuitively and automatically quickly determine the type and legal compliance of electronic signature authentication certificates.

[0006] Therefore, an electronic signature authentication certificate identification and verification method, device and electronic equipment with an explicit identification are proposed. Summary of the Invention

[0007] This specification provides an electronic signature authentication certificate identification and verification method, device and electronic device with an explicit identification. By carrying key information through the self-contained field in the explicit identification extension, the verifier can complete the legal compliance judgment by only parsing the certificate itself, avoiding the risk of inaccessible external files; at the same time, it helps business application systems to quickly identify the type of electronic signature authentication certificate and verify the legal compliance of the certificate.

[0008] This specification provides a method for identifying an electronic signature authentication certificate with an explicit identifier, including: The registration authority obtains the electronic signature certification request sent by the applicant; The registration authority determines the type of the electronic signature authentication certificate based on the electronic signature authentication certificate request and authenticates the identity of the applicant; When the identity authentication of the applicant is normal, the certificate issuing authority embeds an explicit identification extension item in the electronic signature authentication certificate based on the type of the electronic signature authentication certificate; The certificate issuing authority digitally signs the electronic signature authentication certificate containing the explicit identification extension item to obtain an electronic signature authentication certificate with an explicit identification.

[0009] Optionally, the explicit identification extension includes an electronic signature authentication certificate statement, an electronic authentication service license number, an identity authentication field, and a cryptographic component identifier; The electronic signature authentication certificate statement includes the certificate type and legal validity compliance statement; The electronic certification service license number includes the license number of the certificate issuing authority; The identity authentication field includes the identity authentication result of the applicant by the registration authority; The cryptographic component identifier includes the commercial cryptographic product authentication certificate number used to generate the certificate signature.

[0010] Optionally, before the registration authority obtains the electronic signature authentication certificate request sent by the applicant, the following steps may be performed: The certificate issuing authority formulates electronic signature authentication certificate policies and business rules, and issues certificate configuration rule templates to the registration authority.

[0011] This specification provides a method for verifying an electronic signature authentication certificate with an explicit identifier, including: Obtain an electronic signature authentication certificate with a visible logo; Performing explicit identification extension verification on the electronic signature authentication certificate with the explicit identification, and outputting a legal compliance verification result; When the legal compliance verification result is compliance, performing electronic signature validity verification on the electronic signature authentication certificate with the explicit mark and outputting the validity verification result; When the validity verification result is compliance, the verification of the electronic signature authentication certificate with the explicit mark is completed.

[0012] Optionally, before obtaining the electronic signature authentication certificate with an explicit identification, the following steps are included: The relying party formulates a checking strategy for the explicit identification extension of the electronic signature certificate based on the application scenario, and configures the checking strategy and its associated data set to the verification system.

[0013] Optionally, the performing explicit identification extension verification on the electronic signature authentication certificate with an explicit identification includes: Parse the declaration fields of the electronic signature authentication certificate to extract the certificate type and legal compliance statement; Verify the electronic certification service license number and the issuing agency's qualifications through the Ministry of Industry and Information Technology's license database stored locally; Verify the identity authentication field to confirm that the applicant's identity authentication result is normal; Verify the cryptographic component identification field and match the commercial cryptographic product certification certificate number stored locally with the national cryptographic management agency filing information stored locally.

[0014] This specification provides an electronic signature authentication certificate identification device with an explicit identification, including: The first acquisition module is used for the registration authority to obtain the electronic signature authentication certificate request sent by the applicant; An authentication module, configured for the registration authority to determine the type of the electronic signature authentication certificate based on the electronic signature authentication certificate request and to authenticate the identity of the applicant; an embedding module, configured to, when the identity authentication of the applicant is normal, embed, by the certificate issuing authority, an explicit identification extension item in the electronic signature authentication certificate based on the type of the electronic signature authentication certificate; The signature module is used for the certificate issuing authority to digitally sign the electronic signature authentication certificate containing the explicit identification extension item to obtain the electronic signature authentication certificate with the explicit identification.

[0015] Optionally, the explicit identification extension includes an electronic signature authentication certificate statement, an electronic authentication service license number, an identity authentication field, and a cryptographic component identifier; The electronic signature authentication certificate statement includes the certificate type and legal validity compliance statement; The electronic certification service license number includes the license number of the certificate issuing authority; The identity authentication field includes the identity authentication result of the applicant by the registration authority; The cryptographic component identifier includes the commercial cryptographic product authentication certificate number used to generate the certificate signature.

[0016] Optionally, before the first acquisition module, the following steps are included: The certificate issuing authority formulates electronic signature authentication certificate policies and business rules, and issues certificate configuration rule templates to the registration authority.

[0017] This specification provides a device for verifying an electronic signature certificate with an explicit logo, including: The second acquisition module is used to obtain an electronic signature authentication certificate with an explicit logo; A first verification module is used to verify the explicit identification extension item of the electronic signature authentication certificate with the explicit identification and output a legal compliance verification result; A second verification module is configured to, when the legal compliance verification result is compliance, perform electronic signature validity verification on the electronic signature authentication certificate with the explicit mark and output a validity verification result; The verification completion module is used to complete the verification of the electronic signature authentication certificate with the explicit mark when the validity verification result is compliance.

[0018] Optionally, before the second acquisition module, the following steps are included: The relying party formulates a checking strategy for the explicit identification extension of the electronic signature certificate based on the application scenario, and configures the checking strategy and its associated data set to the verification system.

[0019] Optionally, the first verification module includes: Parse the declaration fields of the electronic signature authentication certificate to extract the certificate type and legal compliance statement; Verify the electronic certification service license number and the issuing agency's qualifications through the Ministry of Industry and Information Technology's license database stored locally; Verify the identity authentication field to confirm that the applicant's identity authentication result is normal; Verify the cryptographic component identification field and match the commercial cryptographic product certification certificate number stored locally with the national cryptographic management agency filing information stored locally.

[0020] This specification also provides an electronic device, wherein the electronic device includes: A processor; and a memory storing computer-executable instructions, which, when executed, cause the processor to perform any of the above methods.

[0021] This specification also provides a computer-readable storage medium, wherein the computer-readable storage medium stores one or more programs, and when the one or more programs are executed by a processor, any of the above methods is implemented.

[0022] In the present invention, by explicitly identifying the self-contained fields in the extension items to carry key information, the verifier can complete the legal compliance judgment by only parsing the certificate itself, avoiding the risk of inaccessible external files. At the same time, it helps the business application system to quickly identify the type of electronic signature authentication certificate and verify the legal compliance of the certificate. The certificate declaration field in the extension item directly states the certificate type and legal compliance, solving the problem of lack of intuitiveness of traditional certificate policies. The relying party can directly read the field value to judge the legal effect without manual interpretation of obscure policy documents. Based on the pre-configured inspection strategy, the verification system verifies the four major fields of the extension item and outputs a machine-readable legal compliance conclusion. This process replaces manual intervention and achieves timely response to legal effect judgments. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0024] Figure 1 A schematic diagram illustrating a method for identifying an electronic signature authentication certificate with an explicit identifier provided in an embodiment of this specification; Figure 2 A schematic diagram illustrating a method for verifying an electronic signature certificate with an explicit identifier provided in an embodiment of this specification; Figure 3 A schematic diagram of the structure of an electronic signature authentication certificate identification device with an explicit identification provided in an embodiment of this specification; Figure 4 A schematic diagram of the structure of an electronic signature authentication certificate verification device with an explicit mark provided in an embodiment of this specification; Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of this specification; Figure 6 A schematic diagram of a computer-readable medium provided in accordance with an embodiment of this specification. DETAILED DESCRIPTION

[0025] The following description is intended to disclose the present invention so that those skilled in the art can implement the present invention. The preferred embodiments described below are for illustrative purposes only, and those skilled in the art will readily appreciate other obvious variations. The basic principles of the present invention defined in the following description may be applied to other embodiments, variations, improvements, equivalents, and other technical solutions that do not depart from the spirit and scope of the present invention.

[0026] The following is combined with Figure 1-6The exemplary embodiments of the present invention are described more fully. However, the exemplary embodiments can be implemented in various forms, and the present invention should not be construed as being limited to the embodiments set forth herein. On the contrary, providing these exemplary embodiments enables the present invention to be more comprehensive and complete, and more conveniently conveys the inventive concept to those skilled in the art. In the figures, the same reference numerals represent the same or similar elements, components, or parts, and thus their repeated description will be omitted.

[0027] Under the premise of being consistent with the technical concept of the present invention, the features, structures, characteristics or other details described in a specific embodiment do not exclude that they can be combined in one or more other embodiments in a suitable manner.

[0028] In the description of specific embodiments, the features, structures, characteristics, or other details of the present invention are described to enable those skilled in the art to fully understand the embodiments. However, this does not preclude those skilled in the art from practicing the technical solutions of the present invention without one or more of the specific features, structures, characteristics, or other details.

[0029] The flowcharts shown in the accompanying drawings are for illustrative purposes only and do not necessarily include all contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps may be decomposed, while others may be combined or partially combined. Therefore, the actual execution order may vary depending on the actual situation.

[0030] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically separate entities. That is, these functional entities may be implemented in software, in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0031] The term "and / or" or "and / or" includes all combinations of any one or more of the associated listed items.

[0032] Figure 1 A schematic diagram of a method for identifying an electronic signature authentication certificate with an explicit identifier provided in an embodiment of this specification. The method may include: Optionally, before S110, the steps include: The certificate issuing authority formulates electronic signature authentication certificate policies and business rules, and issues certificate configuration rule templates to the registration authority.

[0033] In the specific implementation of this specification, a certificate authority (CA) first establishes policies and business rules for electronic signature authentication certificates, including legal compliance standards, certificate type definitions, and cryptographic algorithm specifications. The CA system then uses a policy-structured compilation engine to convert these rules into machine-executable code modules and dynamically generate certificate configuration rule templates.

[0034] S110: The registration authority obtains the electronic signature authentication certificate request sent by the applicant; S120: The registration authority determines the type of the electronic signature authentication certificate based on the electronic signature authentication certificate request and authenticates the identity of the applicant; S130: When the identity authentication of the applicant is normal, the certificate issuing authority embeds an explicit identification extension item in the electronic signature authentication certificate based on the type of the electronic signature authentication certificate; S140: The certificate issuing authority digitally signs the electronic signature authentication certificate containing the explicit identification extension to obtain an electronic signature authentication certificate with an explicit identification.

[0035] Optionally, the explicit identification extension includes an electronic signature authentication certificate statement, an electronic authentication service license number, an identity authentication field, and a cryptographic component identifier; The electronic signature authentication certificate statement includes the certificate type and legal validity compliance statement; The electronic certification service license number includes the license number of the certificate issuing authority; The identity authentication field includes the identity authentication result of the applicant by the registration authority; The cryptographic component identifier includes the commercial cryptographic product authentication certificate number used to generate the certificate signature.

[0036] In the specific implementation of this specification, a registration authority (RA) receives a request for an electronic signature authentication certificate from an applicant, determines the required certificate type (e.g., personal signature, corporate seal, etc.) based on the request content, and performs real-name authentication on the applicant. Once the identity authentication result is confirmed to be normal, the certificate authority (CA) embeds an explicit identification extension in the electronic signature authentication certificate based on the determined certificate type. As shown in Table 1, this extension contains the following core fields: Electronic signature certification certificate statement: clearly indicate the certificate type and legal compliance (e.g., "Complies with Article 13 of the Electronic Signature Law"); Electronic Certification Service License Number: Enter the legal license number of the CA organization; Identity authentication field: records the real-name authentication status of the applicant by the RA; Cryptographic component identification: Indicate the cryptographic algorithm and national cryptographic certification number used to generate the certificate signature.

[0037] The CA organization digitally signs the certificate containing this extension, ultimately generating an electronic signature authentication certificate with an explicit logo and distributing it to the applicant.

[0038] Table 1 Content and definition of electronic signature authentication certificate extensions Figure 2 A schematic diagram of a method for verifying an electronic signature authentication certificate with an explicit identifier provided in an embodiment of this specification. The method may include: Optionally, before S210, the steps include: The relying party formulates a checking strategy for the explicit identification extension of the electronic signature certificate based on the application scenario, and configures the checking strategy and its associated data set to the verification system.

[0039] In the specific implementation of this specification, the relying party formulates an explicit identification extension check policy based on the legal validity requirements of the application scenario. The policy includes the following core contents: Certificate type verification rules: set a list of allowed certificate types (e.g. only accept “qualified electronic signatures”); Legal compliance assertion condition: The legal statement field in the extension must be true. Identity authentication threshold: The identity authentication field value must reach the "real-name authentication passed" level; Cryptographic identification whitelist: limits the acceptable range of commercial cryptographic product certification certificate numbers.

[0040] The aforementioned policies and associated datasets (such as the National Cryptography Administration's algorithm database) are configured in the verification system to generate executable machine verification rules. The verification system automatically loads the policies at runtime, performs field-level verification of the certificate's explicit identification extensions, and outputs legal compliance decision instructions.

[0041] S210: Obtain an electronic signature authentication certificate with an explicit logo; S220: Verify the explicit identification extension item of the electronic signature authentication certificate with the explicit identification, and output a legal compliance verification result; S230: When the legal compliance verification result is compliance, performing electronic signature validity verification on the electronic signature authentication certificate with the explicit mark, and outputting the validity verification result; S240: When the validity verification result is compliance, the verification of the electronic signature authentication certificate with the explicit mark is completed.

[0042] Optionally, the S220 includes: Parse the declaration fields of the electronic signature authentication certificate to extract the certificate type and legal compliance statement; Verify the electronic certification service license number and the issuing agency's qualifications through the Ministry of Industry and Information Technology's license database stored locally; Verify the identity authentication field to confirm that the applicant's identity authentication result is normal; Verify the cryptographic component identification field and match the commercial cryptographic product certification certificate number stored locally with the national cryptographic management agency filing information stored locally.

[0043] In the specific implementation of this specification, the verification system first obtains an electronic signature authentication certificate with an explicit identifier and performs a four-step field-level verification on the explicit identifier extension in the certificate: Parse certificate declaration fields: extract the certificate type and legal compliance declaration (e.g., "Complies with Article 13 of the Electronic Signature Law"); Verify license number: Verify the legality of the issuing agency through the electronic certification service license database of the Ministry of Industry and Information Technology; Verify the identity authentication field: Confirm that the applicant's identity authentication status is "normal" (such as real-name authentication passed); Verify cryptographic component identification: Match the commercial cryptographic product certification certificate number with the national cryptographic management agency filing information to ensure algorithm compliance.

[0044] Output legal compliance verification results: If all four steps are verified successfully, it will be marked as "Legal Compliance Verification Passed"; If any field fails to be verified → the process is terminated and the specific failure reason (such as "password component identifier not registered") is returned.

[0045] When the legal compliance result is passed, the system triggers the electronic signature validity verification (including certificate chain verification, signature algorithm verification, etc.). Finally, only after the signature validity verification is passed, the electronic signature authentication certificate verification is considered completed. In the present invention, by explicitly identifying the self-contained fields in the extension items to carry key information, the verifier can complete the legal compliance judgment by only parsing the certificate itself, avoiding the risk of inaccessible external files. At the same time, it helps the business application system to quickly identify the type of electronic signature authentication certificate and verify the legal compliance of the certificate. The certificate declaration field in the extension item directly states the certificate type and legal compliance, solving the problem of lack of intuitiveness of traditional certificate policies. The relying party can directly read the field value to judge the legal effect without manually interpreting the obscure policy document. Based on the pre-configured inspection strategy, the verification system verifies the four major fields of the extension item and outputs a machine-readable legal compliance conclusion. This process replaces manual intervention and achieves a second-level response to the legal effect judgment.

[0046] Figure 3A schematic diagram of the principle of an electronic signature authentication certificate identification device with an explicit identification provided in an embodiment of this specification, the device may include: The first acquisition module 10 is used for the registration authority to obtain the electronic signature authentication certificate request sent by the applicant; An authentication module 20 is configured for the registration authority to determine the type of the electronic signature authentication certificate based on the electronic signature authentication certificate request and to authenticate the identity of the applicant; The embedding module 30 is configured to embed, by the certificate issuing authority, an explicit identification extension item in the electronic signature authentication certificate based on the type of the electronic signature authentication certificate when the identity authentication of the applicant is normal; The signature module 40 is used for the certificate issuing authority to digitally sign the electronic signature authentication certificate containing the explicit identification extension to obtain the electronic signature authentication certificate with the explicit identification.

[0047] Optionally, the explicit identification extension includes an electronic signature authentication certificate statement, an electronic authentication service license number, an identity authentication field, and a cryptographic component identifier; The electronic signature authentication certificate statement includes the certificate type and legal validity compliance statement; The electronic certification service license number includes the license number of the certificate issuing authority; The identity authentication field includes the identity authentication of the applicant by the registration authority; The cryptographic component identifier includes the commercial cryptographic product authentication certificate number used to generate the certificate signature.

[0048] Optionally, before the first obtaining module 10, the following steps are included: The certificate issuing authority formulates electronic signature authentication certificate policies and business rules, and issues certificate configuration rule templates to the registration authority.

[0049] The functions of the device in the embodiment of the present invention have been described in the above method embodiment. Therefore, for details not fully described in this embodiment, please refer to the relevant description in the above embodiment and will not be repeated here.

[0050] Figure 4 A schematic diagram of a device for verifying an electronic signature certificate with an explicit identifier provided in an embodiment of this specification may include: The second acquisition module 50 is used to obtain an electronic signature authentication certificate with an explicit logo; A first verification module 60 is configured to verify the explicit identification extension of the electronic signature authentication certificate with the explicit identification and output a legal compliance verification result; A second verification module 70 is configured to, when the legal compliance verification result is compliance, perform electronic signature validity verification on the electronic signature authentication certificate with an explicit mark and output a validity verification result; The verification completion module 80 is configured to complete the verification of the electronic signature authentication certificate with an explicit mark when the validity verification result is in compliance.

[0051] Optionally, before the second acquisition module 50, the following steps are included: The relying party formulates a checking strategy for the explicit identification extension of the electronic signature certificate based on the application scenario, and configures the checking strategy and its associated data set to the verification system.

[0052] Optionally, the first verification module 60 includes: Parse the declaration fields of the electronic signature authentication certificate to extract the certificate type and legal compliance statement; Verify the electronic certification service license number and the issuing agency's qualifications through the Ministry of Industry and Information Technology's license database stored locally; Verify the identity authentication field to confirm that the applicant's identity authentication result is normal; Verify the cryptographic component identification field and match the commercial cryptographic product certification certificate number stored locally with the national cryptographic management agency filing information stored locally.

[0053] The functions of the device in the embodiment of the present invention have been described in the above method embodiment. Therefore, for details not fully described in this embodiment, please refer to the relevant description in the above embodiment and will not be repeated here.

[0054] Based on the same inventive concept, an embodiment of this specification also provides an electronic device.

[0055] The following describes an electronic device embodiment of the present invention, which can be considered a specific physical implementation of the method and apparatus embodiments of the present invention described above. Details described in the electronic device embodiment of the present invention should be considered supplementary to the above-mentioned method or apparatus embodiments; details not disclosed in the electronic device embodiment of the present invention can be implemented with reference to the above-mentioned method or apparatus embodiments.

[0056] Figure 5 This is a schematic diagram of the structure of an electronic device provided in the embodiment of this specification. Figure 5 The electronic device 300 according to this embodiment of the present invention will be described. Figure 5 The electronic device 300 shown is merely an example and should not limit the functions and scope of use of the embodiments of the present invention.

[0057] like Figure 5As shown, electronic device 300 is implemented as a general-purpose computing device. Components of electronic device 300 may include, but are not limited to, at least one processing unit 310, at least one storage unit 320, a bus 330 connecting various system components (including storage unit 320 and processing unit 310), and a display unit 340.

[0058] The storage unit stores program codes that can be executed by the processing unit 310, so that the processing unit 310 performs the steps according to various exemplary embodiments of the present invention described in the above processing method section of this specification. For example, the processing unit 310 can perform the following steps: Figure 1 and / or the steps shown in 2.

[0059] The storage unit 320 may include a readable medium in the form of a volatile storage unit, such as a random access memory unit (RAM) 3201 and / or a cache memory unit 3202 , and may further include a read-only memory unit (ROM) 3203 .

[0060] The storage unit 320 may also include a program / utility 3204 having a set (at least one) of program modules 3205, such program modules 3205 including but not limited to: an operating system, one or more application programs, other program modules and program data, each of which or some combination may include an implementation of a network environment.

[0061] Bus 330 may represent one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0062] The electronic device 300 may also communicate with one or more external devices 400 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), one or more devices that enable viewers to interact with the electronic device 300, and / or any device that enables the electronic device 300 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed through an input / output (I / O) interface 350. Furthermore, the electronic device 300 may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) through a network adapter 360. The network adapter 360 may communicate with other modules of the electronic device 300 through the bus 330. It should be understood that although Figure 5Not shown, other hardware and / or software modules may be used in conjunction with the electronic device 300, including but not limited to microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0063] Through the description of the above embodiments, it is easy for those skilled in the art to understand that the exemplary embodiments described in the present invention can be implemented by software or by combining software with necessary hardware. Therefore, the technical solution according to the embodiment of the present invention can be embodied in the form of a software product, which can be stored in a computer-readable storage medium (which can be a CD-ROM, USB flash drive, mobile hard disk, etc.) or on a network, and includes a number of instructions to enable a computing device (which can be a personal computer, server, or network device, etc.) to execute the above method according to the present invention. When the computer program is executed by a data processing device, the computer-readable medium is enabled to implement the above method of the present invention, that is: Figure 1 and / or the method shown in 2.

[0064] Figure 6 A schematic diagram of a computer-readable medium provided in accordance with an embodiment of this specification.

[0065] accomplish Figure 1 The computer program of the method shown in and / or 2 can be stored on one or more computer-readable media. The computer-readable medium can be a readable signal medium or a readable storage medium. The readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or component, or any combination thereof. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0066] The computer-readable storage medium may include a data signal propagated in baseband or as part of a carrier wave, wherein the readable program code is carried. The data signal propagated may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. The readable storage medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, device, or component. The program code contained on the readable storage medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination thereof.

[0067] The program code for performing the operations of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages such as Java, C++, and the like, as well as conventional procedural programming languages such as "C" or similar programming languages. The program code may be executed entirely on the viewer computing device, partially on the viewer device, as a stand-alone software package, partially on the viewer computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device may be connected to the viewer computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0068] In summary, the present invention can be implemented in hardware, or as a software module running on one or more processors, or a combination thereof. Those skilled in the art will appreciate that, in practice, general-purpose data processing devices such as microprocessors or digital signal processors (DSPs) can be used to implement some or all of the functions of some or all of the components according to the embodiments of the present invention. The present invention can also be implemented as a device or apparatus program (e.g., a computer program or computer program product) for performing part or all of the methods described herein. Such a program implementing the present invention can be stored on a computer-readable medium or in the form of one or more signals. Such signals can be downloaded from an Internet website, provided on a carrier signal, or provided in any other form.

[0069] The specific embodiments described above further illustrate the objectives, technical solutions, and beneficial effects of the present invention. It should be understood that the present invention is not inherently related to any specific computer, virtual device, or electronic device, and various general-purpose devices can also implement the present invention. The above description is only a specific embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention shall be included in the scope of protection of the present invention.

[0070] The various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on the differences from other embodiments.

[0071] The foregoing is merely an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present application should be included within the scope of the claims of the present application.

Claims

1. A method for identifying an electronic signature authentication certificate with an explicit identification, characterized in that: include: The registration authority obtains the electronic signature certification request sent by the applicant; The registration authority determines the type of the electronic signature authentication certificate based on the electronic signature authentication certificate request and authenticates the identity of the applicant; When the identity authentication of the applicant is normal, the certificate issuing authority embeds an explicit identification extension item in the electronic signature authentication certificate based on the type of the electronic signature authentication certificate; The certificate issuing authority digitally signs the electronic signature authentication certificate containing the explicit identification extension item to obtain an electronic signature authentication certificate with an explicit identification.

2. The electronic signature authentication certificate identification method with an explicit identification according to claim 1, characterized in that: The explicit identification extension includes an electronic signature authentication certificate statement, an electronic authentication service license number, an identity authentication field, and a cryptographic component identifier; The electronic signature authentication certificate statement includes the certificate type and legal validity compliance statement; The electronic certification service license number includes the license number of the certificate issuing authority; The identity authentication field includes the identity authentication result of the applicant by the registration authority; The cryptographic component identifier includes the commercial cryptographic product authentication certificate number used to generate the certificate signature.

3. The electronic signature authentication certificate identification method with an explicit identification as claimed in claim 2, characterized in that: Before the registration authority obtains the electronic signature authentication certificate request sent by the applicant, it includes: The certificate issuing authority formulates electronic signature authentication certificate policies and business rules, and issues certificate configuration rule templates to the registration authority.

4. A method for verifying an electronic signature authentication certificate with an explicit identification, characterized in that: include: Obtain an electronic signature authentication certificate with a visible logo; Performing explicit identification extension verification on the electronic signature authentication certificate with the explicit identification, and outputting a legal compliance verification result; When the legal compliance verification result is compliance, performing electronic signature validity verification on the electronic signature authentication certificate with the explicit mark and outputting the validity verification result; When the validity verification result is compliance, the verification of the electronic signature authentication certificate with the explicit mark is completed.

5. The method for verifying an electronic signature authentication certificate with an explicit mark according to claim 4, wherein: Before obtaining the electronic signature authentication certificate with an explicit mark, the following steps are included: The relying party formulates a checking strategy for the explicit identification extension of the electronic signature certificate based on the application scenario, and configures the checking strategy and its associated data set to the verification system.

6. The method for verifying an electronic signature authentication certificate with an explicit mark according to claim 5, wherein: The verification of the explicit identification extension item of the electronic signature authentication certificate with the explicit identification includes: Parse the declaration fields of the electronic signature authentication certificate to extract the certificate type and legal compliance statement; Verify the electronic certification service license number and the issuing agency's qualifications through the Ministry of Industry and Information Technology's license database stored locally; Verify the identity authentication field to confirm that the applicant's identity authentication result is normal; Verify the cryptographic component identification field and match the commercial cryptographic product certification certificate number stored locally with the national cryptographic management agency filing information stored locally.

7. An electronic signature authentication certificate identification device with an explicit identification, characterized in that: include: The first acquisition module is used for the registration authority to obtain the electronic signature authentication certificate request sent by the applicant; An authentication module, configured for the registration authority to determine the type of the electronic signature authentication certificate based on the electronic signature authentication certificate request and to authenticate the identity of the applicant; an embedding module, configured to, when the identity authentication of the applicant is normal, embed, by the certificate issuing authority, an explicit identification extension item in the electronic signature authentication certificate based on the type of the electronic signature authentication certificate; The signature module is used for the certificate issuing authority to digitally sign the electronic signature authentication certificate containing the explicit identification extension item to obtain the electronic signature authentication certificate with the explicit identification.

8. An electronic signature authentication certificate verification device with an explicit mark, characterized in that: include: The second acquisition module is used to obtain an electronic signature authentication certificate with an explicit logo; A first verification module is used to verify the explicit identification extension item of the electronic signature authentication certificate with the explicit identification and output a legal compliance verification result; A second verification module is configured to, when the legal compliance verification result is compliance, perform electronic signature validity verification on the electronic signature authentication certificate with the explicit mark and output a validity verification result; The verification completion module is used to complete the verification of the electronic signature authentication certificate with the explicit mark when the validity verification result is compliance.

9. An electronic device, wherein: The electronic device includes: A processor; and a memory storing computer-executable instructions, which, when executed, cause the processor to perform the method according to any one of claims 1 to 6.

10. A computer-readable storage medium, wherein: The computer-readable storage medium stores one or more programs, and when the one or more programs are executed by a processor, the method of any one of claims 1 to 6 is implemented.

Images