Electronic signature and verification method and system based on dynamic password

Abstract

The present application relates to the field of dynamic password technology, and provides an electronic signature and verification method and system based on dynamic passwords, which is used to solve the problems of low anti-counterfeiting ability and poor identity authentication reliability of electronic signatures in cross-device scenarios in the prior art. Among them, the method of the present application includes: when receiving a signature request from a mobile device, first collecting the user's biometric data and superimposing a timestamp to generate a dynamic password seed, converting it into a dynamic password request identifier for biometric correlation verification, and matching the device hardware fingerprint at the same time; after the verification is passed, using the elliptic curve algorithm to generate a digital signature, and recording the tamper-proof signature timestamp; encoding the signature, request identifier, hardware fingerprint and timestamp into an electronic signature data packet and returning it to the mobile device; the mobile device determines the legitimacy of the signature by verifying the biometric difference, signature validity and time-space matching. The present application improves the anti-counterfeiting ability and identity authentication reliability of electronic signatures in cross-device scenarios.

Description

Technical Field

[0001] The present application relates to the field of dynamic password technology, and in particular to a method and system for electronic signature and verification based on dynamic password. Background Art

[0002] With the widespread adoption of cross-device electronic signatures, users are placing higher demands on the security and convenience of the signing process. In scenarios like mobile working and remote contract signing, an electronic signature solution is needed that can simultaneously guarantee identity authenticity, data integrity, and timeliness, ensuring non-repudiation of signatures while also resisting security threats like man-in-the-middle and replay attacks.

[0003] Currently, a typical electronic signature solution uses a static password authentication mechanism based on digital certificates. This solution verifies the user's identity using a pre-set digital certificate, combines it with a one-time password to generate a signature, and embeds a timestamp in the signature data. During verification, the server verifies the legitimacy of the signature using the certificate chain and also checks the validity of the timestamp.

[0004] The static password and fixed digital certificate mechanism is vulnerable to brute force attacks or certificate theft, and the uniqueness of the timestamp makes it difficult to effectively prevent replay attacks. Furthermore, the solution lacks hardware binding verification, allowing the same certificate to be misused on different devices, reducing the uniqueness and irreproducibility of the signature. Summary of the Invention

[0005] The present application provides an electronic signature and verification method and system based on a dynamic password, which is used to solve the problems of low anti-counterfeiting ability and poor identity authentication reliability of electronic signatures in cross-device scenarios in the prior art.

[0006] In a first aspect, the present application provides an electronic signature and verification method based on a dynamic password, comprising:

[0007] When receiving a signature request from a mobile device, the user's biometric data is obtained and superimposed with the current timestamp to generate a dynamic password seed;

[0008] Based on the dynamic password seed, a corresponding dynamic password request identifier is generated, the dynamic password request identifier is associated with a biometric feature corresponding to the user in a preset biometric feature library, and a hardware fingerprint corresponding to the mobile device is matched from a preset hardware fingerprint library based on the dynamic password request identifier;

[0009] When the correlation verification passes, the elliptic curve algorithm is used to generate a digital signature, and the tamper-proof signature timestamp generated when the digital signature is generated is recorded;

[0010] Encoding the digital signature, the dynamic password request identifier, the hardware fingerprint and the tamper-proof signature timestamp into an electronic signature data packet;

[0011] The electronic signature data packet is sent to a mobile device, so that the mobile device can verify the difference of the biometric data, the validity of the digital signature, and the spatiotemporal matching between the tamper-proof signature timestamp and the hardware fingerprint based on the electronic signature data packet. If the verification result indicates that all legal conditions are met, the electronic signature is determined to be legal.

[0012] Optionally, the step of generating a digital signature using an elliptic curve algorithm and recording a tamper-proof signature timestamp generated when the digital signature is generated includes:

[0013] Extracting a unique coding sequence corresponding to the biometric data from the dynamic password request identifier;

[0014] Logically binding the unique coding sequence with the hardware fingerprint of the mobile device to form signature input data;

[0015] According to a preset cryptographic rule set, the signature input data is segmented and reassembled to generate discretized data;

[0016] Based on the secure clock chip of the remote server and the signature input data, a tamper-proof signature timestamp is formed;

[0017] The discretized data and the tamper-proof signature timestamp are input into a cryptographic operation unit, and combined with an elliptic curve algorithm, a digital signature is output.

[0018] Optionally, the step of inputting the discretized data and the tamper-proof signature timestamp into a cryptographic operation unit, combining the elliptic curve algorithm, and outputting a digital signature includes:

[0019] Inputting the discretized data and the tamper-proof signature timestamp into a cryptographic operation unit, the cryptographic operation unit splits the discretized data into a plurality of discretized data blocks according to a preset segmentation rule, wherein the length of each discretized data block is dynamically determined by the parity of the time mark code in the tamper-proof signature timestamp;

[0020] For each discretized data block, a nonlinear transformation operation is performed on the discretized data block using an elliptic curve algorithm according to the time stamp code to generate a cryptographic sequence segment;

[0021] Cross-recombining the cipher sequence segments of each discretized data block according to the generation order of the time mark code to form an initial cipher sequence;

[0022] Extracting the last pulse characteristic value of the tamper-proof signature timestamp and using the last pulse characteristic value as a cyclic shift;

[0023] permuting bits of the initial cipher sequence according to the cyclic shift to generate an intermediate cipher sequence;

[0024] A bitwise logic operation is performed on the intermediate cryptographic sequence and the physical characteristic value of the hardware fingerprint to generate a target cryptographic sequence, and the target cryptographic sequence is used as a digital signature.

[0025] Optionally, performing a nonlinear transformation operation on the discretized data block using an elliptic curve algorithm according to the time stamp code to generate a cryptographic sequence segment includes:

[0026] Selecting a parameter adjustment coefficient corresponding to a discretized data block from the cryptographic rule set;

[0027] Splitting the physical feature values ​​of the hardware fingerprint into a plurality of reference arrays, and converting the decimal value form of the parameter adjustment coefficient into a two's complement form;

[0028] Performing a modular addition operation on the parameter adjustment coefficient in the two's complement format with the corresponding byte in the reference array bit by bit;

[0029] Performing a bitwise OR operation on the result of the modular addition operation and the current time mark code to generate a combined value, and using the combined value as a dynamic operation constraint condition;

[0030] Under the dynamic operation constraint condition, the elliptic curve algorithm is used to perform a nonlinear transformation operation on the discretized data block to generate a cryptographic sequence segment.

[0031] Optionally, the forming of a tamper-proof signature timestamp based on the secure clock chip of the remote server and the signature input data includes:

[0032] Generate a reference clock signal through the internal oscillator of the security clock chip;

[0033] Phase synchronization of the reference clock signal with a generation time node of the signature input data;

[0034] The synchronized reference clock signal is converted into a digital pulse sequence, and the digital pulse sequence is used as an anti-tampering signature timestamp.

[0035] Optionally, generating a corresponding dynamic password request identifier based on the dynamic password seed includes:

[0036] Extracting the biometric data component and the timestamp component from the dynamic password seed;

[0037] Dividing the biometric data component into a plurality of feature data blocks according to a preset binary segmentation rule;

[0038] For each characteristic data block, logically combining the characteristic data block with the periodic sequence segment corresponding to the timestamp component;

[0039] Rearranging all combined feature data blocks according to the generation sequence of the timestamp components to generate a unique coding sequence;

[0040] The unique code sequence is compressed, and the compressed unique code sequence is cross-joined with the last cyclic sequence of the timestamp component to form a dynamic password request identifier.

[0041] Optionally, encoding the digital signature, the dynamic password request identifier, the hardware fingerprint, and the tamper-proof signature timestamp into an electronic signature data packet includes:

[0042] Extracting the first byte of the digital signature as a length identifier;

[0043] Dividing the digital signature into a signature header and a signature body according to the length identifier;

[0044] Performing a bitwise exclusive OR operation on the dynamic password request identifier and the last pulse characteristic value of the tamper-proof signature timestamp;

[0045] Reorganize the operation results into identification data blocks according to byte alignment;

[0046] Converting the character encoding value of the hardware fingerprint into a binary encoding sequence;

[0047] Using the signature header as a starting mark, sequentially splicing the identification data block, the binary sequence, and the pulse sequence of the tamper-proof signature timestamp to construct a data packet structure;

[0048] Calculating a checksum of all data in the data packet structure;

[0049] The checksum is inserted as a separator after the pulse sequence in the data packet structure, and the signature body is inserted after the separator to form an electronic signature data packet.

[0050] In a second aspect, the present application provides an electronic signature and verification system based on a dynamic password, comprising:

[0051] The acquisition module is used to obtain the user's biometric data when receiving a signature request sent by a mobile device, and superimpose the current timestamp to generate a dynamic password seed;

[0052] a first generation module, configured to generate a corresponding dynamic password request identifier based on the dynamic password seed, perform correlation verification on the dynamic password request identifier and a biometric feature corresponding to the user in a preset biometric feature library, and match a hardware fingerprint corresponding to the mobile device from a preset hardware fingerprint library based on the dynamic password request identifier;

[0053] The second generation module is used to generate a digital signature using an elliptic curve algorithm when the association verification passes, and record the tamper-proof signature timestamp generated when the digital signature is generated;

[0054] An encoding module, configured to encode the digital signature, the dynamic password request identifier, the hardware fingerprint, and the tamper-proof signature timestamp into an electronic signature data packet;

[0055] A sending module is used to send the electronic signature data packet to a mobile device, so that the mobile device can verify the difference of the biometric data, the validity of the digital signature, and the spatiotemporal matching between the tamper-proof signature timestamp and the hardware fingerprint based on the electronic signature data packet. If the verification result indicates that all legal conditions are met, the electronic signature is determined to be legal.

[0056] In a third aspect, the present application provides a computing device comprising a processor and a memory, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute any of the electronic signature and verification methods based on dynamic passwords described in the first aspect.

[0057] In a fourth aspect, the present application provides a computer storage medium having computer program instructions stored thereon, which, when executed by a processor, implements an electronic signature and verification method based on a dynamic password as described in any one of the first aspects.

[0058] The present application provides an electronic signature and verification method based on a dynamic password, the method comprising: upon receiving a signature request sent by a mobile device, obtaining biometric data of the user and superimposing a current timestamp to generate a dynamic password seed; generating a corresponding dynamic password request identifier based on the dynamic password seed, performing correlation verification on the dynamic password request identifier and the biometric corresponding to the user in a preset biometric library, and matching the hardware fingerprint corresponding to the mobile device from a preset hardware fingerprint library based on the dynamic password request identifier; when the correlation verification passes, generating a digital signature using an elliptic curve algorithm, and recording the tamper-proof signature timestamp generated when the digital signature is generated; encoding the digital signature, the dynamic password request identifier, the hardware fingerprint, and the tamper-proof signature timestamp together into an electronic signature data packet; and sending the electronic signature data packet to a mobile device so that the mobile device can verify the difference of the biometric data, the validity of the digital signature, and the spatiotemporal matching between the tamper-proof signature timestamp and the hardware fingerprint based on the electronic signature data packet. If the verification result indicates that all legal conditions are met, the electronic signature is determined to be legal.

[0059] The technical solution provided by this application has the following beneficial effects:

[0060] This application realizes the dual binding of user identity and real-time to prevent replay attacks; ensures the authenticity of the user through biometric library comparison and the legitimacy of the device through hardware fingerprint matching; provides unforgeable cryptographic signatures and timestamps to ensure the timeliness of operations; realizes multi-dimensional binding of signatures, identities, devices and time to enhance data integrity; and ensures the security of the entire signature chain through triple verification of biometric difference, signature validity and time-space matching.

[0061] Furthermore, this application also extracts the unique biometric coding sequence from the dynamic password request identifier, binds it to the device hardware fingerprint logic to form signature input data, and after segmenting and reorganizing it into discrete data according to cryptographic rules, combines it with a secure clock chip to generate a tamper-proof timestamp, and finally uses the elliptic curve algorithm to fuse the discretized data with the timestamp to generate a digital signature.

[0062] In addition, identity uniqueness is enhanced through dynamic binding of biometrics and device fingerprints, segmented reassembly and tamper-proof timestamps ensure the irreversibility of data processing, and the elliptic curve algorithm ensures signature strength, forming an end-to-end non-repudiation security mechanism.

[0063] These and other aspects of the present application will become more readily apparent from the description of the following embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0064] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0065] Figure 1 A flowchart of an electronic signature and verification method based on a dynamic password provided in an embodiment of the present application;

[0066] Figure 2 A schematic diagram of the structure of an electronic signature and verification system based on a dynamic password provided in an embodiment of the present application;

[0067] Figure 3 A schematic diagram of the structure of a computing device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0068] In order to enable people skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0069] In some of the processes described in the specification and claims of this application and the above-mentioned figures, multiple operations that appear in a specific order are included, but it should be clearly understood that these operations may not be executed in the order in which they appear in this document or may be executed in parallel. The serial numbers of the operations, such as 101, 102, etc., are only used to distinguish between different operations, and the serial numbers themselves do not represent any order of execution. In addition, these processes may include more or fewer operations, and these operations may be executed in sequence or in parallel. It should be noted that the descriptions of "first", "second", etc. in this document are used to distinguish different messages, devices, modules, etc., and do not represent a sequential order, nor do they limit "first" and "second" to being different types.

[0070] Researchers have found that existing electronic signature solutions have problems in cross-device scenarios, such as single identity authentication, weak device binding, and insufficient anti-replay mechanisms. Based on this, the embodiments of this application provide an electronic signature and verification method based on dynamic passwords. This method can generate password seeds through the dynamic fusion of biometrics and timestamps, combine hardware fingerprints with elliptic curve algorithms to achieve multiple security bindings, and use tamper-proof timestamps to ensure spatiotemporal consistency, thereby building an end-to-end trusted signature chain. The technical solution of this application is applicable to scenarios requiring high-security cross-device collaboration, such as mobile office and remote contract signing.

[0071] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without making creative efforts are within the scope of protection of this application.

[0072] Figure 1 A flowchart of an electronic signature and verification method based on a dynamic password is provided in an embodiment of the present application, such as Figure 1 As shown, the method includes:

[0073] Step 101: When receiving a signature request sent by a mobile device, obtain the user's biometric data and superimpose the current timestamp to generate a dynamic password seed.

[0074] In this step, biometric data refers to the digital representation of a user's unique physiological or behavioral characteristics (such as fingerprints or irises) captured by sensors and used for identity authentication. The current timestamp represents the precise time when the server receives the request, including date and time information. The dynamic password seed represents the initial password raw material generated by combining the biometric data and the current timestamp.

[0075] In an embodiment of the present application, the mobile device collects the user's biometric raw data through a built-in biometric sensor. After receiving the data, the server immediately obtains the current system time, performs bit-wise splicing operations on the binary stream of the biometric data and the binary representation of the timestamp, and the spliced ​​data is standardized to form a dynamic password seed, which serves as the basic material for the subsequent generation of dynamic passwords.

[0076] For example, when a user initiates a contract signing request on a mobile banking app, the mobile phone fingerprint module collects the fingerprint image and converts it into feature point data. When the server receives the request, it records the time information accurate to the millisecond, concatenates the fingerprint feature point data with the timestamp data, and generates a dynamic password seed through a hash operation.

[0077] Step 102: Based on the dynamic password seed, a corresponding dynamic password request identifier is generated, and the dynamic password request identifier is associated with the biometric corresponding to the user in the preset biometric database for verification. According to the dynamic password request identifier, the hardware fingerprint corresponding to the mobile device is matched from the preset hardware fingerprint database.

[0078] In this step, the dynamic password request identifier represents the unique identity authentication identifier generated by the conversion of the dynamic password seed. The preset biometric database represents the pre-stored biometric database of registered users. The hardware fingerprint represents the unique identification feature combination of the mobile device hardware. Biometrics refer to the user's unique physiological feature data (such as fingerprint line features, iris texture, etc.) collected by the biometric sensor of the mobile device, which is stored in the system in the form of a digital feature template to verify the authenticity of the user's identity. The preset hardware fingerprint library refers to a pre-established mobile device hardware feature database that stores the unique hardware identification information of each registered device (such as chip serial number, address and other combined features) to verify the legitimacy of the signing device.

[0079] In an embodiment of the present application, the server performs segmented hashing on the dynamic password seed to generate a dynamic password request identifier, compares the identifier with the registration data in the biometric library for similarity to verify the user's identity, and after the verification is passed, retrieves the corresponding device hardware feature data from the hardware fingerprint library based on the device information field in the identifier.

[0080] For example, the dynamic password seed generated above is hashed twice to form a request identifier, which is then matched with the fingerprint template stored when the user registered in the bank system. After a successful match, the hardware configuration feature code of the mobile phone is retrieved from the device library based on the mobile phone model and serial number information.

[0081] Step 103: When the association verification passes, an elliptic curve algorithm is used to generate a digital signature, and a tamper-proof signature timestamp generated when the digital signature is generated is recorded.

[0082] In this step, the elliptic curve algorithm refers to an asymmetric encryption algorithm based on the mathematical theory of elliptic curves. The tamper-proof signature timestamp represents a time stamp with anti-counterfeiting properties generated by a secure clock chip. The digital signature is a cryptographic signature generated on the signed data using the elliptic curve algorithm. It contains an encrypted combination of the hash value of the signed content, user identity information, and a timestamp, and is non-forgeable and non-repudiable.

[0083] In an embodiment of the present application, the server uses an elliptic curve algorithm to perform digital signature operations on verified user and device information, calls a secure clock chip to obtain a precise time signal during the signing process, binds the time signal to the signature data, and generates a signature result with time proof, ensuring that the signature time and content cannot be tampered with.

[0084] For example, the bank server uses a 256-bit elliptic curve to generate a digital signature for user information and contract content, and at the same time obtains a time stamp accurate to the microsecond level from the hardware security module, binds the time stamp to the signature data, and forms an electronic signature with time proof.

[0085] Step 104: Encode the digital signature, the dynamic password request identifier, the hardware fingerprint and the tamper-proof signature timestamp together into an electronic signature data packet.

[0086] In this step, the electronic signature data package contains a standardized data set of elements such as signature, identity, device and time.

[0087] In an embodiment of the present application, the digital signature, dynamic password request identifier, hardware fingerprint and tamper-proof timestamp are structured and assembled according to preset coding rules. First, the data packet header identifier is added, and then the element data is arranged in sequence. Finally, the check code is calculated and attached to the end of the data packet to form a complete electronic signature data packet.

[0088] For example, the banking system packages user digital signatures, device fingerprint features, time proof and other data according to the ASN.1 (Abstract Syntax Notation.One, ASN.1) encoding rules, adds length identifiers and checksums to form standard data packets that can be parsed by mobile terminals.

[0089] Step 105: Send the electronic signature data packet to a mobile device so that the mobile device can verify the difference of the biometric data, the validity of the digital signature, and the spatiotemporal matching between the tamper-proof signature timestamp and the hardware fingerprint based on the electronic signature data packet. If the verification result indicates that all legal conditions are met, the electronic signature is determined to be legal.

[0090] In this step, spatiotemporal matching refers to the logical rationality of verifying the signature time and device location. Legal conditions refer to the judgment criteria that all verification factors meet the preset security requirements. The difference of biometric data refers to the matching similarity between the biometric data collected by the mobile device in real time and the feature template stored in the electronic signature data packet, and the difference value is calculated by the feature point comparison algorithm. The validity of the digital signature refers to the process of verifying whether the digital signature is generated by a legitimate private key and the signed content has not been tampered with, including signature algorithm verification, certificate chain verification and content integrity check. Spatiotemporal matching refers to the logical rationality verification between the signing time recorded by the tamper-proof signature timestamp and the device geographic location, usage history and other spatiotemporal information corresponding to the hardware fingerprint.

[0091] In an embodiment of the present application, after the mobile device receives the electronic signature data packet, it first parses out the data elements, and performs biometric comparison, signature validity verification and time device consistency check respectively. If all three verifications are passed, the signature is determined to be legal, otherwise the signature is rejected.

[0092] For example, after the user's mobile phone receives the signature data packet sent back by the bank, it first verifies the consistency of the fingerprint features with the locally collected data, then verifies the validity of the digital signature, and finally checks whether the signature time and device location are reasonable. After all pass, the valid signature mark will be displayed on the contract.

[0093] This method uses dynamic password seeds to achieve real-time authentication of user identities, combines hardware fingerprints to ensure the legitimacy of the device, uses elliptic curve algorithms to provide high-strength digital signatures, and cooperates with tamper-proof timestamps to ensure operation timeliness. Finally, a complete electronic signature security chain is built through a multi-factor verification mechanism, effectively solving security issues such as identity forgery, data tampering and replay attacks in cross-device scenarios, and improving the reliability and credibility of electronic signatures.

[0094] To address the authentication security and timeliness issues of electronic signatures in cross-device scenarios, in some embodiments, step 103: generating a digital signature using an elliptic curve algorithm and recording a tamper-proof signature timestamp generated when the digital signature is generated, includes:

[0095] Step 201: extracting a unique coding sequence corresponding to the biometric data from the dynamic password request identifier.

[0096] In step 201, the unique coding sequence refers to a feature coding string extracted from the dynamic password request identifier and strictly corresponding to the user's biometric data. The coding string is generated by converting the core feature points of the biometric data and is user-unique.

[0097] In an embodiment of the present application, the server parses the data structure of the dynamic password request identifier, locates the biometric coding segment therein, obtains the feature point combination that best represents the user's biometric characteristics through a feature extraction algorithm, and concatenates the digital representations of these feature points according to preset rules to form a unique coding sequence.

[0098] Step 202: Logically bind the unique coding sequence to the hardware fingerprint of the mobile device to form signature input data.

[0099] In step 202, logical binding involves establishing an inseparable association between the unique code sequence and the hardware fingerprint through specific calculation rules, forming comprehensive verification data that includes both the user's identity and device characteristics. The specific logical binding process involves binding the unique code sequence (e.g., 64-bit "0x5A3D...") to the hardware fingerprint (e.g., 128-bit "0xA83C...") according to the following steps: Taking the first 3 bits of the code sequence and performing a bitwise XOR operation with the last 32 bits of the hardware fingerprint; performing a modular addition operation on the result and the first 32 bits of the hardware fingerprint; and finally, concatenating the result with the last 32 bits of the code sequence after a circular shift to form the 256-bit signature input data. For example, in the scenario of electronic contract signing on a banking app: unique coding sequence: 0x5A3D (iris feature code of user A), hardware fingerprint: 0xA83C (iPhone 13 hardware ID), XOR operation: 0x5A3D^0x83C0=0xD9FD, modular addition operation: 0xD9FD+0xA800=0x81 FD (overflow part is discarded), circular splicing: 0x81 FD+(0x3D5A>>4)=0x81 FD3D5 is the final signature input data. The signature input data is the composite verification data formed by logically binding the user's biometric unique coding sequence with the device hardware fingerprint. It serves as the original input material for the digital signature operation and contains dual verification elements of user identity characteristics and device characteristics.

[0100] In the embodiment of the present application, after the unique coding sequence is grouped by bytes, it is alternately inserted with the corresponding bytes of the hardware fingerprint, and then the insertion result is cyclically shifted, and the final generated composite data is used as the signature input data.

[0101] Step 203: According to a preset cryptographic rule set, the signature input data is segmented and reassembled to generate discretized data.

[0102] In step 203, the cryptographic rule set is a predefined data processing rule base on the server. It contains specifications such as data segmentation strategies, reorganization algorithms, and security parameters. These rules guide the structured transformation of the signature input data, ensuring that the resulting discretized data meets cryptographic security requirements. Discretized data is a segmented data structure formed by reorganizing the signature input data according to cryptographic security requirements, with each data segment having independent operational characteristics.

[0103] In an embodiment of the present application, according to the segmentation strategy in the cryptographic rule set, padding bits are first added to the signature input data to make it reach the standard length, and then the data is reorganized into multiple data blocks of equal length in an alternating extraction manner, each data block containing different characteristic parts of the original data.

[0104] Step 204: Based on the secure clock chip of the remote server and the signature input data, a tamper-proof signature timestamp is formed.

[0105] In step 204, the secure clock chip is a dedicated timing unit in the server hardware security module, which has physical anti-tampering characteristics and cryptographic timing functions, and can generate accurate and unforgeable time pulse signals to provide reliable time proof for signature operations.

[0106] In an embodiment of the present application, the secure clock chip triggers the generation of a time pulse sequence based on the hash value of the signature input data, combines the pulse sequence with the value of the chip's internal encryption counter, and then processes it through digital signature processing to form a tamper-proof signature timestamp with a complete time proof chain.

[0107] Step 205: Input the discretized data and the tamper-proof signature timestamp into a cryptographic operation unit, combine with the elliptic curve algorithm, and output a digital signature.

[0108] In step 205, the cryptographic operation unit refers to a hardware security module that is specifically used to perform elliptic curve cryptographic operations, and can ensure the security of the key and the operation process.

[0109] In an embodiment of the present application, after the discretized data is sent into the cryptographic operation unit, it is first bit-mixed with the tamper-proof signature timestamp, and then an intermediate result is generated through a point multiplication operation of the elliptic curve algorithm, and finally a digital signature of a fixed length is output through compression function processing.

[0110] Here's a specific example:

[0111] In the scenario of large-value transfers in mobile banking, when a user logs in to the APP with a fingerprint to initiate a transfer operation, the fingerprint sensor of the mobile phone collects the fingerprint image and extracts 42 feature point data (obtained through a feature point detection algorithm). After receiving the request, the server records the current timestamp (accurate to milliseconds, in the format of year, month, day, hour, minute, second, and millisecond), concatenates the feature point data with the timestamp, and generates a dynamic password seed through a SHA-256 (Secure Hash Algorithm 256-bit, SHA-256) operation. The seed generates a dynamic password request identifier through two SM3 hash operations (the first output is a 256-bit hash value as an intermediate result, and the second hashes the intermediate result again) and matches it with the fingerprint template reserved by the bank (which stores 50 feature point data) (the matching algorithm calculates that the similarity of the two sets of feature points reaches more than 98% and is considered passed). After a successful match, the hardware fingerprint of the mobile phone (composed of the IMEI (International Mobile Equipment Identity, IMEI) number, CPU (Central Processing Unit) and the like) is retrieved from the bank's device library according to the device identification code embedded in the request identifier. The server performs a bitwise XOR operation on the fingerprint feature point data and the hardware fingerprint, and then performs a modular addition operation on the last 8 bits of the timestamp (formula: (feature point data ^ hardware fingerprint) + last 8 bits of the timestamp) to generate the signature input data. The input data is first padded with zeros to 512 bits and then reorganized into four data blocks in 128-bit segments. Simultaneously, the secure clock chip is triggered based on the hash value of the signature input data to generate a tamper-proof signature timestamp containing a 64-bit timestamp and a 32-bit random number. Finally, the four data blocks and the timestamp are input into the cryptographic module, and a digital signature is generated using the SM2 elliptic curve algorithm (using a 256-bit prime field parameter).

[0112] In the embodiment of the present application, the dual trust of identity and device is ensured through deep binding of unique coding sequence and hardware fingerprint, segmented reconstruction and tamper-proof timestamps ensure the integrity and timeliness of the data processing process, and finally a high-security digital signature is generated by a dedicated cryptographic operation unit, constructing a complete security chain from identity authentication to signature generation, thereby improving the anti-attack capability and legal effect of electronic signatures in cross-device scenarios.

[0113] To improve the security and dynamism of the digital signature generation process, in some embodiments, step 205: inputting the discretized data and the tamper-proof signature timestamp into a cryptographic operation unit, combining the elliptic curve algorithm, and outputting the digital signature includes:

[0114] Step 301: The discretized data and the tamper-proof signature timestamp are input into a cryptographic operation unit. The cryptographic operation unit splits the discretized data into multiple discretized data blocks according to a preset segmentation rule. The length of each discretized data block is dynamically determined by the parity of the time mark code in the tamper-proof signature timestamp.

[0115] In step 301, the preset segmentation rule refers to a pre-defined data segmentation standard. The length of each discretized data block is dynamically adjusted based on the parity of the time stamp code in the tamper-proof signature timestamp. Odd-numbered markers correspond to larger data blocks, while even-numbered markers correspond to smaller data blocks. This ensures randomness and unpredictability in data segmentation. Discretized data blocks are data units formed by dividing the signature input data according to specific rules. Each data block has independent operational characteristics, and its length is dynamically determined by the parity of the time stamp code. Odd numbers correspond to longer blocks, while even numbers correspond to shorter blocks.

[0116] In an embodiment of the present application, the cryptographic operation unit first parses the time mark code in the tamper-proof signature timestamp, determines the segment length threshold based on its parity, and then scans and segments the discretized data to ensure that each data block contains complete feature information while maintaining the logical connection between the blocks.

[0117] Step 302: For each discretized data block, perform a nonlinear transformation operation on the discretized data block using an elliptic curve algorithm according to the time mark code to generate a cryptographic sequence segment.

[0118] In step 302, the nonlinear transformation operation is a complex computation based on the mathematical properties of the elliptic curve, converting the data block into a cryptographic sequence through point multiplication on the curve. A cryptographic sequence segment is an encrypted data fragment generated by the nonlinear transformation of a single discretized data block using the elliptic curve algorithm. It contains the characteristic information of the original data block and the result of the time stamp operation, and is the basic unit of a complete digital signature.

[0119] In an embodiment of the present application, each data block is first filled in a standardized manner, and then a specific base point on the elliptic curve is selected according to the time mark code. A cryptographic sequence segment corresponding to the content of the data block is generated through iterative point multiplication operations, and a fragment of the time mark code is incorporated into each operation as a random factor.

[0120] Step 303: Cross-recombining the cipher sequence segments of each discretized data block according to the generation order of the time mark code to form an initial cipher sequence.

[0121] In step 303, the initial cryptographic sequence refers to an intermediate cryptographic result formed by cross-combining the cryptographic sequence segments in chronological order, which retains all the characteristics of the original data.

[0122] In an embodiment of the present application, the cryptographic sequence segments generated by each data block are arranged in a zigzag cross pattern according to the order in which the time mark code is generated, with odd bits taken from the preceding segment and even bits taken from the succeeding segment, forming a long sequence with obfuscation properties.

[0123] Step 304: extracting the last pulse characteristic value of the tamper-proof signature timestamp, and using the last pulse characteristic value as the cyclic shift amount.

[0124] In step 304, the cyclic shift refers to the shift parameter derived from the last pulse characteristic value of the timestamp, which is used to perform a controllable cyclic shift on the cryptographic sequence. The last pulse characteristic value refers to a specific length feature code extracted from the end of the anti-tampering signature timestamp pulse sequence. It is usually the value converted from the last 8 pulse signals and used as the dynamic parameter for the cryptographic sequence shift operation. The extraction process of the last pulse characteristic value is as follows: from the complete pulse sequence of the anti-tampering signature timestamp (such as 1024 bits), the pulse signal corresponding to the last 8 clock cycles (i.e., the last 8 bits of the sequence) is intercepted and converted into a 1-byte hexadecimal value (such as the last 8 bits of the pulse sequence "...11011010" to 0xDA). This value is the last pulse characteristic value. The clock cycle is the fixed time interval between two adjacent rising edges (or falling edges) in the clock signal. The clock signal is a periodic electrical pulse waveform generated by a clock generator, and each complete pulse waveform corresponds to one clock cycle.

[0125] In an embodiment of the present application, the last eight pulse signals of the tamper-proof signature timestamp are extracted, converted into binary values, and the modulo operation result is used as the displacement amount to ensure that the displacement operation is strictly bound to time.

[0126] Step 305: permuting bits of the initial cipher sequence according to the cyclic shift to generate an intermediate cipher sequence.

[0127] In step 305, the bits are derived from the combination of cryptographic sequence segments generated by each data block using an elliptic curve algorithm. Specifically, each data block undergoes a nonlinear transformation to generate a fixed-length cryptographic sequence segment (e.g., 256 bits). The cryptographic sequence segments of all data blocks are then interleaved in time-stamped order (e.g., alternating odd and even data blocks). The resulting continuous binary bit sequence is the bit sequence of the initial cryptographic sequence. The intermediate cryptographic sequence refers to the transition state of the initial cryptographic sequence after the shift transformation, enhancing the sequence's randomness and unpredictability.

[0128] In the embodiment of the present application, a circular right shift with carry is performed on the initial password sequence according to the circular shift amount, and the shifted bits are added to the sequence header to form a new bit arrangement combination.

[0129] Step 306: Perform a bitwise logic operation on the intermediate cryptographic sequence and the physical characteristic value of the hardware fingerprint to generate a target cryptographic sequence, and use the target cryptographic sequence as a digital signature.

[0130] In step 306, bitwise logic operation refers to the encryption operation of bitwise combining the intermediate cryptographic sequence with the hardware fingerprint feature. For example, in a smart contract signing scenario, when the mobile device has the hardware fingerprint 0xA83C and the intermediate cryptographic sequence is 0x5D2F: the hardware fingerprint is truncated to a portion equal to the intermediate cryptographic sequence (the lower 16 bits of 0xA83C are taken); a bitwise exclusive OR operation is performed: 0x5D2F ^ 0xA83C = 0xF513; the result 0xF513 is cyclically shifted with the last 8 bits of the anti-tampering signature timestamp (e.g., 0xB6) (0xB6<<4 = 0xB60) and then a bitwise AND operation is performed: 0xF513 & 0xB60 = 0xB400; the final target cryptographic sequence 0xB400 is written as the digital signature into the electronic signature data packet. Physical feature values ​​are binary features extracted from a mobile device's unique hardware identifier (such as the chip serial number). These features are generated by collecting hardware information such as the device's CPU serial number and baseband chip ID during device registration, converting them into a 128-bit fixed-length binary string after standardization, storing them in the server's hardware fingerprint database, and retrieving them through a dynamic password request identifier match during signature generation. The target cryptographic sequence is the final cryptographic data generated by performing bitwise logic operations on the intermediate cryptographic sequence and the physical feature value of the hardware fingerprint. This data is device-bound and irreversible, and is output as the official digital signature.

[0131] In the embodiment of the present application, the intermediate password sequence is subjected to a segmented XOR operation with the physical characteristic value of the hardware fingerprint, and the result is selectively bit-flipped to finally generate a target password sequence with device binding characteristics.

[0132] Here's a specific example:

[0133] In the scenario of large-value transfer in mobile banking, the server inputs the generated 512-bit signature input data (obtained by XORing the fingerprint feature with the hardware fingerprint and then adding it to the last 8 bits of the timestamp) into the cryptographic operation unit. First, the parity of the time mark code in the tamper-proof signature timestamp is checked (assuming that the last bit of the time mark code is 1, which is judged to be an odd number). Based on this, the data is split into 3 discrete data blocks (with lengths of 192 bits, 160 bits, and 160 bits respectively, obtained by dividing the total length by the segmentation coefficient 2.67 and rounding it up); the SM2 elliptic curve algorithm is used to transform each data block: the first data block is multiplied by the first 16 bits of the timestamp code to generate a 256-bit cryptographic sequence segment, the second data block is multiplied by the middle 16 bits to generate a 256-bit sequence segment, and the third data block is multiplied by the middle 16 bits to generate a 256-bit sequence segment. The data block and the last 16 bits are combined to generate a 256-bit sequence segment; the three cryptographic sequence segments are arranged alternately in the clock order of the time mark code (the first 85 bits of the first sequence segment + the middle 86 bits of the second sequence segment + the last 85 bits of the third sequence segment) to form a 768-bit initial cryptographic sequence; the last 8-bit pulse value (such as 0xB6) is extracted from the tamper-proof signature timestamp, converted to decimal 182, and modulo 128 to obtain 54 as the cyclic shift; the initial cryptographic sequence is cyclically right-shifted 54 bits (the shifted bits are added to the sequence head) to generate an intermediate cryptographic sequence; finally, the sequence is segmented XORed with the physical feature value of the hardware fingerprint (such as 0xA83C) (one XOR per 32 bits), and the result is then inverted every 8 bits. The final target cryptographic sequence is used as the digital signature.

[0134] In the embodiment of the present application, the indivisibility of the signature data is ensured through dynamic segmentation and time-series cross-reorganization, and the multiple associations of the signature with the device and time are realized by combining timestamp displacement and hardware fingerprint binding. The digital signature finally generated has both cryptographic strength and contains complete space-time device information, which effectively prevents signature forgery and illegal reuse, and improves the legal effect and security level of the electronic signature.

[0135] To further enhance the security and dynamism of the digital signature generation process, in some embodiments, step 302: performing a nonlinear transformation operation on the discretized data block using an elliptic curve algorithm based on the time stamp code to generate a cryptographic sequence segment includes:

[0136] Step 401: Select a parameter adjustment coefficient corresponding to a discretized data block from the cryptographic rule set.

[0137] In step 401, the parameter adjustment coefficient refers to the operation parameter dynamically selected from the cryptographic rule set, which is used to adjust the operation characteristics of the elliptic curve algorithm. Each discretized data block corresponds to an independent adjustment coefficient to ensure that the transformation process of each data block is different.

[0138] In an embodiment of the present application, the cryptographic operation unit matches the corresponding parameter group from a pre-stored cryptographic rule set based on the sequence number and length characteristics of the discretized data block, and extracts the adjustment coefficient that matches the current operation stage. This coefficient will affect the subsequent selection of elliptic curve base points and the operation intensity.

[0139] Step 402: Split the physical feature values ​​of the hardware fingerprint into multiple reference arrays, and convert the decimal value form of the parameter adjustment coefficient into a two's complement form.

[0140] In step 402, the reference array refers to a reference data set formed by structured decomposition of the physical feature values ​​of the hardware fingerprint, providing a hardware-related operational benchmark for parameter adjustment. The decimal value format refers to the original storage format of the parameter adjustment coefficients in the cryptographic rule set. It uses conventional decimal numbers for ease of manual configuration and management, and must be converted to two's complement format before calculation. Two's complement format refers to a binary format that uses two's complement encoding rules to handle negative numbers when converting decimal values ​​to binary representation. The highest bit is the sign bit (0 for positive and 1 for negative), and the remaining bits represent the value, ensuring uniformity in addition and subtraction operations.

[0141] In an embodiment of the present application, the physical feature value of the hardware fingerprint is divided into multiple equal-length sub-segments according to a fixed length, each sub-segment is converted into a standardized binary array, and the decimal value of the parameter adjustment coefficient is converted into a signed two's complement form to facilitate subsequent bit-level operations.

[0142] Step 403: performing a modular addition operation on the parameter adjustment coefficient in the binary complement format and the corresponding byte in the reference array bit by bit.

[0143] In step 403, the parameter adjustment coefficient is a computational parameter dynamically selected from a set of cryptographic rules based on the characteristics of the discretized data block. Its value is derived from a preset cryptographic parameter table and is determined by matching characteristics such as the data block sequence number and length. It is used to adjust the computational strength and base point selection of the elliptic curve algorithm. Modular addition refers to a special addition operation that performs cyclic accumulation on binary data. When the result exceeds the bit width, it automatically takes the modulus and wraps around to ensure a fixed number of output bits. For example, when the parameter adjustment coefficient is 0x1F (binary 00011111) and the current byte of the reference array is 0xA3 (binary 10100011), bitwise modular addition refers to performing binary addition on each bit independently and then taking the modulo 2 (no carry): 1+0=1, 0+0=0, 0+1=1, 1+1=0 (modulo 2), 1+1=0, 1+1=0, 1+0=1, 1+0=1, and the final result is 0xBC (binary 10111100).

[0144] In the embodiment of the present application, among multiple reference arrays, the reference array corresponding to the sequence number of the currently processed discretized data block is selected for operation (e.g., when processing the third data block, the reference array [2] is selected), and the array sequence numbers are matched sequentially starting from 0. After the parameter adjustment coefficient in the form of two's complement is aligned with the corresponding byte of the reference array, the addition operation with carry is performed in sequence from the low bit to the high bit. If the result of each addition overflows, the high-order carry is automatically discarded to ensure that the operation result always remains within the preset bit width range.

[0145] Step 404: Perform a bitwise OR operation on the result of the modular addition operation and the current time mark code to generate a combined value, and use the combined value as a dynamic operation constraint condition.

[0146] In step 404, the current time stamp code refers to the most recently generated tamper-proof time pulse sequence generated by the secure clock chip at the time of data processing. Its "currentness" is determined by the following method: the cryptographic operation unit monitors the clock chip's pulse count signal in real time. When a new rising edge trigger is detected, the complete pulse sequence corresponding to that moment is immediately locked as the current time stamp code. The specific process of the bitwise OR operation is as follows: a bit-by-bit logical OR operation is performed on two binary numbers (e.g., the time stamp code 0xB6 (10110110) and the lower 8 bits of the operation result 0xC2E4 (1100001011100100), 0xE4 (11100100)): 11100100 (0xE4) | 10110110 (0xB6) = 11110110 (0xF6). The combined value is the composite value generated by the bitwise OR operation of the modular addition result and the time stamp code. It also contains hardware characteristics, dynamic parameters, and time information, serving as a constraint for subsequent nonlinear transformations. Dynamic computation constraints are composite computation constraints that combine hardware features, adjustment parameters, and time factors, guiding the specific execution of subsequent nonlinear transformations. For example, when the hardware fingerprint physical feature value is 0xA3C5 (reference array [0xA3, 0xC5]) and the parameter adjustment coefficient is 0x1F (binary 00011111), the following applies: modular addition: 0xA3 + 0x1F = 0xC2 (high byte), 0xC5 + 0x1F = 0xE4 (low byte). If the lower 8 bits of the time stamp are 0xB6, the following applies: bitwise OR: 0xC2E4 | 0x00B6 = 0xC2F6, resulting in a dynamic computation constraint of 0xC2F6.

[0147] In an embodiment of the present application, the result of the modular addition operation is bitwise ORed with the current time mark code, so that the generated conditional value simultaneously contains hardware fingerprint features, dynamic adjustment parameters and real-time time information, forming an operation constraint with time and space characteristics.

[0148] Step 405: Under the dynamic operation constraint condition, use the elliptic curve algorithm to perform a nonlinear transformation operation on the discretized data block to generate a cryptographic sequence segment.

[0149] In step 405, the nonlinear transformation operation refers to an irreversible calculation process based on the mathematical properties of the elliptic curve, which implements data obfuscation and diffusion through point multiplication operations on the curve.

[0150] In this embodiment, under the control of dynamic computation constraints, a specific base point on the elliptic curve is first selected based on the conditional value. The discretized data block is then converted into the coordinates of a point on the curve. A cryptographic sequence segment is generated through iterative point multiplication, with each iteration incorporating a different fragment of the constraint as a random factor. The specific process involves performing a bitwise AND operation on the low-order byte 0xF6 of the dynamic computation constraint and the data block length to determine the number of iterations. After each operation, the corresponding bit of the current time stamp is extracted to dynamically adjust the elliptic curve computation parameters. The x-coordinate value of the final elliptic curve point is taken, and the valid bits, equal in length to the data block, are truncated as the cryptographic sequence segment. For example, when the data block is 0x7B2D and the dynamic operation constraint is 0xC2F6: split the constraint 0xC2F6 into high byte 0xC2 and low byte 0xF6; use 0xC2 as the elliptic curve base point selection parameter to locate the starting operation point on the preset curve; use the data block 0x7B2D as a scalar and perform a point multiplication operation with the starting operation point: 0x7B2D is converted to binary "0111101100101101"; iterative calculation is performed bit by bit from high to low: when encountering "1", perform a point addition operation, and when encountering "0", perform a point doubling operation; after each operation, take the lower 4 bits of 0xF6 as the modulus adjustment parameter; finally output the x value of the point coordinate 0x59E3 as the password sequence segment.

[0151] Here's a specific example:

[0152] In the mobile banking large-value transfer scenario, when the server processes the first 192-bit discretized data block, it selects a parameter adjustment coefficient (such as the decimal value 235) from the password rule set and converts the coefficient into a two's complement form (i.e., 11101011). At the same time, the hardware fingerprint physical feature value (such as 0xA83C5D2F) is split into four reference arrays ([0xA8, 0x3C, 0x5D, 0x2F]). The two's complement form of the parameter adjustment coefficient is modulo-added with the first reference array 0xA8 (binary 10101000) (calculation formula: (11101011+10101000) mod256 = 10010011). The calculation result 0x93 is added to the first 8 bits of the time stamp code 0x1 A bitwise OR operation (10010011|00011111=10011111) is performed on F to obtain the combined value 0x9F as a dynamic operation constraint condition. Based on this condition, an elliptic curve base point is selected, and a point multiplication operation is performed on the 192-bit data block (three iterative point multiplications are performed on each 64-bit data block), ultimately generating a 256-bit cryptographic sequence segment.

[0153] In the embodiment of the present application, dynamic parameter adjustment and hardware feature binding are used to ensure that the transformation process of each data block is unique. The unpredictability of the operation is enhanced by combining the constraints of time factors. The cryptographic sequence segment finally generated not only retains the characteristics of the original data, but also incorporates the device fingerprint and timestamp information, making the digital signature more resistant to cracking and device binding characteristics, effectively preventing signature forgery and illegal copying.

[0154] To ensure the immutability and accuracy of the signature timestamp, in some embodiments, step 204: forming a tamper-proof signature timestamp based on the remote server's secure clock chip and the signature input data, includes:

[0155] Step 501: Generate a reference clock signal through the internal oscillator of the security clock chip.

[0156] In step 501, the reference clock signal refers to a stable periodic electrical signal generated by the internal oscillation circuit of the secure clock chip, which has a fixed frequency and precise timing characteristics, and provides a reliable time reference for timestamp generation.

[0157] In an embodiment of the present application, after the secure clock chip is powered on, the built-in crystal oscillator is started to generate a high-frequency stable pulse signal, which is adjusted to a frequency suitable for cryptographic operations through a frequency division circuit. At the same time, a temperature compensation mechanism is enabled to eliminate the impact of environmental factors on clock accuracy.

[0158] Step 502: Synchronize the phase of the reference clock signal with the generation time node of the signature input data.

[0159] In step 502, the generation time is the precise moment (accurate to the microsecond level) recorded by the server's system clock when the remote server receives the signature input data (including the biometrics and the timestamp of the dynamic password seed) sent by the mobile device. This time is calibrated using the secure clock chip's timing service to ensure synchronization with the mobile device's timestamp. Phase synchronization is the process of aligning the clock signal with the time of the signature operation, ensuring that the timestamp accurately reflects the moment the signature was generated.

[0160] In an embodiment of the present application, when the signature input data arrives at the cryptographic operation unit, the clock synchronization circuit is immediately triggered, the rising edge of the current clock signal is captured as the synchronization point, and the complete cycle counting state of the oscillator at that moment is recorded as the basis for phase locking of the time reference.

[0161] Step 503: Convert the synchronized reference clock signal into a digital pulse sequence, and use the digital pulse sequence as an anti-tampering signature timestamp.

[0162] In step 503, the digital pulse sequence refers to converting the synchronized analog clock signal into a digital timing code, which includes complete clock cycle information and synchronization marks.

[0163] In an embodiment of the present application, the synchronized clock signal is sampled into discrete level values ​​via an analog-to-digital converter, then converted by an encoder into a structured digital sequence containing a preamble, a cycle count, and a checksum. Finally, the chip's unique identifier is added to form a complete tamper-proof signature timestamp. For example, when the reference clock signal frequency is 1 MHz and the synchronization moment is the 387,492nd clock cycle: intercept a square wave signal of 1024 consecutive clock cycles after synchronization; convert the high level of each cycle to "1" and the low level to "0" to generate the original pulse string "10111001..." (a total of 1024 bits); convert each 8-bit group into a hexadecimal sequence: 0xB9, 0x3C, 0x7A, ... (a total of 128 bytes); and take the first 64 bytes of the sequence as the valid tamper-proof signature timestamp.

[0164] Here's a specific example:

[0165] In the large-value transfer scenario of mobile banking, when the server generates 512-bit signature input data, the oscillator of the security clock chip starts immediately and generates a reference clock signal (frequency is 10MHz, implemented by a crystal oscillator circuit); at the moment when the signature input data completes the zero-padding operation, the system captures the rising edge of the 387492th cycle of the clock signal (recorded in real time by an internal counter) as the synchronization point; the analog clock signal is sampled by an analog-to-digital converter, the first 16 bits record the chip serial number, the middle 32 bits store the cycle count value at the synchronization moment (calculation formula: number of synchronization cycles = reference frequency × time difference, take 387492), and the last 16 bits are a combination of the temperature sensor reading and the check code; the final generated 64-bit digital pulse sequence (such as 0x3A874B92C5D6E8F1) serves as the tamper-proof signature timestamp.

[0166] In the embodiment of the present application, the accuracy of the timestamp is guaranteed by hardware-level clock signal generation and phase synchronization mechanism, the structured encoding of the digital pulse sequence ensures the integrity and verifiability of the time information, and the anti-tampering function realized by combining the physical characteristics of the chip effectively prevents time forgery, provides reliable time proof for electronic signatures, and meets the strict requirements of government scenarios for document timeliness.

[0167] To improve the security and uniqueness of the dynamic password request identifier, in some embodiments, step 102: generating a corresponding dynamic password request identifier based on the dynamic password seed includes:

[0168] Step 601: Extract the biometric data component and the timestamp component from the dynamic password seed.

[0169] In step 601, the biometric data component refers to the user's biometric raw data portion contained in the dynamic password seed, and the timestamp component refers to the time information portion recorded in the dynamic password seed.

[0170] In an embodiment of the present application, the server parses the data structure of the dynamic password seed, identifies the original feature data portion collected by the biometric sensor and the time information portion recorded by the system, extracts them separately and temporarily stores them for subsequent processing.

[0171] Step 602: Divide the biometric data component into multiple feature data blocks according to a preset binary segmentation rule.

[0172] In step 602, the preset binary segmentation rule refers to a pre-defined standard method for dividing the biometric data binary stream into feature data blocks. It includes specific provisions such as segment length, boundary alignment, and feature point distribution principles, ensuring that key feature points are not segmented and that the security strength of each data block is balanced. Feature data blocks are data units formed by dividing biometric data according to specific rules. Each data block contains partial feature information, and the segmentation rules ensure the integrity of key features. The difference between the discretized data block and the discretized data block is that the discretized data is derived from the signature input data, while the biometric data components are directly derived from the original biometric features in the dynamic password seed. The segmentation rules for the discretized data are dynamically determined by the parity of the tamper-proof signature timestamp, while the segmentation rules for the biometric data components are a preset fixed binary segmentation method. Discretized data blocks are used for nonlinear transformations in elliptic curve algorithms, while biometric data blocks are used to construct dynamic password request identifiers. The two differ substantially in data source, segmentation rules, and technical functions.

[0173] In an embodiment of the present application, according to a preset segmentation strategy, the biometric data is first standardized, then sorted according to the importance of the feature points, and high-weight features are evenly distributed to each data block to ensure that each data block contains the necessary verification information.

[0174] Step 603: For each characteristic data block, logically combine the characteristic data block with the periodic sequence segment corresponding to the timestamp component.

[0175] In step 603, periodic sequence segments are subsequence segments generated by dividing the complete timestamp into fixed periods (e.g., 4 bits per period). Each periodic sequence segment is generated by performing a modulo operation on the timestamp component (e.g., timestamp value divided by period length) and taking the remainder corresponding to a specific binary pattern stored in a preset coding table. Logical combination refers to the process of performing specific operations to fuse the feature data block with the timestamp information of the corresponding time period, thereby enhancing the temporal and spatial correlation of the data.

[0176] In an embodiment of the present application, for each characteristic data block, its hash value is first calculated, then a bitwise XOR operation is performed with the binary representation of the corresponding time period in the timestamp component, and finally a cyclic shift operation is performed on the result to form a new data block with time binding.

[0177] Step 604: rearrange all combined feature data blocks according to the generation sequence of the timestamp components to generate a unique coding sequence.

[0178] In step 604, the generation sequence of the timestamp components refers to the timestamp components extracted from the dynamic password seed being divided into multiple consecutive time units (e.g., millisecond-level segments) during the generation process, and their time sequence strictly follows the natural increasing order of the timestamp values. This sequence is determined by the remote server system clock when the dynamic password seed is generated.

[0179] In an embodiment of the present application, the processed feature data blocks are sorted in chronological order according to the time recorded in the timestamp component, and the data blocks are spliced ​​into a long sequence in an alternating manner, and time stamps are added at the beginning and end of the sequence to form the final code.

[0180] Step 605: compress the unique code sequence, cross-join the compressed unique code sequence with the last cyclic sequence of the timestamp component to form a dynamic password request identifier.

[0181] In step 605, compression processing refers to the operation of reducing the length of the coding sequence through a specific algorithm, and the last cyclic sequence refers to the feature code extracted from the end of the timestamp component and cyclically expanded. The specific process is: extracting the first byte of the biometric data component in the dynamic password seed as the verification reference value; performing a modular addition operation on every two adjacent bytes of the intermediate unique coding sequence and the verification reference value; retaining the lower 8 bits of the modular addition result as the compressed output. The last cyclic sequence of the timestamp component refers to the cyclic redundancy sequence generated by passing the least significant bit part of the timestamp component (such as the last 16 binary bits) through a circular shift register. It is specifically obtained in the following way: the last bit of the timestamp is input into a linear feedback shift register (LFSR), and the bit sequence is output after a preset number of shifts (such as 8 times). Cross-stitching uses a bit-alternating insertion method to merge the compressed unique coding sequence (such as "1010") and the cyclic sequence of the last bit of the timestamp (such as "1100") in odd-even order to generate the final sequence of "11100100", where the odd bits are taken from the timestamp sequence and the even bits are taken from the coding sequence.

[0182] In an embodiment of the present application, a lossy compression algorithm is performed on the unique coding sequence to retain the data of key feature points. At the same time, the last few bits of the timestamp are cyclically shifted to generate a sequence of equal length. Finally, the compressed code and the cyclic sequence are alternately merged according to the parity bits to form the final dynamic password request identifier.

[0183] Here's a specific example:

[0184] In the mobile banking contract signing scenario, the server extracts the user's fingerprint feature data (42 feature points, each represented by 16 bits) and a timestamp accurate to milliseconds (formatted as year, month, day, hour, minute, second, millisecond, totaling 64 bits) from the dynamic password seed; divides the fingerprint feature data into three feature data blocks according to preset rules (the first block has 14 feature points with 224 bits, the second block has 14 feature points with 224 bits, and the third block has 14 feature points with 224 bits, obtained by evenly dividing and rounding the total number of feature points); each feature data block is logically combined with the corresponding fragment of the timestamp (the first block is combined with the timestamp); The first 21 bits of the timestamp are XORed, the second block is XORed with the middle 22 bits, and the third block is XORed with the last 21 bits); the three combined data blocks are arranged in timestamp order to generate a 672-bit code sequence; this sequence is compressed (2 bits are taken from every 3 bits) to obtain 448 bits of compressed data; at the same time, the last 8 bits of the timestamp are cyclically expanded to a 448-bit sequence (for example, the last 8 bits 0xB6 are expanded to 56 repetitions of 0xB6); finally, the compressed data and the expanded sequence are alternately spliced ​​bit by bit (odd bits are taken from the compressed data, and even bits are taken from the expanded sequence) to generate an 896-bit dynamic password request identifier.

[0185] In the embodiment of the present application, through multi-level fusion processing of biometrics and timestamps, the generated dynamic password request identifier has both user biometric uniqueness and operation time sensitivity, effectively preventing identity impersonation and request replay attacks, and providing a highly secure identity authentication foundation for financial transactions.

[0186] To improve the security and structure of the electronic signature data packet, in some embodiments, step 104: encoding the digital signature, the dynamic password request identifier, the hardware fingerprint, and the tamper-proof signature timestamp into the electronic signature data packet includes:

[0187] Step 701: Extract the first byte of the digital signature as a length identifier.

[0188] In step 701, the length identifier refers to the meta-information bytes extracted from the starting position of the digital signature and used to indicate the signature data structure, including the signature format version and the body length prompt.

[0189] In an embodiment of the present application, the first byte of the digital signature is parsed, and the upper 4 bits are extracted as a format identifier, and the lower 4 bits are extracted as a length reference value to guide the structural division of subsequent data packets.

[0190] Step 702: Divide the digital signature into a signature header and a signature body according to the length identifier.

[0191] In step 702, the signature header refers to the initial portion of the digital signature containing the algorithm identifier and parameter information, while the signature body refers to the core data portion containing the actual signature value.

[0192] In an embodiment of the present application, according to the indication of the length identifier, fixed-length header information is divided from the digital signature, and the remaining part is used as the signature body. The header is used to quickly identify the signature type, and the body is used for detailed verification.

[0193] Step 703: Perform a bitwise exclusive OR operation on the dynamic password request identifier and the last pulse characteristic value of the tamper-proof signature timestamp.

[0194] In step 703, the bitwise XOR operation refers to performing a logical XOR operation on corresponding bits of two binary numbers to achieve data obfuscation and binding.

[0195] In an embodiment of the present application, a binary stream of the dynamic password request identifier is XORed bit by bit with an extended form of the last digit pulse characteristic value of the tamper-proof signature timestamp to generate new identification data with a time binding characteristic.

[0196] Step 704: Reorganize the operation result into a marking data block according to the byte alignment method.

[0197] In step 704, byte alignment reorganization refers to rearranging the calculation results according to the processor's optimal access length to improve data processing efficiency. The identification data block refers to a structured data unit formed by reorganizing the dynamic password request identifier and the last pulse characteristic value of the anti-tampering signature timestamp after a bitwise exclusive OR operation according to the system byte alignment requirements. It contains the binding result of user identity information and time characteristics and is used for the identity verification part of the electronic signature data packet. The identification data block is a structured data block generated by the operation of the dynamic password request identifier and the timestamp characteristic value. The discretized data block is the segmented result of the signature input data after being processed by cryptographic rules. The feature data block is the original segment of the biometric data. The three data sources and processing stages are different but there is a temporal relationship: from the feature data block to the dynamic password request identifier to the identification data block, and the discretized data block is an independent cryptographic operation branch.

[0198] In an embodiment of the present application, the XOR operation result is padded and truncated so that its length meets the system byte alignment requirement, and then the data block structure is reorganized in big-endian order.

[0199] Step 705: Convert the character code value of the hardware fingerprint into a binary code sequence.

[0200] In step 705, the character encoding value is obtained by converting the ASCII string of the hardware fingerprint (such as "iPhone13_7A83C") character by character into the corresponding ASCII code value (0x49, 0x70, ...). The two are in a conversion relationship rather than an inclusion relationship. The hardware fingerprint is the original device identifier, and the character encoding value is its standardized binary representation. The binary encoding sequence refers to the data stream that converts the character form of the hardware fingerprint into a pure binary representation.

[0201] In the embodiment of the present application, each character in the hardware fingerprint string is converted into its corresponding code value, and then these code values ​​are continuously concatenated to form a binary sequence, removing redundant separators.

[0202] Step 706: Using the signature header as a starting mark, sequentially concatenate the identification data block, the binary sequence, and the pulse sequence of the tamper-proof signature timestamp to construct a data packet structure.

[0203] In step 706, the data packet structure refers to a standardized container format that arranges the data elements in a specific order. The final pulse feature value is the last 8-bit feature code (e.g., 0xB6) extracted from the complete pulse sequence (e.g., 1024 bits). The pulse sequence is the result of converting the original timing signal. The feature value is used for local calculations, while the complete sequence is used for data packet construction.

[0204] In the embodiment of the present application, the signature header is placed first as a guide identifier, and then the identification data block, hardware fingerprint sequence and time stamp pulse sequence are arranged to form a data structure with a clear hierarchy.

[0205] Step 707: Calculate the checksum of all data in the data packet structure.

[0206] In step 707 , the checksum refers to a data integrity verification value calculated by a specific algorithm.

[0207] In an embodiment of the present application, all data in the data packet structure except the signature body is accumulated in sections, and then the accumulated results are subjected to modular operation and bit reversal to generate a check code.

[0208] Step 708: Insert the checksum as a separator after the pulse sequence in the data packet structure, and insert the signature body after the separator to form an electronic signature data packet.

[0209] In step 708, the delimiter refers to a special marker byte used to distinguish different parts of the data packet.

[0210] In an embodiment of the present application, a checksum is inserted between the timestamp pulse sequence and the signature body as a demarcation mark and also as a verification point for data integrity.

[0211] Here's a specific example:

[0212] In the mobile banking contract signing scenario, the server extracts the first byte 0x9F from the 256-bit digital signature (the upper 4 bits 1001 indicate the algorithm version, and the lower 4 bits 1111 indicate the signature body length of 240 bits); based on this identifier, the signature is divided into a 16-byte header and a 240-bit body; the 896-bit dynamic password request identifier is XORed with the last 8 bits 0xB6 of the anti-tampering timestamp (0xB6 is extended to 896 bits and then XORed bit by bit); the XOR result is reorganized into 14 data blocks (896 / 64=14) with 64-bit alignment; and the hardware fingerprint "PH-1234-ABCD" is converted into ASCII. The I-code sequence is then spliced ​​into a binary stream; the signature header, 14 identification data blocks, the hardware fingerprint binary stream, and the complete timestamp pulse sequence are assembled in sequence; the CRC-32 checksum 0x8A3D7C29 is calculated for all assembled data; this checksum is inserted into the timestamp data, and finally the 240-bit signature body is appended to form an electronic signature data packet with a total length of 1536 bits.

[0213] In the embodiments of the present application, the integrity and verifiability of the electronic signature data package are ensured through structured coding and multiple data bindings, the verification mechanism prevents data tampering, and the standardized format improves system compatibility, providing safe and reliable technical guarantees for electronic file exchange.

[0214] Figure 2 A structural diagram of an electronic signature and verification system based on a dynamic password is provided in an embodiment of the present application, such as Figure 2 As shown, the system includes:

[0215] The acquisition module 21 is used to obtain the user's biometric data when receiving a signature request sent by a mobile device, and add the current timestamp to generate a dynamic password seed.

[0216] The first generation module 22 is used to generate a corresponding dynamic password request identifier based on the dynamic password seed, verify the association between the dynamic password request identifier and the biometric characteristics corresponding to the user in a preset biometric characteristic library, and match the hardware fingerprint corresponding to the mobile device from a preset hardware fingerprint library based on the dynamic password request identifier.

[0217] The second generating module 23 is configured to generate a digital signature using an elliptic curve algorithm when the association verification passes, and record the tamper-proof signature timestamp generated when the digital signature is generated.

[0218] The encoding module 24 is used to encode the digital signature, the dynamic password request identifier, the hardware fingerprint and the tamper-proof signature timestamp into an electronic signature data packet.

[0219] The sending module 25 is used to send the electronic signature data packet to the mobile device, so that the mobile device can verify the difference of the biometric data, the validity of the digital signature, and the temporal and spatial matching between the tamper-proof signature timestamp and the hardware fingerprint based on the electronic signature data packet. If the verification result indicates that all the legal conditions are met, the electronic signature is determined to be legal.

[0220] Figure 2 The electronic signature and verification system based on dynamic password can be executed Figure 1 The implementation principle and technical effects of the dynamic password-based electronic signature and verification method described in the illustrated embodiment will not be elaborated on here. The specific manner in which each module and unit performs operations in the dynamic password-based electronic signature and verification system in the above embodiment has been described in detail in the embodiment of the method and will not be elaborated on here.

[0221] In one possible design, Figure 2 The electronic signature and verification system based on dynamic password of the embodiment shown can be implemented as a computing device, such as Figure 3 As shown, the computing device may include a storage component 31 and a processing component 32;

[0222] The storage component 31 stores one or more computer instructions, wherein the one or more computer instructions are called and executed by the processing component 32 .

[0223] The processing component 32 is as follows Figure 1 The embodiment provides an electronic signature and verification method based on a dynamic password.

[0224] The processing component 32 may include one or more processors to execute computer instructions to complete all or part of the steps in the above method. Of course, the processing component may also be implemented as one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to perform the above method.

[0225] The storage component 31 is configured to store various types of data to support operations at the terminal. The storage component can be implemented by any type of volatile or non-volatile memory device, or a combination thereof, such as static random-access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk, or optical disk.

[0226] Of course, a computing device may also include other components, such as input / output interfaces, display components, communication components, etc.

[0227] The input / output interface provides an interface between the processing component and the peripheral interface module, which can be an output device, an input device, etc.

[0228] The communication component is configured to facilitate, among other things, wired or wireless communications between the computing device and other devices.

[0229] Among them, the computing device can be a physical device or an elastic computing host provided by a cloud computing platform, etc. In this case, the computing device can refer to a cloud server, and the above-mentioned processing components, storage components, etc. can be basic server resources rented or purchased from the cloud computing platform.

[0230] The present application also provides a computer storage medium storing a computer program, wherein the computer program can achieve the above-mentioned Figure 1 The embodiment shown is an electronic signature and verification method based on a dynamic password.

[0231] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0232] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., they may be located in one location or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of the present embodiment. Persons of ordinary skill in the art will be able to understand and implement the present invention without inventive effort.

[0233] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, or of course, by hardware. Based on this understanding, the essence of the above technical solution or the part that contributes to the existing technology can be embodied in the form of a software product. The computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or certain parts of the embodiments.

[0234] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. An electronic signature and verification method based on a dynamic password, characterized in that: Applied to remote servers, including: When receiving a signature request from a mobile device, the user's biometric data is obtained and superimposed with the current timestamp to generate a dynamic password seed; Based on the dynamic password seed, a corresponding dynamic password request identifier is generated, the dynamic password request identifier is associated with a biometric feature corresponding to the user in a preset biometric feature library, and a hardware fingerprint corresponding to the mobile device is matched from a preset hardware fingerprint library based on the dynamic password request identifier; When the correlation verification passes, the elliptic curve algorithm is used to generate a digital signature, and the tamper-proof signature timestamp generated when the digital signature is generated is recorded; Encoding the digital signature, the dynamic password request identifier, the hardware fingerprint and the tamper-proof signature timestamp into an electronic signature data packet; The electronic signature data packet is sent to a mobile device, so that the mobile device can verify the difference of the biometric data, the validity of the digital signature, and the spatiotemporal matching between the tamper-proof signature timestamp and the hardware fingerprint based on the electronic signature data packet. If the verification result indicates that all legal conditions are met, the electronic signature is determined to be legal.

2. The method according to claim 1, characterized in that The digital signature is generated using an elliptic curve algorithm, and the tamper-proof signature timestamp generated when the digital signature is generated is recorded, including: Extracting a unique coding sequence corresponding to the biometric data from the dynamic password request identifier; Logically binding the unique coding sequence with the hardware fingerprint of the mobile device to form signature input data; According to a preset cryptographic rule set, the signature input data is segmented and reassembled to generate discretized data; Based on the secure clock chip of the remote server and the signature input data, a tamper-proof signature timestamp is formed; The discretized data and the tamper-proof signature timestamp are input into a cryptographic operation unit, and combined with an elliptic curve algorithm, a digital signature is output.

3. The method according to claim 2, characterized in that The step of inputting the discretized data and the tamper-proof signature timestamp into a cryptographic operation unit, combining the elliptic curve algorithm, and outputting a digital signature includes: Inputting the discretized data and the tamper-proof signature timestamp into a cryptographic operation unit, the cryptographic operation unit splits the discretized data into a plurality of discretized data blocks according to a preset segmentation rule, wherein the length of each discretized data block is dynamically determined by the parity of the time mark code in the tamper-proof signature timestamp; For each discretized data block, a nonlinear transformation operation is performed on the discretized data block using an elliptic curve algorithm according to the time stamp code to generate a cryptographic sequence segment; Cross-recombining the cipher sequence segments of each discretized data block according to the generation order of the time mark code to form an initial cipher sequence; Extracting the last pulse characteristic value of the tamper-proof signature timestamp and using the last pulse characteristic value as a cyclic shift; permuting bits of the initial cipher sequence according to the cyclic shift to generate an intermediate cipher sequence; A bitwise logic operation is performed on the intermediate cryptographic sequence and the physical characteristic value of the hardware fingerprint to generate a target cryptographic sequence, and the target cryptographic sequence is used as a digital signature.

4. The method according to claim 3, characterized in that The step of performing a nonlinear transformation operation on the discretized data block using an elliptic curve algorithm according to the time stamp code to generate a cryptographic sequence segment includes: Selecting a parameter adjustment coefficient corresponding to a discretized data block from the cryptographic rule set; Splitting the physical feature values ​​of the hardware fingerprint into a plurality of reference arrays, and converting the decimal value form of the parameter adjustment coefficient into a two's complement form; Performing a modular addition operation on the parameter adjustment coefficient in the two's complement format with the corresponding byte in the reference array bit by bit; Performing a bitwise OR operation on the result of the modular addition operation and the current time mark code to generate a combined value, and using the combined value as a dynamic operation constraint condition; Under the dynamic operation constraint condition, the elliptic curve algorithm is used to perform a nonlinear transformation operation on the discretized data block to generate a cryptographic sequence segment.

5. The method according to claim 2, characterized in that The secure clock chip based on the remote server and the signature input data forms a tamper-proof signature timestamp, including: Generate a reference clock signal through the internal oscillator of the security clock chip; Phase synchronization of the reference clock signal with a generation time node of the signature input data; The synchronized reference clock signal is converted into a digital pulse sequence, and the digital pulse sequence is used as an anti-tampering signature timestamp.

6. The method according to claim 1, wherein The step of generating a corresponding dynamic password request identifier based on the dynamic password seed includes: Extracting the biometric data component and the timestamp component from the dynamic password seed; Dividing the biometric data component into a plurality of feature data blocks according to a preset binary segmentation rule; For each characteristic data block, logically combining the characteristic data block with the periodic sequence segment corresponding to the timestamp component; Rearranging all combined feature data blocks according to the generation sequence of the timestamp components to generate a unique coding sequence; The unique code sequence is compressed, and the compressed unique code sequence is cross-joined with the last cyclic sequence of the timestamp component to form a dynamic password request identifier.

7. The method according to claim 1, characterized in that The step of encoding the digital signature, the dynamic password request identifier, the hardware fingerprint, and the tamper-proof signature timestamp into an electronic signature data packet includes: Extracting the first byte of the digital signature as a length identifier; Dividing the digital signature into a signature header and a signature body according to the length identifier; Performing a bitwise exclusive OR operation on the dynamic password request identifier and the last pulse characteristic value of the tamper-proof signature timestamp; Reorganize the operation results into identification data blocks according to byte alignment; Converting the character encoding value of the hardware fingerprint into a binary encoding sequence; Using the signature header as a starting mark, sequentially splicing the identification data block, the binary code sequence, and the pulse sequence of the tamper-proof signature timestamp to construct a data packet structure; Calculating a checksum of all data in the data packet structure; The checksum is inserted as a separator after the pulse sequence in the data packet structure, and the signature body is inserted after the separator to form an electronic signature data packet.

8. An electronic signature and verification system based on dynamic password, characterized in that: Applied to remote servers, including: The acquisition module is used to obtain the user's biometric data when receiving a signature request sent by a mobile device, and superimpose the current timestamp to generate a dynamic password seed; a first generation module, configured to generate a corresponding dynamic password request identifier based on the dynamic password seed, perform correlation verification on the dynamic password request identifier and a biometric feature corresponding to the user in a preset biometric feature library, and match a hardware fingerprint corresponding to the mobile device from a preset hardware fingerprint library based on the dynamic password request identifier; The second generation module is used to generate a digital signature using an elliptic curve algorithm when the association verification passes, and record the tamper-proof signature timestamp generated when the digital signature is generated; An encoding module, configured to encode the digital signature, the dynamic password request identifier, the hardware fingerprint, and the tamper-proof signature timestamp into an electronic signature data packet; A sending module is used to send the electronic signature data packet to a mobile device, so that the mobile device can verify the difference of the biometric data, the validity of the digital signature, and the spatiotemporal matching between the tamper-proof signature timestamp and the hardware fingerprint based on the electronic signature data packet. If the verification result indicates that all legal conditions are met, the electronic signature is determined to be legal.

9. A computing device, characterized in that It comprises a processing component and a storage component; the storage component stores one or more computer instructions; the one or more computer instructions are used to be called and executed by the processing component to implement an electronic signature and verification method based on a dynamic password as described in any one of claims 1 to 7.

10. A computer storage medium, characterized in that A computer program is stored, and when the computer program is executed by a computer, an electronic signature and verification method based on a dynamic password as claimed in any one of claims 1 to 7 is implemented.

Images