Electronic signature system and method based on biometric recognition authentication

Abstract

This invention discloses an electronic signature system and method based on biometric identification and authentication, relating to the field of information security technology. It includes a client device, a server device, and a Certificate Authority (CA). The client device is connected to the server device via a communication network, and the server device is connected to the CA via the same communication network. The client device is used to collect the biometric features of the signer and to interact with the signer's business system client. The server device is used to authenticate the signer by comparing the biometric value collected by the client device with the biometric template collected during registration. After successful biometric authentication, the electronic signature is completed, and the corresponding signature evidence data is saved. The CA is used to issue digital certificates to the signer. The communication network provides a secure transmission channel for transmitting relevant interactive information. This invention solves the problem of needing to strictly verify the signer's true identity.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to an electronic signature system and method based on biometric identification and authentication. Background Technology

[0002] Currently, electronic signature technology is being used more and more widely. Electronic signatures can verify the signer's acceptance of the signed information, serving functions such as identity authentication, data tamper prevention, and prevention of repudiation. Typically, electronic signatures are completed using a UKey or mobile collaborative signing method. During the signing process, the signer enters a PIN code to verify their identity, and then uses their private key to complete the electronic signature.

[0003] Currently, using UKey or mobile collaborative signing requires the signer to operate a PC or mobile device and enter a PIN code from a digital certificate to complete the electronic signature. However, in certain special scenarios (such as requiring a doctor's electronic signature in an operating room), PIN-based electronic signing is unsuitable, necessitating alternative authentication methods to access the signer's private key. Furthermore, PIN-based signature authentication can lead to discrepancies between the operator and the actual signer. Additionally, in applications requiring strict verification of the signer's identity, current technologies cannot easily and effectively achieve this. Summary of the Invention

[0004] The purpose of this invention is to provide an electronic signature system and method based on biometric identification and authentication. Human biometric features are unique and relatively stable. This invention uses biometric identification technology (face recognition, finger vein recognition, fingerprint recognition) to authenticate the signer's identity, determine the signer's true identity, and then perform electronic signing. This solves the problem of the inconvenience of using traditional UKey and mobile terminal collaborative signing in special scenarios (such as: doctors needing electronic signatures in the operating room), and also solves the problem of needing to strictly verify the signer's true identity.

[0005] To achieve the above objectives, the technical solution adopted by this invention is: an electronic signature system based on biometric identification and authentication, comprising a client device, a server device, and a CA (Certificate Authority). The client device is connected to the server device via a communication network, and the server device is connected to the CA via a communication network. The client device is used to collect the biometric features of the signer and to interact with the signer's business system client. The biometric features are one or more combinations of facial features, finger vein features, and fingerprint features. The server device is used to authenticate the signer by comparing the biometric feature value collected by the client device with the biometric feature template collected during registration. After successful biometric authentication, the electronic signature is completed, and the corresponding signature behavior evidence data is saved. The CA is used to issue digital certificates to the signer. The communication network is used to provide a secure transmission channel for transmitting relevant interactive information.

[0006] As a further improvement of the present invention, the client device specifically includes:

[0007] The first central processing unit, the first communication module, and the first operating system are used to provide the basic hardware and software environment for the client device to run.

[0008] Biometric data acquisition terminal is used to collect the biometric features of the signer and to perform liveness detection on the signer;

[0009] The client software is used to collect the biometric values ​​of the signer through the biometric collection terminal, and to cooperate with the server software of the server device to complete the biometric identification and authentication of the signer, while providing an interactive interface for the signer;

[0010] The client SDK is used to provide interfaces to business system clients and complete collaboration with the business system.

[0011] The first national cryptographic security chip is used to store the private key of the client device's asymmetric key and the corresponding digital certificate of the client device, and provides cryptographic operation capabilities; the client device uses the chip ID of the first national cryptographic security chip as the client device ID, denoted as DevID, and the private key of the asymmetric key is pre-installed in the first national cryptographic security chip. Device digital certificates for client devices It is used to encrypt and decrypt transmitted data and to achieve two-way authentication with server devices.

[0012] As a further improvement of the present invention, the server-side device specifically includes:

[0013] The second central processing unit, the second communication module, and the second operating system are used to provide the basic hardware and software environment for the server device to run.

[0014] The server-side software is used to collaborate with the client software to complete the registration of client devices, signer registration, collection of signer biometric values, and to authenticate the signer's identity through biometric identification. After successful authentication, the signer's private key is used to perform electronic signing, as well as the collection and storage of corresponding signature evidence.

[0015] Signature value data is used to store the signature value of the signer;

[0016] Signer's encrypted private key and certificate data, used to store the signer's encrypted private key and digital certificate information;

[0017] Signer identity and biometric template data, used to store the signer's identity information and the signer's encrypted biometric template data;

[0018] Client device registration data is used to store data on registered client devices.

[0019] Signature behavior evidence data is used to store behavioral data information of the signer when making an electronic signature;

[0020] API interfaces are used to provide interfaces to the business system server to implement electronic signatures;

[0021] The second national cryptographic security chip is used to store the private key of the asymmetric key of the server device and the corresponding digital certificate of the server device, and provides cryptographic operation capabilities; the server device has the private key of the asymmetric key pre-installed in the second national cryptographic security chip. Device digital certificate for server equipment It is used to encrypt and decrypt transmitted data and to achieve two-way authentication with client devices, with a pre-set symmetric key. Encrypt sensitive information of the signer.

[0022] This invention also provides an electronic signature method based on biometric identification and authentication, implemented using the electronic signature system based on biometric identification and authentication as described above. The method includes the following steps:

[0023] S10. Client device registration: Set the server device's service address and digital certificate on the client device. When the client device starts up, it sends registration request parameters. The server device authenticates the client device based on the registration request parameters. After successful authentication, it updates the client device's network address and completes the client device registration.

[0024] S20. Signer Registration: The client device collects the signer's identity information and biometric template, forms a signer registration data packet, signs and encrypts the signer registration data packet, and then sends it to the server device for registration. After receiving the data, the server device decrypts the data, verifies the signature, forms the signer's asymmetric key pair based on the signer's identity information, applies for the signer's digital certificate from the CA authority, and finally saves the signer's identity information, biometric template data, digital certificate, and encrypted signature private key information to complete the signer registration.

[0025] S30, Signer Biometric Authentication Signature: The signer initiates an electronic signature within the business system. The business system calls the API interface of the server device to perform the electronic signature. The server device and the client device collaborate to complete biometric identification and authentication. After successful authentication, the signer completes the electronic signature using the signer's private key and returns the result to the business system.

[0026] As a further improvement of the present invention, S10 specifically includes the following steps:

[0027] S1001. The whitelist information of the client devices is pre-imported into the server device and stored in the client device registration data. The whitelist information of the client devices includes the device ID (DevID) and the digital certificate of the client devices. ;

[0028] S1002. Configure the server device's service address and digital certificate on the client device. and the completed digital certificate It is stored in the first national cryptographic security chip; the client device saves the service address of the corresponding server device;

[0029] S1003. The client device prepares registration parameters and encrypts them with the server device's digital certificate. The client device obtains the client device ID DevID and generates a random number for device registration using the first national cryptographic security chip. Obtain the client device's network address IPAddr and form the string DevID||IPAddr|| Where || represents concatenation, and the hash value is calculated using the SM3 algorithm. Then through the client device's private key Perform digital signature to obtain the client device signature value DevSign, and package the registration parameter values ​​(DevID, IPAddr, ...). (Through the digital certificate of the server device) Public key within The registration parameter values ​​are encrypted to obtain the encrypted registration parameter values. ;

[0030] S1004, The client device requests registration; the client device sends... DevSign is sent as a registration request parameter to the server device to request registration;

[0031] S1005. The server device receives the registration request, decrypts the registration request parameters, and sends the received data... Through the private key of the server device Decryption is performed to restore the plaintext registration parameter values ​​(DevID, IPAddr, ...). );

[0032] S1006. Determine if the device is in the whitelist. Query the client device registration data for client device information using the client device ID DevID. If it does not exist, registration fails and proceeds to S1010; if it exists, proceeds to S1007.

[0033] S1007. Authenticate the client device. The server device uses the received DevSign and the client device's digital certificate retrieved in S1006. and plaintext registration parameter values ​​(DevID, IPAddr, Verify the validity of the signature value DevSign;

[0034] S1008. Client device authentication is successful. The authentication of the client device is checked based on the validity of the signature value. If the signature value is valid, the authentication is successful and proceeds to S1009; if the signature value is invalid, the registration fails and proceeds to S1010.

[0035] S1009. Store the network address of the client device, and update the network address IPAddr of the client device in the corresponding record in the client device registration data according to the client device ID DevID;

[0036] S1010. Return the registration result information to the client. When the client device registers successfully, the server device uses the private key of the pre-embedded asymmetric key in the second national cryptographic security chip. For received Sign it and get As returned data; returns the reason for registration failure if registration fails;

[0037] S1011. Receive and process the registration result information from the client device. If registration is successful, verify the digital certificate of the server device. right The device will be verified and will be ready if the verification is successful. If the registration fails or the verification fails, the device will be offline and you will be prompted to re-register the device.

[0038] As a further improvement of the present invention, S20 specifically includes the following steps:

[0039] S2001. Collect signer identity information. The signer enters the signer information, including Name and ID number, on the user interface of the client device to complete the collection of signer identity information.

[0040] S2002. Collect the biometric template of the signer. The client device user interface guides the signer to collect the biometric template BioSample on the biometric collection terminal.

[0041] S2003. The client device prepares the signer registration parameters. The client device generates a random number for signer registration using the first national cryptographic security chip. The client device obtains the client device ID (DevID) and assembles the signer registration parameter package. Parameter package This includes DevID, Name, IDNumber, BioSample, ;

[0042] S2004. The client device encrypts and signs the signer's registration parameters, and calculates the signer's registration parameter packet. The hash value, i.e. Use the client device's private key right Perform an electronic signature and obtain the signature value of the signer's registration request. Digital certificates for server-side devices Public key within right Encryption is performed to obtain the ciphertext of the signer's registration parameter packet. ;

[0043] S2005, The client device sends a signer registration request, and... , Send a request to the server device to register the signer;

[0044] S2006. The server device receives the registration request, decrypts the ciphertext of the signer registration parameter packet, and the server device receives... , Through the device private key pre-installed on the server device Decryption get ;

[0045] S2007. The server-side device verifies the validity of the signer registration request, and the server-side device parses the request. Obtain the DevID, query the client device registration data using the DevID, and obtain the client device's digital certificate. ,calculate Through the digital certificate of the client device verify Validity;

[0046] S2008. The validity of the registration request is determined by the validity of the signature value. If the signature value is valid, the signature is parsed out. Name, IDNumber, BioSample, If the signature value is invalid, proceed to S2009; if the signature value is invalid, proceed to S2013, registration fails.

[0047] S2009. Generate a signer asymmetric key pair. The server device generates a signer key pair using the second national cryptographic security chip, which consists of a public key and a private key. and private key At the same time, according to Name, IDNumber and Generate a Certificate Application Request (CSR) and encrypt it using a second national cryptographic security chip to obtain the private key ciphertext. ;

[0048] S2010. Apply for a digital certificate for the signer. The server device sends the certificate application request (Csr) to the CA authority to apply for a digital certificate for the signer.

[0049] S2011, CA authorities issue digital certificates to signers. CA authorities issue digital certificates to signers based on certificate application requests (CSR). ;

[0050] S2012, Save the signer's registration information. The server-side device stores the signer's IDNumber, , Save the signature's encrypted private key and certificate data, save the signature's Name, IDNumber, and BioSample data into the signature's identity and biometric template data, and save the BioSample using the symmetric key stored in the second national cryptographic security chip on the server device. Encrypt and store;

[0051] S2013. Return the signer registration result information. The server device returns the signer registration result information to the client device.

[0052] S2014. The client device receives and processes the registration result information of the signer, and displays the corresponding prompt information to the signer based on the registration result.

[0053] As a further improvement of the present invention, S30 specifically includes the following steps:

[0054] S3001. The signer initiates the signing process on the client side of the business system. The client side of the business system obtains the device ID DevID of the client device through the client SDK provided by the client device.

[0055] S3002. The business system server prepares the original signature text OrgData, the signer's identity identifier IDNumber, the client device ID DevID, and the business serial number BusiNumber, and calls the API interface of the server device to perform electronic signature.

[0056] S3003. The server device generates a biometric identification challenge value (Challenge) using the second national cryptographic security chip and establishes a corresponding relationship with the business serial number (BusiNumber). Based on the client device ID (DevID), it queries the client device's network address (IPAddr) in the client device registration data. Then, it uses the server device's private key through the second national cryptographic security chip. Perform an electronic signature to obtain the challenge value's signature value. Use the digital certificate of the client device. Public key within Encrypt the Challenge value to obtain the Challenge ciphertext. ; encrypt the challenge value and the signature value of the challenge value As a biometric identification instruction parameter, it is sent to the client device corresponding to the device ID;

[0057] S3004. After receiving the biometric identification command and parameters, the client device uses the client device's private key through the client device's first national cryptographic security chip. The challenge value (plaintext "Challeng") is decrypted using the server's device digital certificate. Verify the signature value of the challenge. If the verification fails, the server device is returned that the signature failed and enters S3013; if the verification succeeds, the biometric value of the signer is collected through the biometric collection terminal of the client device.

[0058] S3005. The client device encrypts and signs the biometric value of the signer and sends it to the server device.

[0059] S3006. The server device decrypts the response data of the client device and the corresponding challenge value. Based on the signer's identity identifier passed in by the business system, the server device finds the corresponding signer's biometric template and decrypts it.

[0060] S3007. The server-side device uses a biometric recognition algorithm to identify and authenticate the collected biometric value BioValue and the signer's biometric template BioSample.

[0061] S3008. Determine whether the biometric authentication is successful. If successful, proceed to S3009; if unsuccessful, encrypt the challenge value. Challenge value signature value The reason for the failed biometric authentication is sent to the client device, and the process proceeds to S3011.

[0062] S3009. The server device finds the signer's encrypted private key based on the signer's identity and signs the original text through the second national cryptographic security chip.

[0063] S3010, the server-side device generates and saves the signature behavior evidence data of the signer, and saves the signature value, including IDNumber, BusiNumber, and , Save to the signature behavior evidence data; include IDNumber, BusiNumber, Save to the signature value data;

[0064] S3011, The client device prompts the signer to re-identify or cancel;

[0065] S3012. Determine whether the signer has re-identified or canceled the signature. The signer operates on the client device's interactive interface to confirm re-identification or cancellation. If re-identification occurs, proceed to S3004; if cancellation occurs, proceed to S3013.

[0066] S3013, The server-side device generates the signature result data and returns it to the business system. If the signature is successful, it returns BusiNumber. If the signature fails, return the reason for the failure.

[0067] S3014. The business system server receives and processes the signature result data. If the signature is successful, the signature value is saved; if the signature fails, the reason for the failure is displayed.

[0068] As a further improvement of the present invention, S3005 is specifically as follows:

[0069] Client devices assemble biometric authentication data packets for signers. Including Challenge and BioValue; calculation The device's private key is used through the first national cryptographic security chip on the client device. Perform an electronic signature to obtain the signature value of the biometric authentication data packet. Digital certificates for server-side devices Public key within right Encryption is performed to obtain the ciphertext of the biometric authentication data packet. ;Bundle , Send to the server device.

[0070] As a further improvement of the present invention, S3006 is specifically as follows:

[0071] The server device received , ; via the device private key pre-installed on the server-side device Decryption get ;according to Within the challenge value (Challeng), find the corresponding business serial number (BusiNumber) and client device ID (DevID); based on the client device ID (DevID), query the client device's digital certificate in the client device registration data. ;calculate ,verify The validity of the signature is checked. If invalid, the signature fails and proceeds to step S3013. If valid, the signer's identity identifier IDNumber is found based on the business serial number BusiNumber. The IDNumber is used to find the signer's identity and the encrypted biometric template in the biometric template data. The symmetric key is then used in the second national cryptographic security chip of the server device. Decryption yields the biometric template BioSample corresponding to the signer; extraction BioValue within.

[0072] As a further improvement of the present invention, S3009 is specifically as follows:

[0073] The server device retrieves the signer's encrypted private key from the signer's private key and certificate data based on the signer's identity identifier IDNumber. digital certificate of the signer ; through the symmetric key within the second national cryptographic security chip of the server device Decrypting the encrypted private key Obtain the signer's private key Then, the private key is used via the second national cryptographic security chip. The original OrgData is digitally signed to obtain the original signature value. .

[0074] Based on the uniqueness and relative stability of biometrics, this invention enables client device registration, signer registration, and electronic signature based on biometric identification and authentication of the signer through the division of labor between client devices and server devices. This provides a strong identity authentication electronic signature, and saves the biometric identification data of the signer as evidence of the signing behavior when the signing is completed, effectively preventing the signer from denying it afterward.

[0075] This invention uses a national cryptographic security chip as the unique identifier for the client device, and facilitates integration with business system clients through a client SDK, thereby effectively establishing an interactive identifier between the client device and the server device. It pre-issues digital certificates for the client device and stores the client device's private key through the national cryptographic security chip, serving as the foundation for subsequent identity authentication and secure encryption of sensitive data with the server device. Furthermore, it pre-imports the client device's information into the server device and dynamically updates the client device's network address during client registration, effectively solving the problems of client device impersonation and volatile network addresses.

[0076] The client registration method of the present invention enables the client device to automatically register when it is powered on or when the client device is connected to the server device via the network.

[0077] This invention uses a national cryptographic security chip in the server-side device to store the server-side device's private key and device certificate, which serve as the basis for identity authentication between the client device and the server-side device. At the same time, the national cryptographic security chip in the server-side device provides the server with cryptographic computing capabilities to ensure the communication security between the client device and the server-side device.

[0078] This invention supports signers registering on any trusted client device. During registration, the client device collects the signer's identity information and biometric template, and encrypts the sensitive information using asymmetric encryption technology before transmitting it to the server device. The server device verifies the registration information and generates the signer's public-private key pair using a national cryptographic security chip. The server can then apply for the signer's digital certificate from a CA authority and encrypt and store the signer's sensitive information (signing private key, biometric template), thereby ensuring the security of the signer's sensitive information.

[0079] This invention enables electronic signatures by using a client SDK provided by the client device and an API interface provided by the server device in conjunction with the client and server of the business system. The client of the business system only needs to obtain the client device ID of the connected client device to call the API interface of the server device on the business system server to perform electronic signatures. The specific signing process is entirely handled by the server device, which autonomously distributes instructions to the client device and collects the biometric value of the signer. Then, biometric identification and authentication are performed. Once the authentication is successful, the electronic signature is completed. If the biometric identification and authentication fails once, multiple biometric value collection and authentication of the signer can be performed.

[0080] When the server receives a signature request, the present invention uses a challenge value as an identifier for a signature transaction and maps it to the responding client device ID, business serial number, and signer identity identifier, thereby simplifying the interaction parameters between the client device and the server device. The challenge value can also effectively prevent man-in-the-middle attacks during the communication process between the client device and the server device.

[0081] After the electronic signature is completed, this invention saves the encrypted biometric value information, challenge value information, and signature value information of the client device on the above values ​​as evidence data of the signer's signature behavior, and associates them with the current signature behavior as evidence data of the signer's signature behavior.

[0082] The beneficial effects of this invention are:

[0083] This invention solves the problem of using biometrics to authenticate signers and implement electronic signatures in business systems. It provides integration interfaces for both client and server devices, effectively simplifying integration and interaction with business systems. Furthermore, it confines the biometric authentication process to the client and server devices, thus simplifying the biometric authentication and signature process. Additionally, it encrypts the signer's sensitive information using a national cryptographic security chip, ensuring security during the transmission and storage of sensitive information and mitigating the risk of leakage. Finally, by authenticating the signer's biometrics and encrypting and storing the signer's signature data, this invention effectively solves the problem of requiring strict verification of the signer's true identity to implement electronic signatures. Attached Figure Description

[0084] Figure 1 This is a framework diagram of the electronic signature system in an embodiment of the present invention;

[0085] Figure 2 This is an overall flowchart of the electronic signature method in an embodiment of the present invention;

[0086] Figure 3This is a flowchart illustrating the registration process of a client device in an embodiment of the present invention.

[0087] Figure 4 This is a flowchart illustrating the registration process for signatories in an embodiment of the present invention.

[0088] Figure 5 This is a flowchart illustrating the biometric authentication process for the signer in an embodiment of the present invention. Detailed Implementation

[0089] The embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0090] Example

[0091] In this embodiment, a strong two-way authentication method between the client and server is adopted during the registration process of the client device on the server device to ensure the construction of a trusted signature environment. It can also collect the biometric values ​​(facial feature value, finger vein feature value, fingerprint feature value) of the signer during the signer registration, generate a signature key pair, and apply for a digital certificate from the CA authority based on the signer's identity information (name, ID number, etc.) to complete the signer registration. When signing, the biometric identification of the signer is collected by the client device and the signer's identity is authenticated on the server device. After the identity authentication is successful, the signature key is called to complete the electronic signature and save the biometric signature behavior evidence data.

[0092] like Figure 1 As shown, an electronic signature system based on biometric identification and authentication includes a client device 100, a server device 200, a CA (Certificate Authority) 300, and a communication network 400. The client device 100 is connected to the server device 200 via the communication network 400 and communicates through a secure transmission channel 401. The client device 100 collects the biometric features of the signer and interacts with the signer's business system client. The server device 300 is connected to the CA 300 via the communication network 400 and communicates through the secure transmission channel 401. The server device 300 performs authentication by comparing the biometric value of the signer collected by the client device 100 with the biometric template of the signer collected during registration. After successful biometric authentication, the electronic signature is completed, and the corresponding signature evidence data is saved. The communication network 400 provides the secure transmission channel 401 to transmit relevant interactive information. The CA 300 can be any third-party electronic authentication service provider, responsible for issuing digital certificates to the signer.

[0093] For example Figure 1As shown, the client device 100 specifically includes a biometric acquisition terminal 101, a first central processing unit 102, a first communication module 103, a first national cryptographic security chip 104, a first operating system 105, client software 106, and client SDK 107. The first central processing unit 102, the first communication module 103, and the first operating system 105 constitute the basic hardware and software environment for the client device 100. The biometric acquisition terminal 101 is used to collect the biometric features of the signer and perform liveness detection on the signer; it can be one or more combinations of a face recognition terminal, a finger vein recognition terminal, and a fingerprint recognition terminal. The first national cryptographic security chip 104 is used to store the private key of the client device 100's asymmetric key and the corresponding digital certificate of the client device 100, and provides cryptographic computation capabilities. The client software 106 is responsible for collecting the signer's biometric values ​​through the biometric acquisition terminal 101 and collaborating with the server software 201 of the server device 200 to complete the biometric identification and authentication of the signer, while also providing an interactive interface for the signer. The client SDK 107 is responsible for providing an interface to the business system client to complete collaboration with the business system. Client device 100 uses the chip ID of the first national cryptographic security chip 104 as the client device IDDevID, and the private key of the asymmetric key is pre-installed in the first national cryptographic security chip 104. And the device digital certificate of client device 100 It is used to encrypt and decrypt transmitted data and to achieve two-way authentication with the server device 200.

[0094] For example Figure 1As shown, the server-side device 200 specifically comprises server-side software 201, a second central processing unit 202, signature value data 203, signer's encrypted private key and certificate data 204, signer's identity and biometric template data 205, client device registration data 206, a second communication module 207, signature behavior evidence data 208, a second national cryptographic security chip 209, a second operating system 210, and an API interface 211. The second central processing unit 202, the second communication module 207, and the second operating system 210 form the basic hardware and software environment for the server-side device 200. The server-side software 201 collaborates with the client software 106 to complete client device registration, signer registration, and biometric value collection. It also authenticates the signer's identity through biometric identification. After successful authentication, it performs electronic signing using the signer's private key and collects and stores corresponding signature behavior evidence. The signature value data 203 stores the signer's signature value. The signer's encrypted private key and certificate data 204 stores the signer's encrypted private key and digital certificate information. Signer identity and biometric template data 205 stores the signer's identity information and encrypted biometric template data. Client device registration data 206 stores registered client device data. Signature behavior evidence data 208 stores the signer's behavior data when performing an electronic signature. The second national cryptographic security chip 209 stores the private key of the server device's asymmetric key and the corresponding digital certificate of the server device 200, and provides cryptographic computation capabilities. API interface 211 provides an interface to the business system server to implement electronic signatures. The server device 200 has the private key of the asymmetric key pre-installed in the second national cryptographic security chip 209. Digital certificate of server device 200 It is used to encrypt and decrypt transmitted data and to achieve two-way authentication with client devices, with a pre-set symmetric key. Encrypt sensitive information of the signer.

[0095] like Figure 2 As shown, this embodiment also provides an electronic signature method based on biometric identification authentication, specifically including the following steps:

[0096] S10: Client device registration. Set the service address of the server device and the digital certificate of the server device 200 on the client device. When the client device 100 starts up, the client device 100 sends registration request parameters. The server device 200 authenticates the client device 100 according to the registration request parameters. After successful authentication, the network address of the client device 100 is updated, and the registration of the client device 100 is completed.

[0097] S20: Signer registration. Client device 100 collects the signer's identity information and biometric template (which can be a face feature template, finger vein feature template, or fingerprint feature template), forms a signer registration data packet, signs and encrypts the signer registration data packet, and then sends it to server device 200 for registration. After receiving the data, server device 200 decrypts the data, verifies the signature, forms the signer's asymmetric key pair based on the signer's identity information, applies for the signer's digital certificate from a CA authority, and finally saves the signer's identity information, biometric template data, digital certificate, and encrypted signature private key information to complete the signer registration.

[0098] S30: Signer biometric authentication signature. The signer initiates an electronic signature within the business system. The business system calls the API interface 211 of the server device 200 to perform the electronic signature. The server device 200 and the client device 100 collaborate to complete biometric identification and authentication. After successful authentication, the signer completes the electronic signature using the signer's private key and returns the result to the business system.

[0099] The electronic signature method of this embodiment will be further explained below:

[0100] like Figure 3 As shown, the S10 client device registration specifically includes the following steps:

[0101] S1001: Pre-import client device whitelist information into the server-side device. The client device whitelist information includes the client device's device ID (DevID) and the client device's digital certificate. Multiple client device information can be imported at once. The imported whitelist information is stored in the client device registration data 206.

[0102] S1002: Configure the service address and digital certificate of server device 200 on client device 100. When the server device's digital certificate is set up, the configuration is complete. The information is stored in the first national cryptographic security chip 104. During the initial registration of the client device, the above information needs to be set. After successful registration, the client device 100 does not need to set the server device information upon subsequent restarts or relocations, and directly enters step S1003. The client device 100 saves the corresponding service address of the server device 200.

[0103] S1003: The client device prepares registration parameters and encrypts them with the server device's digital certificate. The client device 100 obtains the client device ID DevID and generates a device registration random number using the first national cryptographic security chip 104. Obtain the client device's network address IPAddr and form the string DevID||IPAddr|| Calculate the hash value using the SM3 algorithm. Then via the client device's private key Perform digital signature to obtain the client device signature value DevSign, and package the registration parameter values ​​(DevID, IPAddr, ...). ) Through the server device 200 digital certificate Public key within For registration parameter values ​​(DevID, IPAddr, Encryption is performed to obtain the encrypted registration parameter value. .

[0104] S1004: Client device requests registration, 100 client devices DevSign is sent as a registration request parameter to the server device to request registration.

[0105] S1005: The server device receives the registration request, decrypts the registration request parameters, and sends the received data... Through the private key of the server device Decryption is performed to restore the plaintext registration parameter values ​​(DevID, IPAddr, ...). ).

[0106] S1006: Determine if the device is in the whitelist. Query the client device registration data 206 for client device information using the client device ID DevID. If it does not exist, registration fails and proceeds to S1010; if it exists, proceeds to S1007.

[0107] S1007: Authentication of the client device. The server device authenticates the client device based on the received DevSign and the digital certificate of the client device found in S1006. and plaintext registration parameter values ​​(DevID, IPAddr, Verify the validity of the signature value DevSign.

[0108] S1008: Client device authentication passed. The authentication of the client device is checked based on the validity of the signature value. If the signature value is valid, the authentication is successful and proceeds to S1009; if the signature value is invalid, the registration fails and proceeds to S1010.

[0109] S1009: Store the network address of the client device, and update the network address IPAddr of the client device in the corresponding record in the client device registration data 206 according to the client device ID DevID.

[0110] S1010: Returns client registration result information. When client device 100 successfully registers, server device 200 uses the private key of the pre-embedded asymmetric key in the second national cryptographic security chip 209. For received Obtain by signing This will be returned as data; if registration fails, the reason for the failure will be returned.

[0111] S1011: Receive and process the registration result information from the client device. If registration is successful, verify the digital certificate of the server device 200. right The device will be verified and will be ready if the verification is successful. If the registration fails or the verification fails, the device will be offline and you will be prompted to re-register the device.

[0112] like Figure 4 As shown, the signer can complete the signer registration on any successfully registered client device; the S20 signer registration specifically includes the following steps:

[0113] S2001: Collect signer identity information. The signer enters the signer information, including Name and ID number, on the client device user interface to complete the collection of signer identity information.

[0114] S2002: Collect the biometric template of the signer. The client device user interface guides the signer to collect the biometric template BioSample on the biometric collection terminal 101.

[0115] S2003: The client device prepares the signer registration parameters. The client device generates a random number for signer registration using the first national cryptographic security chip 104. The client device obtains the client device ID (DevID) and assembles the signer registration parameter package. The package includes DevID, Name, IDNumber, BioSample, .

[0116] S2004: The client device encrypts and signs the signer's registration parameters, and calculates the signer's registration parameter packet. The hash value, i.e. Use the client device's private key right Perform an electronic signature and obtain the signature value of the signer's registration request. ; digital certificate through server device 200 Public key within right Encryption is performed to obtain the ciphertext of the signer's registration parameter packet. .

[0117] S2005: The client device sends a signer registration request, and... , Send a request to the server device to register the signer.

[0118] S2006: The server device receives the registration request, decrypts the encrypted signature registration parameter packet, and the server device receives a 200 response. , By using the device private key pre-installed on server device 200 Decryption get .

[0119] S2007: The server verifies the validity of the signer registration request; the server resolves the 200 error. Obtain the DevID, query the client device registration data (206) using the DevID, and obtain the client device's digital certificate. ,calculate Through the digital certificate of the client device verify The effectiveness.

[0120] S2008: The validity of the registration request is determined by the validity of the signature value. If the signature value is valid, the signature is parsed out. Name, IDNumber, BioSample, If the signature value is invalid, proceed to S2009; if the signature value is invalid, proceed to S2013, and registration fails.

[0121] S2009: Generate a signer asymmetric key pair. The server device 200 generates the signer key pair via the second national cryptographic security chip 209, which consists of a public key and a private key. and private key At the same time, according to Name, IDNumber and A Certificate Application Request (CSR) is generated and encrypted using the second national cryptographic security chip 209 to obtain the private key ciphertext. .

[0122] S2010: Apply for a digital certificate for the signer. The server device 200 sends the certificate application request Csr to the CA authority 300 to apply for a digital certificate for the signer.

[0123] S2011: CA authorities issue digital certificates to signers. CA authorities issue digital certificates to signers based on certificate application requests (CSRs). .

[0124] S2012: Save signer registration information; the server-side device stores the signer's IDN number 200 times. , Save the signer's encrypted private key and certificate data to 204; save the signer's Name, IDNumber, and BioSample to the signer's identity and biometric template data to 205; and save the symmetric key of BioSample stored in the second national cryptographic security chip 209 of the server device 200. Store after encryption.

[0125] S2013: Return the signer registration result information. The server device 200 returns the signer registration result information to the client device 100.

[0126] S2014: The client device receives and processes the registration result information of the signer, and displays the corresponding prompt information to the signer based on the registration result.

[0127] like Figure 5 As shown, the business system calls the client SDK 107 of the client device 100 and the API interface 211 of the server device 200 to implement electronic signature. The biometric authentication signature of the signer in S30 specifically includes the following steps:

[0128] S3001: The signer initiates the signing process on the client side of the business system. The client side of the business system obtains the device ID DevID of the client device 100 through the client SDK 107 provided by the client device 100.

[0129] S3002: The business system server prepares the original signature text OrgData, the signer's identity identifier IDNumber, the client device ID DevID, and the business serial number BusiNumber, and calls the API interface 211 of the server device 200 to perform electronic signature.

[0130] S3003: Server device 200 generates a biometric identification challenge value (Challenge) through the second national cryptographic security chip 209 and establishes a corresponding relationship with the business serial number (BusiNumber). Based on the client device ID (DevID), it queries the client device network address (IPAddr) of client device 100 in the client device registration data 206. The server device 200 then uses its private key through the second national cryptographic security chip 209. Perform an electronic signature to obtain the challenge value's signature value. Use the digital certificate of client device 100 Public key within Encrypt the Challenge value to obtain the Challenge ciphertext. ; encrypt the challenge value and the signature value of the challenge value It is sent as a biometric identification instruction parameter to the client device 100 corresponding to the device ID.

[0131] S3004: After receiving the biometric identification command and parameters, the client device 100 uses the client device's private key through the first national cryptographic security chip 104. The challenge value (plaintext "Challeng") was decrypted using the server device's digital certificate (device number 200). Verify the signature value of the challenge. If the verification fails, the server device is returned, the signature fails, and the process proceeds to S3013; if the verification succeeds, the biometric value of the signer is collected by the biometric collection terminal 101 of the client device 100.

[0132] S3005: The client device encrypts and signs the biometric value of the signer and sends it to the server. The specific process is as follows: Client device 100 assembles the biometric identification and authentication data packet of the signer. The data packet includes Challenge and BioValue; calculation The device private key of the client device is used through the first national cryptographic security chip 104 of the client device 100. Perform an electronic signature to obtain the signature value of the biometric authentication data packet. ; digital certificate through server device 200 Public key within right Encryption is performed to obtain the ciphertext of the biometric authentication data packet. ;Bundle , Send to server device 200.

[0133] S3006: The server device decrypts the client device's response data and the corresponding challenge value. Based on the signer's identity identifier passed from the business system, it finds the corresponding signer's biometric template and decrypts it. The specific processing procedure is as follows: The server device receives the response data from the client device (S3006). , ; via the device private key pre-installed on server device 200 Decryption get ;according to Within the challenge value Challenge, find the corresponding business serial number BusiNumber and client device ID DevID; based on the client device ID DevID, query the digital certificate of client device 100 in client device registration data 206. ;calculate ,verify The validity of the signature is checked. If invalid, the signature fails and proceeds to step S3013. If valid, the signature identifier IDNumber is found based on the business serial number BusiNumber. The encrypted biometric template is then found in the signature identifier and biometric template data 205 using IDNumber, and the symmetric key is obtained from the second national cryptographic security chip 209 of the server device 200. Decryption yields the biometric template BioSample corresponding to the signer; extraction BioValue within.

[0134] S3007: The server-side device uses a biometric recognition algorithm to identify and authenticate the collected biometric value BioValue and the signer's biometric template BioSample.

[0135] S3008: Determine whether the biometric authentication is successful. If successful, proceed to S3009; if unsuccessful, encrypt the challenge value. Challenge value signature value The reason for the failure of biometric identification authentication is sent to the client device 100, and enters S3011.

[0136] S3009: The server device finds the signer's encrypted private key based on the signer's identity identifier and signs the original text using the second national cryptographic security chip. The specific process is as follows: The server device 200 retrieves the signer's encrypted private key from the signer's encrypted private key and certificate data 204 based on the signer's identity identifier IDNumber. digital certificate of the signer ; through the symmetric key within the second national cryptographic security chip 209 of the server device 200 Decrypting the encrypted private key Obtain the signer's private key Then, the private key is used via the second national cryptographic security chip 209. The original OrgData is digitally signed to obtain the original signature value. .

[0137] S3010: The server-side device generates and saves the signature behavior evidence data of the signer, and saves the signature value. The specific process is as follows: save IDNumber, BusiNumber, , Within the signature evidence data 208; save IDNumber, BusiNumber, Up to signature value data 203.

[0138] S3011: Client device 100 prompts for signer to re-identify or cancel.

[0139] S3012: Determine whether the signer needs to re-identify or cancel the signature. The signer operates on the client device's interactive interface to confirm re-identification or cancellation. If re-identification occurs, proceed to S3004; if cancellation occurs, proceed to S3013.

[0140] S3013: The server-side device generates signature result data and returns it to the business system. Upon successful signature, it returns BusiNumber. If the signature fails, return the reason for the failure.

[0141] S3014: The business system server receives and processes the signature result data. If the signature is successful, the signature value is saved; if the signature fails, the reason for the failure is displayed.

[0142] The embodiments described above are merely illustrative of specific implementations of the present invention, and while the descriptions are detailed, they should not be construed as limiting the scope of the present invention. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the present invention, and these modifications and improvements all fall within the scope of protection of the present invention.

Claims

1. An electronic signature method based on biometric identification and authentication, characterized in that, An electronic signature system based on biometric authentication is employed. The system includes a client device, a server device, and a Certificate Authority (CA). The client device is connected to the server device via a communication network, and the server device is connected to the CA via the same communication network. The client device is used to collect the biometric features of the signer and to interact with the signer's business system client. The biometric features are one or more combinations of facial features, finger vein features, and fingerprint features. The server device is used to authenticate the signer by comparing the biometric feature values ​​collected by the client device with the biometric feature template collected during registration. After successful biometric authentication, the electronic signature is completed, and the corresponding signature evidence data is saved. The CA is used to issue digital certificates to the signer. The communication network provides a secure transmission channel for transmitting relevant interactive information. The method includes the following steps: S10. Client device registration: Set the server device's service address and digital certificate on the client device. When the client device starts up, it sends registration request parameters. The server device authenticates the client device based on the registration request parameters. After successful authentication, it updates the client device's network address and completes the client device registration. S10 specifically includes the following steps: S1001. The whitelist information of the client devices is pre-imported into the server device and stored in the client device registration data. The whitelist information of the client devices includes the device ID (DevID) and the digital certificate of the client devices. ; S1002. Configure the server device's service address and digital certificate on the client device. and the completed digital certificate It is stored in the first national cryptographic security chip; the client device saves the service address of the corresponding server device; S1003. The client device prepares registration parameters and encrypts them with the server device's digital certificate. The client device obtains the client device ID DevID and generates a random number for device registration using the first national cryptographic security chip. Obtain the client device's network address IPAddr and form the string DevID||IPAddr|| Where || represents concatenation, and the hash value is calculated using the SM3 algorithm. Then through the client device's private key Perform digital signature to obtain the client device signature value DevSign, and package the registration parameter values ​​(DevID, IPAddr, ...). (Through the digital certificate of the server device) Public key within The registration parameter values ​​are encrypted to obtain the encrypted registration parameter values. ; S1004, The client device requests registration; the client device sends... DevSign is sent as a registration request parameter to the server device to request registration; S1005. The server device receives the registration request, decrypts the registration request parameters, and sends the received data... Through the private key of the server device Decryption is performed to restore the plaintext registration parameter values ​​(DevID, IPAddr, ...). ); S1006. Determine if the device is in the whitelist. Query the client device registration data for client device information using the client device ID DevID. If it does not exist, registration fails and proceeds to S1010; if it exists, proceeds to S1007. S1007. Authenticate the client device. The server device uses the received DevSign and the client device's digital certificate retrieved in S1006. and plaintext registration parameter values ​​(DevID, IPAddr, Verify the validity of the signature value DevSign; S1008. Client device authentication is successful. The authentication of the client device is checked based on the validity of the signature value. If the signature value is valid, the authentication is successful and proceeds to S1009; if the signature value is invalid, the registration fails and proceeds to S1010. S1009. Store the network address of the client device, and update the network address IPAddr of the client device in the corresponding record in the client device registration data according to the client device ID DevID; S1010. Return the registration result information to the client. When the client device registers successfully, the server device uses the private key of the pre-embedded asymmetric key in the second national cryptographic security chip. For received Sign it and get As returned data; returns the reason for registration failure if registration fails; S1011. Receive and process the registration result information from the client device. If registration is successful, verify the digital certificate of the server device. right The device will be verified and will be ready if the verification is successful. If the registration fails or the verification fails, the device will be offline and you will be prompted to re-register the device. S20. Signer Registration: The client device collects the signer's identity information and biometric template, forms a signer registration data packet, signs and encrypts the signer registration data packet, and then sends it to the server device for registration. After receiving the data, the server device decrypts the data, verifies the signature, forms the signer's asymmetric key pair based on the signer's identity information, applies for the signer's digital certificate from the CA authority, and finally saves the signer's identity information, biometric template data, digital certificate, and encrypted signature private key information to complete the signer registration. S30, Signer Biometric Authentication Signature: The signer initiates an electronic signature within the business system. The business system calls the API interface of the server device to perform the electronic signature. The server device and the client device collaborate to complete biometric identification and authentication. After successful authentication, the signer completes the electronic signature using the signer's private key and returns the result to the business system.

2. The electronic signature method based on biometric identification and authentication according to claim 1, characterized in that, S20 specifically includes the following steps: S2001. Collect signer identity information. The signer enters the signer information, including Name and ID number, on the user interface of the client device to complete the collection of signer identity information. S2002. Collect the biometric template of the signer. The client device user interface guides the signer to collect the biometric template BioSample on the biometric collection terminal. S2003. The client device prepares the signer registration parameters. The client device generates a random number for signer registration using the first national cryptographic security chip. The client device obtains the client device ID (DevID) and assembles the signer registration parameter package. Parameter package This includes DevID, Name, IDNumber, BioSample, ; S2004. The client device encrypts and signs the signer's registration parameters, and calculates the signer's registration parameter packet. The hash value, i.e. Use the client device's private key right Perform an electronic signature and obtain the signature value of the signer's registration request. Digital certificates for server-side devices Public key within right Encryption is performed to obtain the ciphertext of the signer's registration parameter packet. ; S2005, The client device sends a signer registration request, and... , Send a request to the server device to register the signer; S2006. The server device receives the registration request, decrypts the ciphertext of the signer registration parameter packet, and the server device receives... , Through the device private key pre-installed on the server device Decryption get ; S2007. The server-side device verifies the validity of the signer registration request, and the server-side device parses the request. Obtain the DevID, query the client device registration data using the DevID, and obtain the client device's digital certificate. ,calculate Through the digital certificate of the client device verify The effectiveness; S2008. The validity of the registration request is determined by the validity of the signature value. If the signature value is valid, the signature is parsed out. Name, IDNumber, BioSample, If the signature value is invalid, proceed to S2009; if the signature value is invalid, proceed to S2013, registration fails. S2009. Generate a signer asymmetric key pair. The server device generates a signer key pair using the second national cryptographic security chip, which consists of a public key and a private key. and private key At the same time, according to Name, IDNumber and Generate a Certificate Application Request (CSR) and encrypt it using a second national cryptographic security chip to obtain the private key ciphertext. ; S2010. Apply for a digital certificate for the signer. The server device sends the certificate application request (Csr) to the CA authority to apply for a digital certificate for the signer. S2011, CA authorities issue digital certificates to signers. CA authorities issue digital certificates to signers based on certificate application requests (CSR). ; S2012, Save the signer's registration information. The server-side device stores the signer's IDNumber, , Save the signature's encrypted private key and certificate data, save the signature's Name, IDNumber, and BioSample data into the signature's identity and biometric template data, and save the BioSample using the symmetric key stored in the second national cryptographic security chip on the server device. Encrypt and store; S2013. Return the signer registration result information. The server device returns the signer registration result information to the client device. S2014. The client device receives and processes the registration result information of the signer, and displays the corresponding prompt information to the signer based on the registration result.

3. The electronic signature method based on biometric identification and authentication according to claim 2, characterized in that, S30 specifically includes the following steps: S3001. The signer initiates the signing process on the client side of the business system. The client side of the business system obtains the device ID DevID of the client device through the client SDK provided by the client device. S3002. The business system server prepares the original signature text OrgData, the signer's identity identifier IDNumber, the client device ID DevID, and the business serial number BusiNumber, and calls the API interface of the server device to perform electronic signature. S3003. The server device generates a biometric identification challenge value (Challenge) using the second national cryptographic security chip and establishes a corresponding relationship with the business serial number (BusiNumber). Based on the client device ID (DevID), it queries the client device's network address (IPAddr) in the client device registration data. Then, it uses the server device's private key through the second national cryptographic security chip. Perform an electronic signature to obtain the challenge value's signature value. Use the digital certificate of the client device. Public key within Encrypt the Challenge value to obtain the Challenge ciphertext. ; encrypt the challenge value and the signature value of the challenge value As a biometric identification instruction parameter, it is sent to the client device corresponding to the device ID; S3004. After receiving the biometric identification command and parameters, the client device uses the client device's private key through the client device's first national cryptographic security chip. The plaintext challenge value is decrypted using the server's device digital certificate. Verify the signature value of the challenge. If the verification fails, the server device is returned that the signature failed and enters S3013; if the verification succeeds, the biometric value of the signer is collected through the biometric collection terminal of the client device. S3005. The client device encrypts and signs the biometric value of the signer and sends it to the server device. S3006. The server device decrypts the response data of the client device and the corresponding challenge value. Based on the signer's identity identifier passed in by the business system, the server device finds the corresponding signer's biometric template and decrypts it. S3007. The server-side device uses a biometric recognition algorithm to identify and authenticate the collected biometric value BioValue and the signer's biometric template BioSample. S3008. Determine whether the biometric authentication is successful. If successful, proceed to S3009; if unsuccessful, encrypt the challenge value. Challenge value signature value The reason for the failed biometric authentication is sent to the client device, and the process proceeds to S3011. S3009. The server device finds the signer's encrypted private key based on the signer's identity and signs the original text through the second national cryptographic security chip. S3010, the server-side device generates and saves the signature behavior evidence data of the signer, and saves the signature value, including IDNumber, BusiNumber, , Save to the signature behavior evidence data; include IDNumber, BusiNumber, Save to the signature value data; S3011, The client device prompts the signer to re-identify or cancel; S3012. Determine whether the signer has re-identified or canceled the signature. The signer operates on the client device's interactive interface to confirm re-identification or cancellation. If re-identification occurs, proceed to S3004; if cancellation occurs, proceed to S3013. S3013, The server-side device generates the signature result data and returns it to the business system. If the signature is successful, it returns BusiNumber. If the signature fails, return the reason for the failure. S3014. The business system server receives and processes the signature result data. If the signature is successful, the signature value is saved; if the signature fails, the reason for the failure is displayed.

4. The electronic signature method based on biometric identification and authentication according to claim 3, characterized in that, The specific details of S3005 are as follows: Client devices assemble biometric authentication data packets for signers. This includes Challenge and BioValue; calculation The device's private key is used through the first national cryptographic security chip on the client device. Perform an electronic signature to obtain the signature value of the biometric authentication data packet. Digital certificates for server-side devices Public key within right Encryption is performed to obtain the ciphertext of the biometric authentication data packet. ;Bundle , Send to the server device.

5. The electronic signature method based on biometric identification and authentication according to claim 4, characterized in that, S3006 is as follows: The server device received , ; via the device private key pre-installed on the server device Decryption get ;according to Within the Challenge value, find the corresponding Business Transaction Number (BusiNumber) and Client Device ID (DevID); based on the Client Device ID (DevID), query the client device's digital certificate in the client device registration data. ;calculate ,verify The validity of the signature is checked. If invalid, the signature fails and proceeds to step S3013. If valid, the signer's identity identifier IDNumber is found based on the business serial number BusiNumber. The IDNumber is used to find the signer's identity and the encrypted biometric template in the biometric template data. The symmetric key is then used in the second national cryptographic security chip of the server device. Decryption yields the biometric template BioSample corresponding to the signer; extraction BioValue within.

6. The electronic signature method based on biometric identification and authentication according to claim 5, characterized in that, The specific details of S3009 are as follows: The server device retrieves the signer's encrypted private key from the signer's private key and certificate data based on the signer's identity identifier IDNumber. digital certificate of the signer ; through the symmetric key within the second national cryptographic security chip of the server device Decrypting the encrypted private key Obtain the signer's private key Then, the private key is used via the second national cryptographic security chip. The original OrgData is digitally signed to obtain the original signature value. .

7. The electronic signature method based on biometric identification and authentication according to claim 1, characterized in that, The client device specifically includes: The first central processing unit, the first communication module, and the first operating system are used to provide the basic hardware and software environment for the client device to run. Biometric data acquisition terminal is used to collect the biometric features of the signer and to perform liveness detection on the signer; The client software is used to collect the biometric values ​​of the signer through the biometric collection terminal, and to cooperate with the server software of the server device to complete the biometric identification and authentication of the signer, while providing an interactive interface for the signer; The client SDK is used to provide interfaces to business system clients and complete collaboration with the business system. The first national cryptographic security chip is used to store the private key of the client device's asymmetric key and the corresponding digital certificate of the client device, and provides cryptographic operation capabilities; the client device uses the chip ID of the first national cryptographic security chip as the client device ID, denoted as DevID, and the private key of the asymmetric key is pre-installed in the first national cryptographic security chip. Device digital certificates for client devices It is used to encrypt and decrypt transmitted data and to achieve two-way authentication with server devices.

8. The electronic signature method based on biometric identification and authentication according to claim 7, characterized in that, The server-side equipment specifically includes: The second central processing unit, the second communication module, and the second operating system are used to provide the basic hardware and software environment for the server device to run. The server-side software is used to collaborate with the client software to complete the registration of client devices, signer registration, collection of signer biometric values, and to authenticate the signer's identity through biometric identification. After successful authentication, the signer's private key is used to perform electronic signing, as well as the collection and storage of corresponding signature evidence. Signature value data is used to store the signature value of the signer; Signer's encrypted private key and certificate data, used to store the signer's encrypted private key and digital certificate information; Signer identity and biometric template data, used to store the signer's identity information and the signer's encrypted biometric template data; Client device registration data is used to store data on registered client devices. Signature behavior evidence data is used to store behavioral data information of the signer when making an electronic signature; API interfaces are used to provide interfaces to the business system server to implement electronic signatures; The second national cryptographic security chip is used to store the private key of the asymmetric key of the server device and the corresponding digital certificate of the server device, and provides cryptographic operation capabilities; the server device has the private key of the asymmetric key pre-installed in the second national cryptographic security chip. Device digital certificate for server equipment It is used to encrypt and decrypt transmitted data and to achieve two-way authentication with client devices, with a pre-set symmetric key. Encrypt sensitive information of the signer.

Images