Electronic signature system

Abstract

The invention discloses an electronic signature system. The system comprises the following steps: sending a target signature request to a server; receiving to-be-signed data and first intermediate signature data sent by the server, and encrypting the to-be-signed data based on a Hash convergence encryption algorithm to generate second intermediate signature data; merging the first intermediate signature data and the second intermediate signature data to generate target signature data; sending the target signature data to a server, so that the server verifies whether the target signature data is correct or not; and receiving a verification result sent by the server for the target signature data. When the client side and the server side conduct signature, encryption signature is conducted through the generated secret key pair, meanwhile, the number of times of interaction is reduced, and safety and convenience of service signature are improved. According to the embodiment of the invention, the technical effects of improving the signature speed and signature convenience, and improving the market utilization rate of product applications are realized.

Description

Technical Field

[0001] This application belongs to the field of electronic signature technology, and in particular relates to an electronic signature system. Background Technology

[0002] Most current electronic signature services are tightly coupled with application systems, requiring significant modifications to the network deployment and system integration of existing business systems and necessitating professional maintenance. Improving performance through repeated deployment of hardware devices fails to achieve automatic allocation and adaptive scaling of hardware resources, resulting in low data utilization. Currently, service performance is typically improved through load balancing or clustering, requiring a large increase in hardware devices, leading to continuously rising hardware investment, energy consumption, and management costs. Furthermore, some electronic signature models, due to low security, are only for one-time use, requiring users to authenticate themselves every time, failing to provide convenience and compromising security. Summary of the Invention

[0003] This application provides an electronic signature system that can improve the security and convenience of business signatures, increase signature speed and ease of use, and enhance the market usage of product applications.

[0004] In a first aspect, embodiments of this application provide an electronic signature system applied to a client, comprising: sending a target signature request to a server, so that the server obtains data to be signed according to the target signature request, and generating first intermediate signature data according to a pre-generated key pair and the data to be signed; receiving the data to be signed and the first intermediate signature data sent by the server, and encrypting the data to be signed using a client private key component to generate second intermediate signature data, wherein the client private key component is obtained by decomposing the key pair; merging the first intermediate signature data and the second intermediate signature data to generate target signature data; sending the target signature data to the server, so that the server verifies whether the target signature data is correct; and receiving the verification result of the target signature data sent by the server.

[0005] In one possible implementation, the utility client private key component encrypts the data to be signed to generate second intermediate signature data, including: calling the client private key component stored in the client collaborative signature software toolkit; and performing a hash convergence encryption algorithm calculation on the data to be signed based on the client private key component to generate second intermediate signature data.

[0006] In one possible implementation, before receiving the data to be signed and the first intermediate signature data sent by the server, the method further includes: determining whether the target signature request is a first-time signature request; if the target signature request is determined to be a first-time signature request, receiving authentication information sent by the server and performing authentication processing based on the authentication information; sending the authentication result after authentication processing to the server so that the server generates original signature confirmation information based on the authentication result; receiving the original signature confirmation information sent by the server; and if the target signature request is determined to be a non-first-time signature request, receiving proxy signature confirmation information sent by the server.

[0007] In one possible implementation, receiving the original signature confirmation information sent by the server includes: receiving an original signature request sent by the server; obtaining original signature information input by the user based on the original signature request; sending the original signature information to the server so that the server generates original signature confirmation information based on the original signature information; receiving the original signature confirmation information sent by the server and sending the original signature confirmation result to the server.

[0008] In one possible implementation, receiving the proxy signature confirmation information sent by the server includes: receiving the proxy signature confirmation information sent by the server, wherein the proxy signature confirmation information is generated by the server through data signing based on the original signature information; confirming the proxy signature confirmation information to generate a proxy signature confirmation result; and sending the proxy signature confirmation result to the server.

[0009] In one possible implementation, after receiving the identity verification information sent by the server, the method further includes: sending the identity verification result and the target signature request to the signature verification service cluster in the server, so that the signature verification service cluster generates a signature key pair, the signature key pair including a client private key component and a server private key component; receiving the client private key component sent by the signature verification service cluster, and storing the client private key component in a client collaborative signature software toolkit.

[0010] Secondly, embodiments of this application provide an electronic signature system applied on a server, comprising: receiving a target signature request sent by a client, obtaining data to be signed according to the target signature request, generating first intermediate signature data according to a pre-generated key pair and the data to be signed; sending the data to be signed and the first intermediate signature data to the client, so that the client uses a client private key component to encrypt the data to be signed to generate second intermediate signature data, and generating target signature data according to the first intermediate signature data and the first intermediate signature data, wherein the client private key component is obtained by decomposing the key pair; receiving the target signature data sent by the client, verifying the correctness of the target signature data, obtaining a corresponding verification result; and sending the verification result to the client.

[0011] In one possible implementation, generating the first intermediate signature data based on the pre-generated key pair and the data to be signed includes: calling a server-side private key component stored in a key store through a server-side collaborative signature component, wherein the key pair is decomposed into a server-side private key component; and performing encrypted calculations on the server-side private key component and the data to be signed to obtain the first intermediate signature data.

[0012] In one possible implementation, after receiving the target signature request sent by the client, the method further includes: determining whether the target signature request is a first signature request; if the target signature request is determined to be a first signature request, generating authentication information based on the target signature request; sending the authentication information to the client so that the client performs authentication based on the authentication information and generates an authentication result; and receiving the authentication result sent by the client.

[0013] In one possible implementation, after determining that the target signature request is a first-time signature request and receiving the authentication result sent by the client, an original signature request is generated; the original signature request is sent to the client; the original signature information sent by the client is received, and corresponding original signature confirmation information is generated; the original signature confirmation information is sent to the client; the original signature confirmation result sent by the client is received, and a proxy signature corresponding to the digital signature is generated based on the original signature confirmation result; if it is determined that the target signature request is not a first-time signature request, the proxy signature is invoked, and proxy signature confirmation information is generated; the proxy signature confirmation information is sent to the client, and the proxy signature confirmation result sent by the client is received.

[0014] In one possible implementation, after receiving the authentication result sent by the client, the method further includes: generating a signature key pair through a signature verification server; generating a signature public key and a signature private key from the signature key pair according to a key decomposition method, wherein the signature private key includes a client private key component and a server private key component; binding the signature public key with the authentication result to generate signature confirmation information, wherein the signature confirmation information includes original signature confirmation information or proxy signature confirmation information; sending the signature confirmation information to the client; receiving the signature confirmation result sent by the client, and recovering the found client private key component according to the key decomposition method to obtain a corresponding signature recovery key pair; and performing digital signature processing based on the signature recovery key pair.

[0015] This application provides an electronic signature system that enables encrypted signing using a generated key pair during client-server signing, reducing the number of interactions and improving the security and convenience of business signing. According to this application, the system achieves the technical effect of improving signing speed and convenience, thereby increasing the market adoption rate of the product. Attached Figure Description

[0016] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 This is a flowchart illustrating an electronic signature system provided in an embodiment of this application; Figure 2 This is a schematic diagram of a process for determining second intermediate signature data provided in an embodiment of this application; Figure 3 This is a schematic diagram of a process for determining a target signature request provided in an embodiment of this application; Figure 4 This is a schematic diagram of another process for determining a target signature request provided in an embodiment of this application; Figure 5 This is a schematic diagram of another process for determining a target signature request provided in an embodiment of this application; Figure 6 This is a schematic diagram of a process for determining a signature key pair provided in an embodiment of this application; Figure 7 This is a flowchart illustrating another electronic signature system provided in an embodiment of this application; Figure 8 This is an interaction diagram of an electronic signature system provided in an embodiment of this application; Figure 9 This is a schematic diagram of a process for determining first intermediate signature data provided in an embodiment of this application; Figure 10 This is a schematic diagram of another process for determining a target signature request provided in an embodiment of this application; Figure 11 This is a schematic diagram of yet another process for determining a target signature request provided in an embodiment of this application; Figure 12 This is a schematic diagram of another process for determining a signature key pair provided in an embodiment of this application. Detailed Implementation

[0018] The features and exemplary embodiments of various aspects of this application will be described in detail below. To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain this application and not to limit it. For those skilled in the art, this application can be implemented without some of these specific details. The following description of the embodiments is merely to provide a better understanding of this application by illustrating examples.

[0019] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus that includes said element.

[0020] The Collaborative Signature SDK is a software development kit specifically designed for mobile security authentication. Its core function is to achieve digital signatures without hardware media through key splitting and collaborative computing technologies. It is mainly used in scenarios requiring compliant signatures, such as e-government and healthcare. The user's private key is generated and stored independently by the terminal (such as a mobile phone, computer, or laptop) and the server. Both parties collaborate to complete the signature, and the complete key is never seen throughout the process. It also supports multi-factor authentication such as PIN codes and biometrics to complete identity authentication.

[0021] Conventional digital signature methods are based on USB-key client private key signing. This method completes the entire process of data encryption / decryption, signature verification, and identity authentication within the USB-key media chip. When using USB-key digital signing, the USB-key automatically performs the signature calculation after receiving the signing command and sends the signature result out. USB-keys are relatively expensive; if users only need to use them once or for a limited number of signatures, purchasing USB-keys is not cost-effective for widespread application, as it is inconvenient and costly. Furthermore, some digital signature methods have low security, can only be used once, and require identity verification each time, failing to provide user convenience and compromising security.

[0022] To address the aforementioned technical problems, this application provides an electronic signature system. A client sends a target signature request to a server. The server obtains the data to be signed based on the request and generates first intermediate signature data using a pre-generated key pair and the data to be signed. The server then sends the data to be signed and the first intermediate signature data to the client. The client uses an encryption algorithm to calculate second intermediate signature data from the data to be signed, and merges the first and second intermediate signature data to obtain the target signature data. The server then verifies the target signature data, completing the electronic signature process. By having the client and server perform encrypted signing on the data to be signed, generating the first and second intermediate signature data respectively, the client only needs to merge the first and second intermediate signature data to obtain the final target signature data. Compared to conventional signing processes, this eliminates the need for the server to sign again and return the data to the client, reducing the number of interactions and the amount of data exchanged, thus improving signing efficiency. This achieves the goal of improving the security and convenience of business signatures. It also enhances the speed and convenience of signature applications, increasing the market adoption rate of product applications. The following is a description of the electronic signature system provided in this application.

[0023] Figure 1 This is a flowchart illustrating an electronic signature system provided in an embodiment of this application. It is applied to a client-side application. According to... Figure 1 The provided diagram shows that the electronic signature system specifically includes: S101~S105.

[0024] S101. Send a target signature request to the server so that the server can obtain the data to be signed according to the target signature request, and generate the first intermediate signature data according to the pre-generated key pair and the data to be signed.

[0025] The target signature request mentioned here can be understood as a business or transaction signature request. The data to be signed mentioned here can be understood as the server-generated visual interface awaiting electronic signature and the specified signature area, etc. The key pair mentioned here can be understood as the encryption key pair automatically generated by the server, including the private key and public key. The first intermediate signature data mentioned here can be understood as the data encrypted and signed by the server.

[0026] Furthermore, this application addresses a business scenario where a client requests a signature service, and the user sends a signature request to the server via a mobile terminal. When the user makes a signature request using the mobile terminal, the target signature request is input through the corresponding client of the application system on the mobile terminal, and the target signature request is sent to the server for parsing and processing. The server parses the target signature request, generates visualized data to be signed, and encrypts the data to be signed using a pre-generated encryption key, thus achieving server-side electronic signature. The electronically signed data is then used as the first intermediate signature data, providing reference data for the next step of the client's electronic signature.

[0027] S102. Receive the data to be signed and the first intermediate signature data sent by the server, and encrypt the data to be signed using the client's private key component to generate the second intermediate signature data. The client's private key component is obtained by decomposing the key pair.

[0028] The second intermediate signature data mentioned here can be understood as the electronic signature performed by the user on the client.

[0029] Furthermore, the client receives the data to be signed and the first intermediate signature data sent by the server. The client uses a pre-stored key to encrypt the data to be signed, thereby realizing the client's electronic signature and generating the second intermediate signature data, which provides reference data for the next step of determining the electronic signature.

[0030] S103. Merge the first intermediate signature data and the second intermediate signature data to generate the target signature data.

[0031] Furthermore, after the client generates the second intermediate signature data, the first intermediate signature data, which has been pre-signed by the server, is merged into a single signature data. This signature data is then used as the target signature data to perform the electronic signature operation.

[0032] S104. Send the target signature data to the server so that the server can verify whether the target signature data is correct.

[0033] To determine whether the final electronic signature generated by the client is correct, the target signature data needs to be sent to the server. The server then verifies the correctness of the target signature data, providing reference data for the next step of successfully implementing the business electronic signature event.

[0034] S105. Receive the verification result of the target signature data sent by the server.

[0035] The verification result mentioned here includes whether the verification was successful or failed.

[0036] Furthermore, after the server verifies and analyzes the target signature data, it sends the verification result to the client. The client receives the verification result through a visual and user-friendly interface, confirming the success of the user's electronic signature. If the client receives a successful verification result, it means the user's electronic signature is correct and has passed server verification. If the client receives a verification failure result, it means the user's entered electronic signature is incorrect or does not match the correct electronic signature pre-stored on the server, requiring the user to re-execute the electronic signature input step.

[0037] This application provides an electronic signature system. It involves sending a target signature request to a server, enabling the server to obtain data to be signed based on the request, and generating first intermediate signature data using a pre-generated key pair and the data to be signed. The system then receives the data to be signed and the first intermediate signature data from the server, and encrypts the data to be signed using a hash convergence encryption algorithm to generate second intermediate signature data. The key pair is used to encrypt the data to be signed on both the client and server sides. The first and second intermediate signature data are merged to generate target signature data. The target signature data is then sent to the server for verification. Finally, the system receives the verification result from the server. Compared to conventional signature processes, this system eliminates the need for the server to re-sign and return the signature to the client, reducing the number of interactions and the amount of data exchanged, thus improving signing efficiency. This enhances the security and convenience of business signatures, thereby increasing the market adoption rate of the product.

[0038] Regarding the process of generating the second intermediate signature data in step S102, Figure 2 This is a schematic diagram of a process for determining second intermediate signature data provided in an embodiment of this application. Figure 2 This description is based on the previous embodiment. According to... Figure 2 The provided diagram shows that the process for determining the second intermediate signature data includes: S201~S202.

[0039] S201. Call the client private key component stored in the client collaborative signature software toolkit.

[0040] S202. Calculate the hash convergence encryption algorithm based on the client's private key component to generate the second intermediate signature data.

[0041] The client-side collaborative signature software toolkit mentioned here can be understood as a client-side collaborative signature SDK.

[0042] Furthermore, after the client receives the data to be signed from the server, it decomposes the key pair generated by the server to obtain the client's private key component, which is then stored in the client-side collaborative signature SDK. Upon receiving the data to be signed, the client uses the client's private key component from the client-side collaborative signature SDK to encrypt the data using a hash convergence encryption algorithm, thus performing the client-side electronic signature operation and generating the client's electronic signature data, which serves as the second intermediate signature data.

[0043] The method provided in this application for determining the second intermediate signature data involves using a pre-generated client private key component to perform encrypted calculations on the data to be signed, thereby obtaining the client's electronic signature. This differs from conventional methods of determining the data to be signed or adding hardware processing steps. By using the client private key component for electronic signing, the encryption process of the electronic signature is achieved, thus improving the security of the electronic signature.

[0044] After receiving the target signature request in step S101, Figure 3 This is a schematic diagram of a process for determining a target signature request provided in an embodiment of this application. Figure 3 The description is based on the first embodiment. Figure 3 The provided diagram shows that the process for determining the target signature request includes steps S301 to S305.

[0045] S301. Determine whether the target signature request is the first signature request.

[0046] Furthermore, after receiving the target signature request, the server analyzes whether the information in the request is a first-time signature or a subsequent signature. Authentication is required for first-time signatures, but not for subsequent signatures.

[0047] S302. If the target signature request is determined to be the first signature request, receive the authentication information sent by the server and perform authentication processing based on the authentication information.

[0048] S303. Send the identity verification result after identity authentication to the server so that the server can generate the original signature confirmation information based on the identity verification result.

[0049] S304. Receive the original signature confirmation information sent by the server.

[0050] The identity authentication information mentioned here can be understood as the user's mobile phone number, facial recognition information, iris recognition information, or fingerprint recognition information during the electronic signature process. The original signature confirmation information mentioned here can be understood as the prompt information after identity authentication during the first electronic signature, including whether identity authentication was successful or failed.

[0051] Server-side signing involves two roles: the original signer and the proxy signer. The original signer can delegate digital signing authority to the proxy signer, who then generates the digital signature on behalf of the original signer. The original signer is the user, and the proxy signer is the server-side signature verification server. The proxy signature is a digital signature created using the private key generated by the server-side signature verification server itself. Users must perform an original signature the first time they use the electronic signature system; subsequent uses will utilize proxy signatures.

[0052] Furthermore, if the server analyzes the target signature request and determines it's the first time applying for an electronic signature, user authentication is required. The client inputs the user's mobile phone number, facial recognition information, iris recognition information, or fingerprint recognition information to verify the user's identity. The authentication result is then sent to the server. Upon receiving successful authentication, the server regenerates the information to verify its correctness. If authentication is successful, the server sends the original signature confirmation information to the client, allowing the client to reconfirm the initial signature confirmation. If the information is correct, the server reports successful authentication. If authentication fails, the server sends an authentication failure message to the client, reminding the user to re-authenticate.

[0053] S305. If it is determined that the target signature request is not the first signature request, receive the proxy signature confirmation information sent by the server.

[0054] Furthermore, if the server analyzes that the user corresponding to the target signature request is not making a first-time signature request, then the original signer on the server delegates the task to a proxy signer. The server-side signature verification server performs the proxy signature and generates corresponding proxy signature confirmation information. No further identity authentication is required; the generated proxy signature confirmation information is directly sent to the client, and the user can verify the information based on the proxy signature confirmation information to achieve identity authentication.

[0055] This application provides an electronic signature system. After receiving a target signature request, the server analyzes whether the information in the request is a first-time signature or a subsequent signature. To simplify the signing process and improve electronic signature efficiency, the conventional method of authenticating the signature request for each signature step is abandoned. By analyzing whether the target signature request is a first-time signature request, authentication is performed for first-time signature requests. Electronic signature operation is performed after successful authentication, and the user's identity information is stored. In the case of subsequent non-first-time signature requests, the authentication step is not required. The server directly retrieves the previously authenticated information to generate identity confirmation information, thus saving the authentication operation for each signature and improving signing efficiency.

[0056] In step S302, if the target signature request is the first signature request, Figure 4 This is a schematic diagram of another process for determining a target signature request provided in an embodiment of this application. Figure 4 This description is based on the previous embodiment. According to... Figure 4 The provided diagram shows that the process for determining the target signature request includes steps S401 to S404.

[0057] S401, Receive the original signature request sent by the server.

[0058] S402. Obtain the original signature information input by the user based on the original signature request.

[0059] S403. Send the original signature information to the server so that the server can generate the original signature confirmation information based on the original signature information.

[0060] S404. Receive the original signature confirmation information sent by the server and send the original signature confirmation result to the server.

[0061] If the server determines that the user is performing an electronic signature operation for the first time, the user's identity is authenticated on the mobile terminal using methods such as facial recognition, password authentication, fingerprint recognition, SMS or fingerprint biometric information. The original signature information corresponding to the user's authentication information is sent to the server. The server confirms the user's authentication information and generates original signature confirmation information for the user on the client side to confirm.

[0062] The target signature request provided in this application embodiment is divided into original signature and proxy signature. The user's first signature requires the original signature, while subsequent signatures use proxy signatures generated by the server, requiring only confirmation of the signature information. For the original signature, the server provides the data to be signed, and the user verifies their identity through an operable interface. The server then sends the verification result back to the server, generating corresponding original signature confirmation information to complete the first identity authentication operation. Subsequent electronic signature requests from the same user do not require further identity verification, improving electronic signature efficiency.

[0063] In step S305, if the target signature request is not the first signature request, Figure 5 This is a schematic diagram of another process for determining a target signature request provided in an embodiment of this application. Figure 5 Is Figure 3 The description is based on the corresponding embodiments. Figure 5 The provided diagram shows that the process for determining the target signature request includes steps S501 to S503.

[0064] S501. Receive the proxy signature confirmation information sent by the server. The proxy signature confirmation information is generated by the server through data signing based on the original signature information.

[0065] S502. Confirm the proxy signature confirmation information and generate the proxy signature confirmation result.

[0066] S503, Send the proxy signature confirmation result to the server.

[0067] When the server-side analysis indicates that the target signature request is not the first signature, the original signer on the server delegates a proxy signer to perform the signature. The proxy signer then performs the electronic signature, generating a proxy signature confirmation message. Upon receiving the proxy signature confirmation message from the server, the client confirms it. If the message is correct, it directly sends a confirmation feedback; otherwise, it sends an error indication to the server. After confirming the proxy signature is correct, the client generates a proxy signature confirmation result and sends it back to the server, achieving rapid electronic signature processing. This eliminates the need for identity authentication, simplifying the process and improving the efficiency of electronic signature processing.

[0068] Optionally, the server generates multiple different keys through key decomposition, and each electronic signature uses a randomly selected key.

[0069] The target signature request scenarios provided in this application are divided into proxy signatures and original signatures. When a user uses the electronic signature system for the first time, they use an original signature, requiring identity verification and entry of personal information. This lays the foundation for using proxy signatures. Subsequently, users only need to confirm the information's correctness via a mobile terminal. Proxy signatures do not require manual confirmation from the user, improving signing speed and convenience. Furthermore, by using key decomposition, multiple different keys are generated, facilitating repeated use of the electronic signature system by the same user while reducing the risk of key theft and avoiding potential vulnerabilities.

[0070] Regarding the process of receiving identity authentication information in step S302, Figure 6 This is a schematic diagram of a process for determining a signature key pair provided in an embodiment of this application. Figure 6 Is Figure 3 The description is based on the corresponding embodiments. Figure 6 The provided diagram shows that the process of determining the signature key pair includes steps S601 to S602.

[0071] S601. Send the identity verification result and the target signature request to the signature verification service cluster in the server so that the signature verification service cluster generates a signature key pair, which contains the client private key component and the server private key component.

[0072] S602. Receive the client private key component sent by the signature verification service cluster and store the client private key component in the client collaborative signature software toolkit.

[0073] Furthermore, after the server confirms the user's identity authentication, it randomly generates a signature key pair using the signature verification service cluster on the server, and decomposes the key pair into a private key and a public key. The private key is further decomposed into a client-side private key component and a server-side private key component, and the private key in the key pair is stored according to the key decomposition method. The client-side private key component is stored in the client-side collaborative signature SDK for use in encrypted electronic signature processing by the client.

[0074] The signature key pair provided in this application embodiment is randomly generated by the signature verification service cluster in the server, and the signature key pair is decomposed. The decomposed client private key component is stored in the client collaborative signature SDK to realize client-side encrypted signature operation and improve the security of electronic signature.

[0075] In one possible example scenario, Figure 7 This is a flowchart illustrating another electronic signature system provided in an embodiment of this application. It is applied to the server side. Figure 7 The description is based on the first embodiment. Figure 7The provided diagram shows that the operation process of the electronic signature system includes: S701~S704.

[0076] S701: Receive the target signature request sent by the client, obtain the data to be signed according to the target signature request, and generate the first intermediate signature data according to the pre-generated key pair and the data to be signed.

[0077] Furthermore, when a user makes a signature request using a mobile terminal, the target signature request is input through the corresponding client of the application system on the mobile terminal. The server parses the received target signature request, generates visualized data to be signed, and encrypts the data to be signed using a pre-generated encryption key, thus realizing server-side electronic signature. The electronically signed data is then used as the first intermediate signature data, providing reference data for the next step of electronic signature by the client.

[0078] S702. Send the data to be signed and the first intermediate signature data to the client so that the client can encrypt the data to be signed according to the client's private key component to generate the second intermediate signature data, and generate the target signature data according to the first intermediate signature data and the first intermediate signature data. The client's private key component is obtained by decomposing the key pair.

[0079] Furthermore, the client receives the data to be signed and the first intermediate signature data sent by the server. The client uses a pre-stored key to encrypt the data to be signed, realizing the client's electronic signature and generating the second intermediate signature data. The first intermediate signature data, which has been pre-signed by the server, is then merged into a single signature data. This single signature data is used as the target signature data to perform the electronic signature operation, and the client sends the target signature data to the server.

[0080] S703: Receive the target signature data sent by the client, verify the correctness of the target signature data, and obtain the corresponding verification result.

[0081] S704. Send the verification result to the client.

[0082] To determine the correctness of the final digital signature generated by the client, the server receives the target signature data sent by the client and verifies its correctness. After analyzing and verifying the target signature data, the server sends the verification result back to the client. The client receives the verification result through a visual and interactive interface, confirming the success of the user's digital signature. If the server sends a successful verification result, it means the user's digital signature is correct and has passed server verification. If the server sends a verification failure result, it means the user's entered digital signature is incorrect or does not match the correct digital signature pre-stored on the server, requiring the user to re-execute the digital signature input step.

[0083] In one possible example scenario, Figure 8 This is an interaction diagram of an electronic signature system provided in an embodiment of this application. According to... Figure 8 The provided diagram illustrates the interaction process of the electronic signature system, which includes steps 1 through 8.

[0084] Step S1: The client sends a target signature request to the server.

[0085] Step S2: The server receives the target signature request sent by the client, obtains the data to be signed according to the target signature request, and generates the first intermediate signature data according to the pre-generated key pair and the data to be signed.

[0086] Step S3: The client receives the data to be signed and the first intermediate signature data sent by the server.

[0087] Step S4: Generate second intermediate signature data, and merge the first intermediate signature data and the second intermediate signature data to generate the target signature data.

[0088] Step S5: The client sends the target signature data to the server.

[0089] Step S6: The server verifies whether the target signature data is correct.

[0090] Step S7: The server sends the verification result to the client.

[0091] according to Figure 8 The provided diagram illustrates how the client and server use encrypted signing to exchange signatures. The server sends intermediate signature data to the client, which then generates the final signature data upon confirmation. The client returns the final signature data to the server for verification of the signature result's correctness, ensuring that the electronic signature is initiated by the user and not stolen by someone else, thus reducing the number of interactions and improving signing efficiency.

[0092] The electronic signature system provided in this application embodiment involves a user initiating a signature request to a server via a client. The server generates data to be signed and calculates the data based on its local server private key to obtain first intermediate data. The server then returns the data to be signed and the first intermediate data to the client. The client uses the original signature / proxy signature to sign the data to be signed, obtaining second intermediate data. The first and second intermediate data are then merged to obtain the signed data, which is sent to the server for correctness verification. The signature is encrypted using a generated key pair during the client-server signing process, reducing the number of interactions and improving the security and convenience of business signatures. According to this application embodiment, the system achieves the technical effect of improving signature speed and convenience, thereby increasing the market adoption rate of the product application.

[0093] Regarding the process of generating the first intermediate signature data in step S701, Figure 9 This is a schematic diagram of a process for determining first intermediate signature data provided in an embodiment of this application. Figure 9 This description is based on the previous embodiment. According to... Figure 9 The provided diagram shows that the process of determining the first intermediate signature data includes: S901~S902.

[0094] S901. The server-side private key component stored in the key store is called through the server-side collaborative signature component, and the key pair is decomposed into the server-side private key component.

[0095] S902. The server's private key component and the data to be signed are encrypted and calculated to obtain the first intermediate signature data.

[0096] The server-side collaborative signature component mentioned here can be understood as the keystore on the server side.

[0097] Furthermore, after the server confirms successful identity authentication, the server-generated key pair is decomposed to obtain the server-side private key component. The server-side collaborative signature component then calls the server-side private key component stored in the server-side keystore. It performs encrypted calculations using the server-side private key component and the data to be signed to achieve the server-side electronic signature operation, obtaining the first intermediate signature data and completing the server-side encrypted signature.

[0098] The method provided in this application for determining the first intermediate signature data involves decomposing the data using a pre-generated key pair on the server side to obtain a server-side private key component. Then, by calling the server-side private key component stored in the server-side keystore to perform encryption calculations on the data to be signed, a server-side electronic signature is obtained, thus realizing the encryption process of the electronic signature and improving its security.

[0099] After receiving the target signature request sent by the client in step S701, Figure 10This is a schematic diagram of another process for determining a target signature request provided in an embodiment of this application. Figure 10 Is Figure 8 The description is based on the corresponding embodiments. Figure 10 The provided diagram shows that the process of determining the target signature request includes: S1001~S1004.

[0100] S1001. Determine whether the target signature request is the first signature request.

[0101] After receiving the target signature request, the server analyzes the information in the request to determine whether it is a first-time signature or a subsequent signature. Authentication is required for first-time signatures, but not for subsequent signatures.

[0102] S1002. If it is determined that the target signature request is the first signature request, generate identity authentication information based on the target signature request.

[0103] S1003. Send the identity authentication information to the client so that the client can perform identity authentication based on the identity authentication information and generate the identity authentication result.

[0104] S1004. Receive the authentication result sent by the client.

[0105] If the server determines that the user is performing an electronic signature operation for the first time, the user's identity is authenticated on the mobile terminal using methods such as facial recognition, password authentication, fingerprint recognition, SMS or fingerprint biometric information. The original signature information corresponding to the user's authentication information is sent to the server. The server confirms the user's authentication information and generates original signature confirmation information for the user on the client side to confirm.

[0106] The target signature request provided in this application embodiment is divided into original signature and proxy signature. The user's first signature requires the original signature, while subsequent signatures use proxy signatures generated by the server, requiring only confirmation of the signature information. For the original signature, the server provides the data to be signed, and the user verifies their identity through an operable interface. The server then sends the verification result back to the server, generating corresponding original signature confirmation information to complete the first identity authentication operation. Subsequent electronic signature requests from the same user do not require further identity verification, improving electronic signature efficiency.

[0107] Regarding whether the target signature request in step S1001 is the first signature request, Figure 11 This is a schematic diagram of yet another process for determining a target signature request provided in an embodiment of this application. Figure 11 Is Figure 10 The description is based on the corresponding embodiments. Figure 11The provided diagram shows that the process of determining the target signature request includes: S1101~S1108.

[0108] S1101. Determine whether the target signature request is the first signature request.

[0109] S1102. After determining that the target signature request is the first signature request and receiving the authentication result sent by the client, generate the original signature request.

[0110] S1103. Send the original signature request to the client.

[0111] S1104. Receive the original signature information sent by the client and generate the corresponding original signature confirmation information.

[0112] S1105. Send the original signature confirmation information to the client.

[0113] S1106. Receive the original signature confirmation result sent by the client, and generate the proxy signature corresponding to the digital signature based on the original signature confirmation result.

[0114] Server-side signing involves two roles: the original signer and the proxy signer. The original signer can delegate digital signing authority to the proxy signer, who then generates the digital signature on behalf of the original signer. The original signer is the user, and the proxy signer is the server-side signature verification server. The proxy signature is a digital signature created using the private key generated by the server-side signature verification server itself. Users must perform an original signature the first time they use the electronic signature system; subsequent uses will utilize proxy signatures.

[0115] Furthermore, if the server analyzes the target signature request and determines it's the first time applying for an electronic signature, user authentication is required. The client verifies the user's identity by inputting their mobile phone number, facial recognition information, iris recognition information, or fingerprint recognition information based on the original signature request. After receiving the authentication result from the client, the server generates the original signature request. The server receives the original signature information from the client and generates corresponding original signature confirmation information. After the client sends the original signature confirmation result, the server generates a proxy signature corresponding to the digital signature. The server receives the authentication result from the client again, and if successful, regenerates the information to verify its correctness. If authentication is successful, the server sends the original signature confirmation information to the client, who then confirms the initial signature. If the information is correct, the server reports successful authentication. If authentication fails, the server sends an authentication failure message to the client, reminding the user to re-authenticate.

[0116] S1107. If it is determined that the target signature request is not the first signature request, the proxy signature is invoked and the proxy signature confirmation information is generated.

[0117] S1108. Send the proxy signature confirmation information to the client and receive the proxy signature confirmation result sent by the client.

[0118] When the server-side analysis indicates that the target signature request is not the first signature, the original signer on the server delegates a proxy signer to perform the signature. The proxy signer then performs the electronic signature, generating a proxy signature confirmation message. Upon receiving the proxy signature confirmation message from the server, the client confirms it. If the message is correct, it directly sends a confirmation feedback; otherwise, it sends an error indication to the server. After confirming the proxy signature is correct, the client generates a proxy signature confirmation result and sends it back to the server, achieving rapid electronic signature processing. This eliminates the need for identity authentication, simplifying the process and improving the efficiency of electronic signature processing.

[0119] The target signature request provided in this application embodiment is divided into proxy signature and original signature. When a user uses the electronic signature system for the first time, they use the original signature; subsequently, they only need to confirm the information's correctness via a mobile terminal. Proxy signature eliminates the need for manual confirmation, improving signing speed and convenience. Furthermore, it generates multiple different keys through key decomposition, facilitating repeated use of the electronic signature system by the same user while reducing the risk of key theft and avoiding potential vulnerabilities.

[0120] After receiving the target signature request sent by the client in step S702, Figure 12 This is a schematic diagram of another process for determining a signature key pair provided in an embodiment of this application. Figure 12 This description is based on the previous embodiment. According to... Figure 12 The provided diagram shows that the process of determining the signature key pair includes: S1201~S1206.

[0121] S1201. Generate a signature key pair through the signature verification server.

[0122] S1202. Generate a signing public key and a signing private key from the signing key pair according to the key decomposition method. The signing private key includes a client private key component and a server private key component.

[0123] S1203. Bind the signing public key with the identity authentication result to generate signature confirmation information, which includes original signature confirmation information or proxy signature confirmation information.

[0124] S1204. Send the signature confirmation information to the client.

[0125] S1205. Receive the signature confirmation result sent by the client, and perform recovery processing on the found client private key component according to the key decomposition method to obtain the corresponding signature recovery key pair.

[0126] S1206. Perform digital signature processing based on the signature recovery key pair.

[0127] In one possible scenario, during a user's first signature operation, after authentication, the user's authentication information and signature request are sent to the signature verification service cluster on the server. The signature verification service cluster randomly generates a signature key pair, stores the private key according to key decomposition, binds the signature public key to the user's identity information, and sends a confirmation message to the user via SMS to confirm that the electronic signature for the certificate is indeed issued by the user. Based on the SMS or fingerprint verification, the user must confirm upon receiving the confirmation message from the signature verification server. After receiving the confirmation message, the signature verification service cluster looks up the user's corresponding client private key in the client, and recovers the original key from any m sub-signature keys using a recovery algorithm according to key decomposition. This key pair is then used for electronic signature, thus completing the server-side electronic signature operation.

[0128] This application provides an electronic signature system that enables encrypted signing using a generated key pair during client-server signing. Multiple different keys are generated through key decomposition, facilitating repeated use by the same user while reducing the risk of key theft and preventing potential vulnerabilities. It also reduces the number of interactions, improving the security and convenience of business signing. According to this application, the system achieves the technical effect of improving signing speed and convenience, thereby increasing the market adoption rate of the product.

[0129] It should also be noted that the exemplary embodiments mentioned in this application describe methods or systems based on a series of steps or apparatus. However, this application is not limited to the order of the above steps; that is, the steps can be performed in the order mentioned in the embodiments, or in a different order, or several steps can be performed simultaneously.

[0130] The aspects of this application have been described above with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It should be understood that each block in the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that these instructions, executable via the processor of the computer or other programmable data processing apparatus, enable the implementation of the functions / actions specified in one or more blocks of the flowchart illustrations and / or block diagrams. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor, or a field-programmable logic circuit. It is also understood that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can also be implemented by dedicated hardware performing the specified functions or actions, or can be implemented by a combination of dedicated hardware and computer instructions.

[0131] The above description is merely a specific implementation of this application. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, modules, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here. It should be understood that the protection scope of this application is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in this application, and these modifications or substitutions should all be covered within the protection scope of this application.

Claims

1. An electronic signature system, characterized in that, Applied to the client side, including: Send a target signature request to the server so that the server can obtain the data to be signed according to the target signature request, and generate first intermediate signature data according to the pre-generated key pair and the data to be signed; The system receives the data to be signed and the first intermediate signature data sent by the server, and uses the client's private key component to encrypt the data to be signed to generate the second intermediate signature data. The client's private key component is obtained by decomposing the key pair. The first intermediate signature data and the second intermediate signature data are merged to generate the target signature data; The target signature data is sent to the server so that the server can verify whether the target signature data is correct. Receive the verification result for the target signature data sent by the server.

2. The system according to claim 1, characterized in that, The step of encrypting the data to be signed using the client's private key component to generate second intermediate signature data includes: Call the client's private key component stored in the client's collaborative signature software toolkit; The data to be signed is calculated using a hash convergence encryption algorithm based on the client's private key component to generate second intermediate signature data.

3. The system according to claim 1, characterized in that, Before receiving the data to be signed and the first intermediate signature data sent by the server, the method further includes: Determine whether the target signature request is the first signature request; If it is determined that the target signature request is the first signature request, the identity authentication information sent by the server is received, and identity authentication processing is performed based on the identity authentication information; The identity verification result after the identity verification process is sent to the server so that the server can generate the original signature confirmation information based on the identity verification result. Receive the original signature confirmation information sent by the server; If it is determined that the target signature request is not the first signature request, the proxy signature confirmation information sent by the server is received.

4. The system according to claim 3, characterized in that, The receipt of the original signature confirmation information sent by the server includes: Receive the original signature request sent by the server; Obtain the original signature information input by the user based on the original signature request; The original signature information is sent to the server so that the server generates original signature confirmation information based on the original signature information. Receive the original signature confirmation information sent by the server, and send the original signature confirmation result to the server.

5. The system according to claim 3, characterized in that, The receipt of the proxy signature confirmation information sent by the server includes: Receive proxy signature confirmation information sent by the server, wherein the proxy signature confirmation information is generated by the server through data signing based on the original signature information; Confirmation is performed based on the proxy signature confirmation information, and a proxy signature confirmation result is generated. Send the proxy signature confirmation result to the server.

6. The system according to claim 3, characterized in that, After receiving the identity verification information sent by the server, the system further includes: The identity verification result and the target signature request are sent to the signature verification service cluster in the server so that the signature verification service cluster generates a signature key pair, which includes a client private key component and a server private key component. Receive the client private key component sent by the signature verification service cluster, and store the client private key component in the client collaborative signature software toolkit.

7. An electronic signature system, characterized in that, Applied to the server side, including: Receive a target signature request sent by the client, obtain the data to be signed according to the target signature request, and generate first intermediate signature data according to the pre-generated key pair and the data to be signed; The data to be signed and the first intermediate signature data are sent to the client so that the client uses the client private key component to encrypt the data to be signed to generate the second intermediate signature data, and generates the target signature data based on the first intermediate signature data and the first intermediate signature data. The client private key component is obtained by decomposing the key pair. Receive the target signature data sent by the client, verify the correctness of the target signature data, and obtain the corresponding verification result; The verification result is sent to the client.

8. The system according to claim 7, characterized in that, The step of generating first intermediate signature data based on a pre-generated key pair and the data to be signed includes: The server-side private key component stored in the key store is invoked through the server-side collaborative signature component, and the key pair is decomposed into the server-side private key component. The first intermediate signature data is obtained by performing encrypted calculations on the server-side private key component and the data to be signed.

9. The system according to claim 7, characterized in that, After receiving the target signature request sent by the client, the system further includes: Determine whether the target signature request is the first signature request; If it is determined that the target signature request is the first signature request, identity authentication information is generated based on the target signature request; The identity authentication information is sent to the client so that the client performs identity authentication based on the identity authentication information and generates an identity authentication result. Receive the authentication result sent by the client.

10. The system according to claim 9, characterized in that, After determining that the target signature request is the first signature request and receiving the authentication result sent by the client, an original signature request is generated; Send the original signature request to the client; Receive the original signature information sent by the client and generate the corresponding original signature confirmation information; Send the original signature confirmation information to the client; Receive the original signature confirmation result sent by the client, and generate a proxy signature corresponding to the digital signature based on the original signature confirmation result; If it is determined that the target signature request is not the first signature request, the proxy signature is invoked, and proxy signature confirmation information is generated; Send the proxy signature confirmation information to the client, and receive the proxy signature confirmation result sent by the client.

11. The system according to claim 9, characterized in that, After receiving the authentication result sent by the client, the method further includes: Generate a signature key pair using the signature verification server; The signature key pair is used to generate a signature public key and a signature private key according to the key decomposition method. The signature private key includes a client private key component and a server private key component. The signature public key is bound to the identity authentication result to generate signature confirmation information, which includes original signature confirmation information or proxy signature confirmation information. Send the signature confirmation information to the client; The system receives the signature confirmation result sent by the client and performs recovery processing on the found client private key component according to the key decomposition method to obtain the corresponding signature recovery key pair. Perform digital signature processing based on the signature recovery key pair.

Images