A processing method and device for asynchronous collaborative signature, electronic equipment and storage medium

Abstract

Embodiments of the present application provide a kind of asynchronous collaborative signature processing method, device, electronic equipment and storage medium, the method includes: sending the pre-application request of collaborative signature to cooperation party equipment, wherein, first to be signed data is included in pre-application request;Pre-application information corresponding to pre-application request returned by cooperation party equipment is received, current signature time and pre-application information are signed by using the signature algorithm of pre-setting, and target signature data is obtained;Target signature data is sent to receiver equipment, and receiver equipment judges whether current signature time is in line with signature time window after receiving the target signature data, and then target signature data is verified.Through collaborative signature pre-application mechanism and signature time window control mechanism, the efficiency and availability problem caused by traditional collaborative signature network dependence and the security risk problem caused by time effectiveness loss are effectively solved.

Description

Technical Field

[0001] This application relates to the field of digital signature technology, and more specifically, to an asynchronous collaborative signature processing method, apparatus, electronic device, and storage medium. Background Technology

[0002] In today's digital business environment, collaborative signature technology is widely used in various business scenarios to ensure the security and legitimacy of business operations. Regarding collaborative signature technology, existing systems generally employ the key splitting principle, dividing the signing private key into client and server key components. Both parties store these components separately and collaboratively compute to generate the complete signature, thus preventing the emergence of a complete key and enhancing security. Currently, the signatures generated during the collaborative signature process are used in real time. However, if the network fails or the instantaneous service load is too high during the signing process, signature failures or delays may occur. In terms of time-related technology, existing collaborative signatures cannot actively control the effective time window of the signature during the signing process, making it difficult to meet the dynamic time compliance requirements of scenarios such as time limits for enterprise business permissions and temporary authorization of car keys. Summary of the Invention

[0003] The purpose of some embodiments of this application is to provide an asynchronous collaborative signature processing method, apparatus, electronic device, and storage medium. Through the technical solutions of the embodiments of this application, a pre-application request for collaborative signature is sent to a collaborating device, wherein the pre-application request includes first data to be signed; pre-application information corresponding to the pre-application request is received from the collaborating device, wherein the pre-application information is determined based on the first data to be signed and signature time window information, the signature time window information being determined by the initiating device or the collaborating device and used to manage the validity period of the signature; the initiating device can use a pre-set signature algorithm at any time within the signature time window to sign the current signature time and the pre-application information to obtain target signature data; the target signature data is sent to a receiving device, and the receiving device… The device verifies the target signature data. In this embodiment, pre-application information is requested in advance. This pre-application information is determined based on the first data to be signed and the signature time window information. During the actual signing process, the initiating device performs signature processing based on the current signature time and the pre-application information to obtain the target signature data, and sends the target signature data to the receiving device. After receiving the target signature data, the receiving device determines whether the current signature time meets the signature time window, and then verifies the target signature data. Thus, through the collaborative signature pre-application mechanism and the signature time window control mechanism, the efficiency and availability problems caused by network dependence and the security risks caused by the lack of time validity in traditional collaborative signatures are effectively solved. Regardless of the business, the signature operation can be completed quickly, reducing waiting time and improving the overall business flow speed.

[0004] Firstly, some embodiments of this application provide an asynchronous collaborative signature processing method, applied to the initiating device, including:

[0005] Send a pre-application request for collaborative signature to the collaborating device, wherein the pre-application request includes first data to be signed;

[0006] The system receives pre-application information corresponding to the pre-application request returned by the collaborating device, wherein the pre-application information is determined based on the first data to be signed and the signature time window information, and the signature time window information is determined by the initiating device or the collaborating device.

[0007] Using a pre-set signature algorithm, the current signature time and the pre-application information are processed to obtain the target signature data;

[0008] The target signature data is sent to the receiving device, and the receiving device verifies the target signature data.

[0009] Some embodiments of this application utilize pre-application information, which is determined based on the first data to be signed and the signature time window information. During the actual signing process, the initiating device performs signature processing on the current signature time and the pre-application information to obtain the target signature data, and sends the target signature data to the receiving device. After receiving the target signature data, the receiving device determines whether the current signature time conforms to the signature time window, and then verifies the target signature data. Thus, through the collaborative signature pre-application mechanism, the impact of the network environment on real-time services is effectively avoided. Signature operations can be completed quickly regardless of the service, reducing waiting time, avoiding signature unavailability issues caused by network failures, and improving the overall business flow speed.

[0010] Optionally, the pre-application information corresponding to the pre-application request is obtained in the following manner:

[0011] The initiating device sends the pre-application request to the collaborating device, wherein the first data to be signed includes at least a pre-application identifier, business information, and user information;

[0012] The initiating device determines a first random number, and generates a first intermediate value Q1 based on the first random number and the pre-set public key of the collaborating device, and sends the first data to be signed and the first intermediate value Q1 to the collaborating device.

[0013] The collaborating device verifies the first intermediate value Q1 and the first data to be signed;

[0014] If the first intermediate value and the first data to be signed pass verification, the collaborating device generates the second data to be signed based on the signature time window information and the first data to be signed.

[0015] The collaborating device uses a pre-set cryptographic hash algorithm to calculate the second data to be signed, and obtains a data digest e1.

[0016] The collaborating device determines the second random data, and determines the first intermediate data r based on the first intermediate value Q1, the second random data, and the data digest;

[0017] The collaborating device determines the second intermediate value s2 based on the collaborating device's private key, the first intermediate data r, and the second random data;

[0018] The collaborating device sends the second data to be signed, the first intermediate data r, and the second intermediate value s2 to the initiating device.

[0019] Some embodiments of this application involve adding a signature time window after the collaborating device receives the first data to be signed, obtaining the second data to be signed, and then performing signature processing on the second data to be signed to obtain pre-requested intermediate data. This solves the problem of the validity of collaborative signature time in business scenarios, and at the same time realizes collaborative signature pre-request with a time validity period (time window) to improve business execution efficiency and enhance signature security and compliance.

[0020] Optionally, the collaborating device verifies the first intermediate value Q1 and the first data to be signed, including:

[0021] The collaborating device verifies the first intermediate value and determines whether the first intermediate value satisfies the elliptic curve equation.

[0022] If the first intermediate value satisfies the elliptic curve equation, the business information and user information are verified respectively.

[0023] Some embodiments of this application verify the business information and user information sent by the initiating device in different business scenarios, ensuring the security of business execution, realizing the decoupling of multi-role responsibilities and collaborative closed loop, and eliminating the risk of single-role control.

[0024] Optionally, the step of using a pre-set signature algorithm to sign the current signature time and the pre-application information to obtain the target signature data includes:

[0025] Based on the current signature time, the private key of the initiating device, the first random number, the first intermediate data r, and the second intermediate value s2, generate the second intermediate data s;

[0026] Based on the first intermediate data r, determine the data of the first point (x1, y1) on the ellipse.

[0027] Based on the first point data, the current signature time, and the pre-calculated first intermediate value Q1, generate the second point data (x1', y1') on the ellipse.

[0028] Based on the second data point, determine the third intermediate data r';

[0029] The first intermediate data, the second intermediate data, and the third intermediate data are determined as the target signature data;

[0030] The target signature data is verified based on the pre-set certificate public key and the current signature time;

[0031] Sending the target signature data to the receiving device includes:

[0032] If the target signature data passes verification, the second data to be signed, the current signing time, the target signature data (r, r', s), and the certificate are sent to the receiving device.

[0033] Some embodiments of this application, by using pre-approved signature time window information and incorporating the signature time into the calculation and verification of the target signature value, enable the signature time to be effectively verified in various scenarios where the enterprise platform limits the validity period and the user-defined time window, preventing the signature from being used illegally after it expires, reducing business risks, and protecting the rights and interests of all parties.

[0034] Optionally, the step of using a pre-set signature algorithm to sign the pre-application information to obtain target signature data includes:

[0035] A pre-set signature algorithm is used to sign the first intermediate data and the second intermediate value to obtain an intermediate signature value.

[0036] The current signing time, the intermediate signature value, and the second data to be signed are used to generate a timestamp request according to the timestamp interface specification standard, and the request is sent to the timestamp server so that the timestamp server can generate a timestamp corresponding to the timestamp request.

[0037] Receive the timestamp returned by the timestamp server, and generate the target signature data based on the intermediate signature value and the timestamp;

[0038] The target signature data is sent to the receiving device so that the receiving device can verify the intermediate signature value and timestamp signature value of the target signature data.

[0039] In some embodiments of this application, a timestamp service is invoked to add a timestamp to the intermediate signature value during real-time signing, ensuring the authenticity and immutability of the signature time. Users do not need to use the time value to verify the validity of the time, but rather verify the validity of the timestamp.

[0040] Optionally, the receiving device verifies the target signature data, including:

[0041] Based on the current signature time and the signature time window information in the second data to be signed, determine whether the current signature time conforms to the signature time window information;

[0042] If the current signature time matches the signature time window information, the third point data on the ellipse is determined based on the second intermediate data, the first intermediate data, the current signature time, and the certificate public key.

[0043] Based on the third data point, determine the fourth intermediate data;

[0044] The fourth intermediate data and the third intermediate data are compared;

[0045] If the fourth intermediate data matches the third intermediate data, then the target signature data is determined to have passed verification.

[0046] In some embodiments of this application, after receiving various types of data sent by the initiator, the receiving device first determines whether the current signature time is within the signature time window information of the second data to be signed. If the current signature time matches the signature time window information, the target signature data is verified again using the certificate public key and the current signature time.

[0047] Secondly, some embodiments of this application provide an asynchronous collaborative signature processing apparatus, applied to the initiating device, including:

[0048] The application module is used to send a pre-application request for collaborative signature to the collaborating device, wherein the pre-application request includes first data to be signed;

[0049] A receiving module is configured to receive pre-application information corresponding to the pre-application request returned by the collaborating device, wherein the pre-application information is determined based on the first data to be signed and the signature time window information, and the signature time window information is determined by the initiating device or the collaborating device.

[0050] The signature module is used to perform signature processing on the current signature time and the pre-application information using a pre-set signature algorithm to obtain the target signature data;

[0051] The sending module is used to send the target signature data to the receiving device, and the receiving device verifies the target signature data.

[0052] Some embodiments of this application utilize pre-application information, which is determined based on the first data to be signed and the signature time window information. During the actual signing process, the initiating device performs signature processing using the current signature time and the pre-application information to obtain the target signature data, and sends the target signature data to the receiving device. After receiving the target signature data, the receiving device determines whether the current signature time conforms to the signature time window, and then verifies the target signature data. Thus, through the collaborative signature pre-application mechanism, the impact of the network environment on real-time services is effectively avoided, and the signing operation can be completed quickly regardless of the service, reducing waiting time and improving the overall service flow speed.

[0053] Optionally, the pre-application information corresponding to the pre-application request is obtained in the following manner:

[0054] The application module of the initiator device is used for:

[0055] Send the pre-application request to the collaborating device, wherein the first data to be signed includes at least a pre-application identifier, business information, and user information;

[0056] A first random number is determined, and a first intermediate value Q1 is generated based on the first random number and the pre-set public key of the collaborating party device. The first data to be signed and the first intermediate value Q1 are then sent to the collaborating party device.

[0057] The generation module in the collaborating device is used for:

[0058] Verify the first intermediate value Q1 and the first data to be signed;

[0059] If the first intermediate value and the first data to be signed pass verification, the second data to be signed is generated based on the signature time window information and the first data to be signed.

[0060] A pre-set cryptographic hash algorithm is used to calculate the data digest e1 from the second data to be signed.

[0061] Determine the second random data, and determine the first intermediate data r based on the first intermediate value Q1, the second random data, and the data digest;

[0062] The second intermediate value s2 is determined based on the private key of the collaborating device, the first intermediate data r, and the second random data;

[0063] Send the second data to be signed, the first intermediate data r, and the second intermediate value s2 to the initiating device.

[0064] Some embodiments of this application involve adding a signature time window after the collaborating device receives the first data to be signed, obtaining the second data to be signed, and then performing signature processing on the second data to be signed to obtain pre-requested intermediate data. This solves the problem of the validity of collaborative signature time in business scenarios, and at the same time realizes collaborative signature pre-request with a time validity period (time window) to improve business execution efficiency and enhance signature security and compliance.

[0065] Optionally, the generation module in the collaborating device is used for:

[0066] The first intermediate value is verified to determine whether it satisfies the equation of an elliptic curve.

[0067] If the first intermediate value satisfies the elliptic curve equation, the business information and user information are verified respectively.

[0068] Some embodiments of this application verify the business information and user information sent by the initiating device in different business scenarios, ensuring the security of business execution, realizing the decoupling of multi-role responsibilities and collaborative closed loop, and eliminating the risk of single-role control.

[0069] Optionally, the signature module is used for:

[0070] Based on the current signature time, the private key of the initiating device, the first random number, the first intermediate data r, and the second intermediate value s2, generate the second intermediate data s;

[0071] Based on the first intermediate data r, determine the data of the first point (x1, y1) on the ellipse.

[0072] Based on the first point data, the current signature time, and the pre-calculated first intermediate value Q1, generate the second point data (x1', y1') on the ellipse.

[0073] Based on the second data point, determine the third intermediate data r';

[0074] The first intermediate data, the second intermediate data, and the third intermediate data are determined as the target signature data;

[0075] The target signature data is verified based on the pre-set certificate public key and the current signature time;

[0076] Sending the target signature data to the receiving device includes:

[0077] If the target signature data passes verification, the second data to be signed, the current signing time, the target signature data, and the certificate are sent to the receiving device.

[0078] Some embodiments of this application, by using pre-approved signature time window information and incorporating the signature time into the calculation and verification of the target signature value, enable the signature time to be effectively verified in various scenarios where the enterprise platform limits the validity period and the user-defined time window, preventing the signature from being used illegally after it expires, reducing business risks, and protecting the rights and interests of all parties.

[0079] Optionally, the signature module is used for:

[0080] A pre-set signature algorithm is used to sign the first intermediate data and the second intermediate value to obtain an intermediate signature value.

[0081] The current signing time, the intermediate signature value, and the second data to be signed are used to generate a timestamp request according to the timestamp interface specification standard, and the request is sent to the timestamp server so that the timestamp server can generate a timestamp corresponding to the timestamp request.

[0082] Receive the timestamp returned by the timestamp server, and generate the target signature data based on the intermediate signature value and the timestamp;

[0083] The target signature data is sent to the receiving device so that the receiving device can verify the intermediate signature value and timestamp signature value of the target signature data.

[0084] In some embodiments of this application, a timestamp service is invoked to add a timestamp to the intermediate signature value during real-time signing, ensuring the authenticity and immutability of the signature time. Users do not need to use the time value to verify the validity of the time, but rather verify the validity of the timestamp.

[0085] Optionally, the receiving device includes a verification module, the verification module being used for:

[0086] Based on the current signature time and the signature time window information in the second data to be signed, determine whether the current signature time conforms to the signature time window information;

[0087] If the current signature time matches the signature time window information, the third point data on the ellipse is determined based on the second intermediate data, the first intermediate data, the current signature time, and the certificate public key.

[0088] Based on the third data point, determine the fourth intermediate data;

[0089] The fourth intermediate data and the third intermediate data are compared;

[0090] If the fourth intermediate data matches the third intermediate data, then the target signature data is determined to have passed verification.

[0091] In some embodiments of this application, after receiving various types of data sent by the initiator, the receiving device first determines whether the current signature time is within the signature time window information of the second data to be signed. If the current signature time matches the signature time window information, the target signature data is verified again using the certificate public key and the current signature time.

[0092] Thirdly, some embodiments of this application provide an electronic device including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, can implement the asynchronous collaborative signature processing method as described in any embodiment of the first aspect.

[0093] Fourthly, some embodiments of this application provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, can implement the asynchronous collaborative signature processing method as described in any embodiment of the first aspect.

[0094] Fifthly, some embodiments of this application provide a computer program product, the computer program product including a computer program, wherein when the computer program is executed by a processor, it can implement the asynchronous collaborative signature processing method as described in any embodiment of the first aspect. Attached Figure Description

[0095] To more clearly illustrate the technical solutions of some embodiments of this application, the accompanying drawings used in some embodiments of this application will be briefly described below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0096] Figure 1 A flowchart illustrating an asynchronous collaborative signature processing method provided in an embodiment of this application;

[0097] Figure 2 A flowchart illustrating another asynchronous collaborative signature processing method provided in this application embodiment;

[0098] Figure 3 A flowchart illustrating another asynchronous collaborative signature processing method provided in this application embodiment;

[0099] Figure 4 A flowchart illustrating another asynchronous collaborative signature processing method provided in this application embodiment;

[0100] Figure 5 A schematic diagram of the structure of an asynchronous collaborative signature processing device provided in an embodiment of this application;

[0101] Figure 6 This is a schematic diagram of an electronic device provided in an embodiment of this application. Detailed Implementation

[0102] The technical solutions of some embodiments of this application will now be described with reference to the accompanying drawings.

[0103] It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, in the description of this application, terms such as "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0104] In today's digital business environment, collaborative signature technology is widely used in various business scenarios to ensure the security and legitimacy of business operations. Regarding collaborative signature technology, existing systems generally employ the key splitting principle, dividing the signature private key into client and server key components. Both parties store these components separately and collaboratively compute to generate the complete signature, thus preventing the emergence of a complete key and enhancing security. Currently, the signatures generated during the collaborative signature process are used in real time. For example, in collaborative signature schemes for mobile scenarios, the client and server need to interact in real time to calculate partial signature values ​​before integrating them to obtain the final signature result. In the field of smart cars, collaborative signature operations related to smart car keys rely on real-time communication and key exchange between the terminal and the cloud. All of the above schemes require the client and server to maintain a network connection during signing, and lack a pre-request mechanism for intermediate signature values. In environments with limited network access, such as underground parking garages, or in scenarios with network congestion during peak business hours, real-time interaction interruptions can easily lead to signature failures or delays.

[0105] In business operations, network instability is often a key factor affecting the efficiency of collaborative signatures. For example, in internal business processes, when internal personnel are authorized by the enterprise platform to perform relevant tasks, the enterprise may use collaborative signatures to address the issue of internal personnel having independent control over signatures. However, in situations requiring high real-time performance, such as urgent order processing or immediate financial approvals, network latency or interruptions may prevent collaborative signatures from being completed in a timely manner, severely impacting business efficiency. Similarly, in scenarios where car owners use collaborative signatures to unlock their vehicles with smart keys, network issues in areas with poor signal, such as underground parking garages, may prevent car owners from successfully completing the collaborative signature to unlock their vehicles, causing significant inconvenience to users.

[0106] On the other hand, existing collaborative signature technologies have significant shortcomings in controlling the validity of signature times. When enterprise platforms impose time limits on business data and operational execution rights, current collaborative signature methods cannot effectively ensure that the signature time is within the validity period set by the enterprise platform, easily leading to business disputes and risks. For example, when internal personnel send a signature value to a customer, the customer has difficulty verifying whether the signature time is within the enterprise's authorized time window. In scenarios where users set their own authorization time windows, such as in the use of smart car keys, where car owners set a time window for this use to prevent the signature value from being misused, existing collaborative signature technologies cannot guarantee that the signature time is within the set validity period when the car owner uses the car key, posing a security risk.

[0107] In view of this, some embodiments of this application provide an asynchronous collaborative signature processing method. The method includes sending a pre-application request for collaborative signature to a collaborating device, wherein the pre-application request includes first data to be signed; receiving pre-application information corresponding to the pre-application request returned by the collaborating device, wherein the pre-application information is determined based on the first data to be signed and signature time window information, wherein the signature time window information is determined by the initiating device or the collaborating device; at any time within the signature time window, using a pre-set signature algorithm, performing signature processing on the current signature time and the pre-application information to obtain target signature data; and sending the target signature data to a receiving device. The device verifies the target signature data. In this embodiment, pre-application information is requested in advance. This pre-application information is determined based on the first data to be signed and the signature time window information. During the actual signing process, the initiating device performs signature processing based on the current signature time and the pre-application information to obtain the target signature data, and sends the target signature data to the receiving device. After receiving the target signature data, the receiving device determines whether the current signature time meets the signature time window, and then verifies the target signature data. Thus, through the collaborative signature pre-application mechanism, the impact of the network environment on real-time services is effectively avoided. Signature operations can be completed quickly regardless of the service, reducing waiting time and improving the overall business flow speed.

[0108] like Figure 1 As shown, embodiments of this application provide an asynchronous collaborative signature processing method applied to the initiating device. The method includes:

[0109] S101. Send a pre-application request for collaborative signature to the collaborating device, wherein the pre-application request includes first data to be signed;

[0110] Specifically, the embodiments of this application are applied to a collaborative signature system, which includes an initiating device, a collaborating device, and a receiving device, wherein the initiating device is connected to the receiving device and the collaborating device respectively.

[0111] When a signature is required and in the event of a future event such as poor network conditions or excessive traffic, the initiating device sends a pre-application request for collaborative signature to the collaborating device. The pre-application request includes first data to be signed, which is used to apply for a signature at a future time.

[0112] S102. Receive pre-application information corresponding to the pre-application request returned by the collaborating device, wherein the pre-application information is determined based on the first data to be signed and the signature time window information, and the signature time window information is determined by the initiating device or the collaborating device.

[0113] Specifically, after receiving a pre-application request from the initiating device, the collaborating device generates pre-application information corresponding to the request. This involves adding a signature time window to the first data to be signed to obtain the second data to be signed. The second data is then signed to generate the pre-application information, which is then sent to the initiating device. This signature time window information can be sent by the initiating device through a set trusted clock module, or it can be set by the collaborating device for business control, depending on different needs. This application does not impose specific limitations; it simply sets a validity period for the pre-application information.

[0114] For example, in enterprise monitoring scenarios, enterprise platforms set validity periods for business data and operational execution rights. In smart car key applications, users can set their own time windows, and employees cannot generate valid signatures independently; enterprises must participate through collaborative signatures to avoid unilaterally controlling the signature content and value.

[0115] S103. Using a pre-set signature algorithm, the current signature time and the pre-application information are processed to obtain the target signature data;

[0116] Specifically, after receiving the pre-application information, the initiating device uses a pre-set signature algorithm to sign the current signature time and the pre-application information to obtain the target signature data. The pre-set signature algorithm includes the SM2 collaborative signature algorithm and the customized collaborative signature algorithm in this invention.

[0117] S104. Send the target signature data to the receiving device, and the receiving device verifies the target signature data.

[0118] Specifically, the initiating device sends the second data to be signed, the current signing time, and the target signing data to the receiving device. The receiving device first judges the current signing time and the signing time window in the second data to be signed. If the current signing time is within the signing time window, then the target signing data is further verified, that is, the target signing data is verified using the certificate public key and the current signing time. In this way, it is ensured that not only the current signing time is within the signing time window, but also that the target signing data was generated within the signing time window.

[0119] Specifically, this application embodiment is applied to a collaborative signature system, including an initiating device, a collaborating device, and a receiving device. The initiating device sends a pre-application request for collaborative signature to the collaborating device, wherein the pre-application request includes first data to be signed; after verifying the pre-application request, the collaborating device returns pre-application information corresponding to the pre-application request to the initiating device, wherein the pre-application information is determined based on the first data to be signed and signature time window information, and the signature time window information is determined by either the initiating device or the collaborating device.

[0120] The initiating device performs final signature processing on the current signature time and pre-request information based on a pre-set signature algorithm to obtain the target signature data. It then sends the target signature data to the receiving device, which verifies the data, including checking if the current signature time is within the signature time window. Through the collaborative signature pre-request mechanism and the signature time window control mechanism, the efficiency and availability issues caused by network dependence in traditional collaborative signatures, as well as the security risks arising from the lack of time validity, are effectively resolved.

[0121] Some embodiments of this application pre-apply for pre-application information, which is determined based on the first data to be signed and the signature time window information. During the actual signing process, the initiating device performs signature processing using the current signature time and the pre-application information to obtain the target signature data, and sends the target signature data to the receiving device. After receiving the target signature data, the receiving device determines whether the current signature time conforms to the signature time window, and then verifies the target signature data. Thus, through the collaborative signature pre-application mechanism and the signature time window control mechanism, the efficiency and availability problems caused by network dependence and the security risks caused by the lack of time validity in traditional collaborative signatures are effectively solved.

[0122] Another embodiment of this application further supplements the asynchronous collaborative signature processing method provided in the above embodiments.

[0123] like Figure 2 As shown in the embodiment of this application, a new time parameter, namely the current signing time T, is added to the calculation process of the final signature operation performed by the initiator of the collaborative signature, allowing the current signing time T to participate in the final signature operation. When the receiving device receives the target signature data, it uses the certificate public key and the time value T to verify the validity of the target signature data.

[0124] The present application embodiment incorporates the current signature time T into the signature and verification calculations. Taking the SM2 collaborative signature calculation process as an example, the specific process is as follows:

[0125] Optionally, the pre-application information corresponding to the pre-application request is obtained in the following ways:

[0126] The initiating device sends a pre-request request to the collaborating device, wherein the first data to be signed includes at least a pre-request identifier, business information, and user information;

[0127] The initiating device determines a first random number, and generates a first intermediate value Q1 based on the first random number and the pre-set public key of the collaborating device, and sends the first data to be signed and the first intermediate value Q1 to the collaborating device;

[0128] The collaborating device verifies the first intermediate value Q1 and the first data to be signed;

[0129] If the first intermediate value and the first data to be signed pass verification, the collaborating device generates the second data to be signed based on the signature time window information and the first data to be signed.

[0130] The collaborating device uses a pre-set cryptographic hash algorithm to calculate the second data to be signed, and obtains the data digest e1;

[0131] The collaborating device determines the second random data, and determines the first intermediate data r based on the first intermediate value Q1, the second random data, and the data digest;

[0132] The collaborating device determines the second intermediate value s2 based on the collaborating device's private key, the first intermediate data r, and the second random data;

[0133] The collaborating device sends the second data to be signed, the first intermediate data r, and the second intermediate value s2 to the initiating device.

[0134] Specifically, the initiating device obtains the first data to be signed, i.e. the content Mi to be signed. In this embodiment of the application, the initiating device supports batch application of intermediate values, i.e., pre-application information, so i=0,1, ...,N, where N is the number of concurrent services.

[0135] For each signed content Mi obtained by the initiating device, a complete collaborative signature must be performed, meaning that the subsequent selection of random numbers k1 and k2 must be randomly selected for different Mi.

[0136] In this embodiment of the application, N=1, that is, Figure 2 The entire computation process is performed for the collaborative signature of a single message. In scenarios where N > 1, multiple computation processes can be performed for different Mi.

[0137] Specifically, it includes:

[0138] (1) The initiating device obtains the first data to be signed, namely the content to be signed, M1;

[0139] (2) The initiating device randomly selects the first random number k1∈[1,n-1], where n is the order of the base point G on the elliptic curve;

[0140] (3) Calculate the first intermediate value Q1=k1*P2, send M1 and Q1 to the collaborating device, and P2 is the collaborating party's public key;

[0141] (1)-(3) are the intermediate value pre-application process initiated by the initiating device.

[0142] (4) The collaborating party's equipment verifies whether the first intermediate value Q1 satisfies the elliptic curve equation;

[0143] (5) The collaborating party's equipment verifies whether the first data M1 to be signed conforms to the pre-agreed content, such as whether the business information in the signed content sent by the employee is the task assigned to the employee by the company in advance.

[0144] (6) If the verification is successful, the collaborating device adds the authorization time window T1-T2, i.e., the signature time window information, to the first data to be signed M1, and generates a new M1', i.e., the second data to be signed. The addition of the time window can be an operation by the collaborating device, such as in the above-mentioned enterprise supervision scenario, or it can be an operation by the initiating device, such as in the car key authorization scenario.

[0145] (7) Summary of equipment calculation data of collaborating party ;

[0146] Where: Hv() is a cryptographic hash algorithm with a message digest length of v bits. This is a hash value relating to the user's alias, some elliptic curve system parameters, and the user's public key;

[0147] (8) The collaborating device randomly selects the second random data k2∈[1,n-1];

[0148] (9) The collaborating equipment calculates the first point data (x1,y1)=[k2]G+Q1, where [k2]G is the k2 times the base point G on the elliptic curve; (x1,y1) is a point on the elliptic curve;

[0149] (10) The collaborating party's equipment calculates the first intermediate data r=( +x1)modn;

[0150] (r=0 or r+ k2=n, return (8)), where mod n represents modulo n operation;

[0151] (11) The collaborating party's equipment calculates the second intermediate value. The second data to be signed, M1', the first intermediate data, r, and the second intermediate value, s2, are sent to the initiating device. Indicates the inverse of d2;

[0152] (4)-(11) is the process of calculating the pre-application intermediate value and generating the pre-application information for the collaborating device. After the collaborating device sends the second data to be signed M' and the intermediate value (r,s2) to the initiating device, the initiating device performs the final signature calculation.

[0153] Some embodiments of this application address the issue of the validity of collaborative signature time in business scenarios, while simultaneously enabling collaborative signature pre-application with a time validity period (time window), thereby improving business execution efficiency and enhancing signature security and compliance.

[0154] Optionally, the collaborating device verifies the first intermediate value Q1 and the data to be signed, including:

[0155] The collaborating device verifies the first intermediate value to determine whether it satisfies the elliptic curve equation.

[0156] If the first intermediate value satisfies the elliptic curve equation, the business information and user information are verified separately.

[0157] In this embodiment, the collaborating device verifies the first intermediate value to determine whether it satisfies the elliptic curve equation. If the first intermediate value satisfies the elliptic curve equation, the business information and user information are verified separately. This clearly defines the division between "employees being responsible for information collection and signature generation, and enterprises being responsible for authorization verification and intermediate value / token generation. Employees have no authorization permissions, and enterprises have no access permissions to employees' private keys, forming a "mutually restrictive and collaboratively secure" architecture.

[0158] Some embodiments of this application verify the business information and user information sent by the initiating device in different business scenarios, ensuring the security of business execution, realizing the decoupling of multi-role responsibilities and collaborative closed loop, and eliminating the risk of single-role control.

[0159] Optionally, a pre-set signature algorithm is used to sign the current signature time and the pre-application information to obtain the target signature data, including:

[0160] Generate the second intermediate data s based on the current signature time, the first intermediate data r, and the second intermediate value s2;

[0161] Based on the first intermediate data r, determine the data of the first point (x1, y1) on the ellipse.

[0162] Based on the first point data, the current signature time, and the pre-calculated first intermediate value Q1, generate the second point data (x1', y1') on the ellipse.

[0163] Based on the second data point, determine the third intermediate data r';

[0164] The first intermediate data, the second intermediate data, and the third intermediate data are determined as the target signature data;

[0165] The target signature data is verified based on the pre-set certificate public key and the current signature time;

[0166] Send the target signature data to the receiving device, including:

[0167] If the target signature data passes verification, the target signature data, the second data to be signed, the current signing time, the target signature data (r, r', s), and the certificate are sent to the receiving device.

[0168] Specifically, (12) the initiating device determines if the first random number k1 + the second intermediate value s2 = n, then returns (2);

[0169] (13) When the initiating device calculates the final signature, it calculates the second intermediate data s by adding the current system time T, i.e., the current signature time. ;

[0170] (14) If s=0, then return (2);

[0171] (15) The initiating device calculates x1=re, which can obtain the data of the first point (x1,y1) on the ellipse;

[0172] (16) The initiating device can obtain [k2]G based on (x1,y1)=[k2]G+Q1;

[0173] (17) The initiating device adds the time parameter T, and calculates (x1',y1') = ([k2]*T*G+Q1); (x1',y1') is a point on the elliptic curve;

[0174] (18) The initiating device calculates the third intermediate data r'=x1'+e;

[0175] (19) The initiating device uses the public key PA and time parameter T to verify whether (r, r', s) is the signature of M1'. After the verification is successful, M1', T, (r, r', s) and the certificate are sent to the receiving device.

[0176] (12)-(19) is the process of the initiator calculating the final signature. After calculating the final signature value, i.e. the target signature data, the target signature data and verification information are sent to the receiving device.

[0177] In this embodiment, T is embedded in s and r. Even if the user obtains the signature value and time T, he cannot replace T because he does not know k1 and d1, thus avoiding the risk of T being replaced.

[0178] Some embodiments of this application, through pre-approved signature time window information, enable the signature time to be effectively verified in various scenarios, including those with enterprise platform-limited validity periods and user-defined time windows, preventing the signature from being used illegally after expiration, reducing business risks, and protecting the rights and interests of all parties.

[0179] Optionally, a pre-set signature algorithm is used to sign the pre-application information to obtain target signature data, including:

[0180] A pre-set signature algorithm is used to sign the first intermediate data and the second intermediate value to obtain an intermediate signature value.

[0181] The current signing time, the intermediate signature value, and the second data to be signed are used to generate a timestamp request according to the timestamp interface specification standard, and the request is sent to the timestamp server so that the timestamp server can generate a timestamp corresponding to the timestamp request.

[0182] Receive the timestamp returned by the timestamp server, and generate the target signature data based on the intermediate signature value and the timestamp;

[0183] The target signature data is sent to the receiving device so that the receiving device can verify the intermediate signature value and timestamp signature value of the target signature data.

[0184] Specifically, as another embodiment of this application, the initiating device uses an existing collaborative signature algorithm to calculate an intermediate signature value by using the first intermediate data r and the second intermediate value s2. The device then generates a timestamp request by using the current signature time, the intermediate signature, and the second data to be signed according to the timestamp interface specification standard, and sends it to the timestamp server. The timestamp server generates a timestamp corresponding to the timestamp request based on the timestamp request. The device receives the timestamp returned by the timestamp server and generates the target signature data based on the intermediate signature value and the timestamp. In this way, the initiating device finally obtains a target signature data with a timestamp.

[0185] In other words, the steps before step (12) are the same as the steps above. In the actual signing process, the initiating device no longer adds the system time T, i.e. the current signing time, to the signing operation. Instead, it calls the timestamp service when signing the final data. The timestamp server adds a time stamp, i.e., timestamp data, to the signature value of the first data to be signed, ensuring the authenticity and immutability of the signing time. Users do not need to use the time value T to verify the validity of the time, but instead verify the validity of the timestamp.

[0186] In some embodiments of this application, a timestamp server is invoked to add a timestamp to the intermediate signature value during real-time signing, ensuring the authenticity and immutability of the signature time. Users do not need to use the time value to verify the validity of the time, but rather verify the validity of the timestamp.

[0187] Optionally, the receiving device verifies the target signature data, including:

[0188] Based on the current signature time and the signature time window information in the second data to be signed, determine whether the current signature time conforms to the signature time window information;

[0189] If the current signature time matches the signature time window information, the third point data on the ellipse is determined based on the second intermediate data, the first intermediate data, the current signature time, and the certificate public key.

[0190] Based on the third data point, determine the fourth intermediate data;

[0191] The fourth intermediate data and the third intermediate data are compared;

[0192] If the fourth intermediate data matches the third intermediate data, then the target signature data is determined to have passed verification.

[0193] In some embodiments of this application, after receiving various types of data sent by the initiator, the receiving device first determines whether the current signature time is within the signature time window information of the second data to be signed. If the current signature time matches the signature time window information, the target signature data is verified again using the certificate public key and the current signature time.

[0194] Specifically, after receiving the target signature data sent by the initiating device, the receiving device verifies the validity of the certificate and then uses the certificate public key PA and time parameter T to verify whether (r, r', s) is the signature of the target signature data M1'.

[0195] The specific verification method is as follows:

[0196] s*G+(s+r*T)*PA

[0197] =sG+s*PA+r*T*PA

[0198] =sG+s(d1d2-1)G+r*T*(d1d2-1)G

[0199] =(d1d2sG+(d1d2-1)r*G)*T

[0200] =(d1d2(d1-1(k1+s2*T)-r*T)+ (d1d2-1)r*T)G

[0201] =((k1d2+k2*T+r*T-d1d2*T*r)+d1d2*r*Tr*T)G

[0202] =(k1d2+k2*T)G

[0203] =(x2,y2);

[0204] R = (x² + e);

[0205] Determine whether the fourth intermediate data R and the third intermediate data r' are equal. If they are equal, the verification is successful.

[0206] In some embodiments of this application, after the receiving device verifies the legitimacy of the certificate, it uses the certificate public key and the current signature time to verify the target signature data.

[0207] like Figure 3 As shown, the embodiments of this application are applied to an enterprise system, including the computing and data transmission process between the enterprise (collaborating device), employees (initiating device), and customers (receiving device).

[0208] Architecture Setup: The enterprise platform deploys a collaborative signature server. This server possesses high-performance computing capabilities and large-capacity storage to store user permission information, business rules, and intermediate values ​​for collaborative signatures. Simultaneously, the server has an audit log module that records the entire process of "generating collaborative intermediate values ​​and determining order ownership." The logs are stored using blockchain (such as a consortium blockchain), ensuring immutability and serving for subsequent compliance audits and dispute resolution.

[0209] The terminal devices used by internal personnel of an enterprise (such as computers and mobile office devices) are equipped with collaborative signature client software that is compatible with the enterprise platform. This software is responsible for communicating with the server, initiating pre-application requests, obtaining pre-application intermediate values, and completing operations such as calculating the final signature value.

[0210] Pre-application process: Company employee A is responsible for handling the company's urgent order business. Before the peak business period, A opens the collaborative signature client software and selects the "Batch Pre-application of Collaborative Signature Intermediate Value" function in the software interface. The software packages A's user ID, business type (order number), and other information into a request data packet and sends it to the company platform's collaborative signature server.

[0211] Specifically:

[0212] A1 will send the signed data M=(pre-application identifier||order number||employee ID) to the collaborating party;

[0213] After receiving the request, the server (enterprise) first verifies whether user A's permissions meet the pre-application conditions (verifying the association with the order, certificate validity, etc.). If the verification is successful, the server starts the signature intermediate value calculation module according to the business rules and the business type applied for by A, calculates the collaborative signature intermediate value in batches, and stores the calculation results in a specific database table on the server. At the same time, the server returns a pre-application success response message to A's client software, which includes a unique identifier for the pre-application intermediate value (the unique identifier can be a sequence number that can uniquely identify this intermediate value calculation, such as the order number).

[0214] B1 first verifies the validity of the employee ID's certificate, and then verifies the association between orderD and the employee ID;

[0215] If the certificate is valid and associated, add an authorization time window to M, where M' includes the pre-application identifier, order number, employee ID, and T1-T2.

[0216] B3 uses private key d2 to perform a partial signature operation on the hash value H of M' to obtain (r1,s1), and sends M' and (r1,s1) to the initiator;

[0217] The signature process during business execution is as follows: When an urgent order arrives, A selects the corresponding order in the client software. The software retrieves the pre-approved collaborative signature intermediate value from the server based on the order information (by querying a unique identifier), and calculates the final signature value according to the predetermined signature algorithm, combining this with the specific data of the order (such as order amount, product information, etc., depending on the situation) and the current system time. A sends the calculated signature value to the customer. After receiving the signature value, the customer verifies the validity of the signature value and whether the signature time is within the validity period set by the enterprise platform, by using the online verification tool provided by the enterprise platform or the verification module integrated into its business system, and inputting the signature value and relevant verification parameters (such as validity period rules, public key, system time, etc.).

[0218] Specifically, it includes:

[0219] A2 uses the private key d1 and the signature time value T to perform the final signature operation on (r1, s1) to obtain (r, s);

[0220] A3 sends M', T, (r1,r,s) and the certificate to the recipient;

[0221] C1 uses the issuing authority's public key to verify the legitimacy of the certificate;

[0222] C2 checks whether the signature time T is within the authorized time window. If the verification is successful, it uses the certificate public key and time T to verify the signature value.

[0223] Based on business data, C3 further verifies whether the signed content contains order numbers or other data that precisely aligns with its own.

[0224] Asynchronous collaborative signature primarily addresses the issue of time validity of collaborative signatures in business scenarios.

[0225] When internal personnel are authorized to perform relevant tasks, they can pre-apply for collaborative signatures in batches to avoid being affected by the network environment when performing tasks with high real-time requirements.

[0226] This application also provides another application scenario, such as when a car owner uses collaborative signature to implement a smart car key. For example, if a parking garage may be unable to access the network, a collaborative signature can be pre-applied for.

[0227] like Figure 4 As shown, this illustrates the calculation and data transfer process between the vehicle owner (collaborator), the service platform (initiator), and the vehicle (receiver).

[0228] System Component Deployment: Vehicle manufacturers integrate a collaborative signature verification module into their vehicle control systems. This module receives and verifies signature values ​​from the vehicle owner's mobile device. Simultaneously, a vehicle-compatible mobile application is developed and installed on the owner's smartphone. This application provides functions such as collaborative signature pre-application, signature value calculation, and communication with the vehicle control system. A service platform establishes a collaborative signature server to process vehicle owner pre-application requests, calculate intermediate collaborative signature values, and store data such as the owner's authorization information and time windows. The service platform includes an audit log module that records all operations, including "collaborative intermediate value generation." The logs are stored using blockchain (such as a consortium blockchain), ensuring immutability and serving as evidence for subsequent compliance audits and dispute resolution.

[0229] Pre-application process: Car owner B plans to drive to a shopping mall, anticipating passing through areas with poor network signal, such as the underground parking garage. Before departure, B opens the vehicle's accompanying mobile application on their phone and clicks the "Smart Car Key Collaborative Signature Pre-application" button. The application obtains information such as the Vehicle Identification Number (VIN) and owner ID, and sends a pre-application request to the service platform. B can also choose to set the validity period of the pre-application (e.g., if the expected stay in the underground parking garage is 2 hours, the validity period is set to 2 hours). Upon receiving the request, the service platform verifies the legality of B's ​​identity and vehicle information, and whether the time window complies with regulations. If the verification is successful, the service platform calculates the collaborative signature intermediate value based on the vehicle information and the collaborative signature algorithm, and sends the intermediate value and related pre-application validity period information to B's mobile application for storage. Simultaneously, the service platform records the pre-application information in its database.

[0230] Specifically, it includes:

[0231] The A1 initiating device will send the signed data M, including instruction information, vehicle information, and valid time window, to the collaborating party;

[0232] B1 first verifies the vehicle information using the collaborating equipment to determine if it is a registered vehicle, and then verifies whether the time window meets the requirements.

[0233] B2 uses private key d2 to perform a partial signature operation on the hash value H of M to obtain (r1,s1), and sends M and (r1,s1) to the initiator;

[0234] Vehicle unlocking signature process: When B enters the underground parking garage and the network signal is interrupted, B needs to unlock the vehicle. B opens the mobile application. The application detects that there is currently no network but a valid pre-requested collaborative signature intermediate value exists. Based on the vehicle unlocking operation, the signature value calculation process is triggered. The application combines vehicle information, the pre-requested collaborative signature intermediate value, and the current system time to calculate the final signature value according to a specific signature algorithm. B brings the phone close to the vehicle, and the application sends the signature value to the collaborative signature verification module in the vehicle control system via Bluetooth or Near Field Communication (NFC). After receiving the signature value, the verification module retrieves the time window information set by B from the signed content and compares whether the signature time is within the time window. If it is within the time window and the signature value verification passes, the vehicle unlocks successfully; otherwise, the vehicle remains locked, and the reason for the unlocking failure is reported to B's mobile application.

[0235] Specifically:

[0236] A2 uses the private key d1 and the signature time value T to perform the final signature operation on (r1, s1) to obtain (r, s);

[0237] A3 sends M, T, (r1,r,s) and the certificate to the recipient;

[0238] The C1 receiving device uses the issuing authority's public key to verify the legitimacy of the vehicle owner's certificate;

[0239] C2 checks whether the signature time T is within the authorized time window. After successful verification, the receiving device uses the certificate public key and time T to verify the signature value.

[0240] Meanwhile, it supports scenarios where car owners authorize smart car keys to friends. Car owners can set a time window for authorization. When a friend sends a command to the car, the vehicle needs to check whether the friend's signature time is within the authorization time window.

[0241] This application proposes a novel collaborative signature method that integrates "pre-application of intermediate values ​​for collaborative signatures" with "management of the validity period (time window) of intermediate values." This method targets typical scenarios such as real-time business within enterprises and smart car keys. On the one hand, it supports users (such as internal personnel and car owners) to pre-application for collaborative signature intermediate values ​​individually or in batches when the network environment is good, avoiding signature delays caused by subsequent network limitations (such as underground parking garages or network congestion during peak business periods), thus ensuring efficient business execution. On the other hand, it requires embedding the signature completion time into the final signature value calculation and incorporating the time validity period (the business permission period set by the enterprise or the user-defined authorization window) into the signed content. This allows the verifier (such as the customer or vehicle) to accurately verify whether the signature time is within the compliant validity period, effectively solving two major practical problems of traditional collaborative signatures: "efficiency bottlenecks caused by network dependence" and "security risks caused by the lack of time validity."

[0242] 1. Significantly improves business execution efficiency. The collaborative signature pre-application mechanism effectively avoids the impact of network environment on real-time business. Whether it is the handling of urgent business within the enterprise or the use of smart car keys in network-restricted scenarios, the signing operation can be completed quickly, reducing waiting time and improving the overall business flow speed.

[0243] 2. Significantly enhances signature security and compliance. The time-limited collaborative signature design ensures that signature time can be effectively verified in various scenarios, including those with enterprise platform-defined validity periods and user-defined time windows. This prevents signatures from being used illegally after expiration, reduces business risks, and protects the rights and interests of all parties.

[0244] It should be noted that each of the implementable methods in this embodiment can be implemented individually or in any combination without conflict. This application does not limit this.

[0245] Another embodiment of this application provides an asynchronous collaborative signature processing apparatus for executing the asynchronous collaborative signature processing method provided in the above embodiments.

[0246] like Figure 5 The diagram shown is a structural schematic of an asynchronous collaborative signature processing device provided in an embodiment of this application. Applied to the initiating device, the asynchronous collaborative signature processing device includes an application module 501, a receiving module 502, a signature module 503, and a sending module 504, wherein:

[0247] The application module 501 is used to send a pre-application request for collaborative signature to the collaborating device, wherein the pre-application request includes first data to be signed;

[0248] The receiving module 502 is used to receive the pre-application information returned by the collaborating device corresponding to the pre-application request, wherein the pre-application information is determined based on the first data to be signed and the signature time window information, and the signature time window information is determined by the initiating device or the collaborating device.

[0249] The signature module 503 is used to perform signature processing on the current signature time and the pre-application information using a pre-set signature algorithm to obtain the target signature data;

[0250] The sending module 504 is used to send the target signature data to the receiving device, and the receiving device verifies the target signature data.

[0251] Regarding the apparatus in this embodiment, the specific manner in which each module performs its operations has been described in detail in the embodiments related to the method, and will not be elaborated upon here.

[0252] Some embodiments of this application utilize pre-application information, which is determined based on the first data to be signed and the signature time window information. During the actual signing process, the initiating device performs signature processing using the current signature time and the pre-application information to obtain the target signature data, and sends the target signature data to the receiving device. After receiving the target signature data, the receiving device determines whether the current signature time conforms to the signature time window, and then verifies the target signature data. Thus, through the collaborative signature pre-application mechanism, the impact of the network environment on real-time services is effectively avoided, and the signing operation can be completed quickly regardless of the service, reducing waiting time and improving the overall service flow speed.

[0253] Another embodiment of this application further illustrates the asynchronous collaborative signature processing apparatus provided in the above embodiments.

[0254] Optionally, the pre-application information corresponding to the pre-application request is obtained in the following manner:

[0255] The application module of the initiator device is used for:

[0256] Send the pre-application request to the collaborating device, wherein the first data to be signed includes at least a pre-application identifier, business information, and user information;

[0257] A first random number is determined, and a first intermediate value Q1 is generated based on the first random number and the pre-set public key of the collaborating party device. The first data to be signed and the first intermediate value Q1 are then sent to the collaborating party device.

[0258] The generation module in the collaborating device is used for:

[0259] Verify the first intermediate value Q1 and the first data to be signed;

[0260] If the first intermediate value and the first data to be signed pass verification, the second data to be signed is generated based on the signature time window information and the first data to be signed.

[0261] A pre-set cryptographic hash algorithm is used to calculate the data digest e1 from the second data to be signed.

[0262] Determine the second random data, and determine the first intermediate data r based on the first intermediate value Q1, the second random data, and the data digest;

[0263] The second intermediate value s2 is determined based on the private key of the collaborating device, the first intermediate data r, and the second random data;

[0264] Send the second data to be signed, the first intermediate data r, and the second intermediate value s2 to the initiating device.

[0265] Some embodiments of this application involve adding a signature time window after the collaborating device receives the first data to be signed, obtaining the second data to be signed, and then performing signature processing on the second data to be signed to obtain pre-requested intermediate data. This solves the problem of the validity of collaborative signature time in business scenarios, and at the same time realizes collaborative signature pre-request with a time validity period (time window) to improve business execution efficiency and enhance signature security and compliance.

[0266] Optionally, the generation module in the collaborating device is used for:

[0267] The first intermediate value is verified to determine whether it satisfies the equation of an elliptic curve.

[0268] If the first intermediate value satisfies the elliptic curve equation, the business information and user information are verified respectively.

[0269] Some embodiments of this application verify the business information and user information sent by the initiating device in different business scenarios, ensuring the security of business execution, realizing the decoupling of multi-role responsibilities and collaborative closed loop, and eliminating the risk of single-role control.

[0270] Optionally, the signature module is used for:

[0271] Based on the current signature time, the private key of the initiating device, the first random number, the first intermediate data r, and the second intermediate value s2, generate the second intermediate data s;

[0272] Based on the first intermediate data r, determine the data of the first point (x1, y1) on the ellipse.

[0273] Based on the first point data, the current signature time, and the pre-calculated first intermediate value Q1, generate the second point data (x1', y1') on the ellipse.

[0274] Based on the second data point, determine the third intermediate data r';

[0275] The first intermediate data, the second intermediate data, and the third intermediate data are determined as the target signature data;

[0276] The target signature data is verified based on the pre-set certificate public key and the current signature time;

[0277] Sending the target signature data to the receiving device includes:

[0278] If the target signature data passes verification, the second data to be signed, the current signing time, the target signature data, and the certificate are sent to the receiving device.

[0279] Some embodiments of this application, through pre-approved signature time window information, enable the signature time to be effectively verified in various scenarios, including those with enterprise platform-limited validity periods and user-defined time windows, preventing the signature from being used illegally after expiration, reducing business risks, and protecting the rights and interests of all parties.

[0280] Optionally, the signature module is used for:

[0281] A pre-set signature algorithm is used to sign the first intermediate data and the second intermediate value to obtain an intermediate signature value.

[0282] The current signing time, the intermediate signature value, and the second data to be signed are used to generate a timestamp request according to the timestamp interface specification standard, and the request is sent to the timestamp server so that the timestamp server can generate a timestamp corresponding to the timestamp request.

[0283] Receive the timestamp returned by the timestamp server, and generate the target signature data based on the intermediate signature value and the timestamp;

[0284] The target signature data is sent to the receiving device so that the receiving device can verify the intermediate signature value and timestamp signature value of the target signature data.

[0285] In some embodiments of this application, a timestamp service is invoked to add a timestamp to the intermediate signature value during real-time signing, ensuring the authenticity and immutability of the signature time. Users do not need to use the time value to verify the validity of the time, but rather verify the validity of the timestamp.

[0286] Optionally, the receiving device includes a verification module, the verification module being used for:

[0287] Based on the current signature time and the signature time window information in the second data to be signed, determine whether the current signature time conforms to the signature time window information;

[0288] If the current signature time matches the signature time window information, the third point data on the ellipse is determined based on the second intermediate data, the first intermediate data, the current signature time, and the certificate public key.

[0289] Based on the third data point, determine the fourth intermediate data;

[0290] The fourth intermediate data and the third intermediate data are compared;

[0291] If the fourth intermediate data matches the third intermediate data, then the target signature data is determined to have passed verification.

[0292] In some embodiments of this application, after receiving various types of data sent by the initiator, the receiving device first determines whether the current signature time is within the signature time window information of the second data to be signed. If the current signature time matches the signature time window information, the target signature data is verified again using the certificate public key and the current signature time.

[0293] Regarding the apparatus in this embodiment, the specific manner in which each module performs its operations has been described in detail in the embodiments related to the method, and will not be elaborated upon here.

[0294] It should be noted that each of the implementable methods in this embodiment can be implemented individually or in any combination without conflict. This application does not limit this.

[0295] This application also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, can implement the operation of any of the methods corresponding to the asynchronous cooperative signature processing methods provided in the above embodiments.

[0296] This application also provides a computer program product, which includes a computer program, wherein when the computer program is executed by a processor, it can implement the operation of any of the methods corresponding to the embodiments of the asynchronous collaborative signature processing method provided in the above embodiments.

[0297] like Figure 6 As shown, some embodiments of this application provide an electronic device 600, which includes a memory 610, a processor 620, and a computer program stored in the memory 610 and executable on the processor 620. When the processor 620 reads the program from the memory 610 via a bus 630 and executes the program, it can implement any of the methods included in the above-described asynchronous collaborative signature processing method.

[0298] Processor 620 can process digital signals and can include various computing architectures. For example, it can be a complex instruction set computer architecture, a reduced instruction set computer architecture, or an architecture that implements multiple instruction set combinations. In some examples, processor 620 can be a microprocessor.

[0299] The memory 610 can be used to store instructions executed by the processor 620 or data related to the execution of instructions. These instructions and / or data may include code for implementing some or all of the functions of one or more modules described in the embodiments of this application. The processor 620 of this disclosure embodiment can be used to execute the instructions in the memory 610 to implement the methods shown above. The memory 610 includes dynamic random access memory, static random access memory, flash memory, optical memory, or other memories well known to those skilled in the art.

[0300] The above are merely embodiments of this application and are not intended to limit the scope of protection of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application. It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0301] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0302] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

Claims

1. A method for processing asynchronous collaborative signatures, characterized in that, Applied to the initiating device, the method includes: Send a pre-application request for collaborative signature to the collaborating device, wherein the pre-application request includes first data to be signed; The system receives pre-application information corresponding to the pre-application request returned by the collaborating device, wherein the pre-application information is determined based on the first data to be signed and the signature time window information, and the signature time window information is determined by the initiating device or the collaborating device. Using a pre-set signature algorithm, the current signature time and the pre-application information are processed to obtain the target signature data; The target signature data is sent to the receiving device, and the receiving device verifies the target signature data; wherein: The pre-application information corresponding to the pre-application request is obtained in the following manner: The initiating device sends the pre-application request to the collaborating device, wherein the first data to be signed includes at least a pre-application identifier, business information, and user information; The initiating device determines a first random number, and generates a first intermediate value based on the first random number and the pre-set public key of the collaborating device, and sends the first data to be signed and the first intermediate value to the collaborating device. The collaborating device verifies the first intermediate value and the first data to be signed; If the first intermediate value and the first data to be signed pass verification, the collaborating device generates the second data to be signed based on the signature time window information and the first data to be signed. The collaborating device uses a pre-set cryptographic hash algorithm to calculate the second data to be signed, and obtains a data digest. The collaborating device determines the second random data, and determines the first intermediate data based on the first intermediate value, the second random data, and the data digest; The collaborating device determines the second intermediate value based on the collaborating device's private key, the first intermediate data, and the second random data; The collaborating device sends the second data to be signed, the first intermediate data, and the second intermediate value to the initiating device; The process involves using a pre-set signature algorithm to sign the current signature time and the pre-application information to obtain the target signature data, including: Generate second intermediate data based on the current signature time, the private key of the initiating device, the first random number, the first intermediate data, and the second intermediate value; Based on the first intermediate data, determine the data of the first point on the ellipse; Based on the first point data, the current signature time, and the pre-calculated first intermediate value, generate the second point data on the ellipse; Based on the second data point, determine the third intermediate data; The first intermediate data, the second intermediate data, and the third intermediate data are determined as the target signature data; The target signature data is verified based on the pre-set certificate public key and the current signature time.

2. The asynchronous collaborative signature processing method according to claim 1, characterized in that, The collaborating device verifies the first intermediate value and the first data to be signed, including: The collaborating device verifies the first intermediate value and determines whether the first intermediate value satisfies the elliptic curve equation. If the first intermediate value satisfies the elliptic curve equation, the business information and user information are verified respectively.

3. The asynchronous collaborative signature processing method according to claim 1, characterized in that, Sending the target signature data to the receiving device includes: If the target signature data passes verification, the second data to be signed, the current signing time, the target signature data, and the certificate are sent to the receiving device.

4. The asynchronous collaborative signature processing method according to claim 1, characterized in that, The step of using a pre-set signature algorithm to sign the pre-application information to obtain target signature data includes: A pre-set signature algorithm is used to sign the first intermediate data and the second intermediate value to obtain an intermediate signature value. The current signing time, the intermediate signature value, and the second data to be signed are used to generate a timestamp request according to the timestamp interface specification standard, and the request is sent to the timestamp server so that the timestamp server can generate a timestamp corresponding to the timestamp request. Receive the timestamp returned by the timestamp server, and generate the target signature data based on the intermediate signature value and the timestamp; The target signature data is sent to the receiving device so that the receiving device can verify the intermediate signature value and timestamp signature value of the target signature data.

5. The asynchronous collaborative signature processing method according to claim 3, characterized in that, The receiving device verifies the target signature data, including: Based on the current signature time and the signature time window information in the second data to be signed, determine whether the current signature time conforms to the signature time window information; If the current signature time matches the signature time window information, the third point data on the ellipse is determined based on the second intermediate data, the first intermediate data, the current signature time, and the certificate public key. Based on the third data point, determine the fourth intermediate data; The fourth intermediate data and the third intermediate data are compared; If the fourth intermediate data matches the third intermediate data, then the target signature data is determined to have passed verification.

6. An asynchronous collaborative signature processing apparatus, characterized in that, Applied to the initiating device, the device includes: The application module is used to send a pre-application request for collaborative signature to the collaborating device, wherein the pre-application request includes first data to be signed; A receiving module is configured to receive pre-application information corresponding to the pre-application request returned by the collaborating device, wherein the pre-application information is determined based on the first data to be signed and the signature time window information, and the signature time window information is determined by the initiating device or the collaborating device. The signature module is used to perform signature processing on the current signature time and the pre-application information using a pre-set signature algorithm to obtain the target signature data; The sending module is used to send the target signature data to the receiving device, and the receiving device verifies the target signature data; The pre-application information corresponding to the pre-application request is obtained in the following manner: The initiating device sends the pre-application request to the collaborating device, wherein the first data to be signed includes at least a pre-application identifier, business information, and user information; The initiating device determines a first random number, and generates a first intermediate value based on the first random number and the pre-set public key of the collaborating device, and sends the first data to be signed and the first intermediate value to the collaborating device. The collaborating device verifies the first intermediate value and the first data to be signed; If the first intermediate value and the first data to be signed pass verification, the collaborating device generates the second data to be signed based on the signature time window information and the first data to be signed. The collaborating device uses a pre-set cryptographic hash algorithm to calculate the second data to be signed, and obtains a data digest. The collaborating device determines the second random data, and determines the first intermediate data based on the first intermediate value, the second random data, and the data digest; The collaborating device determines the second intermediate value based on the collaborating device's private key, the first intermediate data, and the second random data; The collaborating device sends the second data to be signed, the first intermediate data, and the second intermediate value to the initiating device; The signature module is used to generate second intermediate data based on the current signature time, the private key of the initiating device, the first random number, the first intermediate data, and the second intermediate value; Based on the first intermediate data, determine the data of the first point on the ellipse; Based on the first point data, the current signature time, and the pre-calculated first intermediate value, generate the second point data on the ellipse; Based on the second data point, determine the third intermediate data; The first intermediate data, the second intermediate data, and the third intermediate data are determined as the target signature data; The target signature data is verified based on the pre-set certificate public key and the current signature time.

7. The asynchronous collaborative signature processing apparatus according to claim 6, characterized in that, The generation module in the collaborating device is used for: The first intermediate value is verified to determine whether it satisfies the equation of an elliptic curve. If the first intermediate value satisfies the elliptic curve equation, the business information and user information are verified respectively.

8. The asynchronous collaborative signature processing apparatus according to claim 6, characterized in that, The sending module is used for: If the target signature data passes verification, the second data to be signed, the current signing time, the target signature data, and the certificate are sent to the receiving device.

9. An electronic device, characterized in that, It includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, it can implement the asynchronous collaborative signature processing method as described in any one of claims 1-5.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, characterized in that, when the program is executed by a processor, it can implement the asynchronous collaborative signature processing method as described in any one of claims 1-5.

Images