Electronic signature verification method and device, and electronic equipment

Abstract

This application provides an electronic signature verification method, apparatus, and electronic device, relating to the field of electronic signature technology. The method includes: receiving a verification request sent by a terminal, the verification request including an electronic document with electronic signature information and a commitment value; encrypting the commitment value according to pre-acquired scenario feature parameters to generate a challenge value, and sending the challenge value to the terminal; receiving a response value sent by the terminal, and decrypting the response value using a public key corresponding to the private key to obtain a first signature; calculating a signature result using the first signature, the challenge value, the hash value of the electronic document, and the random salt value; and determining the verification result based on the matching degree between the signature result and the electronic signature information. In this way, user private data and document information are not obtained during the verification process, protecting the privacy of user data and improving the security of sensitive data.

Description

Technical Field

[0001] This application relates to the field of electronic signature technology, and in particular to an electronic signature verification method, apparatus and electronic device. Background Technology

[0002] In the field of electronic signatures, digital certificates are the core carrier for achieving trusted verification of subject identity and ensuring data integrity. As a trusted institution, the Certificate Authority (CA) is responsible for verifying the user's real identity information and issuing digital certificates to users based on the verification results, uniquely binding the user's identity information with the public key.

[0003] However, when users verify signatures across systems, the CA needs to repeatedly transmit sensitive data such as user digital certificates, public keys, and document hashes to the verification system. When there are security vulnerabilities in the transmission link, it can easily lead to the leakage of sensitive data, resulting in poor data security. Summary of the Invention

[0004] This application provides an electronic signature verification method, apparatus, and electronic device to address the problem of poor data security.

[0005] To solve the above-mentioned technical problems, this application is implemented as follows:

[0006] In a first aspect, embodiments of this application provide an electronic signature verification method, applied to a server, the method comprising:

[0007] The terminal receives a signature verification request, which includes an electronic document with electronic signature information and a commitment value. The electronic signature information includes the electronic signature of the first user on the electronic document. The commitment value is generated based on the first user's electronic signature and a random salt value. The first user's electronic signature is generated based on the first user's private key.

[0008] The commitment value is encrypted to generate a challenge value based on the pre-acquired scenario feature parameters, and the challenge value is sent to the terminal. The scenario feature parameters are used to characterize the features of the scenario in which the first user performs signature verification.

[0009] The system receives a response value sent by the terminal in response to the challenge value, and decrypts the response value using the public key corresponding to the private key to obtain a first signature.

[0010] The signature result is calculated using the first signature, the challenge value, the hash value of the electronic document, and the random salt value.

[0011] The verification result is determined based on the degree of matching between the signature result and the electronic signature information.

[0012] Secondly, embodiments of this application provide an electronic signature verification method, applied to a terminal, the method comprising:

[0013] Send a signature verification request to the server. The signature verification request includes an electronic document with electronic signature information and a commitment value. The electronic signature information includes the electronic signature of the first user on the electronic document. The commitment value is generated based on the first user's electronic signature and a random salt value. The first user's electronic signature is generated based on the first user's private key.

[0014] Receive the challenge value sent by the server in response to the signature verification request, and generate a response value based on the challenge value and the private key;

[0015] Send the response value to the server.

[0016] Thirdly, embodiments of this application provide an electronic signature verification device applied to a server, the device comprising:

[0017] The first receiving module is used to receive a signature verification request sent by the terminal. The signature verification request includes an electronic document with electronic signature information and a commitment value. The electronic signature information includes the electronic signature of the first user on the electronic document. The commitment value is generated based on the electronic signature of the first user and a random salt value. The electronic signature of the first user is generated based on the private key of the first user.

[0018] The first generation module is used to encrypt the commitment value to generate a challenge value based on the pre-acquired scene feature parameters, and send the challenge value to the terminal. The scene feature parameters are used to characterize the features of the scene in which the first user performs signature verification.

[0019] The second receiving module is used to receive the response value sent by the terminal in response to the challenge value, and to decrypt the response value using the public key corresponding to the private key to obtain the first signature;

[0020] The calculation module is used to calculate the signature result using the first signature, the challenge value, the hash value of the electronic document, and the random salt value;

[0021] The determination module is used to determine the signature verification result based on the matching degree between the signature result and the electronic signature information.

[0022] Fourthly, embodiments of this application provide an electronic signature verification device applied to a terminal, the device comprising:

[0023] The first sending module is used to send a signature verification request to the server. The signature verification request includes an electronic document with electronic signature information and a commitment value. The electronic signature information includes the electronic signature of the first user on the electronic document. The commitment value is generated based on the electronic signature of the first user and a random salt value. The electronic signature of the first user is generated based on the private key of the first user.

[0024] The receiving module is configured to receive the challenge value sent by the server in response to the signature verification request, and generate a response value based on the challenge value and the private key;

[0025] The second sending module is used to send the response value to the server.

[0026] Fifthly, embodiments of this application provide an electronic device, including: a processor, a memory, and a program stored in the memory and executable on the processor, wherein when the program is executed by the processor, it implements the steps of the electronic signature verification method described in the first or second aspect.

[0027] In a sixth aspect, embodiments of this application provide a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the electronic signature verification method described in the first or second aspect.

[0028] In a seventh aspect, a computer program product is provided, including computer instructions that, when executed by a processor, implement the steps of the electronic signature verification method as described in the first or second aspect.

[0029] In this embodiment, a signature verification request is received from a receiving terminal. The request includes an electronic document with electronic signature information and a commitment value. The electronic signature information includes a first user's electronic signature on the electronic document. The commitment value is generated based on the first user's electronic signature and a random salt value, and the first user's electronic signature is generated based on the first user's private key. A challenge value is generated by encrypting the commitment value according to pre-acquired scenario feature parameters, and this challenge value is sent to the terminal. The scenario feature parameters characterize the features of the scenario in which the first user is verifying the signature. A response value sent by the terminal in response to the challenge value is received, and the response value is decrypted using the public key corresponding to the private key to obtain a first signature. A signature result is calculated using the first signature, the challenge value, the hash value of the electronic document, and the random salt value. The signature verification result is determined based on the matching degree between the signature result and the electronic signature information. Thus, the user's identity, signature data, or document information is not acquired during the signature verification process, protecting the privacy of user data. Sensitive information is transmitted in encrypted form throughout the process, improving the security of sensitive data. Attached Figure Description

[0030] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the description of the embodiments of this application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0031] Figure 1 This is one of the flowcharts of an electronic signature verification method provided in the embodiments of this application;

[0032] Figure 2 This is the second flowchart of an electronic signature verification method provided in the embodiments of this application;

[0033] Figure 3 This is the third flowchart of an electronic signature verification method provided in the embodiments of this application;

[0034] Figure 4 This is one of the structural schematic diagrams of an electronic signature verification device provided in the embodiments of this application;

[0035] Figure 5 This is a second schematic diagram of the structure of an electronic signature verification device provided in the embodiments of this application;

[0036] Figure 6 This is one of the structural schematic diagrams of an electronic device provided in the embodiments of this application;

[0037] Figure 7 This is a second schematic diagram of the structure of an electronic device provided in the embodiments of this application. Detailed Implementation

[0038] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0039] This application provides an electronic signature verification method, apparatus, and electronic device to address the problem of poor data security.

[0040] See Figure 1 , Figure 1 This is a flowchart of an electronic signature verification method provided in an embodiment of this application, applied to a server. For example... Figure 1 As shown, the method includes the following steps:

[0041] Step 101: Receive a signature verification request sent by the terminal. The signature verification request includes an electronic document with electronic signature information and a commitment value. The electronic signature information includes the electronic signature of the first user on the electronic document. The commitment value is generated based on the electronic signature of the first user and a random salt value. The electronic signature of the first user is generated based on the private key of the first user.

[0042] Step 102: Encrypt the commitment value according to the pre-acquired scene feature parameters to generate a challenge value, and send the challenge value to the terminal. The scene feature parameters are used to characterize the features of the scene in which the first user performs signature verification.

[0043] Step 103: Receive the response value sent by the terminal in response to the challenge value, and decrypt the response value using the public key corresponding to the private key to obtain the first signature;

[0044] Step 104: Calculate the signature result using the first signature, the challenge value, the hash value of the electronic document, and the random salt value;

[0045] The verification result is determined based on the degree of matching between the signature result and the electronic signature information.

[0046] The electronic signature information may include the first user's signature on the electronic document. The first user's digital identity information may be stored on the blockchain. When a user signs an electronic document, the first user's digital identity information (including private key, identity attribute information, etc.) is obtained from the blockchain to sign the electronic document.

[0047] When the first user verifies the electronic signature using a terminal, a verification request is sent to the server.

[0048] In this context, the electronic signature information can be information from one or more parties electronically signing an electronic document. The commitment value can be understood as an encrypted value generated by the first user's commitment to the electronic document. The random salt value can be a random character used to increase password security; using a random salt value ensures that each commitment value is unique. In some implementations, entropy and a random salt value can also be used for encryption.

[0049] Upon receiving a signature verification request from a user terminal, the commitment value is encrypted using scenario feature parameters.

[0050] The scene feature parameters can be obtained when a signature verification request is received, or they can be obtained in advance before the signature verification request is received.

[0051] Scene feature parameters can include the feature parameters of electronic documents, such as the document's security level and the number of signatories; they can also include environmental parameters for signature verification, such as the CPU load, memory, and network latency of the terminal sending the signature verification request; and they can also include user behavioral characteristics, such as historical signing frequency, geographical location, and fingerprint information of frequently used devices.

[0052] Dynamic factors are generated using scene feature parameters, and the commitment value is encrypted using the dynamic factors to generate a challenge value, which is then sent to the terminal.

[0053] In some implementations, the dynamic factor is obtained by XOR hashing the commitment value with multiple scenario feature parameters.

[0054] In some implementations, when multiple scene feature parameters are included, different weights can be assigned to the multiple scene feature parameters according to their importance. After obtaining the corresponding parameters using the weights, the commitment value and multiple parameters are XORed and hashed to generate the corresponding dynamic factor.

[0055] After receiving the challenge value, the terminal can generate a response value based on the private key and digital signature information, and send the response value to the server.

[0056] After receiving the response value, the server decrypts it using the public key corresponding to the private key, generating a temporary signature, i.e., the first signature. Using the first signature, along with the challenge value, the hash value of the electronic document, and the random salt value, a hash calculation is performed to recover the signature, thus obtaining the final signature.

[0057] If the signature result matches the electronic signature information of the electronic document, the signature verification is successful.

[0058] In this way, when a user needs to verify a signature, the user terminal first obtains the user's signature identity information from the blockchain, encrypts it to generate a set of ciphertext related to the identity information, and combines this set of ciphertext with scene feature parameters (such as environmental document features, environmental parameters, behavioral features, dynamic factors, etc.) to automatically generate an encrypted evidence package containing validity evidence (without containing any plaintext attributes) through a zero-knowledge proof protocol. This proves to the signature verification system that its attributes meet the signature requirements without revealing the specific attribute content. The verifier only needs to judge and output the "valid" or "invalid" result based on the proof information provided by the signer and the verification algorithm. This is like a user having a safe with a password; this verification method allows the user to prove to others "I know the password" without actually saying the password or even opening the safe to show the contents.

[0059] When a document involves multiple signatories, the signature verification system does not need to centrally process all the raw data. It only needs to receive dynamic challenge values ​​and corresponding zero-knowledge proof response values ​​from each signatory, and independently verify the validity of each response value. Finally, it combines all the independent verification results with the integrity check of the document itself to output the verification result of the entire multi-party signed document. This avoids the traditional centralized certificate chain verification model, realizes black-box multi-party electronic signature verification without sensitive data transmission, and significantly improves cross-platform compatibility and the overall system's privacy and security level.

[0060] In this embodiment, the user's identity, signature data, or privacy information is not obtained during the signature verification process, thus protecting the privacy of user data, preventing unnecessary dissemination and leakage of user information among multiple systems, and ensuring consistency and fairness in signature verification, thereby improving the security of sensitive data.

[0061] Optionally, the scene feature parameters include at least one of the following: features of the electronic document, environmental parameters, and behavioral features;

[0062] The step of encrypting the commitment value to generate a challenge value based on pre-acquired scene feature parameters includes:

[0063] The commitment value is XORed with at least one of the features of the electronic document, the environmental parameters, and the behavioral features to obtain a first factor, and the commitment value is encrypted using the first factor to generate the challenge value.

[0064] Upon receiving the commitment value, the server's verification system encrypts the commitment value based on the commitment value, the hash value of the electronic document's features, the environmental parameter string, and the behavioral feature string, generating a challenge value which is then fed back to the user terminal. The challenge value can be generated based on multi-dimensional features.

[0065] The characteristics of electronic documents may include type, density, number of signatories, size, etc.; environmental parameters may include user terminal device model, operating system version, network environment, geographical location, etc.; user behavior characteristics may include user's historical signing duration, input frequency, historical geographical location, and frequently used device information, etc.

[0066] A dynamic factor is obtained by performing an XOR hash calculation on the commitment value, the document feature hash value, the environment parameter string, and the behavior feature string. After encrypting the commitment value using the dynamic factor, the verification system generates a challenge value.

[0067] By using the above method, dynamic challenge values ​​are generated based on multi-dimensional scene feature parameters, ensuring that the challenge value for each verification is unique and does not repeat, thereby improving data security.

[0068] Optionally, the characteristics of the electronic document include at least one of the following: the type of the electronic document, the security classification, and the number of signatories;

[0069] The environmental parameters include at least one of the terminal's CPU load, memory, and network latency;

[0070] The behavioral characteristics include at least one of the following: the first user's historical signature frequency, the fingerprints of the terminal devices used in the past, and the geographical location.

[0071] In some implementations, multiple features such as the type, security level, and number of signatories of the electronic document are extracted to form a document feature vector. These features are then XORed and the hash value is obtained to get the document feature hash value.

[0072] In some implementations, parameters of the verification environment are collected in real time, such as CPU load, memory, network latency of the user terminal, etc., to form an environment parameter vector, which is then encoded to obtain an environment parameter string.

[0073] In some implementations, features such as the user's historical signing frequency, frequently used device fingerprints, and geographical location are analyzed to form a behavioral feature vector, which is then encoded to obtain a behavioral feature string.

[0074] The first factor is obtained by performing an XOR hash calculation on the commitment value, the document feature hash value, the environment parameter string, and the behavior feature string.

[0075] By integrating document semantic features (such as contract terms and monetary values), environmental parameters (device fingerprints, IP addresses, and operating system characteristics), and user behavior data (signing trajectories and input frequency), dynamic challenge values ​​with scenario-specific characteristics are generated in real time. Encryption algorithms are used to encrypt the challenge values, and timestamps and random salt values ​​are introduced to enhance resistance to attacks. This overcomes the limitations of traditional static challenge values ​​(such as user public keys, digital certificates, and documents) which are easily leaked, and ensures that each verification is unique, resisting replay attacks and signature forgery, and achieving adaptive adjustment of verification strength.

[0076] Optionally, the method further includes:

[0077] Obtain the identity attribute information of the first user, and generate the digital identity information of the first user based on the identity attribute information. The digital identity information includes the public key, the private key, and the electronic signature of the first user.

[0078] If at least one of the first user's biometrics and geographic location is verified, the digital identity information is stored in the blockchain.

[0079] In some implementations, a user management system is built based on a decentralized digital identity framework to generate a unique and self-controllable digital identity for each user. This identity is stored using blockchain technology. The system employs an encrypted storage mechanism to generate digital identity information from identity attributes such as user identity (ID), real-name authentication information, permission level, timestamp, and historical signature records. This digital identity information is stored in the blockchain ledger using a distributed storage method. Key sensitive fields are protected using asymmetric encryption technology, and only authorized parties can decrypt and verify it using a key.

[0080] The verification system generates an asymmetric key pair, including a public key and a private key, using national cryptographic algorithms. The public key is the key element used to verify digital signatures, while the private key is used to generate the electronic signature. Once biometric and geolocation verification are completed, the user's digital identity information is stored on the blockchain.

[0081] The above method employs a distributed digital identity architecture to store users' digital identity information. Based on blockchain technology, this ensures the immutability and global uniqueness of the identity. It also includes rich attribute information (such as user ID, real-name authentication data, and permission levels) encrypted and stored in the blockchain's distributed ledger, aiming to maintain the security, integrity, and privacy of the digital identity throughout its creation and storage. This breaks through the traditional absolute control of CA institutions over user information, eliminating the single point of risk inherent in CA institutions, and making this digital identity information a reliable foundation for electronic signatures, preventing identity information from being forged, tampered with, or improperly obtained.

[0082] Optionally, the method further includes:

[0083] Upon receiving a signature request from the terminal corresponding to the first user, an electronic signature for the electronic document is generated using the first user's private key, the hash value of the electronic document, and a random number.

[0084] Let the set of multi-party electronic signatures be . ,in This indicates the parties involved in signing (such as companies, organizations, or individuals). This refers to the corresponding electronic document (such as a multi-party cooperation contract, agreement, or other electronic file). express right Electronic signature.

[0085] When the first user electronically signs an electronic document, the signature is generated using the first user's private key, the hash value of the electronic document, and a random number. Furthermore, the electronic signature may also include the first user's identity attribute information.

[0086] See Figure 2 , Figure 2 This is a flowchart of an electronic signature verification method provided in an embodiment of this application, applied to a terminal. For example... Figure 2 As shown, the method includes the following steps:

[0087] Step 201: Send a signature verification request to the server. The signature verification request includes an electronic document with electronic signature information and a commitment value. The electronic signature information includes the electronic signature of the first user on the electronic document. The commitment value is generated based on the electronic signature of the first user and a random salt value. The electronic signature of the first user is generated based on the private key of the first user.

[0088] Step 202: Receive the challenge value sent by the server in response to the signature verification request, and generate a response value based on the challenge value and the private key;

[0089] Step 203: Send the response value to the server.

[0090] Optionally, before sending the signature verification request to the server, the method further includes:

[0091] Upon obtaining the electronic document to be signed, an electronic signature for the electronic document is generated based on a pre-stored private key, the hash value of the electronic document, and a random number.

[0092] The commitment value is generated based on the electronic signature and random salt value of the electronic document.

[0093] Optionally, generating a response value based on the challenge value and the private key includes:

[0094] The response value is generated by performing dot multiplication and hash operations on the challenge value, the hash value of the electronic document, the private key, and the random salt value.

[0095] The user terminal first generates a digital signature based on the private key, the hash value of the electronic document, and a random number, and then generates a commitment value based on this digital signature and a random salt value. The electronic document containing the multi-party digital signature information and the commitment value are then submitted to the verification system for verification; that is, a signature verification request is sent to the server's verification system. The verification system only obtains this processed commitment value and cannot know the specific details of the digital signature, including the private key used to generate the signature.

[0096] The electronic signature information includes the electronic signatures of the participating signatories (including the first user) on the electronic document. The first user's electronic signature is generated based on the first user's private key and user identity information.

[0097] After obtaining the commitment value, the server encrypts the commitment value using multi-dimensional scene feature parameters to obtain the challenge value, and then sends the challenge value to the user terminal.

[0098] After receiving the challenge value, the user uses their private key and digital signature information (generated during the digital signature generation process) to generate a response value. Specifically, the user performs a series of complex dot multiplication and hash operations under elliptic curve cryptography based on the challenge value, the hash value of the electronic document, their own private key, and a random salt value to generate a compliant response value, which is then sent back to the verification system.

[0099] After receiving the response value, the verification system decrypts it using the verification public key corresponding to the user's private key to obtain a temporary signature. The final signature is then recovered using the temporary signature, the challenge value, the hash value of the electronic document, and a random salt value.

[0100] If a user's response meets the verification rules, the verification system can determine that the digital signature is valid without obtaining the specific content of the digital signature or the user's private key. This is because the user's ability to correctly generate a response value based on the challenge value probabilistically proves that the user possesses legitimate knowledge related to the digital signature (i.e., the private key), and that the digital signature meets the system's expectations.

[0101] Users generate a response value by encrypting the challenge value, document hash value, private key, and biometric data using their private key. The system only verifies the mathematical consistency between the response value and the promised value, without needing to obtain the user's private key, the original document, or biometric data throughout the process. This protocol employs a double-blind verification mechanism, combined with zero-knowledge proof technology to prevent information leakage, thus addressing the privacy risks of sensitive information transmission in traditional centralized verification models and improving data security.

[0102] As a specific embodiment of this application, a method for verifying an electronic signature is as follows: Figure 3 As shown, it includes the following steps:

[0103] The user sends a signature verification request to the verification system. The signature verification request includes an electronic document and a commitment value.

[0104] The verification system encrypts the commitment value based on the commitment value, document feature hash value, environmental parameter string, and behavioral feature string to generate a challenge value, which is then sent to the user's terminal.

[0105] The user terminal performs a series of complex dot multiplication and hash operations under elliptic curve cryptography based on the challenge value, the hash value of the electronic document, the user's own private key, and a random salt value (or entropy value) to generate a response value that meets the requirements, and then sends the response value to the verification system.

[0106] The verification system uses a public key to verify the response value. If the verification is successful (valid), the verification result and / or verification process are stored on the blockchain. If the verification fails (i.e. invalid), exception handling is performed.

[0107] Currently, electronic signature verification mainly relies on centralized Certificate Authorities (CAs). Digital certificates bind user identity and public keys, and verification requires real-time queries to the CA database to confirm certificate validity. This strong dependence on CAs poses a single point of failure. Furthermore, the verification process requires the transmission and storage of sensitive information such as user public keys, private keys, and original document text through a centralized system. Digital certificates are strongly bound to specific electronic signature systems, posing a risk of data leakage.

[0108] In this embodiment, by decoupling identity verification and signature verification, users can prove their signing authority without relying on a centralized CA institution, overcoming the risk of single point of failure in the CA system, forming a distributed supervision closed loop, and improving data credibility. Through a multi-dimensional dynamic challenge value generation mechanism that integrates document semantics, environmental parameters, and user behavior characteristics, scenario-specific challenge values ​​are generated in real time and transmitted in encrypted form, effectively resisting replay attacks and signature forgery. The verification protocol based on zero-knowledge proofs only verifies mathematical relationships without obtaining user private keys, document content, or biometric data. Sensitive information is transmitted in encrypted form throughout the process, significantly reducing the risk of privacy leakage.

[0109] The aforementioned solution can be applied to multiple sectors, including the financial industry (electronic contracts for banks, securities transaction verification, and financial audit evidence storage), the enterprise market (contract management and OA approval), government affairs (document signing and public service authentication), and the e-commerce ecosystem (order verification and electronic invoices), improving the efficiency and security of multi-party collaborative signing. It can also provide financial institutions with intelligent risk control capabilities, such as real-time identification of electronic contract fraud, effectively mitigating data leakage risks in sensitive scenarios such as financial contracts and medical records.

[0110] See Figure 4 , Figure 4 This is a schematic diagram of the structure of an electronic signature verification device provided in an embodiment of this application, as shown below. Figure 4 As shown, the electronic signature verification device 400, applied to a server, includes:

[0111] The first receiving module 401 is used to receive a signature verification request sent by the terminal. The signature verification request includes an electronic document with electronic signature information and a commitment value. The electronic signature information includes the electronic signature of the first user on the electronic document. The commitment value is generated based on the electronic signature of the first user and a random salt value. The electronic signature of the first user is generated based on the private key of the first user.

[0112] The first generation module 402 is used to encrypt the commitment value according to the pre-acquired scene feature parameters to generate a challenge value, and send the challenge value to the terminal. The scene feature parameters are used to characterize the features of the scene in which the first user performs signature verification.

[0113] The second receiving module 403 is used to receive the response value sent by the terminal in response to the challenge value, and to decrypt the response value using the public key corresponding to the private key to obtain the first signature;

[0114] The calculation module 404 is used to calculate the signature result using the first signature, the challenge value, the hash value of the electronic document, and the random salt value;

[0115] The determination module 405 is used to determine the signature verification result based on the matching degree between the signature result and the electronic signature information.

[0116] Optionally, the scene feature parameters include at least one of the following: features of the electronic document, environmental parameters, and behavioral features;

[0117] The first generation module is specifically used for:

[0118] The commitment value is XORed with at least one of the features of the electronic document, the environmental parameters, and the behavioral features to obtain a first factor, and the commitment value is encrypted using the first factor to generate the challenge value.

[0119] Optionally, the characteristics of the electronic document include at least one of the following: the type of the electronic document, the security classification, and the number of signatories;

[0120] The environmental parameters include at least one of the terminal's CPU load, memory, and network latency;

[0121] The behavioral characteristics include at least one of the following: the first user's historical signature frequency, the fingerprints of the terminal devices used in the past, and the geographical location.

[0122] Optionally, the device further includes:

[0123] The third acquisition module is used to acquire the identity attribute information of the first user and generate digital identity information of the first user based on the identity attribute information. The digital identity information includes the public key, the private key and the electronic signature of the first user.

[0124] A storage module is used to store the digital identity information to the blockchain if at least one of the first user's biometrics and geographical location is verified.

[0125] Optionally, the device further includes:

[0126] The second generation module is used to generate an electronic signature for the electronic document using the first user's private key, the hash value of the electronic document, and a random number when a signature request is received from the terminal corresponding to the first user.

[0127] Electronic signature verification devices can achieve Figure 1 The various processes implemented in the method embodiments can achieve the same technical effect, and will not be described again here to avoid repetition.

[0128] It should be noted that the electronic device provided in this application embodiment is capable of executing the above-described electronic signature verification device. Therefore, all implementation methods in the above-described electronic signature verification method embodiments are applicable to this electronic device and can achieve the same or similar beneficial effects. To avoid repetition, this embodiment will not elaborate further.

[0129] See Figure 5 , Figure 5 This is a schematic diagram of the structure of an electronic signature verification device provided in an embodiment of this application, as shown below. Figure 5 As shown, the electronic signature verification device 500, applied to a terminal, includes:

[0130] The first sending module 501 is used to send a signature verification request to the server. The signature verification request includes an electronic document with electronic signature information and a commitment value. The electronic signature information includes the electronic signature of the first user on the electronic document. The commitment value is generated based on the electronic signature of the first user and a random salt value. The electronic signature of the first user is generated based on the private key of the first user.

[0131] The receiving module 502 is used to receive the challenge value sent by the server in response to the signature verification request, and generate a response value based on the challenge value and the private key;

[0132] The second sending module 503 is used to send the response value to the server.

[0133] Optionally, the device further includes:

[0134] The first generation module is used to generate an electronic signature for the electronic document based on a pre-stored private key, the hash value of the electronic document, and a random number when the electronic document to be signed is obtained.

[0135] The second generation module is used to generate the commitment value based on the electronic signature and random salt value of the electronic document.

[0136] Optionally, the receiving module is specifically used for:

[0137] The response value is generated by performing dot multiplication and hash operations on the challenge value, the hash value of the electronic document, the private key, and the random salt value.

[0138] Electronic signature verification devices can achieve Figure 2 The various processes implemented in the method embodiments can achieve the same technical effect, and will not be described again here to avoid repetition.

[0139] It should be noted that the electronic device provided in this application embodiment is capable of executing the above-described electronic signature verification device. Therefore, all implementation methods in the above-described electronic signature verification method embodiments are applicable to this electronic device and can achieve the same or similar beneficial effects. To avoid repetition, this embodiment will not elaborate further.

[0140] See Figure 6 As shown in the figure, this application embodiment also provides an electronic device, including a bus 601, a transceiver 602, an antenna 603, a bus interface 604, a processor 605, and a memory 606.

[0141] Processor 605 is configured to: receive a signature verification request sent by a terminal, the signature verification request including an electronic document with electronic signature information and a commitment value, the electronic signature information including an electronic signature of a first user on the electronic document, the commitment value being generated based on the first user's electronic signature and a random salt value, the first user's electronic signature being generated based on the first user's private key;

[0142] The commitment value is encrypted to generate a challenge value based on the pre-acquired scenario feature parameters, and the challenge value is sent to the terminal. The scenario feature parameters are used to characterize the features of the scenario in which the first user performs signature verification.

[0143] The system receives a response value sent by the terminal in response to the challenge value, and decrypts the response value using the public key corresponding to the private key to obtain a first signature.

[0144] The signature result is calculated using the first signature, the challenge value, the hash value of the electronic document, and the random salt value.

[0145] The verification result is determined based on the degree of matching between the signature result and the electronic signature information.

[0146] exist Figure 6In this document, a bus architecture (represented by bus 601) is used. Bus 601 may include any number of interconnected buses and bridges, linking various circuits including one or more processors represented by processor 605 and memory represented by memory 606. Bus 601 may also link various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and therefore will not be described further herein. Bus interface 604 provides an interface between bus 601 and transceiver 602. Transceiver 602 may be a single element or multiple elements, such as multiple receivers and transmitters, providing a unit for communicating with various other devices over a transmission medium. Data processed by processor 605 is transmitted over a wireless medium via antenna 603, which further receives data and transmits data to processor 605.

[0147] Processor 605 manages bus 601 and general processing, and also provides various functions, including timing, peripheral interface, voltage regulation, power management, and other control functions. Memory 606 can be used to store data used by processor 605 during operation.

[0148] Alternatively, the processor 605 may be a central processing unit (CPU), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or a complex programmable logic device (CPLD).

[0149] Optionally, the scene feature parameters include at least one of the following: features of the electronic document, environmental parameters, and behavioral features;

[0150] The processor 605 performs the step of encrypting the commitment value and generating a challenge value based on the pre-acquired scene feature parameters, including:

[0151] The commitment value is XORed with at least one of the features of the electronic document, the environmental parameters, and the behavioral features to obtain a first factor, and the commitment value is encrypted using the first factor to generate the challenge value.

[0152] Optionally, the characteristics of the electronic document include at least one of the following: the type of the electronic document, the security classification, and the number of signatories;

[0153] The environmental parameters include at least one of the terminal's CPU load, memory, and network latency;

[0154] The behavioral characteristics include at least one of the following: the first user's historical signature frequency, the fingerprints of the terminal devices used in the past, and the geographical location.

[0155] Optionally, the processor 605 is also used to perform:

[0156] Obtain the identity attribute information of the first user, and generate the digital identity information of the first user based on the identity attribute information. The digital identity information includes the public key, the private key, and the electronic signature of the first user.

[0157] If at least one of the first user's biometrics and geographic location is verified, the digital identity information is stored in the blockchain.

[0158] Optionally, the processor 605 is also used to perform:

[0159] Upon receiving a signature request from the terminal corresponding to the first user, an electronic signature for the electronic document is generated using the first user's private key, the hash value of the electronic document, and a random number.

[0160] It should be noted that the electronic device provided in this application embodiment is a device capable of executing the above-described electronic signature verification method. Therefore, all implementation methods in the above-described electronic signature verification method embodiments are applicable to this electronic device and can achieve the same or similar beneficial effects. To avoid repetition, this embodiment will not elaborate further.

[0161] See Figure 7 As shown in the figure, this application embodiment also provides an electronic device, including a bus 701, a transceiver 702, an antenna 703, a bus interface 704, a processor 705, and a memory 706.

[0162] Processor 705 is configured to: send a signature verification request to a server, the signature verification request including an electronic document with electronic signature information and a commitment value, the electronic signature information including an electronic signature of a first user on the electronic document, the commitment value being generated based on the first user's electronic signature and a random salt value, the first user's electronic signature being generated based on the first user's private key;

[0163] Receive the challenge value sent by the server in response to the signature verification request, and generate a response value based on the challenge value and the private key;

[0164] Send the response value to the server.

[0165] exist Figure 7In this document, a bus architecture (represented by bus 701) is used. Bus 701 can include any number of interconnected buses and bridges, linking various circuits including one or more processors represented by processor 705 and memory represented by memory 706. Bus 701 can also link various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and therefore will not be described further herein. Bus interface 704 provides an interface between bus 701 and transceiver 702. Transceiver 702 can be a single element or multiple elements, such as multiple receivers and transmitters, providing a unit for communicating with various other devices over a transmission medium. Data processed by processor 705 is transmitted over a wireless medium via antenna 703, which further receives data and transmits data to processor 705.

[0166] Processor 705 manages bus 701 and general processing, and also provides various functions, including timing, peripheral interface, voltage regulation, power management, and other control functions. Memory 706 can be used to store data used by processor 705 during operation.

[0167] Alternatively, the processor 705 may be a central processing unit (CPU), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or a complex programmable logic device (CPLD).

[0168] Optionally, the processor 705 is further configured to perform: upon obtaining the electronic document to be signed, generating an electronic signature for the electronic document based on a pre-stored private key, the hash value of the electronic document, and a random number;

[0169] The commitment value is generated based on the electronic signature and random salt value of the electronic document.

[0170] Optionally, the processor 705 performs the generation of a response value based on the challenge value and the private key, including:

[0171] The response value is generated by performing dot multiplication and hash operations on the challenge value, the hash value of the electronic document, the private key, and the random salt value.

[0172] It should be noted that the electronic device provided in this application embodiment is a device capable of executing the above-described electronic signature verification method. Therefore, all implementation methods in the above-described electronic signature verification method embodiments are applicable to this electronic device and can achieve the same or similar beneficial effects. To avoid repetition, this embodiment will not elaborate further.

[0173] This application also provides a computer-readable storage medium storing a computer program. When executed by a processor, this computer program implements the various processes of the above-described electronic signature verification method embodiments and achieves the same technical effects. To avoid repetition, it will not be described again here. The computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, etc.

[0174] This application also provides a computer program product, including computer instructions, which, when executed by a processor, implement the above-described... Figure 1 The various processes of the method embodiments shown can achieve the same technical effect, and will not be described again here to avoid repetition.

[0175] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0176] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0177] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.

Claims

1. An electronic signature verification method characterized by comprising: Applied to a server, the method includes: The terminal receives a signature verification request, which includes an electronic document with electronic signature information and a commitment value. The electronic signature information includes the electronic signature of the first user on the electronic document. The commitment value is generated based on the first user's electronic signature and a random salt value. The first user's electronic signature is generated based on the first user's private key. The commitment value is encrypted to generate a challenge value based on the pre-acquired scenario feature parameters, and the challenge value is sent to the terminal. The scenario feature parameters are used to characterize the features of the scenario in which the first user performs signature verification. The system receives a response value sent by the terminal in response to the challenge value, and decrypts the response value using the public key corresponding to the private key to obtain a first signature. The signature result is calculated using the first signature, the challenge value, the hash value of the electronic document, and the random salt value. The verification result is determined based on the degree of matching between the signature result and the electronic signature information.

2. The method of claim 1, wherein, The scene feature parameters include at least one of the following: the features of the electronic document, environmental parameters, and behavioral features; The step of encrypting the commitment value to generate a challenge value based on pre-acquired scene feature parameters includes: The commitment value is XORed with at least one of the features of the electronic document, the environmental parameters, and the behavioral features to obtain a first factor, and the commitment value is encrypted using the first factor to generate the challenge value.

3. The method of claim 2, wherein, The characteristics of the electronic document include at least one of the following: the type of the electronic document, the security classification, and the number of signatories; The environmental parameters include at least one of the terminal's CPU load, memory, and network latency; The behavioral characteristics include at least one of the following: the first user's historical signature frequency, the fingerprints of the terminal devices used in the past, and the geographical location.

4. The method according to any one of claims 1 to 3, characterized in that, The method further includes: Obtain the identity attribute information of the first user, and generate the digital identity information of the first user based on the identity attribute information. The digital identity information includes the public key, the private key, and the electronic signature of the first user. If at least one of the first user's biometrics and geographic location is verified, the digital identity information is stored in the blockchain.

5. The method according to any one of claims 1 to 3, characterized in that, The method further includes: Upon receiving a signature request from the terminal corresponding to the first user, an electronic signature for the electronic document is generated using the first user's private key, the hash value of the electronic document, and a random number.

6. An electronic signature verification method characterized by comprising: Applied to a terminal, the method includes: Send a signature verification request to the server. The signature verification request includes an electronic document with electronic signature information and a commitment value. The electronic signature information includes the electronic signature of the first user on the electronic document. The commitment value is generated based on the first user's electronic signature and a random salt value. The first user's electronic signature is generated based on the first user's private key. Receive the challenge value sent by the server in response to the signature verification request, and generate a response value based on the challenge value and the private key; Send the response value to the server.

7. The method of claim 6, wherein, Before sending the signature verification request to the server, the method further includes: Upon obtaining the electronic document to be signed, an electronic signature for the electronic document is generated based on a pre-stored private key, the hash value of the electronic document, and a random number. The commitment value is generated based on the electronic signature and random salt value of the electronic document.

8. The method of claim 6, wherein, The generation of a response value based on the challenge value and the private key includes: The response value is generated by performing dot multiplication and hash operations on the challenge value, the hash value of the electronic document, the private key, and the random salt value.

9. An electronic signature verification device, characterized by comprising: Applied to a server, the device includes: The first receiving module is used to receive a signature verification request sent by the terminal. The signature verification request includes an electronic document with electronic signature information and a commitment value. The electronic signature information includes the electronic signature of the first user on the electronic document. The commitment value is generated based on the electronic signature of the first user and a random salt value. The electronic signature of the first user is generated based on the private key of the first user. The first generation module is used to encrypt the commitment value to generate a challenge value based on the pre-acquired scene feature parameters, and send the challenge value to the terminal. The scene feature parameters are used to characterize the features of the scene in which the first user performs signature verification. The second receiving module is used to receive the response value sent by the terminal in response to the challenge value, and to decrypt the response value using the public key corresponding to the private key to obtain the first signature; The calculation module is used to calculate the signature result using the first signature, the challenge value, the hash value of the electronic document, and the random salt value; The determination module is used to determine the signature verification result based on the matching degree between the signature result and the electronic signature information.

10. An electronic signature verification device, characterized by comprising: Applied to a terminal, the device includes: The first sending module is used to send a signature verification request to the server. The signature verification request includes an electronic document with electronic signature information and a commitment value. The electronic signature information includes the electronic signature of the first user on the electronic document. The commitment value is generated based on the electronic signature of the first user and a random salt value. The electronic signature of the first user is generated based on the private key of the first user. The receiving module is configured to receive the challenge value sent by the server in response to the signature verification request, and generate a response value based on the challenge value and the private key; The second sending module is used to send the response value to the server.

11. An electronic device, comprising: include: A processor, a memory, and a program stored in the memory and executable on the processor, wherein the program, when executed by the processor, implements the steps of the electronic signature verification method as described in any one of claims 1 to 5, or implements the steps of the electronic signature verification method as described in any one of claims 6 to 8.

12. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the electronic signature verification method as described in any one of claims 1 to 5, or implements the steps of the electronic signature verification method as described in any one of claims 6 to 8.

13. A computer program product, characterised in that, It includes computer instructions that, when executed by a processor, implement the steps of the electronic signature verification method as described in any one of claims 1 to 5, or implement the steps of the electronic signature verification method as described in any one of claims 6 to 8.

Images