Two-factor signature and verification system and method based on PKI and digital penmanship

Abstract

The application discloses a kind of two-factor signature and verification system and method based on PKI and digital handwriting, it is related to information security technical field;System includes registration terminal, signing terminal, PKI certificate system, digital handwriting system and verification terminal;The registration terminal, signing terminal, verification terminal are respectively connected with PKI certificate system and digital handwriting system by network communication;Data interaction is realized between PKI certificate system and digital handwriting system by standardization interface, for the feature identification transfer and association of handwriting data packet;The application is applicable to reliable electronic signature of electronic contract, identity authentication and willingness confirmation in e-government, and online signing in financial business and the like scene.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to a two-factor signature and verification system and method based on PKI and digital handwriting. Background Technology

[0002] Public Key Infrastructure (PKI) is currently the most mature electronic authentication technology system internationally, consisting of core components such as Certificate Authorities (CAs), Registration Authorities (RAs), Certificate Repositories (LDAP), and Certificate Revocation Lists (CRLs). The PKI system binds a user's real identity to a public key through digital certificates, relying on asymmetric cryptographic algorithms to achieve data confidentiality, integrity, authentication, and non-repudiation. After years of development, PKI technology has been widely applied in e-government, e-commerce, online banking, electronic contracts, and other fields, forming a comprehensive system of technical standards and legal regulations.

[0003] In terms of technological evolution, PKI systems have continuously moved towards cloud-based and mobile deployments, resulting in new certificate formats such as cloud certificates and mobile certificates. Simultaneously, the widespread application of national cryptographic algorithms such as SM2 / SM3 / SM4 has further enhanced the security of the PKI system in terms of independent controllability. However, the essence of the PKI system remains an authentication model centered on "what you possess" (private key) and "what you know" (PIN code), which has limitations in expressing and recording signing intent. Specifically, the shortcomings of the PKI certificate system in recording certificate application intent and expressing signing intent are manifested in the following ways:

[0004] (1) Lack of substantive record of intent in the certificate application process; In the traditional PKI certificate issuance process, users can obtain a digital certificate by submitting identity information and passing real-name authentication, but the user's true intent in the certificate application process lacks effective record and evidence. CA institutions cannot prove that users apply for certificates with full knowledge and on a voluntary basis, which may become a difficulty in providing evidence in the event of legal disputes.

[0005] (2) The signing process lacks a direct mechanism for expressing intent; although PKI digital signatures can technically prove that "the private key signed the document", they cannot directly prove the signer's true intent at the time - the private key may be stolen by others, coerced into signing, or accessed without the user's knowledge. The input of the PIN code can only prove that "the person who knows the password" is operating, but cannot prove that "the person himself" completed the signing in a voluntary state.

[0006] (3) The separation between certificates and biometrics; In the existing PKI certificate system, there is a lack of standardized binding mechanism between the certificate and the holder's biometrics (fingerprints, handwriting, face, etc.). Certificate verification can only confirm that "the certificate is valid and the private key holder has performed the signing operation", but cannot confirm "whether the operator is the certificate holder and has expressed the true intention".

[0007] (4) Lack of a complete chain of evidence for signing behavior; PKI digital signatures can guarantee the integrity of documents and the non-repudiation of signatures, but they lack the means to record and preserve contextual information such as environment, state and intention at the time of signing, making it difficult to form a complete chain of evidence from identity authentication to intention confirmation to signing operation.

[0008] Digital handwriting technology is a rapidly developing biometric identification technology in recent years. Unlike traditional static handwriting image recognition, digital handwriting technology collects dynamic behavioral characteristics of the signer during the writing process—including multi-dimensional behavioral feature information such as strokes, stroke order, pen pressure, pen speed, starting point, ending point, and signing time—forming a data package. AI recognition algorithms are then used to perform forward and reverse comparisons of the signed handwriting, effectively identifying the signer's identity.

[0009] Digital handwriting technology is currently applied in fields such as law enforcement, banking, and insurance. Its core advantage lies in combining identity verification and confirmation of intent—the act of writing itself is a direct expression of the intention to sign. In recent years, deep learning-based handwriting feature extraction and recognition models have matured, and recognition accuracy has continued to improve. However, digital handwriting technology still has significant shortcomings in its integration with electronic authentication and cryptographic technologies; the specific deficiencies of handwritten handwriting systems in electronic authentication and cryptographic applications are as follows:

[0010] (1) Lack of systematic identity authentication support; Although handwriting systems have unique advantages in handwriting recognition, their identity authentication usually relies only on the comparison of handwriting biometrics, lacks system-level connection with the legal identity authentication system, and is difficult to independently meet all the requirements for reliable electronic signatures.

[0011] (2) Lack of security protection through cryptographic technology; handwritten handwriting data lacks PKI-based digital signature protection during collection, transmission, and storage, making it difficult to ensure data integrity and authenticity at the cryptographic level. Storage of handwriting feature templates poses a risk of privacy leakage.

[0012] (3) Lack of deep integration with application scenarios; the connection between handwriting recognition results and specific signed documents lacks cryptographic mechanism solidification, making it difficult to form a complete and verifiable chain of evidence.

[0013] (4) There is a lack of standardized mechanism for binding handwriting features with user identity; handwriting feature data packets are independent of the user's legal digital identity (such as digital certificate), making it difficult to be uniformly identified and verified in cross-system and cross-platform scenarios. Summary of the Invention

[0014] To address the problems existing in the prior art, the purpose of this invention is to provide a two-factor signature and verification system and method based on PKI and digital handwriting. This invention is applicable to scenarios such as reliable electronic signatures for electronic contracts, identity authentication and intent confirmation in e-government, and online signing in financial transactions.

[0015] To achieve the above objectives, the technical solution adopted by the present invention is: a two-factor signature and verification system based on PKI and digital handwriting, comprising: a registration terminal, a signing terminal, a PKI certificate system, a digital handwriting system, and a verification terminal; the registration terminal, the signing terminal, and the verification terminal are respectively connected to the PKI certificate system and the digital handwriting system via a network; the PKI certificate system and the digital handwriting system interact with each other through a standardized interface for the transmission and association of feature identifiers of handwriting data packets.

[0016] This invention also provides a two-factor signature and verification method based on PKI and digital handwriting, implemented using the two-factor signature and verification system based on PKI and digital handwriting as described above. The method includes:

[0017] Registration Phase: User identity is verified. After verification, the user writes a first signature and a second signature for handwriting verification. The first signature expresses the signer's intention, and the second signature identifies the signer. The digital handwriting system generates unique identifiers for the first and second handwriting data packets: bjID1 and bjID2. The registration terminal concatenates the user's identity ID, certificate PIN code certPIN, bjID1, and bjID2, calculates the hash value, and generates the private key activation data userKeyAC. The certificate issuance system issues a digital certificate to the user and binds the second handwriting data packet to the digital certificate.

[0018] Signing Phase: When a user initiates a signing request, the signing terminal completes identity authentication. The user writes the first and second signature content on the signing terminal. The digital handwriting system compares and identifies the handwriting with the handwriting model sampled during the registration phase. After successful comparison, the user enters the certificate PIN code for PIN verification, recalculates the hash value to obtain userKeyAC', and compares userKeyAC' with the userKeyAC saved during the registration phase. After successful comparison, the user's certificate private key is activated to digitally sign the document, and the handwriting image is attached to the document to form an electronically signed document.

[0019] Verification phase: The electronically signed document is sequentially verified by PKI digital signature, digital certificate and digital handwriting comparison. The document signature is confirmed to be valid after all three verifications are passed.

[0020] As a further improvement of the present invention, the user identity verification during the registration phase is specifically performed as follows:

[0021] Users upload their personal real-name identity information to the RA certificate registration system of the PKI certificate system through the registration terminal. The RA certificate registration system verifies the authenticity of the user's identity through real-name authentication and forces the user to read the digital certificate service agreement through SMS, email or audio and video recording.

[0022] As a further improvement of the present invention, during the registration stage, the digital handwriting biometric data includes at least one multidimensional dynamic feature among pen pressure, pen speed, pen sequence, starting stroke and ending stroke; the digital handwriting system constructs a digital handwriting recognition model based on the collected digital handwriting biometric data for handwriting comparison and recognition in the subsequent signing stage.

[0023] As a further improvement of the present invention, during the registration phase, the certificate issuance system issues digital certificates to users as follows:

[0024] The registered terminal uses the public key of the KMS key management system to encrypt userKeyAC, generating ciphertext enc-userKeyAC for activation data, and then transmits the user's name, ID number, and enc-userKeyAC to the KMS key management system. The KMS key management system decrypts enc-userKeyAC using its own private key to obtain userKeyAC and saves it to the database. The KMS key management system generates a signature key pair and a Certificate Request (CSR) for the user, sets userKeyAC as the activation data for the user's signature private key, and sends the CSR to the CA certificate issuance system of the PKI certificate system. The CA certificate issuance system issues a digital certificate for the user.

[0025] As a further improvement of the present invention, binding the handwriting data package with the digital certificate during the registration phase specifically includes:

[0026] Write bjID2 into a custom extension of the digital certificate to achieve a permanent, structured binding between the second handwriting data packet and the digital certificate;

[0027] Alternatively, the hash value of the second handwriting data packet can be stored on the blockchain as evidence, while the second handwriting data packet itself is stored in a distributed manner in IPFS or a decentralized storage system; the certificate extension stores the unique identifier bjID2 of the second handwriting data packet and the blockchain evidence storage transaction hash TxHash.

[0028] As a further improvement to the present invention, during the signing stage, the user enters a certificate PIN code for PIN code verification as follows:

[0029] The signing terminal concatenates the user's identity ID, certPIN, bjID1, and bjID2, and calculates its SM3 hash value to obtain userKeyAC'. The signing terminal also calculates the SM3 hash value of the PDF document to be signed to obtain pdfHASH. The signing terminal uses the public key of the KMS key management system to encrypt userKeyAC' and pdfHASH, generating ciphertext enc-userKeyAC' and enc-pdfHASH, and then transmits the user's name, ID number, enc-userKeyAC', and enc-pdfHASH to the KMS key management system. The KMS key management system uses its own private key to decrypt enc-userKeyAC' and enc-pdfHASH to obtain userKeyAC' and pdfHASH, and compares userKeyAC' with the userKeyAC stored in the database. If they are equal, the verification is successful.

[0030] As a further improvement to the present invention, during the signing stage, the handwriting image is attached to the document to form an electronically signed document, specifically as follows:

[0031] The KMS key management system activates the user certificate private key and uses it to encrypt pdfHASH, generating a signature value (SignValue). The SignValue is then returned to the signing terminal. The signing terminal attaches a handwritten image (hwPNG) of the individual's name to the PDF document, creating a PDF electronic signature document containing the digital signature (SignValue) and a visual handwritten seal. The signing process is then complete.

[0032] As a further improvement of the present invention, the triple verification in the verification stage is as follows:

[0033] PKI Digital Signature Verification: The verifier extracts the digital signature value from the electronically signed document, decrypts and verifies the digital signature using the public key of the signer's certificate, and simultaneously recalculates the document's hash value and compares it with the hash value in the signature;

[0034] Digital certificate verification: The verifier verifies the validity of the signer's digital certificate, including certificate chain verification, validity period verification, and Certificate Revocation List (CRL) lookup;

[0035] Digital handwriting comparison and verification: After the digital certificate verification is successful, the verifier reads the unique identifier bjID2 of the second handwriting data packet, reads the handwriting image from the electronic signature document, and sends bjID2 and the handwriting image to the digital handwriting system. The digital handwriting system calls the constructed handwriting model and compares the personal handwriting image with the handwriting model corresponding to bjID2 saved during registration.

[0036] As a further improvement to the present invention, it also includes:

[0037] Users are subjected to facial or fingerprint recognition. Facial or fingerprint information is collected simultaneously during the registration phase. During the signing phase, facial liveness detection or fingerprint comparison is added to the handwriting verification and PIN code verification.

[0038] The beneficial effects of this invention are:

[0039] 1. Enhanced Legal Proof of Electronic Signatures: This invention employs a two-factor authentication mechanism of "certificate verification (identity) and handwriting verification (behavior / intention)," enabling electronic signatures to simultaneously possess cryptographic non-repudiation and biometric proof of the signatory's identity. The signing act simultaneously satisfies: the electronic signature creation data belongs exclusively to the electronic signatory (certificate and handwriting dual-factor control); the signing is controlled solely by the electronic signatory (PIN code and real-time handwriting dual verification); any alteration to the electronic signature after signing can be detected (PKI digital signature); and any alteration to the content and form of the data message after signing can be detected (PKI digital signature and document hash).

[0040] 2. This invention addresses the shortcomings of PKI certificate systems in expressing signing intent: By introducing handwriting sampling during the certificate application process, permanently binding the handwriting data packet ID to the certificate extension, and requiring real-time handwriting confirmation during the signing process, this invention injects "proof of intent" capability into the PKI certificate system. The act of handwriting during signing is itself a direct expression of "agreement" to the signed content, and this expression is collected, modeled, and compared with the registration sample in real time, forming irrefutable evidence of intent.

[0041] 3. It overcomes the shortcomings of digital handwriting systems in cryptographic applications: By writing the handwriting data packet ID into the digital certificate extension, using the handwriting data packet ID as a hash derivation factor to protect the private key activation data, and using digital signatures to protect signed documents, this invention provides cryptographic-level security for digital handwriting technology. Handwriting data no longer exists in isolation but is deeply bound to the user's legal digital identity (certificate), enabling verifiable and traceable handwriting recognition results.

[0042] 4. A complete chain of evidence for signing has been constructed: from identity authentication, handwriting sampling and certificate issuance during registration, to identity authentication, handwriting verification, PIN code verification, digital signature and handwriting image attachment during signing, and then to signature verification, certificate verification and handwriting comparison during verification, this invention constructs a complete chain of evidence covering the entire lifecycle of "identity registration, certificate issuance, signing operation and verification traceability", providing full technical support for judicial appraisal and dispute arbitration.

[0043] 5. Balancing security and user experience: Users only need to write their name and "agree" and enter a PIN code when signing, following the traditional paper-based signing process without any additional complex steps. The backend automatically completes a series of security operations, including handwriting collection, AI recognition and comparison, PIN code verification, and digital signature, ensuring high security while maintaining a good user experience. Attached Figure Description

[0044] Figure 1 This is a system architecture diagram of an embodiment of the present invention. Detailed Implementation

[0045] The embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0046] Example

[0047] This embodiment constructs a complete technical system encompassing "handwriting sample modeling during registration, certificate extension binding, two-factor authentication during signing, and triple verification during verification," deeply integrating the PKI certificate authentication system with the digital handwriting biometric recognition system at the system level. It enhances the evidentiary value of PKI in terms of certificate application and signing intent, and expands the application of digital handwriting technology with electronic authentication and cryptography, integrating identity, password, handwriting, and intent into a unified whole. When used for electronic signatures, this effectively enhances the authenticity, integrity, and non-repudiation of user signing behavior.

[0048] like Figure 1As shown, a two-factor signature and verification system based on PKI and digital handwriting mainly includes a registration terminal, a signing terminal, a PKI certificate system, a digital handwriting system, and a verification terminal. The registration terminal and signing terminal can be electronic devices with touch writing capabilities, such as smartphones, tablets, laptops, or desktop computers. The PKI certificate system further includes a Certificate Authority (CA), a Certificate Registration Authority (RA), a Certificate Delegation Authority (LDAP), a Certificate Revocation List (CRL), and a Key Management System (KMS). The digital handwriting system further includes a handwriting acquisition module, a handwriting feature extraction and modeling module, a handwriting AI recognition model library, and a handwriting data packet storage module.

[0049] The registration terminal, signing terminal, and verification terminal communicate with the PKI certificate system and the digital handwriting system via the network, respectively. The PKI certificate system and the digital handwriting system exchange data through a standardized interface for the transmission and association of feature identifiers for handwriting data packets.

[0050] This embodiment also provides a two-factor signature and verification method based on PKI and digital handwriting, including:

[0051] (1) Registration stage: Two-factor authentication and certificate issuance. During the registration stage, users complete the entire process of identity authentication, handwriting sampling and certificate issuance, which includes the following steps:

[0052] Step S101: The user uploads their personal real-name identity information (including name and ID number) to the RA system through the registration terminal.

[0053] Step S102: The RA system verifies the authenticity of the user's identity through real-name authentication.

[0054] Step S103: The RA system forces users to read the digital certificate service agreement via SMS, email, or dual audio and video recording.

[0055] Step S104: The user writes the word "agree" and their name in the handwriting collection module of the registration terminal to express their true intention to apply for the certificate. The digital handwriting system collects samples of these two handwritings.

[0056] Step S105: The digital handwriting system analyzes and models the collected handwriting biometric data (including multi-dimensional dynamic features such as pen pressure, pen speed, pen sequence, starting stroke, and ending stroke) to construct a digital handwriting artificial intelligence recognition model for handwriting recognition and identification in the subsequent document signing process.

[0057] Step S106: The digital handwriting system generates unique identifiers for two digital handwriting biometric data packets—bjID1 (corresponding to the "agree" handwriting) and bjID2 (corresponding to the "personal name" handwriting).

[0058] Step S107: The digital handwriting system returns bjID1 and bjID2 to the registration terminal.

[0059] Step S108: The user sets the digital certificate PIN code (certPIN) on the registration terminal.

[0060] Step S109: The registration terminal concatenates the user's ID number, certPIN, bjID1, and bjID2, calculates its SM3 hash value, and generates the activation data of the user's digital certificate private key - userKeyAC, userKeyAC=SM3(ID||certPIN||bjID1||bjID2).

[0061] Step S110: The registered terminal calls the public key of the KMS system to encrypt the above userKeyAC, generates the ciphertext enc-userKeyAC of the activation data, and transmits the user's name, ID number, and enc-userKeyAC to the KMS system.

[0062] Step S111: The KMS system uses its own private key to decrypt enc-userKeyAC to obtain userKeyAC, and saves it to the database.

[0063] Step S112: The KMS system generates a signing key pair and a Certificate Request (CSR) for the user, sets userKeyAC as the activation data of the user's signing private key, and sends the Certificate Request (CSR) to the CA system.

[0064] Step S113: The CA system issues a digital certificate to the user and writes bjID2 into the certificate's custom extensions, thereby achieving a permanent structured binding between the digital handwriting data package containing the user's "personal name" and the digital certificate.

[0065] Step S114: The CA system publishes the user's digital certificate to the LDAP system and returns it to the registration terminal, completing the registration.

[0066] (2) Signing stage: Two-factor authentication and electronic signature. During the signing stage, users complete the entire process of identity authentication, handwriting verification, PIN code verification and electronic signature, which includes the following steps:

[0067] Step S201: The user initiates a document (PDF) signing request, and the signing terminal prompts the user to complete identity authentication.

[0068] Step S202: The user enters their name and ID number to complete the two-factor authentication.

[0069] Step S203: The user writes the word "agree" on the touch screen of the signing terminal, and the digital handwriting system collects the handwriting biometric data in real time during the writing process.

[0070] Step S204: The user writes their name on the touch screen of the signing terminal, and the digital handwriting system collects the handwriting biometric data in real time during the writing process.

[0071] Step S205: The digital handwriting system calls the constructed digital handwriting AI recognition model to compare and recognize the "agree" handwriting collected in step S203 with the handwriting model corresponding to bjID1 sampled during registration.

[0072] Step S206: The digital handwriting system calls the constructed digital handwriting AI recognition model to compare and recognize the personal name handwriting collected in step S204 with the handwriting model corresponding to bjID2 sampled during registration.

[0073] Step S207: Determine if handwriting recognition passes – If both handwriting recognitions pass, then send bjID1, bjID2, and the handwriting image (hwPNG) of the individual's name back to the signing terminal and proceed to step S208; if any one fails, the signing fails and the process terminates.

[0074] Step S208: The user enters the digital certificate PIN code (certPIN).

[0075] Step S209: The signing terminal concatenates the user's ID number, certPIN, bjID1, and bjID2, calculates its SM3 hash value, and records it as userKeyAC'=SM3(ID||certPIN||bjID1||bjID2).

[0076] Step S210: The signing terminal calculates the SM3 hash value of the PDF document to be signed, denoted as pdfHASH=SM3(PDF).

[0077] Step S211: The signing terminal calls the public key of the KMS system to encrypt the above userKeyAC' and pdfHASH, generating ciphertext enc-userKeyAC' and enc-pdfHASH, and then transmits the user's name, ID number, enc-userKeyAC', and enc-pdfHASH to the KMS system.

[0078] Step S212: The KMS system uses its own private key to decrypt enc-userKeyAC' and enc-pdfHASH to obtain userKeyAC' and pdfHASH. It compares userKeyAC' with userKeyAC stored in the database. If they are equal, proceed to step S213; otherwise, the signing fails and the process terminates.

[0079] Step S213: KMS system activates user certificate private key.

[0080] Step S214: The KMS system calls the user certificate private key to encrypt pdfHASH, generate a signature value SignValue, and returns SignValue to the signing terminal.

[0081] Step S215: The signing terminal attaches the hwPNG image as a personal signature to the PDF document, synthesizing a PDF electronic signature document containing the digital signature SignValue and a visual handwriting signature, and the signing is completed.

[0082] (3) Verification Phase: Triple verification. The complete process of the verifier performing triple verification on the signed document includes the following steps:

[0083] Step S301: The verifier obtains the PDF electronically signed document to be verified.

[0084] Step S302: First verification – PKI digital signature verification. The verifier extracts the digital signature value from the PDF document, decrypts and verifies the digital signature using the public key of the signer's certificate, and simultaneously recalculates the document's hash value and compares it with the hash value in the signature.

[0085] Step S303: Determine whether the PKI digital signature verification is successful—if successful, proceed to step S304; if unsuccessful, the verification fails, the document has been tampered with, or the signature is invalid.

[0086] Step S304: Second layer of verification – Digital certificate verification. The verifier verifies the validity of the signer's digital certificate, including certificate chain verification, validity period verification, and Certificate Revocation List (CRL) lookup.

[0087] Step S305: Determine if the certificate verification is successful—if successful, proceed to step S306; if unsuccessful, the verification fails, and the certificate is invalid or has been revoked.

[0088] Step S306: The verifier reads the handwriting data packet ID2 (bjID2) from the Certificate Extensions, reads the personal signature image hwPNG from the PDF document, and sends bjID2 and hwPNG to the digital handwriting system.

[0089] Step S307: Third verification – Digital handwriting comparison verification. The digital handwriting system calls the pre-built digital handwriting AI recognition model to compare the personal signature image (hwPNG) with the handwriting model corresponding to the bjID2 sample retained during registration. If the verification passes, proceed to step S308; if it fails, the handwriting verification fails, and the signature is not made by the person or the intention is not genuine.

[0090] Step S308: If all three verifications pass, confirm that the document signature is valid, the signer's identity is authentic, the signing action is performed by the signer and the intention is genuine, and output the verification result.

[0091] In this embodiment, the handwriting biometric data packet is centrally stored and managed by the handwriting system. Simultaneously, the hash value of the handwriting data packet can be stored on the blockchain for evidence preservation. The handwriting data packet itself is stored in a distributed manner on IPFS or a similar decentralized storage system. During verification, the integrity of the handwriting data packet is checked through on-chain hash verification, further enhancing the tamper-proof capability of the handwriting data. In addition to storing the handwriting data packet ID, the certificate extension can also include the blockchain evidence preservation transaction hash (TxHash) of the handwriting data packet.

[0092] The PKI certificate system in this embodiment can be based on a traditional certificate authentication system (X.509 certificate) or a cryptographic system based on the SM9 identity-based cryptography algorithm, using the user's identity identifier (such as ID card number or mobile phone number) as the public key, without the need for traditional digital certificates. Under this architecture, the handwriting data packet ID can be directly bound to the user's identity identifier and stored in the identity-based cryptography system, without the need for certificate extensions. This solution is suitable for scenarios that are sensitive to certificate management costs but still require cryptographic signatures.

[0093] This embodiment requires users to write two handwriting samples during registration: "Agree" and "Personal Name". More handwriting samples can be added to meet different application scenarios, such as phrases with different meanings like "I have read and agree" and "I voluntarily agree," corresponding to different signing scenarios and expression of intent. Each handwriting sample is independently modeled and generates a unique handwriting data package ID. During signing, the corresponding handwriting is selected for verification based on the specific scenario.

[0094] The handwriting AI recognition model in this embodiment can be deployed on the handwriting system cloud, or a lightweight handwriting recognition model can be deployed on user terminal devices (such as mobile phones and tablets). During signing, handwriting collection and preliminary recognition are completed locally on the terminal, and only the recognition result (pass / fail) and necessary feature summaries are uploaded to the handwriting system for secondary confirmation. This solution can reduce the network overhead of handwriting data transmission, reduce the risk of privacy data being intercepted during transmission, and is suitable for mobile signing scenarios.

[0095] This embodiment includes a two-factor authentication system consisting of a "PKI certificate (your digital identity)" and "digital handwriting (your actions / expressed intentions)." A third factor—such as facial recognition or fingerprint recognition (your biometrics)—can be added to form a three-factor authentication architecture. Facial or fingerprint information is collected simultaneously during registration. During signing, facial liveness detection or fingerprint comparison is added to handwriting verification and PIN code verification to further strengthen identity authentication, making it suitable for high-security scenarios (such as large financial transactions).

[0096] The main improvements in this embodiment are specifically reflected in:

[0097] (1) Structured binding mechanism for writing digital handwriting biometric data packet ID into certificate extension: A new extension field is defined in the extension of the X.509 digital certificate to store the handwriting data packet ID, realizing a permanent structured binding between the handwriting feature data packet and the digital certificate; Since there is no standardized binding mechanism between the digital certificate and the user's biometrics, handwriting features are independent of the user's legal digital identity and cannot be uniformly identified and verified in cross-system scenarios. In this embodiment, the handwriting data packet ID is bound to the certificate through the certificate extension, so that the handwriting recognition model can be transmitted and verified along with the certificate, realizing the unity of "certificate is identity, handwriting is intention"; The binding between the handwriting data packet and the certificate is one-time and tamper-proof, ensuring that the association between handwriting and identity is always traceable during the certificate's validity period; The verifier can directly obtain the handwriting data packet ID through the certificate extension without additional querying of external systems, improving verification efficiency; It provides a standardized data interface for subsequent cross-system and cross-platform handwriting verification.

[0098] (2) Private key activation data derivation and protection mechanism based on SM3 (ID||certPIN||bjID1||bjID2): The user's identity ID, PIN code, bjID1, and bjID2 are concatenated to calculate the SM3 hash value, which is used as the activation data for the user's private key. During signing, the hash value needs to be recalculated and compared; the private key can only be activated after successful verification. In PKI systems, private key protection usually relies on direct verification of the PIN code or physical protection of hardware media (such as a USB key), which presents risks such as plaintext transmission of the PIN code and a lack of strong correlation between the PIN code and the user's identity. This embodiment uses the SM3 (ID||certPIN||bjID1||bjID2) hash derivation mechanism to cryptographically bind the user's identity ID, PIN code, bjID1, and bjID2. The leakage of any single factor will not lead to the illegal activation of the private key. Even if the PIN code is stolen, the attacker still needs to obtain the user's identity ID, bjID1, and bjID2 simultaneously to derive the correct activation data. The SM3 hash value is an irreversible one-way function, so even if the activation data is leaked, it is impossible to deduce the original PIN code and bjID1.

[0099] (3) "Dual Handwriting Sample" Mechanism and Two-Factor Authentication Architecture: During registration, users are required to write two handwriting samples simultaneously: "Agree" and "Personal Name." These samples are modeled separately and generate independent handwriting data packet IDs (bjID1, bjID2). Signing also requires writing two handwriting samples to achieve dual handwriting verification. A single handwriting sample is at risk of being imitated or forged. Furthermore, the "Personal Name" handwriting focuses on identity verification, while the "Agree" handwriting focuses on expressing intent; their functions differ. Compared to typically collecting only a single signature sample, it is difficult to distinguish between the different needs of identity authentication and intent confirmation. Dual handwriting verification significantly improves the security of handwriting authentication, requiring attackers to imitate two different handwriting samples simultaneously. The "Agree" handwriting is specifically used for intent confirmation, while the "Personal Name" handwriting is specifically used for identity verification; this functional separation makes the authentication logic clearer.

[0100] (4) System-level integrated architecture of PKI certificate authentication and digital handwriting authentication: Construct a two-factor authentication architecture of "certificate verification (your digital identity) and handwriting verification (your actions / expressed intentions)", in which the PKI system and the digital handwriting system work together throughout the entire process of registration, signing and verification. PKI certificate authentication and digital handwriting recognition are two independent technical paths, each with its own defects. PKI authentication cannot confirm the signing intention, and handwriting recognition lacks cryptographic protection. The two operate independently and cannot form a complete trusted signing loop. The two-factor authentication in this embodiment significantly enhances the authenticity of the signing behavior; cryptographic authentication (PKI) and biometric authentication (handwriting) complement and corroborate each other, constructing a complete evidence chain from identity to intention; integrating identity (certificate), password (PIN code), handwriting (behavioral biometrics), and intention (the writing behavior itself) into one, realizing the unification of "four trusts".

[0101] (5) Handwritten image and digital signature together constitute PDF electronic signature: When signing, not only is the PKI private key used to digitally sign the document, but the handwritten image is also attached to the PDF document as a visual signature. Pure PKI digital signature lacks a visual signature appearance, which does not conform to the user's habits and visual cognition of traditional paper signing; while pure handwritten image signature lacks cryptographic protection and is easily copied and tampered with. In this embodiment, the visual handwritten image meets the user's intuitive cognition and habits of "signing"; the digital signature provides cryptographic protection for the handwritten image and document content to prevent tampering; and realizes "what you see is what you sign" - the handwritten image seen by the user and the cryptographic signature point to the same signing behavior.

[0102] The embodiments described above are merely illustrative of specific implementations of the present invention, and while the descriptions are detailed, they should not be construed as limiting the scope of the present invention. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the present invention, and these modifications and improvements all fall within the scope of protection of the present invention.

Claims

1. A two-factor signature and verification system based on PKI and digital handwriting, characterized in that, include: The system includes a registration terminal, a signing terminal, a PKI certificate system, a digital handwriting system, and a verification terminal. The registration terminal, signing terminal, and verification terminal are respectively connected to the PKI certificate system and the digital handwriting system via a network. The PKI certificate system and the digital handwriting system interact with each other through a standardized interface for the transmission and association of feature identifiers for handwriting data packets.

2. A two-factor signature and verification method based on PKI and digital handwriting, characterized in that, The two-factor signature and verification system based on PKI and digital handwriting as described in claim 1 is used, and the method includes: Registration Phase: User identity is verified. After verification, the user writes a first signature and a second signature for handwriting verification. The first signature expresses the signer's intention, and the second signature identifies the signer. The digital handwriting system generates unique identifiers for the first and second handwriting data packets: bjID1 and bjID2. The registration terminal concatenates the user's identity ID, certificate PIN code certPIN, bjID1, and bjID2, calculates the hash value, and generates the private key activation data userKeyAC. The certificate issuance system issues a digital certificate to the user and binds the second handwriting data packet to the digital certificate. Signing Phase: When a user initiates a signing request, the signing terminal completes identity authentication. The user writes the first and second signature content on the signing terminal. The digital handwriting system compares and identifies the handwriting with the handwriting model sampled during the registration phase. After successful comparison, the user enters the certificate PIN code for PIN verification, recalculates the hash value to obtain userKeyAC', and compares userKeyAC' with the userKeyAC saved during the registration phase. After successful comparison, the user's certificate private key is activated to digitally sign the document, and the handwriting image is attached to the document to form an electronically signed document. Verification phase: The electronically signed document is sequentially verified by PKI digital signature, digital certificate and digital handwriting comparison. The document signature is confirmed to be valid after all three verifications are passed.

3. The two-factor signature and verification method based on PKI and digital handwriting according to claim 2, characterized in that, During the registration phase, user identity verification is performed as follows: Users upload their personal real-name identity information to the RA certificate registration system of the PKI certificate system through the registration terminal. The RA certificate registration system verifies the authenticity of the user's identity through real-name authentication and forces the user to read the digital certificate service agreement through SMS, email or audio and video recording.

4. The two-factor signature and verification method based on PKI and digital handwriting according to claim 2, characterized in that, During the registration phase, the digital handwriting biometric data includes at least one multidimensional dynamic feature among pen pressure, pen speed, pen sequence, starting stroke, and ending stroke; the digital handwriting system constructs a digital handwriting recognition model based on the collected digital handwriting biometric data, which is used for handwriting comparison and recognition in the subsequent signing phase.

5. The two-factor signature and verification method based on PKI and digital handwriting according to claim 2, characterized in that, During the registration phase, the certificate issuance system issues digital certificates to users as follows: The registration terminal uses the public key of the KMS key management system to encrypt userKeyAC, generates the ciphertext enc-userKeyAC of the activation data, and transmits the user's name, ID number, and enc-userKeyAC to the KMS key management system. The KMS key management system uses its own private key to decrypt enc-userKeyAC to obtain userKeyAC, which is then saved to the database. The KMS key management system generates a signing key pair and a Certificate Request (CSR) for the user, sets userKeyAC as the activation data of the user's signing private key, and sends the CSR to the CA certificate issuance system of the PKI certificate system. The CA certificate issuance system issues a digital certificate for the user.

6. The two-factor signature and verification method based on PKI and digital handwriting according to claim 5, characterized in that, During the registration phase, binding the handwriting data package with the digital certificate specifically includes: Write bjID2 into a custom extension of the digital certificate to achieve a permanent, structured binding between the second handwriting data packet and the digital certificate; Alternatively, the hash value of the second handwriting data packet can be stored on the blockchain as evidence, while the second handwriting data packet itself is stored in a distributed manner in IPFS or a decentralized storage system; the certificate extension stores the unique identifier bjID2 of the second handwriting data packet and the blockchain evidence storage transaction hash TxHash.

7. The two-factor signature and verification method based on PKI and digital handwriting according to claim 2, characterized in that, During the signing phase, the user enters a certificate PIN code for PIN verification, as detailed below: The signing terminal concatenates the user's identity ID, certPIN, bjID1, and bjID2, and calculates its SM3 hash value to obtain userKeyAC'. The signing terminal also calculates the SM3 hash value of the PDF document to be signed to obtain pdfHASH. The signing terminal uses the public key of the KMS key management system to encrypt userKeyAC' and pdfHASH, generating ciphertext enc-userKeyAC' and enc-pdfHASH, and then transmits the user's name, ID number, enc-userKeyAC', and enc-pdfHASH to the KMS key management system. The KMS key management system uses its own private key to decrypt enc-userKeyAC' and enc-pdfHASH to obtain userKeyAC' and pdfHASH, and compares userKeyAC' with the userKeyAC stored in the database. If they are equal, the verification is successful.

8. The two-factor signature and verification method based on PKI and digital handwriting according to claim 7, characterized in that, During the signing stage, the handwriting image is attached to the document to create an electronically signed document, as follows: The KMS key management system activates the user certificate private key and uses it to encrypt pdfHASH, generating a signature value (SignValue). The SignValue is then returned to the signing terminal. The signing terminal attaches a handwritten image (hwPNG) of the individual's name to the PDF document, creating a PDF electronic signature document containing the digital signature (SignValue) and a visual handwritten seal. The signing process is then complete.

9. The two-factor signature and verification method based on PKI and digital handwriting according to claim 2, characterized in that, During the verification phase, the triple verification is as follows: PKI Digital Signature Verification: The verifier extracts the digital signature value from the electronically signed document, decrypts and verifies the digital signature using the public key of the signer's certificate, and simultaneously recalculates the document's hash value and compares it with the hash value in the signature; Digital certificate verification: The verifier verifies the validity of the signer's digital certificate, including certificate chain verification, validity period verification, and Certificate Revocation List (CRL) lookup; Digital handwriting comparison and verification: After the digital certificate verification is successful, the verifier reads the unique identifier bjID2 of the second handwriting data packet, reads the handwriting image from the electronic signature document, and sends bjID2 and the handwriting image to the digital handwriting system. The digital handwriting system calls the constructed handwriting model and compares the personal handwriting image with the handwriting model corresponding to bjID2 saved during registration.

10. The two-factor signature and verification method based on PKI and digital handwriting according to any one of claims 2-9, characterized in that, Also includes: Users are subjected to facial or fingerprint recognition. Facial or fingerprint information is collected simultaneously during the registration phase. During the signing phase, facial liveness detection or fingerprint comparison is added to the handwriting verification and PIN code verification.

Images