Signature verification method and device for signed file, equipment, medium and program product

Abstract

This application provides a method, apparatus, device, medium, and program product for verifying signed documents, including: obtaining modified data in the target file to be verified when the digital signature of the target file passes cryptographic integrity verification; determining the object category corresponding to the modified data based on the field information of the modified data; performing compliance judgment on the modified data according to pre-established compliance judgment rules and object category to obtain a compliance judgment result; performing display layer attack detection on the modified data when the modified data is compliant to obtain a visual detection result; and determining the verification result of the modified data in the target file based on the compliance judgment result and the visual detection result. This helps to realize the judgment of different verification levels for modified data, effectively avoids misjudging compliant modifications as tampering, and improves the accuracy of modified data judgment.

Description

Technical Field

[0001] This application relates to the field of signature technology, and more specifically, to a method, apparatus, device, medium, and program product for verifying signed documents. Background Technology

[0002] With the continuous development of signature technology, signatures are used in various scenarios to ensure data security. For example, in the fields of electronic contracts, e-government, bidding, financial instruments, and archival storage, PDFs need to be signed to generate signed PDFs. However, in some cases, signed documents may be modified, so it is necessary to determine whether the modification is allowed. Summary of the Invention

[0003] The purpose of this application is to provide a method, apparatus, device, medium, and program product for verifying signed documents, so as to determine whether modifications to signed PDF documents are compliant.

[0004] In a first aspect, embodiments of this application provide a method for verifying a signed document, including: If the digital signature of the target file passes cryptographic integrity verification, the modified data in the target file to be verified is obtained, wherein the target file is a signed PDF file; Based on the field information of the modified data, determine the object category corresponding to the modified data; Based on the pre-established compliance determination rules and the object category, the modified data is subjected to compliance determination to obtain a compliance determination result, wherein the compliance determination rules are used to determine whether the modified data is compliant; If the modified data is compliant, a display layer attack detection is performed on the modified data to obtain a visual detection result; Based on the compliance judgment result and the visual inspection result, the verification result of the modified data in the target file is determined. The verification result includes the verification level and the judgment result corresponding to the verification level. The judgment result includes the modified data being non-compliant and displayed, the modified data being non-compliant and not displayed, the modified data being compliant and displayed, and the modified data being compliant and not displayed.

[0005] In this embodiment, a signed PDF file is verified. If the verification passes, the modified data in the file is obtained, and the object category to which the modified data belongs is determined. Based on the object category and pre-established compliance judgment rules, the compliance of the modified data is determined. If compliant, display layer attack detection is performed to obtain a visual detection result. Based on the visual detection result and the compliance detection result, a verification result corresponding to the modified data is obtained, such as whether the modified data is compliant and whether it should be displayed. In this way, by combining compliance judgment and display layer attack detection, it is helpful to realize the judgment of different verification levels of modified data, which can effectively avoid misjudging compliant modifications as tampering and improve the accuracy of modified data judgment.

[0006] Optionally, determining the object category corresponding to the modified data based on the field information of the modified data includes: Based on the form fields in the modified data, the object category of the modified data corresponding to the form fields is determined as the form category; Based on the document directory field in the modified data, the object category of the modified data corresponding to the document directory field is determined to be the page content category; Based on the signature field in the modified data, the object category of the modified data corresponding to the signature field is determined as the signature field category; Based on the comment field in the modified data, the object category of the modified data corresponding to the comment field is determined to be the comment category; Based on the verification information structure field in the modified data, the object category of the modified data corresponding to the verification information structure field is determined as the verification information structure category.

[0007] In this embodiment of the application, by identifying the fields in the modified data, the object category of the modified data is determined according to different fields, and then the modified data is judged for compliance based on different object categories and compliance judgment rules.

[0008] Optionally, determining the object category of the modified data corresponding to the form field as a form category based on the form field in the modified data includes: Determine the form fields in the modified data; Based on the form fields, the object category of the modified data is determined to be a form category using the following judgment method; wherein, the judgment method includes: judging the form fields, the array fields corresponding to the form fields, and the field values ​​or form reset default values ​​corresponding to the array fields, and judging whether the type of the form field is not a signature field type, or whether the form field is a visual component field and the modified data is an input value.

[0009] In this embodiment, it is determined whether the modified data belongs to the form category by judging whether the modified data corresponds to the change of field value, default value and / or option value of non-signature field in the AcroForm dictionary, or is only a change of input value on the form visualization component.

[0010] Optionally, determining the object category of the modified data corresponding to the document directory field as the page content category based on the document directory field in the modified data includes: Determine the page dictionary under the document directory corresponding to the modified data, wherein the page dictionary includes resource information and content information, and the resource information includes images, fonts and formatting; Based on the page dictionary and page path, determine whether the object category of the modified data is the page content category.

[0011] In this embodiment of the application, the object category of the modified data is determined to be the page text category by judging whether the change path of the modified data is located in the content stream or resource dictionary under the page dictionary through the document directory and page tree, or by judging the resource objects and structured markup content that are referenced on the page path and affect the rendering of the main text.

[0012] Optionally, the compliance determination rules include document-level modification sub-rules and field-level modification sub-rules. The step of performing compliance determination on the modified data based on the pre-established compliance determination rules and the object category to obtain a compliance determination result includes: Get the current modified value of the object category; The current modified value is matched with the preset modified value in the document-level modification sub-rule to determine the target allowed modification category and the target violation modification type corresponding to the current modified value. The document-level modification sub-rule includes the preset modified value and the allowed modification category and violation modification category corresponding to the preset modified value.

[0013] In this embodiment of the application, compliance determination rules are set, including document-level modification sub-rules and field-level modification sub-rules, and these compliance determination rules are used to determine whether the modified data is compliant. Optionally, the step of performing a compliance determination on the modified data based on pre-established compliance determination rules and the object category to obtain a compliance determination result includes: When the object category is a form category, the modified data is judged using the field-level modification sub-rule to obtain the compliance judgment result. The field-level modification sub-rule includes form fields that are allowed to be modified or form fields that are not allowed to be modified.

[0014] In this application embodiment, for modified data of form categories, in addition to using document-level modification sub-rules for judgment, field-level modification sub-rules can also be used for more detailed judgment, and compliance judgment can be made on modified data based on form fields that are not allowed to be modified.

[0015] Optionally, if the modified data is compliant, the step of performing display layer attack detection on the modified data to obtain visual detection results includes: Based on the fields in the modified data and the pre-set attack detection rules, the visual detection result corresponding to the modified data is determined. The pre-set attack detection rules include reference hiding sub-rules, sequential overlay sub-rules, superimposed replacement sub-rules, page stream injection sub-rules, and abnormal incremental structure sub-rules.

[0016] In this embodiment, the visual detection result corresponding to the modified data is determined based on the fields in the modified data and the pre-set attack detection rules. This can reflect the suspected attack on the display layer, even if the compliance judgment allows changes to form types.

[0017] Secondly, embodiments of this application provide a verification device for signed documents, including: The acquisition module is used to acquire the modified data in the target file to be verified, provided that the digital signature of the target file has passed the cryptographic integrity verification, wherein the target file is a signed PDF file; The determination module is used to determine the object category corresponding to the modified data based on the field information of the modified data; The judgment module is used to perform compliance judgment on the modified data according to the pre-established compliance judgment rules and the object category, and obtain a compliance judgment result, wherein the compliance judgment rules are used to determine whether the modified data is compliant; The detection module is used to perform display layer attack detection on the modified data if the modified data is compliant, and obtain visual detection results; The verification module is used to determine the verification result of the modified data in the target file based on the compliance judgment result and the visual inspection result. The verification result includes a verification level and a judgment result corresponding to the verification level. The judgment result includes the modified data being non-compliant and displayed, the modified data being non-compliant and not displayed, the modified data being compliant and displayed, and the modified data being compliant and not displayed.

[0018] In this embodiment, a signed PDF file is verified. If the verification passes, the modified data in the file is obtained, and the object category to which the modified data belongs is determined. Based on the object category and pre-established compliance judgment rules, the compliance of the modified data is determined. If compliant, display layer attack detection is performed to obtain a visual detection result. Based on the visual detection result and the compliance detection result, a verification result corresponding to the modified data is obtained, such as whether the modified data is compliant and whether it should be displayed. In this way, by combining compliance judgment and display layer attack detection, it is helpful to realize the judgment of different verification levels of modified data, which can effectively avoid misjudging compliant modifications as tampering and improve the accuracy of modified data judgment.

[0019] Optionally, the determining module is configured to: Based on the form fields in the modified data, the object category of the modified data corresponding to the form fields is determined as the form category; Based on the document directory field in the modified data, the object category of the modified data corresponding to the document directory field is determined to be the page content category; Based on the signature field in the modified data, the object category of the modified data corresponding to the signature field is determined as the signature field category; Based on the comment field in the modified data, the object category of the modified data corresponding to the comment field is determined to be the comment category; Based on the verification information structure field in the modified data, the object category of the modified data corresponding to the verification information structure field is determined as the verification information structure category.

[0020] In this embodiment of the application, by identifying the fields in the modified data, the object category of the modified data is determined according to different fields, and then the modified data is judged for compliance based on different object categories and compliance judgment rules.

[0021] Optionally, the determining module is configured to: Determine the form fields in the modified data; Based on the form fields, the object category of the modified data is determined to be a form category using the following judgment method; wherein, the judgment method includes: judging the form fields, the array fields corresponding to the form fields, and the field values ​​or form reset default values ​​corresponding to the array fields, and judging whether the type of the form field is not a signature field type, or whether the form field is a visual component field and the modified data is an input value.

[0022] In this embodiment, it is determined whether the modified data belongs to the form category by judging whether the modified data corresponds to the change of field value, default value and / or option value of non-signature field in the AcroForm dictionary, or is only a change of input value on the form visualization component.

[0023] Optionally, the determining module is configured to: Determine the page dictionary under the document directory corresponding to the modified data, wherein the page dictionary includes resource information and content information, and the resource information includes images, fonts and formatting; Based on the page dictionary and page path, determine whether the object category of the modified data is the page content category.

[0024] In this embodiment of the application, the object category of the modified data is determined to be the page text category by judging whether the changed path in the modified data is located in the content stream or resource dictionary under the page dictionary through the document directory and page tree, or by judging the resource objects and structured markup content that are referenced on the page path and affect the rendering of the main text.

[0025] Optionally, the compliance determination rules include document-level modification sub-rules and field-level modification sub-rules, and the determination module is used for: Get the current modified value of the object category; The current modified value is matched with the preset modified value in the document-level modification sub-rule to determine the target allowed modification category and the target violation modification type corresponding to the current modified value. The document-level modification sub-rule includes the preset modified value and the allowed modification category and violation modification category corresponding to the preset modified value.

[0026] In this embodiment of the application, compliance determination rules are set, including document-level modification sub-rules and field-level modification sub-rules, and these compliance determination rules are used to determine whether the modified data is compliant. Optionally, the determination module is used to: When the object category is a form category, the modified data is judged using the field-level modification sub-rule to obtain the compliance judgment result. The field-level modification sub-rule includes form fields that are allowed to be modified or form fields that are not allowed to be modified.

[0027] In this application embodiment, for modified data of form categories, in addition to using document-level modification sub-rules for judgment, field-level modification sub-rules can also be used for more detailed judgment, and compliance judgment can be made on modified data based on form fields that are not allowed to be modified.

[0028] Optionally, the detection module is used for: Based on the fields in the modified data and the pre-set attack detection rules, the visual detection result corresponding to the modified data is determined. The pre-set attack detection rules include reference hiding sub-rules, sequential overlay sub-rules, superimposed replacement sub-rules, page stream injection sub-rules, and abnormal incremental structure sub-rules.

[0029] In this embodiment, the visual detection result corresponding to the modified data is determined based on the fields in the modified data and the pre-set attack detection rules. This can reflect the suspected attack on the display layer, even if the compliance judgment allows changes to form types.

[0030] Thirdly, embodiments of this application provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, can implement the method described in any embodiment of the first aspect.

[0031] Fourthly, embodiments of this application provide a computer-readable storage medium storing a computer program, which, when executed by a processor, can implement the method described in any embodiment of the first aspect.

[0032] Fifthly, embodiments of this application provide a computer program product, the computer program product including a computer program, wherein when the computer program is executed by a processor, it can implement the method described in any embodiment of the first aspect. Attached Figure Description

[0033] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0034] Figure 1 A flowchart illustrating a method for verifying a signed document provided in an embodiment of this application; Figure 2 A flowchart illustrating another method for verifying a signed document provided in this application embodiment; Figure 3 A schematic diagram of the revised version and post-signature incremental update section structure provided for embodiments of this application; Figure 4 A flowchart for object change classification and MDP compliance determination provided in the embodiments of this application; Figure 5 A schematic diagram illustrating the credible conclusion state provided in the embodiments of this application; Figure 6 A schematic diagram of a device for verifying signed documents provided in this application embodiment; Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0035] The technical solutions in the embodiments of this application will now be described with reference to the accompanying drawings.

[0036] It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, in the description of this application, terms such as "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0037] PDF digital signatures are widely used in electronic contracts, e-government, bidding, financial instruments, and archival storage. Typical applications include PDF electronic signature verification servers, electronic contract judicial evidence storage / compliance review platforms, government and financial document compliance gateways, and verification modules in archival systems. The core scenario involves post-signature verification of signed PDFs. The verifier often only holds the signed PDF file and has not participated in the signing process, requiring an auditable and interoperable verification conclusion in the business system.

[0038] Beyond simply checking the validity of the signature, the focus is more on the business perspective: does the signed document only undergo compliant business modifications (such as filling out forms, adding signatures, or adding PAdES-LTV long-term verification information), or are there text or display-level tampering? However, many products on the market still rely heavily on prompts from general readers or verification SDKs (such as "signature valid" or the vague "document has been modified"), making it difficult to distinguish between compliant form filling, added signatures, and text / display-level risks. This leads to both missed detections (cryptographically valid but what is seen is not the signed document) and false positives (compliant form filling is considered invalid).

[0039] From a technical perspective, even after signing, a document can still have new objects appended to the end via incremental updates allowed by the PDF specification. The original bytes within the signed byte range remain unchanged, thus cryptographic verification (using PKCS#7 / CMS or the signature message data structure of the national cryptographic algorithm) may still show as successful. Therefore, in addition to determining "whether the signature is valid," business systems must also answer "whether the signed text is still trustworthy" and "whether simply filling out a form should be considered compliant." These "post-signature verification" requirements correspond to two industry strategies: "allowing as much post-signature business as possible" and "prohibiting post-signature modifications as much as possible," but neither can meet the fine-grained verification requirements of business systems.

[0040] For example, when performing only cryptographic integrity verification, this approach is the default implementation for current verification servers, readers, and most commercial verification SDKs, and the output is usually a binary result of "valid / invalid".

[0041] The typical processing flow is as follows: Read ByteRange from the signature field dictionary, extract the PDF file bytes by range and calculate the digest; parse the signature message data structure of PKCS#7 / CMS or national cryptographic algorithm from Contents, verify the consistency between the digest and the signature value with the public key of the signature certificate, and verify the certificate chain, revocation status, timestamp, etc.; if the digest is consistent and the certificate is valid, output "signature valid"; otherwise, output "signature invalid".

[0042] This solution is simple to implement and has low integration costs, making it suitable for batch verification of third-party signed PDFs. However, its limitations include: it does not analyze the type of object changes within incremental update sections after signing; it only provides a general reader-level prompt for "the document has been modified after signing," or it still displays "signature valid." In scenarios such as electronic contract countersigning and post-signing field addition, it cannot inform the business system that "only compliance modifications have occurred," nor can it identify situations where cryptography remains valid but the text or display layer is no longer trustworthy.

[0043] For example, a verification strategy that locks all content or prohibits any modification during signing is commonly seen in high-security evidence storage and tamper-proofing-priority product configurations. This contrasts with Solution A's strategy of "maximizing compatibility with post-signature business processes." Some implementations involve writing a "lock all file content" attribute to the PDF during signing, setting document modification permissions (DocMDP permission P=1, prohibiting any changes), or using a strategy that prohibits any non-signature operations such as appending or modifying during the verification phase. This ensures that any incremental updates after signing will result in the reader or verification component indicating an invalid signature. Alternatively, the signature appearance, locking attributes, and the overall document digest can be included in the signing scope. If the document content does not match the digest after signing, an explicit warning should be issued.

[0044] This solution has strong anti-tampering capabilities, but it does not allow common business operations such as compliant form filling after signing, adding signatures, and long-term verification information of PAdES-LTV. It is not suitable for scenarios such as multi-party signing, form filling after signing, and supplementary entry of long-term verification LTV information. Similarly, it cannot output credible verification conclusions such as "signature is valid and only compliant modification has occurred" or "cryptographically valid but the text is untrustworthy", which makes it difficult to meet the fine-grained requirements of regulators and the judiciary for verification reports.

[0045] Based on the above scheme, when the page display content is modified incrementally after signing (such as adding Pages / Contents or overwriting form fields), the bytes within the ByteRange range remain unchanged, and cryptographic signature verification can still pass, failing to identify "what is seen is not what is signed." It cannot distinguish between compliant form filling and text tampering; the business system can only obtain a binary result of "valid / invalid," leading to a high rate of false positives or false negatives. Alternatively, prohibiting post-signature modifications conflicts with legitimate business processes such as electronic contract countersigning, post-signature field addition, and adding DSS to PAdES-LTV. It cannot output a reliable verification conclusion that "the signature is valid and only compliant modifications have occurred."

[0046] The two schemes mentioned above cannot simultaneously satisfy the requirement of identifying text-level risks even when cryptographic signature verification is successful; they separate the determination of compliant form modifications from text tampering and output credible verification conclusions that can be used by regulators and the judiciary. To address the aforementioned issues, this application provides an extended verification method for signed PDF files. Using a specific digital signature field to be verified as an anchor point, the method determines the baseline document revision at the time of signing. It then performs object-level difference analysis on each incremental update section following this revision, categorizing changes into page text-related, interactive form-related, digital signature field-related, comment-related, and PAdES-LTV long-term verification information categories. Finally, it combines DocMDP / FieldMDP / Lock permissions and display layer attack rules to provide a reliable verification conclusion.

[0047] Terminology introduction: 1. Cross-reference table (xref): Records the byte offset of each object number in the file and the index table of the corresponding generation number. Each entry is marked as in use (n) or free (f). It works with endnotes to locate indirect objects, determine the in use objects of each revision, and concatenate the revision sequence along / Prev.

[0048] 2. Trailer: A dictionary located at the end of a file or incremental update section, containing entries such as / Prev, / Size, and / Root; adjacent revisions are linked forward by / Prev.

[0049] 3. Revision: A series of logically saved states linked by / Prev in the endnote; each revision corresponds to the cross-reference table segment and endnote section written for that save. 4. Base Revision (Rs): The revision that corresponds to the completion of writing the signature field to be verified; 5. Incremental Update Section: The body text, cross-references, and endnotes appended to the end of the document in a new revision relative to the previous revision; 6. Post-signature incremental update section: The incremental update section following the baseline revision Rs; the basic unit for object-level difference comparison in this invention, denoted as U1, U2, etc. (see...) Figure 2 (the green block in the middle) 7. In-use objects: PDF objects marked as currently in use in the cross-reference table for a given revision (including object number and corresponding generation number); 8. Object-level difference comparison: Using in-use objects as units, the two revisions are compared item by item to obtain change records such as additions, modifications, and deletions (i.e., generating an object change set); this is different from byte-level integrity verification that only verifies ByteRange. 9. Set of Changes to Objects After Signing (Δ): The set of change records obtained by comparing the baseline revision Rs with the current effective revision (or by comparing each post-signing incremental update section with its previous revision) at the object level, denoted as Δ={(objId, op, path, old, new)}: objId is the object number, op is add / update / delete, path is the object path, and old / new are the value summaries before and after the change; used for category mapping, MDP compliance judgment and display layer attack detection in steps S5 to S8.

[0050] 10. DoCMDP: Document Modification Detection and Prevention: The / P value (1 / 2 / 3) in the signature dictionary / Reference → / TransformParams defines the scope of document modifications allowed after the signature takes effect (e.g., P=2 allows filling in forms, adding signatures, etc.).

[0051] 11. FieldMDP: Field Modification Detection and Prevention: Declare Action (All / Include / Exclude) and field list through signature field Lock or FieldMDP transformation parameters, and agree on which interactive form fields can still be modified after signing.

[0052] 12. Content-related objects: Objects that affect the visible content of the page, such as fonts / images / CMaps in Page / Contents and Resources; 13. Trusted verification conclusions: can distinguish between cryptographically invalid, unsigned modifications, compliant modifications, untrusted text, and suspected display layer attacks.

[0053] like Figure 1 As shown in the figure, this application embodiment provides a method for verifying a signed file, which may include the following steps: S101. If the digital signature of the target file passes the cryptographic integrity verification, obtain the modified data in the target file to be verified, wherein the target file is a signed PDF file; Specifically, the terminal device obtains the target file to be verified, which is a signed PDF file containing one or more signatures, which are not specifically limited in this application.

[0054] The terminal device performs signature verification on the target file to be verified. If the target file passes the signature verification, it obtains the modified data in the target file and determines the baseline revision when the signature is completed based on the position of the signature field. It performs an object-level difference comparison between the post-signature incremental update section between the baseline revision and the current effective revision to generate a post-signature object change set. The change items in the set are used as the modified data.

[0055] S102. Determine the object category corresponding to the modified data based on the field information of the modified data; Specifically, the terminal device parses the modified data to obtain the field information in the modified data, and then determines the object category corresponding to the modified data based on the different field information. For example, the object category includes page content, form field, signature field, comment, PADES_LTV or XREF_TRAILER.

[0056] S103. Based on the pre-established compliance determination rules and the object category, the modified data is subjected to compliance determination to obtain a compliance determination result, wherein the compliance determination rules are used to determine whether the modified data is compliant; Specifically, the terminal device pre-stores compliance judgment rules corresponding to different types of object categories. These compliance judgment rules are used to determine whether the modified data is compliant, that is, whether it is allowed to be modified on the PDF file, and whether the modified content complies with regulations. These compliance judgment rules include document-level category judgment and field-level category judgment.

[0057] For different object categories, the modified data corresponding to the object category is subject to compliance judgment according to the pre-established compliance judgment rules, and a compliance judgment result is obtained. The compliance judgment result includes whether the modified data is compliant or non-compliant.

[0058] S104. If the modified data is compliant, perform display layer attack detection on the modified data to obtain visual detection results; Specifically, when the modified data is compliant, the terminal device performs display layer attack detection on the modified data, that is, it determines whether the modified data in the PDF file is hidden, and matches the modified data with the pre-set attack detection rules to obtain the visual detection result corresponding to the modified data.

[0059] S105. Based on the compliance judgment result and the visual inspection result, determine the verification result of the modified data in the target file. The verification result includes a verification level and a judgment result corresponding to the verification level. The judgment result includes the modified data being non-compliant and displayed, the modified data being non-compliant and not displayed, the modified data being compliant and displayed, and the modified data being compliant and not displayed.

[0060] Specifically, the terminal device combines the compliance judgment result and the visual inspection result to judge the modified data and obtain the verification result of the modified data. That is, the compliance judgment result is used to determine whether the modified data is permissible, while the visual inspection result is used to determine whether the modified data is displayed on the PDF page. Therefore, the terminal device determines different verification levels for the modified data based on whether the modification is permissible and whether it is displayed on the page. For example, different verification levels correspond to different judgment results, including: modified data is non-compliant and displayed on the PDF; modified data is non-compliant and not displayed on the PDF; modified data is compliant and displayed on the PDF; and modified data is compliant and not displayed on the PDF. Furthermore, different verification levels correspond to different execution operations, including: if the data is compliant, the business is approved; if the display layer is attacked, the modified data is considered untrustworthy.

[0061] In this embodiment, a signed PDF file is verified. If the verification passes, the modified data in the file is obtained, and the object category to which the modified data belongs is determined. Based on the object category and pre-established compliance judgment rules, the compliance of the modified data is determined. If compliant, display layer attack detection is performed to obtain a visual detection result. Based on the visual detection result and the compliance detection result, a verification result corresponding to the modified data is obtained, such as whether the modified data is compliant and whether it should be displayed. In this way, by combining compliance judgment and display layer attack detection, it is helpful to realize the judgment of different verification levels of modified data, which can effectively avoid misjudging compliant modifications as tampering and improve the accuracy of modified data judgment.

[0062] Another embodiment of this application further supplements the description of the verification method for signed documents provided in the above embodiments.

[0063] as Figure 2 shown, an embodiment of the present application provides a method for verifying a signed file, comprising: Step S1: A terminal device acquires a PDF file containing at least one digital signature, and determines a signature field to be verified (which may be specified by the signature field name, signing sequence, or service).

[0064] Step S2: Extract the signed bytes according to the byte offset interval ByteRange of the signature field and perform cryptographic integrity verification (PKCS#7 / CMS and / or national secret signature message data structure) to obtain a cryptographic verification result R_crypto (valid / invalid and subcode).

[0065] If R_crypto is invalid, the embodiment adopts a short-circuit strategy: set the sub-status code L6, output the comprehensive grade D and a verification report (including the cryptographic failure subcode and reason), do not perform steps S3 to S8, and the process ends.

[0066] Specifically, in the embodiment of the present application, when the digital signature of the target file passes the cryptographic integrity verification, modified data in the target file to be verified is acquired. The modified data refers to each change record extracted from the post-signature object change set Δ, and each record includes an object number objId, an operation type op (add / update / delete), an object path path, and a pre-change and post-change value digest old / new, as Figure 2 shown, before PDF signing, there is only the original document R0, which is the document state reached before signing, and no intermediate revised version before signing is drawn separately; an actual PDF may undergo zero or more incremental saves before signing, and the Rs baseline revised version is located by the algorithm according to pos_sig, Figure 3 the number of blocks in the example is a specific embodiment.

[0067] The specific manner of determining the modified data is as follows: 1) Traverse forward along / Prev from the endnote at the end of the target file, collect the starting byte offsets of each cross-reference table (xref) segment of each revised version, and record them as off_0, off_1, ..., off_n.

[0068] 2) Read the starting byte position pos_sig of Contents (hexadecimal signature string) in the signature field dictionary to be verified in the PDF.

[0069] 3) The i that satisfies off_i ≤ starting byte position pos_sig < off_{i+1} (or pos_sig is located in the last section) is the sequence number of Rs, see Figure 2 the mark off_s in; this revised version is recorded as the baseline revised version Rs, that is Figure 2 The rectangular block immediately following R0 in the figure.

[0070] 4) For each j>s, mark the body update corresponding to [off_j, off_{j+1}) (the last section goes to EOF), the cross-reference table (xref) section and the trailing note as the post-signature incremental update section U_j. Example: The first post-signature update section U_{s+1} is exactly Figure 2 Rs+1, which is marked as U1 in the figure.

[0071] 5) The generation manner of the post-signature object change set Δ is as follows: a Parse the object dictionaries of the base revision Rs, the current revision Rn and each intermediate post-signature revision, and perform object-level difference comparison only for the in-use objects.

[0072] b Compare Rs and Rn at one time, or compare R_{j 1} and R_j (j>s) section by section and then combine the results; both manners cover all post-signature incremental update sections.

[0073] c Aggregate into the post-signature object change set Δ= {(objId, op, path, old, new)}, where objId is the object number, op is add / update / delete, path is the object path, old / new are the value digests before and after the change, representing all post-signature changes from Rs to Rn for subsequent classification, MDP compliance judgment and display layer attack rule detection. The post-signature object change set is generated in any of the following manners: a) Compare all in-use objects of the base revision Rs and the current valid revision Rn at one time; b) Compare the adjacent post-signature revisions R_{j 1} and R_j (j>s) in sequence, and combine the results of each comparison.

[0074] The combination of the signature field pos_sig and the / Prev chain structure accurately locates the revision (Rs) at the moment when the signature takes effect, which is the premise of all subsequent analyses. The base revision is determined in the following manner: traverse the cross-reference table section forward along the / Prev pointer starting from the trailing note at the end of the file, and obtain the starting offset of each revision; according to the starting byte position pos_sig of the Contents field in the to-be-verified signature field, determine the revision that satisfies off_i ≤ pos_sig<off_{i+1} as the base revision Rs; Step S3: When R_crypto is valid, parse the cross-reference table (xref) and the / Prev connection in the endnotes to obtain the revision sequence. Then, based on the byte offset of the signature field Contents in the file, determine the base revision Rs for which the signature is valid, such as... Figure 2 As shown.

[0075] Step S4: For each incremental update section after Rs, compare the objects in use before and after the revision, and finally summarize to generate a signed object change set Δ. This change set includes the object number, operation type add / update / delete, object path, and a summary of the values ​​before and after the change.

[0076] Step S5: Map each item in the signed object change set Δ to a preset object category, including at least: BODY_PAGE (text page), FORM_VALUE (form value), SIG_FIELD (signature field), ANNOT (comment), PADES_LTV (DSS / DTS), XREF_TRAILER (pure structure), etc., that is, determine the corresponding object category based on the object path information of the changed object in the modified data.

[0077] Step S6: Attempt to read the P value (1 / 2 / 3) of the document-level modification permission DOCMDP from the target signature dictionary / Reference → / TransformParams; if no DOCMDP is declared, assign an equivalent P value according to the default policy that the signature verifier can configure, such as strict P=1, or P=2 for form filling business scenarios. That is, when no DOCMDP is declared in the signature dictionary, the signature verifier's preset default policy is used to assign an equivalent P value. The default policy can be selected as P=1 (strict mode) or P=2 (lenient form filling mode) according to the application scenario.

[0078] Simultaneously, the document modification permission information M is obtained by reading the field-level permissions from the signature field's Lock and field-level modification permissions FieldMDP.

[0079] Step S7: Based on the document modification permission information M and the category mapping result, determine whether the set of object changes Δ after signing are all compliant modifications, and obtain the compliance judgment result R_policy, which is the compliance judgment result. The compliance judgment rule adopts a joint judgment mechanism: first, it is determined whether the change category is allowed based on the P value of DocMDP; if it is a form type change, it is also necessary to further determine whether the specific field is included in the prohibited modification list based on FieldMDP / Lock.

[0080] Step S8: Perform display layer attack detection (R1~R5) on the set of changes to the signed objects Δ and the object reference relationships to obtain the visual detection result R_attack and the visual detection result.

[0081] Step S9: Combine the cryptographic verification result R_crypto, the compliance judgment result R_policy obtained when R_crypto is valid, and the visual inspection result R_attack to output the trusted verification conclusion and comprehensive level (A / B / C / D), and generate the verification result. If the verification result R_crypto is invalid, only the level D is output based on L6.

[0082] In this embodiment of the application, as an optional implementation, if there are multiple signatures in the document, step S2 can be executed separately for each signature field; if R_crypto is valid, steps S3 to S9 are executed for the signature field, and conclusions are output respectively; if R_crypto of any signature field to be verified is invalid, the overall output is level D; or the lowest level is selected and output together according to the business strategy, that is, for a target file containing multiple digital signatures, the above verification process is executed independently for each signature field, and the corresponding verification results and overall level are output respectively.

[0083] like Figure 4 As shown, optionally, determining the object category corresponding to the modified data based on the field information of the modified data includes: Based on the form fields in the modified data, the object category of the modified data corresponding to the form fields is determined as the form category; Based on the document directory field in the modified data, the object category of the modified data corresponding to the document directory field is determined to be the page content category; Based on the signature field in the modified data, the object category of the modified data corresponding to the signature field is determined as the signature field category; Based on the comment field in the modified data, the object category of the modified data corresponding to the comment field is determined to be the comment category; Based on the verification information structure field in the modified data, the object category of the modified data corresponding to the verification information structure field is determined as the verification information structure category.

[0084] In this embodiment of the application, by identifying the fields in the modified data, the object category of the modified data is determined according to different fields, and then the modified data is judged for compliance based on different object categories and compliance judgment rules.

[0085] Optionally, determining the object category of the modified data corresponding to the form field as a form category based on the form field in the modified data includes: Determine the form fields in the modified data; Based on the form fields, the object category of the modified data is determined to be a form category using the following judgment method; wherein, the judgment method includes: judging the form fields, the array fields corresponding to the form fields, and the field values ​​or form reset default values ​​corresponding to the array fields, and judging whether the type of the form field is not a signature field type, or whether the form field is a visual component field and the modified data is an input value.

[0086] Specifically, such as Figure 4 As shown, after obtaining the set of signed object changes, the terminal device parses the object path and maps it to a preset category, such as page content, form value, signature field, comment, etc., and then performs DocMDP judgment. For example, the signed object is mapped to FORM_VALUE (interactive form related), that is, based on the form field, the object category of the modified data is determined to be a form category using the following judgment method.

[0087] For example, the determination of the form field, the array field corresponding to the form field, and the field value or form reset default value corresponding to the array field includes: the change path is located in the top-level form data warehouse AcroForm field, and the Fields array is matched under the AcroForm field. The Fields array stores indirect references to all form fields (text boxes, check boxes, signature fields), the most important node; then, based on the Fields array, the field value / V of the form field dictionary, the default value / DV of the form reset restoration, and the drop-down candidate option array / Opt (drop-down box / Ch, list box / Ch) are matched. If the form field is determined to be of type 'signature field', and the form field is a visual component field and the modified data is an input value, that is, the field / FT (Field Type) of the modified data is not a signature field / Sig, or although it is a field visual box Widget, the change is only a value filled in by the user, a field value written by an external system, or a field value added in an incremental update.

[0088] In this embodiment, it is determined whether the modified data belongs to the form category by judging whether the modified data corresponds to the change of field value, default value and / or option value of non-signature field in the AcroForm dictionary of form data, or is only a change of input value on the form visualization component.

[0089] Optionally, determining the object category of the modified data corresponding to the document directory field as the page content category based on the document directory field in the modified data includes: Determine the page dictionary under the document directory corresponding to the modified data, wherein the page dictionary includes resource information and content information, and the resource information includes images, fonts and formatting; Based on the page dictionary and page path, determine whether the object category of the modified data is the page content category.

[0090] Specifically, the terminal device maps the modified data to the BODY_PAGE page content category based on the change path of the modified data, and makes the following judgments: the change path is located in the content or resources under the document directory Catalog, Pages, or Page dictionary; or the font, XObject external objects (images, FormXObject), CMap, etc. are changed and referenced by a certain page's Resources and affect the rendering of the main text; or the added / modified markup content under StructTreeRoot affects the display of the main text.

[0091] In this embodiment of the application, the object category of the modified data is determined to be the page text category by judging whether the change path of the modified data is located in the content stream or resource dictionary under the page dictionary through the document directory and page tree, or by judging the resource objects and structured markup content that are referenced on the page path and affect the rendering of the main text.

[0092] Based on the above embodiments, the signature field category is determined by the SIG_FIELD field: the PDF signature field adds the / FT / Sig field or writes a signature value (which is compliant when MDP allows appending signatures); The ANNOT field determines the annotation category: annotation dictionary changes for non-form widgets (determined by P=3); The PADES_LTV long-term verifiability field determines the type of verification information structure: only PADES long-term verification information structures such as / DSS, / VRI, and Document TimeStamp are included. The XREF_TRAILE method determines the pure structure category: only endnotes and cross-reference table (xref) segments are added without any substantial changes to the semantics of the objects.

[0093] Optionally, the compliance determination rules include document-level modification sub-rules and field-level modification sub-rules. The step of performing compliance determination on the modified data based on the pre-established compliance determination rules and the object category to obtain a compliance determination result includes: Get the current modified value of the object category; The current modified value is matched with the preset modified value in the document-level modification sub-rule to determine the target allowed modification category and the target violation modification type corresponding to the current modified value. The document-level modification sub-rule includes the preset modified value and the allowed modification category and violation modification category corresponding to the preset modified value.

[0094] Specifically, the document-level modification sub-rule sets the allowed change categories based on the P value of the document modification permission DocMDP in the signature dictionary; the field-level modification sub-rule sets the list of form fields that can be modified based on the field locking policy FieldMDP or the Lock field. like Figure 4 As shown, this application provides a change detection and protection mechanism (MDP) compliance determination rule. The terminal device reads the document modification permission information M, and reads two types of modification permissions, DocMDP and FieldMDP, from the signature field to be verified, and merges them into document modification permission information M. It then determines whether the signature dictionary contains a DocMDP declaration. If the signature dictionary does not contain a DoCDDP declaration, the default equivalent P value will be used for judgment. Strictly, P=1 will be used, or P=2 will be used to allow passage in the case of only filling in the form, combined with the business scenario, and then the following judgment will be made.

[0095] If a DOCMDP declaration exists in the signature dictionary, read the P value of the DOCMDP and the FieldMDP / Lock; and determine the appropriate policy based on the policy table: P=1: only PADES LTV; P=2: +form + signature; P=3: +comment; Furthermore, the terminal device also includes a joint judgment principle, which requires both document-level and field-level compliance. For each change in the signed object change set, the following order applies; if any one of them fails, the entire set is non-compliant: Step 1: Document-level category determination (DocMDP) The object category of this item is compared with the allowed categories of the current P value. If the change category is within the scope allowed by DocMDP, proceed to the second step; otherwise, it is considered a violation.

[0096] The correspondence between P-values ​​and allowed categories is shown in Table 1: Table 1

[0097] The separation determination provided in this application embodiment has the following meaning: if only FORM_VALUE related to interactive forms appears in the same post-signature incremental update section and there is no BODY_PAGE related to page content, it tends to be a compliant modification when P=2; if there is an unauthorized change related to BODY_PAGE page content, then the content is untrustworthy, even if R_crypto is valid.

[0098] In this embodiment of the application, compliance determination rules are set, including document-level modification sub-rules and field-level modification sub-rules, and these compliance determination rules are used to determine whether the modified data is compliant. Optionally, the step of performing a compliance determination on the modified data based on pre-established compliance determination rules and the object category to obtain a compliance determination result includes: When the object category is a form category, the modified data is judged using the field-level modification sub-rule to obtain the compliance judgment result. The field-level modification sub-rule includes form fields that are allowed to be modified or form fields that are not allowed to be modified.

[0099] Step 2: Field-level detailed analysis (FieldMDP / Lock, only for form-type changes): If the object category of this item is mapped to the form field FORM_VALUE, in addition to the document-level category determination (DocMDP), it must also meet the field-level fine-grained determination (FieldMDP / form field locking rule Lock) constraint on that specific field: For example: Action=All: Except for the signature field itself, all other form fields cannot be modified after signing; Action=Include: Lists form fields that are not allowed to be modified; Action=Exclude: Lists the form fields that are allowed to be modified; the rest are not allowed to be modified.

[0100] If the document does not declare FieldMDP / Lock, changes to form types will only be determined according to the DOCMDP document-level rules.

[0101] For non-form-related changes, such as modifications to fields that conform to BODY_PAGE, SIG_FIELD, ANNOT, PADES_LTV, no field-level fine-grained judgment is performed; the judgment is based solely on the DocMDP document-level rules.

[0102] The terminal device modifies the data and obtains a compliance determination result through the above joint judgment. If R_policy is passed, it is a compliant modification; if R_policy is not passed, it is a non-compliant modification.

[0103] In this application embodiment, for modified data of form categories, in addition to using document-level modification sub-rules for judgment, field-level modification sub-rules can also be used for more detailed judgment, and compliance judgment can be made on modified data based on form fields that are not allowed to be modified.

[0104] Optionally, if the modified data is compliant, the step of performing display layer attack detection on the modified data to obtain visual detection results includes: Based on the fields in the modified data and the pre-set attack detection rules, the visual detection result corresponding to the modified data is determined. The pre-set attack detection rules include reference hiding sub-rules, sequential overlay sub-rules, superimposed replacement sub-rules, page stream injection sub-rules, and abnormal incremental structure sub-rules.

[0105] In this embodiment, the visual detection result corresponding to the modified data is determined based on the fields in the modified data and the pre-set attack detection rules. This can reflect the suspected attack on the display layer, even if the compliance judgment allows changes to form types.

[0106] The terminal device is pre-configured with attack detection rules, including reference hiding sub-rule R1, sequential overwrite sub-rule R2, overlay replacement sub-rule R3, page stream injection sub-rule R4, and abnormal incremental structure sub-rule R5. This application only pre-configures five detection rules, but more can be added as needed. The specific detection conditions are shown in Table 2. Table 2

[0107] The display layer attack detection includes at least one of the following: 1) Check if a new visual component Widget is added and overwrites the original field, then sets its / P to null (reference hiding); 2) Check if multiple form field declarations exist in the same area on the same page (sequential overriding); 3) Check if the field / V and the FormXObject prompt layer are separated (overlay replacement); 4) Check if Pages / Contents points to a new stream but is not overwritten by ByteRange (page stream injection); 5) Check if the incremental section after the tag is missing a complete xref or endnote (abnormal incremental structure).

[0108] like Figure 5As shown, the terminal device uses the detection rules in the table above to match the modified data. When any rule from R1 to R5 is hit, R_attack=hit is set, and the trusted conclusion reflects the suspicion of a display layer attack. Even if the compliance judgment allows form-type changes, the display layer attack detection is performed independently of the compliance judgment. Even if a modification is judged to be compliant, if a preset attack rule is hit, it is still marked as having a suspected display layer attack. By introducing an object-level difference comparison mechanism, compared with traditional byte-level integrity verification, it can accurately identify the object type modified after signing, avoiding misjudging compliant form filling as tampering and significantly reducing the false positive rate. By setting five types of display layer attack detection rules, such as reference hiding and sequence overwriting, it can further identify visual deception attacks where the signed object is not actually signed, even after cryptographic signature verification has passed, thus filling the security blind spots of existing technologies.

[0109] Based on the compliance judgment result and the visual inspection result, the terminal device determines the verification result of the modified data in the target file. Table 3 shows the different states of the modified data, i.e., the sub-state codes: Table 3

[0110] The terminal device determines different verification levels based on the different states of the modified data mentioned above: For example, if the modified data is L0 and (L1 or L2), and the verification level of the modified data is determined to be A, the business can be recommended for approval, driving downstream processes that can be automatically approved or released without manual intervention. If the modified data is L0 and L3, and the verification level of the modified data is determined to be B, manual review is recommended, triggering manual review or supplementary materials before a decision is made. If the modified data is L0 and (L4 or L5), and the verification level of the modified data is determined to be C, meaning the signature cryptography is valid but the text or display is untrustworthy, then, provided the cryptographic signature verification still passes, controls can be implemented to restrict acceptance, upgrade approval, or refuse business processing based on the risk at the text or display layer. If the modified data is L6, and the verification level of the modified data is determined to be D, then the corresponding cryptography is invalid, and acceptance can be refused or the process terminated. Therefore, scenarios such as electronic contract co-signing, government document processing, and financial compliance review can connect the signature verification results with the rule engine and workflow engine, reducing false positives and negatives while improving the automation and auditability of the process.

[0111] Then, the terminal device generates a verification result, which includes a sub-status code and a comprehensive level. When the cryptographic verification is valid and there are no post-signature modifications or only PADES-LTV information, level L1 / A is output; when there are compliant modifications, level L2 / A is output; when there are boundary cases (such as no MDP but only a completed form), level L3 / B is output; when the main text is untrustworthy or shows signs of attack, level L4 or L5 / C is output; when the cryptographic verification fails, level L6 / D is output. Simultaneously, a signature verification report is generated, including: signer, signature time, DocMDP, number and category statistics of changes, a list of hit rules, sub-status codes, and verification level.

[0112] In summary, this application embodiment obtains the signature field to be verified of the target file, wherein the target file is a signed PDF file; based on the byte offset data of the signature field to be verified, the signed byte in the signature field to be verified is determined, and the signed data is verified to obtain the verification result; If the verification result is valid, the cross-reference table and endnotes of the target file are parsed to determine the revision sequence of the target file; the baseline revision for which the signature takes effect is determined based on the byte offset of the signature field in the file; based on the baseline revision, a set of changes for the signed objects is generated based on the objects in use before and after the revisions, the set of changes for the signed objects including object number, operation type, object path, and summary of values ​​before and after the change; based on each object data in the set of changes for the signed objects, the target object category for each object data is determined, the target object category including text, form values, signature fields, comments, standard rules, and cross-reference endnote structures; Based on the target object category and preset modification permission information, determine whether the target object category is a compliance judgment result; if the compliance judgment result is compliant, perform display layer attack detection on the object data to obtain a visual detection result; based on the compliance judgment result and the visual detection result, determine the trustworthy verification conclusion and comprehensive level in the target file, and generate a signature verification report.

[0113] In this application embodiment, when byte verification still passes within the defined ByteRange range, the revised post-signature object change Δ classification and display layer attack rule detection can identify "untrustworthy text or display" caused by ISA / shadow attacks, avoiding the security illusion brought by relying solely on cryptographic signature verification and reducing the probability of false alarms. For incremental updates of only FORM_VALUE / SIG_FIELD under DocMDP P=2, L2 / A level is output instead of "document modified / invalid" in all cases, satisfying processes such as countersigning and field supplementation, reducing the probability of false alarms. The output of L0~L6 and A / B / C / D comprehensive levels and change list facilitates the integration of regulatory, judicial and business rule engines, and is hierarchically auditable, solving the problem that binary valid / invalid cannot meet the "trusted verification" problem. The post-signature object change classification, MDP compliance judgment table and R1~R5 attack rule base are configurable and upgradeable, the rules are extensible, and they can adapt to new attack samples without changing the main process.

[0114] The sub-status codes (L0~L6) and comprehensive levels (A / B / C / D) output by the embodiments of this application, as well as information such as change categories and hit rules in the signature verification report, support the direct mapping of business hierarchical handling strategies to the differentiated handling strategies of business systems, rather than just reader-style signature validity / document modification prompts. For example: The baseline revision is determined using the signature field anchor point; object-level differences are compared for each incremental update section after signing, and a set of signed object changes Δ is generated; signed object changes are mapped to categories such as "page text related," "interactive form related," and "other categories," and then separated and judged; when cryptographic verification is valid, a credible conclusion (non-binary valid / invalid) can still be output: "text integrity verification failed" or "suspected display layer attack"; DocMDP / FieldMDP is combined to perform policy judgment on compliant modifications to avoid compliant form filling being judged as tampering; based on the set of signed object changes Δ, display layer attack detection (such as overlay hiding, sequential overwriting, separation of display and value retrieval, etc.) is performed in combination with object reference relationships, and a conclusion independent of MDP compliance judgment is output; the classification of signed object changes, the MDP compliance judgment table, and the display layer attack rule base are upgraded to adapt to new attack samples without changing the main process.

[0115] It should be noted that each of the implementable methods in this embodiment can be implemented individually or in any combination without conflict. This application does not limit this.

[0116] Please refer to Figure 6 This illustration shows a block diagram of a signed document verification apparatus provided in some embodiments of this application. It should be understood that this signed document verification apparatus is similar to the one described above. Figure 1Corresponding to the method embodiments, it is able to execute the various steps involved in the above method embodiments. The specific functions of the verification device for the signed document can be found in the description above. To avoid repetition, detailed descriptions are appropriately omitted here.

[0117] Figure 6 The verification device for the signed document includes at least one software functional module that can be stored in a memory or embedded in the verification device for the signed document in the form of software or firmware. The verification device for the signed document includes: The acquisition module 601 is used to acquire the modified data in the target file to be verified when the digital signature of the target file passes the cryptographic integrity verification, wherein the target file is a signed PDF file; The determining module 602 is used to determine the object category corresponding to the modified data based on the field information of the modified data; The judgment module 603 is used to perform compliance judgment on the modified data according to the pre-established compliance judgment rules and the object category, and obtain a compliance judgment result, wherein the compliance judgment rules are used to determine whether the modified data is compliant; The detection module 604 is used to perform display layer attack detection on the modified data if the modified data is compliant, and obtain visual detection results; The verification module 605 is used to determine the verification result of the modified data in the target file based on the compliance judgment result and the visual inspection result. The verification result includes a verification level and a judgment result corresponding to the verification level. The judgment result includes the modified data being non-compliant and displayed, the modified data being non-compliant and not displayed, the modified data being compliant and displayed, and the modified data being compliant and not displayed.

[0118] In this embodiment, a signed PDF file is verified. If the verification passes, the modified data in the file is obtained, and the object category to which the modified data belongs is determined. Based on the object category and pre-established compliance judgment rules, the compliance of the modified data is determined. If compliant, display layer attack detection is performed to obtain a visual detection result. Based on the visual detection result and the compliance detection result, a verification result corresponding to the modified data is obtained, such as whether the modified data is compliant and whether it should be displayed. In this way, by combining compliance judgment and display layer attack detection, it is helpful to realize the judgment of different verification levels of modified data, which can effectively avoid misjudging compliant modifications as tampering and improve the accuracy of modified data judgment.

[0119] Optionally, the determining module is configured to: Based on the form fields in the modified data, the object category of the modified data corresponding to the form fields is determined as the form category; Based on the document directory field in the modified data, the object category of the modified data corresponding to the document directory field is determined to be the page content category; Based on the signature field in the modified data, the object category of the modified data corresponding to the signature field is determined as the signature field category; Based on the comment field in the modified data, the object category of the modified data corresponding to the comment field is determined to be the comment category; Based on the verification information structure field in the modified data, the object category of the modified data corresponding to the verification information structure field is determined as the verification information structure category.

[0120] In this embodiment of the application, by identifying the fields in the modified data, the object category of the modified data is determined according to different fields, and then the modified data is judged for compliance based on different object categories and compliance judgment rules.

[0121] Optionally, the determining module is configured to: Determine the form fields in the modified data; Based on the form fields, the object category of the modified data is determined to be a form category using the following judgment method; wherein, the judgment method includes: judging the form fields, the array fields corresponding to the form fields, and the field values ​​or form reset default values ​​corresponding to the array fields, and judging that the type of the form fields is not a signature field type, or that the form fields are visual component fields and the modified data is an input value.

[0122] In this embodiment, it is determined whether the modified data belongs to the form category by judging whether the modified data corresponds to the change of field value, default value and / or option value of non-signature field in the AcroForm dictionary, or is only a change of input value on the form visualization component.

[0123] Optionally, the determining module is configured to: Determine the page dictionary under the document directory corresponding to the modified data, wherein the page dictionary includes resource information and content information, and the resource information includes images, fonts and formatting; Based on the page dictionary and page path, determine whether the object category of the modified data is the page content category.

[0124] In this embodiment of the application, the object category of the modified data is determined to be the page text category by judging whether the change path of the modified data is located in the content stream or resource dictionary under the page dictionary through the document directory and page tree, or by judging the resource objects and structured markup content that are referenced on the page path and affect the rendering of the main text.

[0125] Optionally, the compliance determination rules include document-level modification sub-rules and field-level modification sub-rules, and the determination module is used for: Get the current modified value of the object category; The current modified value is matched with the preset modified value in the document-level modification sub-rule to determine the target allowed modification category and the target violation modification type corresponding to the current modified value. The document-level modification sub-rule includes the preset modified value and the allowed modification category and violation modification category corresponding to the preset modified value.

[0126] In this embodiment of the application, compliance determination rules are set, including document-level modification sub-rules and field-level modification sub-rules, and these compliance determination rules are used to determine whether the modified data is compliant. Optionally, the determination module is used to: When the object category is a form category, the modified data is judged using the field-level modification sub-rule to obtain the compliance judgment result. The field-level modification sub-rule includes form fields that are allowed to be modified or form fields that are not allowed to be modified.

[0127] In this application embodiment, for modified data of form categories, in addition to using document-level modification sub-rules for judgment, field-level modification sub-rules can also be used for more detailed judgment, and compliance judgment can be made on modified data based on form fields that are not allowed to be modified.

[0128] Optionally, the detection module is used for: Based on the fields in the modified data and the pre-set attack detection rules, the visual detection result corresponding to the modified data is determined. The pre-set attack detection rules include reference hiding sub-rules, sequential overlay sub-rules, superimposed replacement sub-rules, page stream injection sub-rules, and abnormal incremental structure sub-rules.

[0129] In this embodiment, the visual detection result corresponding to the modified data is determined based on the fields in the modified data and the pre-set attack detection rules. This can reflect the suspected attack on the display layer, even if the compliance judgment allows changes to form types.

[0130] It is understood that the above-described device embodiments correspond to the method embodiments of the present invention. The signed file verification device provided by the embodiments of the present invention can implement the signed file verification method provided by any one of the method embodiments of the present invention.

[0131] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working process of the device described above can be referred to the corresponding process in the aforementioned method, and will not be elaborated further here.

[0132] like Figure 7 As shown, some embodiments of this application provide an electronic device 700, which includes: a memory 710, a processor 720, and a computer program stored on the memory 710 and executable on the processor 720. When the processor 720 reads the program from the memory 710 via a bus 730 and executes the program, it can implement any of the methods included in the above-described verification method for signed documents.

[0133] Processor 720 can process digital signals and can include various computing architectures. For example, it can be a complex instruction set computer architecture, a reduced instruction set computer architecture, or an architecture that implements multiple instruction set combinations. In some examples, processor 720 can be a microprocessor.

[0134] The memory 710 can be used to store instructions executed by the processor 720 or data related to the execution of instructions. These instructions and / or data may include code for implementing some or all of the functions of one or more modules described in the embodiments of this application. The processor 720 of this disclosure embodiment can be used to execute the instructions in the memory 710 to implement the signed document verification method shown above. The memory 710 includes dynamic random access memory, static random access memory, flash memory, optical memory, or other memories well known to those skilled in the art.

[0135] Some embodiments of this application also provide a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the method for verifying a signed file as described in the method embodiments.

[0136] Some embodiments of this application also provide a computer program product that, when run on a computer, causes the computer to perform the method for verifying a signed file as described in the method embodiments.

[0137] It should be noted that the various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For apparatus embodiments, since they are basically similar to method embodiments, the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0138] It should be understood, in the several embodiments provided in this application, that the disclosed apparatus and methods can also be implemented in other ways. The apparatus embodiments described above are merely illustrative; for example, the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram and / or flowchart, and combinations of blocks in block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0139] In addition, the functional modules in the various embodiments of this application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0140] If the aforementioned functions are implemented as software functional modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0141] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application. It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0142] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0143] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

Claims

1. A method for verifying a signed file, characterized in that, The method includes: If the digital signature of the target file passes cryptographic integrity verification, the modified data in the target file to be verified is obtained, wherein the target file is a signed PDF file, and the modified data is a change record extracted from the post-signed incremental update section through object-level difference comparison. Based on the field information of the modified data, determine the object category corresponding to the modified data; Based on the pre-established compliance judgment rules and the object category, the modified data is judged for compliance, and a compliance judgment result is obtained. The compliance judgment rules are used to determine whether the modified data is compliant, and the compliance judgment rules include document-level modification sub-rules and field-level modification sub-rules. If the modified data is compliant, a display layer attack detection is performed on the modified data to obtain a visual detection result; Based on the compliance judgment result and the visual inspection result, the verification result of the modified data in the target file is determined. The verification result includes the verification level and the judgment result corresponding to the verification level. The judgment result includes the modified data being non-compliant and displayed, the modified data being non-compliant and not displayed, the modified data being compliant and displayed, and the modified data being compliant and not displayed.

2. The method for verifying a signed document according to claim 1, characterized in that, The step of determining the object category corresponding to the modified data based on the field information of the modified data includes: Based on the form fields in the modified data, the object category of the modified data corresponding to the form fields is determined as the form category; Based on the document directory field in the modified data, the object category of the modified data corresponding to the document directory field is determined to be the page content category; Based on the signature field in the modified data, the object category of the modified data corresponding to the signature field is determined as the signature field category; Based on the comment field in the modified data, the object category of the modified data corresponding to the comment field is determined to be the comment category; Based on the verification information structure field in the modified data, the object category of the modified data corresponding to the verification information structure field is determined as the verification information structure category.

3. The method for verifying a signed document according to claim 2, characterized in that, The step of determining the object category of the modified data corresponding to the form field as a form category based on the form field in the modified data includes: Determine the form fields in the modified data; Based on the form fields, the object category of the modified data is determined to be a form category using the following judgment method; wherein, the judgment method includes: judging the form fields, the array fields corresponding to the form fields, and the field values ​​or form reset default values ​​corresponding to the array fields, and judging whether the type of the form field is not a signature field type, or whether the form field is a visual component field and the modified data is an input value.

4. The method for verifying a signed document according to claim 2, characterized in that, The step of determining the object category of the modified data corresponding to the document directory field as the page content category based on the modified data includes: Determine the page dictionary under the document directory corresponding to the modified data, wherein the page dictionary includes resource information and content information, and the resource information includes images, fonts and formatting; Based on the page dictionary and page path, determine whether the object category of the modified data is the page content category.

5. The method for verifying a signed document according to claim 1, characterized in that, The compliance determination rules include document-level modification sub-rules and field-level modification sub-rules. The process of performing compliance determination on the modified data based on the pre-established compliance determination rules and the object category to obtain a compliance determination result includes: Get the current modified value of the object category; The current modified value is matched with the preset modified value in the document-level modification sub-rule to determine the target allowed modification category and the target violation modification type corresponding to the current modified value. The document-level modification sub-rule includes the preset modified value and the allowed modification category and violation modification category corresponding to the preset modified value.

6. The method for verifying a signed document according to claim 5, characterized in that, The process of performing a compliance assessment on the modified data based on pre-established compliance assessment rules and the object category, and obtaining a compliance assessment result, includes: When the object category is a form category, the modified data is judged using the field-level modification sub-rule to obtain the compliance judgment result. The field-level modification sub-rule includes form fields that are allowed to be modified or form fields that are not allowed to be modified.

7. The method for verifying a signed document according to claim 1, characterized in that, If the modified data is compliant, the step of performing display layer attack detection on the modified data to obtain visual detection results includes: Based on the fields in the modified data and the pre-set attack detection rules, the visual detection result corresponding to the modified data is determined. The pre-set attack detection rules include reference hiding sub-rules, sequential overlay sub-rules, superimposed replacement sub-rules, page stream injection sub-rules, and abnormal incremental structure sub-rules.

8. A verification device for a signed document, characterized in that, The device includes: The acquisition module is used to acquire the modified data in the target file to be verified, provided that the digital signature of the target file has passed the cryptographic integrity verification, wherein the target file is a signed PDF file; The determination module is used to determine the object category corresponding to the modified data based on the field information of the modified data; The judgment module is used to perform compliance judgment on the modified data according to the pre-established compliance judgment rules and the object category, and obtain a compliance judgment result, wherein the compliance judgment rules are used to determine whether the modified data is compliant; The detection module is used to perform display layer attack detection on the modified data if the modified data is compliant, and obtain visual detection results; The verification module is used to determine the verification result of the modified data in the target file based on the compliance judgment result and the visual inspection result. The verification result includes a verification level and a judgment result corresponding to the verification level. The judgment result includes the modified data being non-compliant and displayed, the modified data being non-compliant and not displayed, the modified data being compliant and displayed, and the modified data being compliant and not displayed.

9. The verification device for signed documents according to claim 8, characterized in that, The determining module is used for: Based on the form fields in the modified data, the object category of the modified data corresponding to the form fields is determined as the form category; Based on the document directory field in the modified data, the object category of the modified data corresponding to the document directory field is determined to be the page content category; Based on the signature field in the modified data, the object category of the modified data corresponding to the signature field is determined as the signature field category; Based on the comment field in the modified data, the object category of the modified data corresponding to the comment field is determined to be the comment category; Based on the verification information structure field in the modified data, the object category of the modified data corresponding to the verification information structure field is determined as the verification information structure category.

10. An electronic device, characterized in that, It includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, it can implement the verification method for a signed document as described in any one of claims 1-7.

11. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the method for verifying a signed document as described in any one of claims 1-7.

12. A computer program product, said computer program product comprising a computer program, wherein, When the computer program is executed by a processor, it can implement the verification method for signed files as described in any one of claims 1-7.

Images