Method and system for integrating user identity verification and electronic signature

Abstract

A method and system integrating user identity verification and electronic signatures are disclosed. The user's terminal device transmits data to be signed to the user's mobile device via an application server and a verification server. After obtaining the user's consent and completing the user's biometric identity verification, the mobile device electronically signs the data to be signed. The signed data and its verification code are then transmitted back to the verification server, which receives and verifies the signature and verification code. Once the signature and verification code are verified, the signature result is provided to the application server. Therefore, this invention can complete the aforementioned identity verification and electronic signature with a single integrated mechanism, and can represent the user's signing intention, thus complying with the regulations of the Electronic Signature Law.

Description

Technical Field

[0001] This invention relates to technologies for cross-device key operation, biometric-based identity verification, and electronic signatures, and particularly to a method and system for integrating user identity verification and electronic signatures. Prior Technology

[0002] Mobile device-based identity verification technology is already widespread. For example, in applications (APPs) that provide financial or securities services, identity verification technology is used to identify and verify the user's identity.

[0003] However, as a key carrier, the mobile device running these applications can currently only provide services limited to biometric identification for individual applications or to provide software credential keys required for securities orders. It cannot be used across applications or platforms, nor does it have electronic signature functionality.

[0004] Furthermore, the order placement applications of major securities firms, after obtaining financial order certificates from the certificate management center, exist in the application as software certificate keys without adequate protection. The order accounts still use weak passwords for login control; once logged in, one can freely apply for and update certificates, and then freely place orders to conduct transactions, rendering the financial institution's identity verification mechanism virtually useless.

[0005] Furthermore, the software credential key pair used by securities order placement applications is in the format of Public Key Cryptography Standards (PKCS) #12 software key, which has a relatively insufficient level of security protection.

[0006] Furthermore, while existing mobile applications can use biometric technology to verify user identity, these applications cannot electronically sign documents, let alone express the signer's intentions. Summary of the Invention

[0007] To address the aforementioned problems, this invention provides a method integrating user identity verification and electronic signature, executed by an application server and a verification server. The method includes: the application server receiving data to be signed uploaded by a user's terminal device; encapsulating the data to be signed and the user's identity information into a signature request; and then transmitting the signature request to the verification server. The verification server then queries the user's mobile device identification information based on the identity information; encapsulates the data to be signed and the mobile device identification information into a cross-device credential; and then transmits the cross-device credential to the user's... A mobile device is configured to execute a verification and signing procedure, wherein the verification and signing procedure includes: prompting the user whether to agree to use mobile credentials to sign the document to be signed; after the user agrees, verifying the user's identity based on the user's biometrics; and after the user passes the identity verification, transmitting the signing result of the document to be signed and the verification code of the signing result back to the verification server; and having the verification server verify the signing result and the verification code; and after the signing result and the verification code pass the verification, providing the signing result to the application server.

[0008] The present invention also provides a system integrating user identity verification and electronic signature, including an application server and a verification server. The application server receives data to be signed uploaded by a user's terminal device, encapsulates the data to be signed and the user's identity information into a signature request, and then transmits the signature request. The verification server receives the signature request, queries the user's mobile device identification information based on the identity information, encapsulates the data to be signed and the mobile device identification information into a cross-device credential, and then transmits the cross-device credential to the user's mobile device to cause the mobile device to execute a verification signature procedure. The verification signature procedure includes: prompting the user whether they agree to use the mobile credential to sign the data to be signed; after the user agrees, verifying the user's identity based on their biometrics; and after the user passes the identity verification, transmitting the signature result of the data to be signed and the verification code of the signature result back to the verification server. In addition, the verification server is reused to verify the signature result and the verification code, so that after the signature result and the verification code are verified, the signature result is provided to the application server.

[0009] By employing the aforementioned technical means, this invention can complete user identity verification and electronic signature with a single integrated mechanism, and can present the user's signature intention, thus complying with the regulations of the Electronic Signature Law. Simple Explanation of the Diagram

[0010] Figure 1 is an architecture diagram of a system integrating user identity verification and electronic signature according to an embodiment of the present invention.

[0011] Figure 2 is a flowchart of a method for integrating user identity verification and electronic signature according to an embodiment of the present invention. Implementation

[0012] The following specific embodiments illustrate the implementation of the present invention. Those skilled in the art can easily understand other advantages and effects of the present invention from the content disclosed in this specification.

[0013] Figure 1 is an architecture diagram of a system 10 integrating user identity verification and electronic signature according to an embodiment of the present invention.

[0014] System 10 includes an application server 200 and an authentication server 300. The application server 200 and the authentication server 300 can be connected via the Internet. In addition, the application server 200 and the authentication server 300 can be connected to the user's terminal device 100 and mobile device 400 via the Internet.

[0015] The terminal device 100 may be the user's desktop computer or laptop computer, wherein the terminal device 100 stores the data to be signed 101.

[0016] Application server 200 includes signature request encapsulation module 201.

[0017] The verification server 300 includes a cross-device credential generation module 301, a signature result verification module 302, and a signature result access module 303, and stores the device binding public key 304 of the mobile device 400.

[0018] Mobile device 400 can be a smartphone or tablet running Apple's iOS, Android, or other mobile operating systems. Mobile device 400 includes a cross-device credential verification module 401 and a signature result calculation module 402, and stores a mobile credential 403 and a device-bound private key 404. The device-bound public key 304 and the device-bound private key 404 form a key pair.

[0019] The modules 201, 301-303 and 401-402 shown in Figure 1 can be either software or hardware. If they are hardware, they can be processing units, processing cores or processors with data processing and computing capabilities. If they are software, they can include processing units, processing cores or program instructions executable by the processor.

[0020] Figure 2 is a flowchart of a method for integrating user identity verification and electronic signature executed by system 10.

[0021] When a user uses the application services provided by the application server 200 through the terminal device 100, the system 10 can execute this method to perform user identity verification and electronic signature required by the application service.

[0022] In one embodiment, the application service may be a document system of a government agency or corporate organization, or in another embodiment, the application service may be an online transaction system of finance, securities or e-commerce, and the aforementioned user identity verification and electronic signature are used to ensure the transaction content.

[0023] The following describes the method flow shown in Figure 2.

[0024] In step S1, the terminal device 100 uploads the document to be signed 101 to the application server 200. The document to be signed 101 can be provided or entered by the user in advance. For example, the document to be signed 101 can be a document or file that requires the user to electronically sign. Alternatively, the user's credentials can be used to electronically sign the document to be signed later.

[0025] In step S2, the signature request encapsulation module 201 of the application server 200 receives the data to be signed 101, encapsulates the data to be signed 101 and the identity information previously provided by the user into a signature request, and then sends the signature request to the verification server 300.

[0026] In step S3, the cross-device credential generation module 301 of the verification server 300 receives the signature request. Based on the user's identity information in the signature request, it queries the mobile device identification information of the mobile device 400 previously bound to the user during registration. The data to be signed and the mobile device identification information are encapsulated into a cross-device credential, which is then transmitted to the user's mobile device 400 to enable the mobile device 400 to execute the verification signature procedure. Furthermore, this verification signature procedure includes subsequent steps S4 to S7.

[0027] To transmit the cross-device credential to the mobile device 400, the cross-device credential generation module 301 of the verification server 300 can cause the user's terminal device 100 to display a barcode corresponding to the cross-device credential, such as a one-dimensional barcode, a two-dimensional barcode, or a quick response code (QR code). The barcode may contain the cross-device credential or a download URL for the cross-device credential. The user can then have the mobile device 400 scan the barcode to obtain the cross-device credential.

[0028] Alternatively, the cross-device credential generation module 301 of the verification server 300 can transmit the cross-device credential to the mobile device 400 based on the mobile device identification information and via push notification of the application (APP).

[0029] In step S4, the cross-device credential verification module 401 of the mobile device 400 receives the cross-device credential transmitted by the verification server 300, and then verifies whether the mobile device identification information in the cross-device credential is consistent with the mobile device identification information recorded by the mobile device 400 itself.

[0030] If the mobile device identification information in the cross-device credential does not match the mobile device identification information recorded by mobile device 400, the cross-device credential verification module 401 terminates the process shown in Figure 2, and all subsequent steps are not executed. Conversely, if the mobile device identification information in the cross-device credential matches the mobile device identification information recorded by mobile device 400, the process proceeds to step S5.

[0031] In step S5, the cross-device credential verification module 401 of the mobile device 400 prompts the user whether he agrees to use the mobile credentials 403 previously registered by the user on the mobile device 400 to sign the document 101 to be signed.

[0032] If the user does not agree to the signature, the cross-device credential verification module 401 terminates the process shown in Figure 2, and all subsequent steps are not executed. Conversely, if the user agrees to the signature, the process proceeds to step S6.

[0033] In step S6, the signature result calculation module 402 of the mobile device 400 verifies the user's identity based on the user's biometrics. The user's biometrics may include at least one of the user's facial features, fingerprint features, and iris features, and the mobile device 400 includes corresponding sensors to read the biometrics.

[0034] If the user fails the identity verification, the signature result calculation module 402 terminates the process shown in Figure 2, and all subsequent steps are not executed. Conversely, if the user passes the identity verification, the process proceeds to step S7.

[0035] In step S7, the signature result calculation module 402 of the mobile device 400 uses the signature private key corresponding to the mobile credential 403 to calculate the data 101 to be signed to generate a signature result. Then, it uses the device binding private key 404 stored in the mobile device 400 to calculate the signature result to generate a verification code for the signature result. Finally, the signature result and the verification code are sent back to the verification server 300.

[0036] In step S8, the signature result verification module 302 of the verification server 300 receives the signature result and the verification code, and uses the device binding public key 304 of the mobile device 400 to verify the signature result and the verification code.

[0037] If the signature and verification code fail the verification, the signature verification module 302 terminates the process shown in Figure 2, and all subsequent steps are not executed. Conversely, if the signature and verification code pass the verification, the process proceeds to step S9.

[0038] In step S9, the signature result access module 303 of the verification server 300 provides the signature result to the application server 200. For example, the cross-device credential generation module 301 of the verification server 300 can generate the cross-device credential in step S3 and then transmit the cross-device credential to the application server 200. Then, the application server 200 can query the verification server 300 based on the cross-device credential to obtain the signature result from the signature result access module 303 of the verification server 300.

[0039] Compared with existing technologies, the method and system for integrating user identity verification and electronic signature of the present invention have the following advantages:

[0040] First, users can initiate biometric identification verification and electronic document signing across devices, platforms, and applications (APPs) according to the operational needs of the application services, and use a single integrated mechanism to complete the aforementioned identification verification and electronic signing, and then send the signed document or verification result to the required service, thereby avoiding the complexity of system switching and data connection between different mechanisms.

[0041] Secondly, by using the software development kit (SDK) and the PKCS#11 standard function library to perform standard access operations on the key, the protection of the key can be enhanced to prevent the key from being misused without the authorization of the mobile device owner.

[0042] Third, after receiving the signature result and verification code, the verification server will confirm that the data is returned by the user's registered and bound mobile device to prevent the user's identity information from being misused by others.

[0043] Fourth, the invention obtains user authorization through the user's mobile device, performs an electronic signature on the mobile device, and then sends the signature result back to the application server that needs the service. Since the electronic signature is based on the user's wishes, the invention can represent the user's expression of wishes and comply with the regulations of the Electronic Signature Law.

[0044] Fifth, the user's identity verification and electronic signature are performed using the mobile credentials linked to the user's mobile device. This eliminates the need for traditional credential chip cards and avoids the inconvenience of needing to connect to an additional card reader to insert a chip card for identity verification and electronic signature.

[0045] The above embodiments are merely illustrative of the principles and effects of the present invention and are not intended to limit the invention. Anyone skilled in the art can modify and alter the above embodiments without departing from the spirit and scope of the present invention. Therefore, the scope of protection of this invention should be as set forth in the following patent claims.

[0046] 10: A system integrating user authentication and electronic signatures 100: Terminal device 101: Documents pending signature 200: Application Server 201: Signature Request Encapsulation Module 300: Verification Server 301: Cross-device certificate manufacturing module 302: Signature Result Verification Module 303: Signature Result Storage Module 304: Device Binding Public Key 400: Mobile Device 401: Cross-device credential verification module 402: Signature Result Calculation Module 403: Action Certificate 404: Device bound to private key S1~S9: Steps

Claims

1. A method for integrating user authentication and electronic signature, executed by an application server and an authentication server, the method comprising: After receiving the data to be signed uploaded by the user's terminal device, the application server encapsulates the data to be signed and the user's identification information into a signing request, and then sends the signing request to the verification server. The verification server queries the user's mobile device identification information based on the identification information, encapsulates the data to be signed and the mobile device identification information into a cross-device credential, and then sends the cross-device credential to the user's mobile device, causing the mobile device to execute the verification signing procedure. The verification signing procedure includes prompting the user whether they agree to use the mobile credential to sign the data to be signed. After the user agrees, the user's identity is verified based on their biometrics. After the user passes the identity verification, the signing private key corresponding to the mobile credential is used to process the data to be signed to generate a signing result. The device binding private key stored on the mobile device is used to process the signing result to generate a verification code for the signing result. The signing result and the verification code are then sent back to the verification server. The verification server verifies the signing result and the verification code. After the signing result and the verification code pass the verification, the signing result is provided to the application server.

2. The method as described in claim 1, further comprising: The verification server instructs the terminal device to display the barcode corresponding to the cross-device credential, so that the mobile device can scan the barcode to obtain the cross-device credential.

3. The method as described in claim 1, wherein, The verification server transmits the cross-device credentials to the mobile device based on the mobile device identification information and via application push.

4. The method as described in claim 1, wherein, The verification and signing procedure executed by the verification server on the mobile device further includes: verifying whether the mobile device identification information in the cross-device credential matches the mobile device identification information recorded by the mobile device. If the mobile device identification information in the cross-device credential matches the mobile device identification information recorded by the mobile device, the user is prompted whether to agree to the signing; otherwise, the user is not prompted whether to agree to the signing.

5. The method as described in claim 1, wherein, The verification and signing procedure executed by the mobile device by the verification server further includes: if the user does not agree to the signing, then the user's identity is not verified based on the biometrics; and if the user fails the identity verification, then the signing result and the verification code are not sent back to the verification server.

6. The method as described in claim 1, wherein, The verification server uses the device-bound public key of the mobile device to verify the signature result and the verification code.

7. The method as described in claim 1, further comprising: If the signature result and the verification code fail the verification of the verification server, the verification server will not provide the signature result to the application server.

8. The method as described in claim 1, further comprising: After the signature result and the verification code are verified by the verification server, the application server obtains the signature result from the verification server based on the cross-device credentials.

9. A system integrating user identity verification and electronic signature, comprising: An application server is configured to receive data to be signed uploaded by a user's terminal device, encapsulate the data to be signed along with the user's identification information into a signing request, and then transmit the signing request; and a verification server is configured to receive the signing request, query the user's mobile device identification information based on the identification information, encapsulate the data to be signed along with the mobile device identification information into a cross-device credential, and then transmit the cross-device credential to the user's mobile device, so that the mobile device executes a verification signing procedure, wherein the verification signing procedure includes: prompting the user whether they agree to use the mobile credential to sign the data to be signed, so as to... After the user agrees, the user's identity is verified based on their biometrics. After the user passes the identity verification, the signing private key corresponding to the mobile credential is used to process the data to be signed to generate a signing result. The device binding private key stored on the mobile device is used to process the signing result to generate a verification code. The signing result and the verification code are then sent back to the verification server. The verification server is used to verify the signing result and the verification code. After the signing result and the verification code are verified, the signing result is provided to the application server.

Images