WO2020215575A1

WO2020215575A1 - Blockchain-based signature file saving method and apparatus, and computer device

Info

Publication number: WO2020215575A1
Application number: PCT/CN2019/103540
Authority: WO
Inventors: 李洪; 江琳; 刘翔
Original assignee: 平安科技（深圳）有限公司
Priority date: 2019-04-25
Filing date: 2019-08-30
Publication date: 2020-10-29
Also published as: CN110175467A

Abstract

A blockchain-based signature file saving method and apparatus, a computer device, and a storage medium. The method comprises: receiving a request for signature on a specified signature file sent by a terminal having a ukey inserted thereon; obtaining a digital certificate sent by the terminal; if the identity of the terminal is verified to be correct, allowing the terminal to execute a signature operation on the specified signature file; determining whether the specified signature file having a signature is valid; and if the specified signature file is valid, saving the specified signature file having the signature in all blockchain nodes in a pre-constructed blockchain network, a server being a blockchain node of the blockchain. Therefore, signing on a signature file is supported, the signature file is saved, and the authenticity of the signature file is ensured.

Description

Block chain-based signature file preservation method, device and computer equipment

This application claims the priority of a Chinese patent application filed with the Chinese Patent Office on April 25, 2019, the application number is 201910341157.3, and the invention title is "Blockchain-based signature file preservation method, device and computer equipment", and its entire content Incorporated in this application by reference.

Technical field

This application relates to the computer field, in particular to a method, device, computer equipment and storage medium for saving signature files based on blockchain.

Background technique

In the development process of enterprises, contracts are implemented in the form of contracts, and electronic contracts are increasingly becoming a development trend. In order to realize the online signing of electronic contracts, electronic contracts are generally signed on third-party online signing platforms. However, the authority of the third-party online contract platform is difficult to guarantee, and it is not suitable to save the signed electronic contract. It is relatively easy to tamper with the electronic contract. Therefore, the security of the electronic contract cannot be guaranteed. If there is a contract dispute , The electronic contract stored in the third-party online contracting platform may be tampered with, so the authenticity of the electronic contract will be questioned, which is not conducive to the settlement of disputes. The inventor realizes that the prior art lacks a technical solution that can support the signing of electronic contracts, preserve electronic contracts, and ensure the authenticity of electronic contracts.

technical problem

The main purpose of this application is to provide a method, device, computer equipment and storage medium for saving signature files based on blockchain, which aims to support signature file signing, save signature files and ensure the authenticity of signature files.

Technical solutions

In order to achieve the above-mentioned purpose of the invention, this application proposes a method for saving signature files based on blockchain, which is applied to a server and includes the following steps:

Receiving a signature request on a designated signature file sent by a terminal plugged with ukey, where a digital certificate is stored in the ukey;

Obtain the digital certificate sent by the terminal, and verify the identity of the terminal according to the digital certificate using a ukey signature plug-in in a preset integrated plug-in, wherein the integrated plug-in includes a ukey signature plug-in and a digital certificate verification plug-in ；

If the identity verification of the terminal is correct, allowing the terminal to perform a signature operation on the designated signature file to obtain a designated signature file with a signature;

Judging whether the specified signature file with signature is valid according to a preset verification rule, wherein the preset verification rule at least includes using the digital certificate verification plug-in to verify the validity of the digital certificate;

If the designated signature file is valid, save the designated signature file with signature in all blockchain nodes in the pre-built blockchain network, where the server is a block of the blockchain Chain node.

This application provides a block chain-based signature file storage device, which is applied to a server, and includes:

A signature request receiving unit, configured to receive a signature request on a designated signature file sent by a terminal plugged with ukey, wherein a digital certificate is stored in the ukey;

The identity verification unit is configured to obtain the digital certificate sent by the terminal, and verify the identity of the terminal according to the digital certificate using a ukey signature plug-in in a preset integrated plug-in, wherein the integrated plug-in includes a ukey signature plug-in And digital certificate verification plug-in;

A designated signature file obtaining unit, configured to allow the terminal to perform a signature operation on the designated signature file to obtain a designated signature file with a signature if the identity verification of the terminal is correct;

The validity judging unit is configured to judge whether the specified signature file with signature is valid according to a preset verification rule, wherein the preset verification rule at least includes using the digital certificate verification plug-in to verify the validity of the digital certificate Sex

The designated signature file storage unit is configured to, if the designated signature file is valid, save the designated signature file with a signature in all blockchain nodes in a pre-built blockchain network, where the server is A block chain node of the block chain.

The present application provides a computer device including a memory and a processor, the memory stores a computer program, and the processor implements the steps of any one of the above methods when the computer program is executed.

The present application provides a non-volatile computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, the steps of any one of the above methods are implemented.

Beneficial effect

The blockchain-based signature file storage method, device, computer equipment and storage medium of this application receive a signature request on a designated signature file sent by a terminal plugged in Ukey, and if the terminal’s identity verification is correct, it is allowed The terminal performs a signature operation on the designated signature file to obtain a designated signature file with a signature, and if the designated signature file is valid, the designated signature file is recorded to all areas in the pre-built blockchain network Block chain node. In this way, online signing and saving of signature files are realized and the authenticity of the saved signature files is guaranteed.

Description of the drawings

FIG. 1 is a schematic flowchart of a method for saving a signature file based on a blockchain according to an embodiment of the application;

FIG. 2 is a schematic block diagram of the structure of a block chain-based signature file storage device according to an embodiment of the application;

FIG. 3 is a schematic block diagram of the structure of a computer device according to an embodiment of the application.

The realization, functional characteristics, and advantages of the purpose of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings.

The best mode of the invention

In order to make the purpose, technical solutions, and advantages of this application clearer, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described here are only used to explain the application, and not used to limit the application.

1, an embodiment of the present application provides a method for saving a signature file based on a blockchain, which is applied to a server and includes the following steps:

S1. Receive a signature request on a designated signature file sent by a terminal plugged with ukey, where a digital certificate is stored in the ukey;

S2. Obtain the digital certificate sent by the terminal, and verify the identity of the terminal according to the digital certificate using a ukey signature plug-in in a preset integrated plug-in, wherein the integrated plug-in includes a ukey signature plug-in and a digital certificate verification Verification plug-in;

S3. If the identity verification of the terminal is correct, allowing the terminal to perform a signature operation on the designated signature file to obtain a designated signature file with a signature;

S4. Determine whether the specified signature file with signature is valid according to a preset verification rule, wherein the preset verification rule at least includes using the digital certificate verification plug-in to verify the validity of the digital certificate;

S5. If the specified signature file is valid, save the specified signature file with the signature in all blockchain nodes in the pre-built blockchain network, where the server is one of the blockchains Blockchain node.

As described in the above step S1, receiving a signature request on a designated signature file sent by a terminal plugged with ukey, wherein a digital certificate is stored in the ukey. Among them, ukey (also known as USBKEY) is a small storage device that is directly connected to the computer via USB (Universal Serial Bus Interface), has a password verification function, and is reliable and high-speed. A digital certificate is stored in the ukey to verify the ukey support. The identity of the owner and the execution of the signature operation. Digital certificate refers to an authoritative third-party organization-CA (Certificate Authority, e-commerce certification authority) issued by the certificate used to identify the identity on the network, can also be called a CA certificate. The digital certificate includes the identity information of the holder and the certificate public key, and the corresponding certificate private key is held by the user corresponding to the ukey. The designated signature file can be any electronic file that requires an electronic signature, such as an electronic contract. A terminal with ukey plugged in is more secure than a terminal without ukey plugged in due to the use of the identity verification function of ukey.

As described in step S2 above, obtain the digital certificate sent by the terminal, and verify the identity of the terminal according to the digital certificate using the ukey signature plug-in in the preset integrated plug-in, wherein the integrated plug-in includes the ukey signature Plug-in and digital certificate verification plug-in. This embodiment adopts an integrated plug-in including a ukey signature plug-in and a digital certificate verification plug-in. Compared with a separate plug-in, the step of calling the plug-in is saved, and the plug-ins that need to be used in this method are called uniformly at one time, and the integration is high. , Time-saving and efficient. The process of verifying the identity of the terminal by the ukey signature plug-in can be in any manner, for example, obtaining a corresponding data certificate from the CA that issued the data certificate, and judging the data certificate of the CA organization and the data sent by the terminal Whether the certificates are the same, if they are the same, it is determined that the identity of the terminal is true. Further, the process of verifying the identity of the terminal by the ukey signature plug-in includes: obtaining the digital certificate sent by the terminal, information used for identity verification, and verifying the information used for identity verification according to the certificate private key Encrypting the ciphertext; using the ukey signature plug-in to obtain the certificate public key from the digital certificate; using the ukey signature plug-in to decrypt the ciphertext using the certificate public key to obtain decryption information; It is determined whether the decrypted information is the same as the information used for identity verification; if the decrypted information is the same as the information used for identity verification, it is determined that the identity verification of the terminal is correct.

As described in step S3 above, if the identity verification of the terminal is correct, the terminal is allowed to perform a signature operation on the designated signature file to obtain a designated signature file with a signature. If the identity verification of the terminal is correct, it is certain that there will be no impersonation phenomenon, so the terminal is allowed to perform a signature operation on the designated signature file to obtain a designated signature file with a signature.

As described in step S4 above, it is determined whether the designated signature file with signature is valid according to a preset verification rule, wherein the preset verification rule at least includes using the digital certificate verification plug-in to verify the digital certificate Effectiveness. As mentioned above, although the identity of the terminal has been determined to be correct, the validity of the digital certificate needs further confirmation. The process of using the digital certificate verification plug-in to verify the validity of the digital certificate includes: extracting the validity-related information of the digital certificate from the digital certificate, such as the effective date, the issuing CA institution, etc., Then judge whether the digital certificate is valid according to the information related to validity, for example, judge whether the current date is within the valid date. Further, the process of judging whether the specified signature file with the signature is valid according to a preset inspection rule may also include any method for judging whether the signature file is valid.

As described in step S5 above, if the designated signature file is valid, the designated signature file with the signature is stored in all the blockchain nodes in the pre-built blockchain network, where the server is the A blockchain node of the blockchain. If the designated signature file is valid, save the designated signature file to complete online signature storage. In order to ensure the security of the designated signature file and ensure that the content of the designated signature file is not tampered with, the designated signature file is recorded in all the blockchain nodes in the pre-built blockchain (that is, stored in the blockchain In the public account book), the data can not be changed by the blockchain to increase the security of the specified signature file. Wherein, the block chain can be constructed in any manner, for example, the server can be used as the initiator of the block chain network. The specific process includes: creating a Blockchain class (block chain class) in any feasible language. Create a list for storing the blockchain in the constructor; after instantiating the Blockchain class, create the genesis block (the first block before the block); determine the consensus mechanism of the blockchain (such as workload Proof mechanism, equity proof mechanism, share authorization proof mechanism and Pool verification pool); receiving the terminal that agrees to the consensus mechanism as the node of the blockchain network, thereby obtaining the pre-built blockchain network. Wherein, the nodes (interacting subjects) of the blockchain network may be terminals that agree to the consensus mechanism. Among them, each node is connected to each other to verify whether the data has been tampered with (using hash value and asymmetric encryption technology in the blockchain). The blockchain may be a public chain, a consortium chain or a private chain.

In one embodiment, the digital certificate records the certificate public key, the user corresponding to the ukey holds the certificate private key, and the digital certificate sent by the terminal is obtained, and a preset integrated plug-in is used The Ukey signature plug-in of the Ukey verifies the identity of the terminal according to the digital certificate, wherein the integrated plug-in includes the Ukey signature plug-in and the digital certificate verification plug-in. Step S2 includes:

S201. Obtain the digital certificate sent by the terminal, the information used for identity verification, and the ciphertext obtained by encrypting the information used for identity verification according to the certificate private key;

S202. Use the ukey signature plug-in to obtain the certificate public key from the digital certificate;

S203. Use the certificate public key to decrypt the ciphertext to obtain decryption information;

S204: Determine whether the decryption information is the same as the information used for identity verification;

S205: If the decrypted information is the same as the information used for identity verification, it is determined that the identity verification of the terminal is correct.

As described above, verification of the identity of the terminal is achieved. The certificate public key is recorded in the digital certificate, and the user corresponding to the ukey holds the certificate private key. Therefore, when the identity of the terminal needs to be verified, the certificate private key held by the user is used by the user. The information used for identity verification (which can be any information used for comparison with the information decrypted by the server) is encrypted to obtain ciphertext. The server can perform decryption operations through the certificate public key clearly recorded in the digital certificate. If the ciphertext is not obtained by encrypting the certificate private key, the decryption information obtained by the server through the certificate public key decryption must be different from the information used for identity verification, so that the identity of the terminal can be determined Otherwise, it is determined that the identity verification of the terminal is correct.

In one embodiment, said determining whether the designated signature file with signature is valid according to a preset verification rule, wherein the preset verification rule at least includes using the digital certificate verification plug-in to verify the digital certificate The validity step S4 includes:

S401. Extract the effective date of the digital certificate from the digital certificate by using the digital certificate verification plug-in;

S402: Determine whether the current date is within the effective date;

S403: If the current date is not within the effective date, determine that the designated signature file with the signature is invalid.

As mentioned above, it is realized whether the specified signature file with signature is valid according to the preset inspection rule. Among them, the digital certificate records relevant information about the effective date, such as the effective start date and the effective end date. The process of extracting the effective date of the digital certificate includes: obtaining the effective start date and the effective end date of extracting the digital certificate, taking the date between the effective start date and the effective end date as the effective date. If the current date is not within the effective date, it is determined that the designated signature file with the signature is invalid, and if the current date is within the effective date, it can be determined that the date is correct.

In one embodiment, after the step S402 of determining whether the current date is within the effective date, the method includes:

S404: If the current date is within the effective date, extract the e-commerce certification authority that issued the digital certificate from the digital certificate;

S405: Determine whether the e-commerce certification authority exists in a preset list of trusted certification agencies;

S406: If the e-commerce certification authority exists in the preset list of trusted certification agencies, determine that the specified signature file with the signature is valid.

As described above, it is achieved by judging whether the e-commerce certification authority (CA) exists in the preset trusted certification authority list, thereby judging whether the specified signature file with the signature is valid. The e-commerce certification authority is not static, and the authority that can be authorized is not necessarily the same. Therefore, the e-commerce certification authority should be verified. Specifically, a list of trusted certification authorities is preset in the server, which records trusted e-commerce certification authorities, so that it is only necessary to determine whether the e-commerce certification authority exists in the trusted certification authority list to verify the The e-commerce certification authority. If the e-commerce certification authority exists in the preset list of trusted certification authorities, the e-commerce certification authority is deemed to be correct, and the designated signature file with the signature is determined to be valid.

In one embodiment, if the specified signature file is valid, the specified signature file with the signature is stored in all blockchain nodes in a pre-built blockchain network, where the server is Before step S5 of a block chain node of the block chain, it includes:

S41. Create a blockchain class in the server in a designated language, and establish a genesis block after instantiating the blockchain class;

S42. Generate other blocks based on the genesis block, where the hash value of the previous block is recorded in the other blocks;

S43. Use a terminal that agrees to the preset consensus mechanism of the blockchain as a blockchain node to establish the blockchain network.

As mentioned above, the construction of a blockchain network is realized. The designated languages include any feasible languages such as JAVA, C++, Python, etc. Class is the basis for information encapsulation in object-oriented programming. A class is a user-defined type, also called a type. Each class contains data descriptions and a set of functions for manipulating data or passing messages. The blockchain class is the class describing the blockchain. Instantiating the blockchain class is to declare an object of the blockchain type, thereby obtaining the genesis block (the first block before the block), where the genesis block can be the previous block The hash value is recorded as 0. Based on the genesis block, other blocks are generated, wherein the other blocks record the hash value of the previous block, thereby forming a multi-block blockchain. Then, the terminal that agrees to the preset consensus mechanism of the blockchain is used as the blockchain node, thereby establishing the blockchain network. Among them, the consensus mechanism is, for example, a workload certification mechanism, an equity certification mechanism, and a share authorization certification mechanism. Accordingly, the blockchain network is established.

In one embodiment, the step S43 of establishing the blockchain network by using the terminal that agrees to the preset consensus mechanism of the blockchain as the blockchain node includes:

S4301: Receive a request to join the blockchain sent by a terminal that agrees to the preset consensus mechanism of the blockchain;

S4302: Determine whether the IP address of the terminal that agrees to the preset consensus mechanism of the blockchain exists in the preset permission IP list;

S4303. If the IP address of the terminal that agrees to the preset consensus mechanism of the blockchain exists in the preset IP list of authority, then the terminal that agrees to the preset consensus mechanism of the blockchain is taken as the zone Block chain nodes, thereby establishing the block chain network.

As mentioned above, the determination of the blockchain node is achieved. In this embodiment, a method of verifying authority is adopted to limit the blockchain nodes, thereby establishing the blockchain network, that is, the blockchain network is preferably a consortium chain or a private chain. Since this block chain is preferably used to store electronic contracts, the parties involved, expected to participate, and involved in the electronic contract are selected as the nodes of the block chain, which can make the block chain easier to build, manage and more flexible . Specifically, by judging whether the IP address of the terminal that agrees to the preset consensus mechanism of the blockchain exists in the preset IP list of permissions, if the terminal agrees to the preset consensus mechanism of the blockchain If the IP address of is in the preset permission IP list, the terminal that agrees to the preset consensus mechanism of the blockchain is used as a blockchain node, thereby establishing the blockchain network.

In one embodiment, if the specified signature file is valid, the specified signature file with the signature is stored in all blockchain nodes in a pre-built blockchain network, where the server is After step S5 of a block chain node of the block chain, it includes:

S51. Receive a signature file query request sent by a designated blockchain node;

S52: By querying the login account authority of the designated blockchain node, it is determined whether the designated blockchain node has the authority to query the signature file;

S53: If the designated blockchain node has the signature file query authority, allowing the designated blockchain node to query the signature file.

As mentioned above, the query of the signature file is realized. The electronic contract has a certain degree of confidentiality and does not want to be inquired by irrelevant personnel, so set the inquiry authority accordingly. Specifically, by querying the login account permissions of the blockchain node, it is determined whether the blockchain node has the signature file query permission, and if the blockchain node has the signature file query permission, the block is allowed The chain node queries the signature file. Wherein, the login account includes user name login or ukey identity login. The process of querying the login account authority of the blockchain node includes: obtaining the login account, determining whether the login account exists in the preset signature file query authority list, and if it exists, determining that it has the signature file query authority.

The blockchain-based signature file saving method of this application receives a signature request on a designated signature file sent by a terminal plugged in Ukey, and if the terminal’s identity verification is correct, the terminal is allowed to sign on the designated signature file. A signature operation is performed on the file to obtain a designated signature file with a signature. If the designated signature file is valid, the designated signature file is recorded in all blockchain nodes in the pre-built blockchain network. In this way, online signing and saving of signature files are realized and the authenticity of the saved signature files is guaranteed.

2, an embodiment of the present application provides a block chain-based signature file storage device applied to a server, including:

The signature request receiving unit 10 is configured to receive a signature request on a designated signature file sent by a terminal plugged with ukey, wherein a digital certificate is stored in the ukey;

The identity verification unit 20 is configured to obtain the digital certificate sent by the terminal, and verify the identity of the terminal according to the digital certificate using a ukey signature plug-in in a preset integrated plug-in, wherein the integrated plug-in includes a ukey signature Plug-in and digital certificate verification plug-in;

The designated signature file obtaining unit 30 is configured to allow the terminal to perform a signature operation on the designated signature file to obtain a designated signature file with a signature if the identity verification of the terminal is correct;

The validity judging unit 40 is configured to judge whether the designated signature file with signature is valid according to a preset verification rule, wherein the preset verification rule at least includes using the digital certificate verification plug-in to verify the digital certificate Effectiveness

The designated signature file storage unit 50 is configured to, if the designated signature file is valid, save the designated signature file with the signature in all blockchain nodes in a pre-built blockchain network, where the server is A blockchain node of the blockchain.

As described in the aforementioned unit 10, receiving a signature request on a designated signature file sent by a terminal with a ukey plugged in, wherein a digital certificate is stored in the ukey. Among them, ukey (also known as USBKEY) is a small storage device that is directly connected to the computer via USB (Universal Serial Bus Interface), has a password verification function, and is reliable and high-speed. A digital certificate is stored in the ukey to verify the ukey support. The identity of the owner and the execution of the signature operation. Digital certificate refers to an authoritative third-party organization-CA (Certificate Authority, e-commerce certification authority) issued by the certificate used to identify the identity on the network, can also be called a CA certificate. The digital certificate includes the identity information of the holder and the certificate public key, and the corresponding certificate private key is held by the user corresponding to the ukey. The designated signature file can be any electronic file that requires an electronic signature, such as an electronic contract. A terminal with ukey plugged in is more secure than a terminal without ukey plugged in due to the use of the identity verification function of ukey.

As described in the aforementioned unit 20, the digital certificate sent by the terminal is obtained, and the identity of the terminal is verified according to the digital certificate using the ukey signature plug-in in the preset integrated plug-in, wherein the integrated plug-in includes the ukey signature Plug-in and digital certificate verification plug-in. This embodiment adopts an integrated plug-in including a ukey signature plug-in and a digital certificate verification plug-in. Compared with a separate plug-in, the step of calling the plug-in is saved, and the plug-ins that need to be used in this method are called uniformly at one time, and the integration is high. , Time-saving and efficient. The process of verifying the identity of the terminal by the ukey signature plug-in can be in any manner, for example, obtaining a corresponding data certificate from the CA that issued the data certificate, and judging the data certificate of the CA organization and the data sent by the terminal Whether the certificates are the same, if they are the same, it is determined that the identity of the terminal is true. Further, the process of verifying the identity of the terminal by the ukey signature plug-in includes: obtaining the digital certificate sent by the terminal, information used for identity verification, and verifying the information used for identity verification according to the certificate private key Encrypting the ciphertext; using the ukey signature plug-in to obtain the certificate public key from the digital certificate; using the ukey signature plug-in to decrypt the ciphertext using the certificate public key to obtain decryption information; It is determined whether the decrypted information is the same as the information used for identity verification; if the decrypted information is the same as the information used for identity verification, it is determined that the identity verification of the terminal is correct.

As described in the aforementioned unit 30, if the identity verification of the terminal is correct, the terminal is allowed to perform a signature operation on the designated signature file to obtain a designated signature file with a signature. If the identity verification of the terminal is correct, it is certain that there will be no impersonation phenomenon, so the terminal is allowed to perform a signature operation on the designated signature file to obtain a designated signature file with a signature.

As described in the aforementioned unit 40, it is determined whether the designated signature file with signature is valid according to a preset verification rule, wherein the preset verification rule at least includes using the digital certificate verification plug-in to verify the digital certificate Effectiveness. As mentioned above, although the identity of the terminal has been determined to be correct, the validity of the digital certificate needs further confirmation. The process of using the digital certificate verification plug-in to verify the validity of the digital certificate includes: extracting the validity-related information of the digital certificate from the digital certificate, such as the effective date, the issuing CA institution, etc., Then judge whether the digital certificate is valid according to the information related to validity, for example, judge whether the current date is within the valid date. Further, the process of judging whether the specified signature file with the signature is valid according to a preset inspection rule may also include any method for judging whether the signature file is valid.

As described in the above unit 50, if the designated signature file is valid, the designated signature file with the signature is stored in all blockchain nodes in the pre-built blockchain network, where the server is the A blockchain node of the blockchain. If the designated signature file is valid, save the designated signature file to complete online signature storage. In order to ensure the security of the designated signature file and ensure that the content of the designated signature file is not tampered with, the designated signature file is recorded in all the blockchain nodes in the pre-built blockchain (that is, stored in the blockchain In the public account book), the data can not be changed by the blockchain to increase the security of the specified signature file. Wherein, the block chain can be constructed in any manner, for example, the server can be used as the initiator of the block chain network. The specific process includes: creating a Blockchain class (block chain class) in any feasible language. Create a list for storing the blockchain in the constructor; after instantiating the Blockchain class, create the genesis block (the first block before the block); determine the consensus mechanism of the blockchain (such as workload Proof mechanism, equity proof mechanism, share authorization proof mechanism and Pool verification pool); receiving the terminal that agrees to the consensus mechanism as the node of the blockchain network, thereby obtaining the pre-built blockchain network. Wherein, the nodes (interacting subjects) of the blockchain network may be terminals that agree to the consensus mechanism. Among them, each node is connected to each other to verify whether the data has been tampered with (using hash value and asymmetric encryption technology in the blockchain). The blockchain may be a public chain, a consortium chain or a private chain.

In one embodiment, the digital certificate records the certificate public key, the user corresponding to the ukey holds the certificate private key, and the identity verification unit 20 includes:

The digital certificate acquisition subunit is configured to acquire the digital certificate sent by the terminal, the information used for identity verification, and the ciphertext obtained by encrypting the information used for identity verification according to the certificate private key;

A certificate public key obtaining subunit, configured to use the ukey signature plug-in to obtain the certificate public key from the digital certificate;

The decryption subunit is used to decrypt the ciphertext using the certificate public key to obtain decryption information;

The decryption information judging subunit is used to judge whether the decrypted information is the same as the information used for identity verification;

The identity verification correctness determination subunit is configured to determine that the identity verification of the terminal is correct if the decrypted information is the same as the information used for identity verification.

In one embodiment, the valid judgment unit 40 includes:

An effective date extraction subunit for extracting the effective date of the digital certificate from the digital certificate by using the digital certificate verification plug-in;

The effective date judging subunit is used to judge whether the current date is within the effective date;

The invalidity determination subunit is used for determining that the designated signature file with signature is invalid if the current date is not within the effective date.

In one embodiment, the valid judgment unit 40 includes:

The authority extraction subunit is configured to extract the e-commerce certification authority that issued the digital certificate from the digital certificate if the current date is within the effective date;

The trusted certification authority judging subunit is used to determine whether the e-commerce certification authority exists in the preset trusted certification authority list;

The validity determination subunit is configured to determine that the designated signature file with the signature is valid if the e-commerce certification authority exists in the preset trusted certification authority list.

In one embodiment, the device includes:

Genesis block establishment unit, used to create a blockchain class in the server in a specified language, and establish a genesis block after instantiating the blockchain class;

A block generating unit, configured to generate other blocks based on the genesis block, wherein the hash value of the previous block is recorded in the other blocks;

The block chain network establishment unit is used to establish the block chain network by using terminals that agree with the preset consensus mechanism of the block chain as the block chain node.

In one embodiment, the block chain network establishment unit includes:

The joining request receiving subunit is used to receive a request to join the blockchain sent by a terminal that agrees to the preset consensus mechanism of the blockchain;

The authority IP judging subunit is used to determine whether the IP address of the terminal that agrees to the preset consensus mechanism of the blockchain exists in the preset authority IP list;

The block chain network establishment sub-unit is configured to: if the IP address of the terminal that agrees to the preset consensus mechanism of the block chain exists in the preset permission IP list, then agree to the block chain The terminal with a preset consensus mechanism serves as a blockchain node, thereby establishing the blockchain network.

In one embodiment, the device includes:

The query request receiving unit is used to receive the signature file query request sent by the designated blockchain node;

The query authority determining unit is used to query the login account authority of the designated blockchain node to determine whether the designated blockchain node has the signature file query authority;

The query permission unit is configured to allow the designated blockchain node to query the signature file if the designated blockchain node has the signature file query authority.

The block chain-based signature file storage device of the present application receives a signature request on a designated signature file sent by a terminal plugged in Ukey, and if the terminal’s identity verification is correct, the terminal is allowed to sign on the designated signature file. A signature operation is performed on the file to obtain a designated signature file with a signature. If the designated signature file is valid, the designated signature file is recorded in all blockchain nodes in the pre-built blockchain network. In this way, online signing and saving of signature files are realized and the authenticity of the saved signature files is guaranteed.

3, an embodiment of the present application also provides a computer device. The computer device may be a server, and its internal structure may be as shown in the figure. The computer equipment includes a processor, a memory, a network interface and a database connected through a system bus. Among them, the computer designed processor is used to provide calculation and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The database of the computer equipment is used to store the data used in the signature file preservation method based on the blockchain. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a method for saving signature files based on blockchain is realized.

The above-mentioned processor executes the above-mentioned blockchain-based signature file storage method, wherein the steps included in the method respectively correspond to the steps of executing the blockchain-based signature file storage method of the foregoing embodiment, and will not be repeated here.

Those skilled in the art can understand that the structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied.

An embodiment of the present application also provides a non-volatile computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, a method for saving a signature file based on a blockchain is realized, wherein the method includes The steps respectively correspond to the steps of executing the method for storing signature files based on the blockchain of the foregoing embodiment one by one, and will not be repeated here.

A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be implemented by instructing relevant hardware through a computer program. The computer program can be stored in a non-volatile computer readable storage. In the medium, when the computer program is executed, it may include the procedures of the above-mentioned method embodiments. Wherein, any reference to memory, storage, database or other media provided in this application and used in the embodiments may include non-volatile and/or volatile memory. Non-volatile memory may include read only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. As an illustration and not a limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual-rate SDRAM (SSRSDRAM), enhanced SDRAM (ESDRAM), synchronous Link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

Claims

A method for saving signature files based on blockchain, applied to a server, and characterized in that it includes:

Receiving a signature request on a designated signature file sent by a terminal plugged with ukey, where a digital certificate is stored in the ukey;

Obtain the digital certificate sent by the terminal, and verify the identity of the terminal according to the digital certificate using a ukey signature plug-in in a preset integrated plug-in, wherein the integrated plug-in includes a ukey signature plug-in and a digital certificate verification plug-in ；

If the identity verification of the terminal is correct, allowing the terminal to perform a signature operation on the designated signature file to obtain a designated signature file with a signature;

Judging whether the specified signature file with signature is valid according to a preset verification rule, wherein the preset verification rule at least includes using the digital certificate verification plug-in to verify the validity of the digital certificate;

If the designated signature file is valid, save the designated signature file with signature in all blockchain nodes in the pre-built blockchain network, where the server is a block of the blockchain Chain node.
The method for saving a signature file based on a blockchain according to claim 1, wherein the digital certificate records a certificate public key, the user corresponding to the ukey holds the certificate private key, and the terminal obtains And verify the identity of the terminal according to the digital certificate by using the ukey signature plug-in in the preset integrated plug-in, wherein the integrated plug-in includes the ukey signature plug-in and the digital certificate verification plug-in. The steps include :

Acquiring the digital certificate sent by the terminal, the information used for identity verification, and the ciphertext obtained by encrypting the information used for identity verification according to the certificate private key;

Obtaining the certificate public key from the digital certificate using the ukey signature plug-in;

Decrypt the ciphertext using the certificate public key to obtain decryption information;

Determine whether the decrypted information is the same as the information used for identity verification;

If the decrypted information is the same as the information used for identity verification, it is determined that the identity verification of the terminal is correct.
The method for saving a signature file based on a blockchain according to claim 1, wherein said determining whether the designated signature file with signature is valid according to a preset verification rule, wherein the preset verification rule At least including the step of using the digital certificate verification plug-in to verify the validity of the digital certificate, including:

Extracting the effective date of the digital certificate from the digital certificate by using the digital certificate verification plug-in;

Determine whether the current date is within the effective date;

If the current date is not within the effective date, it is determined that the designated signature file with the signature is invalid.
The method for saving a signature file based on a blockchain according to claim 3, wherein after the step of judging whether the current date is within the effective date, the method comprises:

If the current date is within the valid date, extract the e-commerce certification authority that issued the digital certificate from the digital certificate;

Judging whether the e-commerce certification authority exists in a preset list of trusted certification agencies;

If the e-commerce certification authority exists in the preset list of trusted certification agencies, it is determined that the specified signature file with the signature is valid.
The method for saving a signature file based on a blockchain according to claim 1, wherein if the designated signature file is valid, the designated signature file with the signature is saved in a pre-built blockchain network Among all the blockchain nodes in the block chain, where the server is a block chain node of the block chain before the step includes:

Use a designated language to create a blockchain class in the server, and create a genesis block after instantiating the blockchain class;

Generate other blocks based on the genesis block, wherein the hash value of the previous block is recorded in the other blocks;

A terminal that agrees to the preset consensus mechanism of the blockchain is used as a blockchain node, thereby establishing the blockchain network.
The method for saving a signature file based on a blockchain according to claim 5, wherein the terminal that agrees to the preset consensus mechanism of the blockchain is used as a blockchain node to establish the blockchain The steps of the network include:

Receiving a request to join the blockchain sent by a terminal that agrees to the preset consensus mechanism of the blockchain;

Judging whether the IP address of the terminal agreeing to the preset consensus mechanism of the blockchain exists in the preset permission IP list;

If the IP address of the terminal that agrees to the preset consensus mechanism of the blockchain exists in the preset permission IP list, then the terminal that agrees to the preset consensus mechanism of the blockchain is taken as the blockchain Node, thereby establishing the blockchain network.
The method for saving a signature file based on a blockchain according to claim 1, wherein if the designated signature file is valid, the designated signature file with the signature is saved in a pre-built blockchain network After the step where the server is a block chain node of the block chain among all the block chain nodes in the block chain, the steps include:

Receive the signature file query request sent by the designated blockchain node;

By querying the login account authority of the designated blockchain node, it is determined whether the designated blockchain node has the authority to query signature files;

If the designated blockchain node has the signature file query authority, the designated blockchain node is allowed to query the signature file.
A device for storing signature files based on blockchain, applied to a server, is characterized in that it includes:

A signature request receiving unit, configured to receive a signature request on a designated signature file sent by a terminal plugged with ukey, wherein a digital certificate is stored in the ukey;

The identity verification unit is configured to obtain the digital certificate sent by the terminal, and verify the identity of the terminal according to the digital certificate using a ukey signature plug-in in a preset integrated plug-in, wherein the integrated plug-in includes a ukey signature plug-in And digital certificate verification plug-in;

A designated signature file obtaining unit, configured to allow the terminal to perform a signature operation on the designated signature file to obtain a designated signature file with a signature if the identity verification of the terminal is correct;

The validity judging unit is configured to judge whether the specified signature file with signature is valid according to a preset verification rule, wherein the preset verification rule at least includes using the digital certificate verification plug-in to verify the validity of the digital certificate Sex

The designated signature file storage unit is configured to, if the designated signature file is valid, save the designated signature file with a signature in all blockchain nodes in a pre-built blockchain network, where the server is A block chain node of the block chain.
The block chain-based signature file storage device according to claim 8, wherein the digital certificate records a certificate public key, the user corresponding to the ukey holds the certificate private key, and the identity verification unit, include:

The digital certificate acquisition subunit is configured to acquire the digital certificate sent by the terminal, the information used for identity verification, and the ciphertext obtained by encrypting the information used for identity verification according to the certificate private key;

A certificate public key obtaining subunit, configured to use the ukey signature plug-in to obtain the certificate public key from the digital certificate;

The decryption subunit is used to decrypt the ciphertext using the certificate public key to obtain decryption information;

The decryption information judging subunit is used to judge whether the decrypted information is the same as the information used for identity verification;

The identity verification correctness determination subunit is configured to determine that the identity verification of the terminal is correct if the decrypted information is the same as the information used for identity verification.
The block chain-based signature file storage device according to claim 8, wherein the validity determining unit 40 comprises:

An effective date extraction subunit for extracting the effective date of the digital certificate from the digital certificate by using the digital certificate verification plug-in;

The effective date judging subunit is used to judge whether the current date is within the effective date;

The invalidity determination subunit is used for determining that the designated signature file with signature is invalid if the current date is not within the effective date.
The block chain-based signature file storage device according to claim 10, wherein the validity determining unit 40 comprises:

The authority extraction subunit is configured to extract the e-commerce certification authority that issued the digital certificate from the digital certificate if the current date is within the effective date;

The trusted certification authority judging subunit is used to determine whether the e-commerce certification authority exists in the preset trusted certification authority list;

The validity determination subunit is configured to determine that the designated signature file with the signature is valid if the e-commerce certification authority exists in the preset trusted certification authority list.
The block chain-based signature file storage device according to claim 8, wherein the device comprises:

Genesis block establishment unit, used to create a blockchain class in the server in a specified language, and establish a genesis block after instantiating the blockchain class;

A block generating unit, configured to generate other blocks based on the genesis block, wherein the hash value of the previous block is recorded in the other blocks;

The block chain network establishment unit is used to establish the block chain network by using terminals that agree with the preset consensus mechanism of the block chain as the block chain node.
The block chain-based signature file storage device according to claim 12, wherein the block chain network establishment unit comprises:

The joining request receiving subunit is used to receive a request to join the blockchain sent by a terminal that agrees to the preset consensus mechanism of the blockchain;

The authority IP judging subunit is used to determine whether the IP address of the terminal that agrees to the preset consensus mechanism of the blockchain exists in the preset authority IP list;

The block chain network establishment sub-unit is configured to: if the IP address of the terminal that agrees to the preset consensus mechanism of the block chain exists in the preset permission IP list, then agree to the block chain The terminal with a preset consensus mechanism serves as a blockchain node, thereby establishing the blockchain network.
The block chain-based signature file storage device according to claim 8, wherein the device comprises:

The query request receiving unit is used to receive the signature file query request sent by the designated blockchain node;

The query authority determining unit is used to query the login account authority of the designated blockchain node to determine whether the designated blockchain node has the signature file query authority;

The query permission unit is configured to allow the designated blockchain node to query the signature file if the designated blockchain node has the signature file query authority.
A computer device includes a memory and a processor, the memory stores computer-readable instructions, and is characterized in that when the processor executes the computer-readable instructions, a method for saving a signature file based on a blockchain is implemented, which is based on The method of saving the signature file of the blockchain includes:

Receiving a signature request on a designated signature file sent by a terminal plugged with ukey, where a digital certificate is stored in the ukey;

Obtain the digital certificate sent by the terminal, and verify the identity of the terminal according to the digital certificate using a ukey signature plug-in in a preset integrated plug-in, wherein the integrated plug-in includes a ukey signature plug-in and a digital certificate verification plug-in ；

If the identity verification of the terminal is correct, allowing the terminal to perform a signature operation on the designated signature file to obtain a designated signature file with a signature;

Judging whether the specified signature file with signature is valid according to a preset verification rule, wherein the preset verification rule at least includes using the digital certificate verification plug-in to verify the validity of the digital certificate;

If the designated signature file is valid, save the designated signature file with signature in all blockchain nodes in the pre-built blockchain network, where the server is a block of the blockchain Chain node.
The computer device according to claim 15, wherein the digital certificate records a certificate public key, the user corresponding to the ukey holds the certificate private key, and the obtaining the digital certificate sent by the terminal, And use the ukey signature plug-in in the preset integrated plug-in to verify the identity of the terminal according to the digital certificate, where the integrated plug-in includes the ukey signature plug-in and the digital certificate verification plug-in, the steps include:

Acquiring the digital certificate sent by the terminal, the information used for identity verification, and the ciphertext obtained by encrypting the information used for identity verification according to the certificate private key;

Obtaining the certificate public key from the digital certificate using the ukey signature plug-in;

Decrypt the ciphertext using the certificate public key to obtain decryption information;

Determine whether the decrypted information is the same as the information used for identity verification;

If the decrypted information is the same as the information used for identity verification, it is determined that the identity verification of the terminal is correct.
The computer device according to claim 15, wherein said determining whether the designated signature file with signature is valid according to a preset verification rule, wherein the preset verification rule at least includes using the digital certificate The step of verifying the validity of the digital certificate by the verification plug-in includes:

Extracting the effective date of the digital certificate from the digital certificate by using the digital certificate verification plug-in;

Determine whether the current date is within the effective date;

If the current date is not within the effective date, it is determined that the designated signature file with the signature is invalid.
A non-volatile computer-readable storage medium with a computer program stored thereon, characterized in that, when the computer program is executed by a processor, a method for saving a signature file based on a blockchain is implemented. Methods for saving signature files include:

Receiving a signature request on a designated signature file sent by a terminal plugged with ukey, where a digital certificate is stored in the ukey;

Obtain the digital certificate sent by the terminal, and verify the identity of the terminal according to the digital certificate using a ukey signature plug-in in a preset integrated plug-in, wherein the integrated plug-in includes a ukey signature plug-in and a digital certificate verification plug-in ；

If the identity verification of the terminal is correct, allowing the terminal to perform a signature operation on the designated signature file to obtain a designated signature file with a signature;

Judging whether the specified signature file with signature is valid according to a preset verification rule, wherein the preset verification rule at least includes using the digital certificate verification plug-in to verify the validity of the digital certificate;

If the designated signature file is valid, save the designated signature file with signature in all blockchain nodes in the pre-built blockchain network, where the server is a block of the blockchain Chain node.
The non-volatile computer-readable storage medium according to claim 18, wherein a certificate public key is recorded in the digital certificate, the user corresponding to the ukey holds the certificate private key, and the acquiring The digital certificate sent by the terminal, and verify the identity of the terminal according to the digital certificate using the ukey signature plug-in in the preset integrated plug-in, wherein the integrated plug-in includes the steps of ukey signature plug-in and digital certificate verification plug-in, include:

Acquiring the digital certificate sent by the terminal, the information used for identity verification, and the ciphertext obtained by encrypting the information used for identity verification according to the certificate private key;

Obtaining the certificate public key from the digital certificate using the ukey signature plug-in;

Decrypt the ciphertext using the certificate public key to obtain decryption information;

Determine whether the decrypted information is the same as the information used for identity verification;

If the decrypted information is the same as the information used for identity verification, it is determined that the identity verification of the terminal is correct.
The non-volatile computer-readable storage medium according to claim 18, wherein said determining whether said designated signature file with signature is valid according to a preset verification rule, wherein said preset verification The rule includes at least the step of using the digital certificate verification plug-in to verify the validity of the digital certificate, including:

Extracting the effective date of the digital certificate from the digital certificate by using the digital certificate verification plug-in;

Determine whether the current date is within the effective date;

If the current date is not within the effective date, it is determined that the designated signature file with the signature is invalid.