CN113452526B

CN113452526B - Electronic file certification method, verification method and corresponding devices

Info

Publication number: CN113452526B
Application number: CN202010216482.XA
Authority: CN
Inventors: 黄翔; 徐丽华
Original assignee: Shenzhen Fadada Network Technology Co ltd
Current assignee: Shenzhen Fadada Network Technology Co ltd
Priority date: 2020-03-25
Filing date: 2020-03-25
Publication date: 2023-06-30
Anticipated expiration: 2040-03-25
Also published as: CN113452526A

Abstract

The application belongs to the technical field of information security, and particularly relates to an electronic file certification method, an electronic file verification method and a corresponding device. The method for storing the electronic file comprises the following steps: acquiring initial certificate storage information of a signed electronic file; performing hash operation on the electronic file to generate a hash value; packaging the hash value and the initial certificate information into first certificate information; signing the first certificate information to generate a digital signature; performing time stamp operation on the first certificate information to generate a time stamp; and packaging the first certificate information, the digital signature and the time stamp into second certificate information. According to the embodiment of the application, the hash operation, the asymmetric encryption operation and the time stamp operation are carried out on the certificate storage information of the signed electronic file, so that the certificate storage safety of the electronic file is remarkably improved.

Description

Electronic file certification method, verification method and corresponding devices

Technical Field

The application belongs to the technical field of information security, and particularly relates to an electronic file certification method, an electronic file verification method and a corresponding device.

Background

Nowadays, in the present day of technological advancement and increasing economic development, protection of digital assets (electronic documents) is increasingly emphasized, and thus it is increasingly important to tamper-proof, falsification-proof and repudiation-proof electronic documents.

However, in the related electronic document certification technical field, security problems such as falsification of electronic document contents or certification information and the like may occur in the certification process of signed electronic documents. Moreover, since the accurate certification time of the electronic file is not recorded, part of electronic file contract signers may repudiate the signing, certification and other actions of the electronic file in the future.

It should be noted that the information disclosed in the foregoing background section is only for enhancing understanding of the background of the present application and thus may include information that does not form the prior art that is already known to those of ordinary skill in the art.

Disclosure of Invention

In view of this, the embodiments of the present application provide an electronic document storage method, an electronic document verification method, and a corresponding apparatus, which can solve the technical problem of low security of electronic document storage.

In a first aspect of the present application, there is provided a method for storing an electronic document, the method comprising:

acquiring initial certificate storage information of a signed electronic file;

performing hash operation on the signed electronic file to generate a hash value;

packaging the hash value and the initial certificate information into first certificate information;

signing the first certificate information according to a preset asymmetric encryption key to generate a digital signature;

Acquiring a trusted time stamp corresponding to the first certificate information;

and packaging the first certification information, the digital signature and the trusted timestamp into second certification information corresponding to the signed electronic file.

In some embodiments of the present application, the obtaining initial certification information for a signed electronic document includes:

acquiring the signed electronic file;

and analyzing the signed electronic file to obtain initial certification information of the signed electronic file.

initial forensic information of the signed electronic file is received, wherein the initial forensic information is analyzed from the signed electronic file.

In some embodiments of the present application, after said packaging said first forensic information, said digital signature and said trusted timestamp into second forensic information corresponding to a signed electronic file, further comprising:

and sending the second certificate information to a local database and/or a standby database for storage.

In a second aspect of the present application, there is provided an electronic document verification method, the method comprising:

Acquiring a file identifier of an electronic file to be verified;

acquiring second certificate storing information corresponding to the electronic file to be verified according to the file identifier;

splitting the second certificate information to obtain a digital signature;

and verifying the digital signature according to a preset asymmetric decryption key to obtain a first verification result.

In some embodiments of the present application, the electronic document verification method further includes:

and splitting the second certificate information to obtain a trusted time stamp.

splitting the second certificate information to obtain a hash value;

carrying out hash operation on the electronic file to be verified to generate a hash value to be verified;

and comparing the hash value with the hash value to be verified to generate a second verification result.

and sending a verification result prompt message of the electronic file to be verified to a preset terminal.

In a third aspect of the present application, there is provided an electronic document authentication device, the device comprising:

the first acquisition module is used for acquiring initial certificate storage information of the signed electronic file;

The computing module is used for carrying out hash operation on the signed electronic file and generating a hash value;

the first packaging module is used for packaging the hash value and the initial certificate information into first certificate information;

the signature module is used for signing the first certificate information according to a preset asymmetric encryption key to generate a digital signature;

the second acquisition module is used for acquiring a trusted time stamp corresponding to the first certificate information;

and the second packaging module is used for packaging the first certification information, the digital signature and the trusted timestamp into second certification information corresponding to the signed electronic file. In some embodiments of the present application, the first obtaining module may include:

a file acquisition subunit, configured to acquire the signed electronic file;

and the certification information analysis subunit is used for analyzing the signed electronic file to obtain the initial certification information of the signed electronic file.

In some embodiments of the present application, the first obtaining module may include:

and the certification information receiving subunit is used for receiving initial certification information of the signed electronic file, wherein the initial certification information is analyzed from the signed electronic file.

In a fourth aspect of the present application, there is provided an electronic document verification device, the device comprising:

the first acquisition module is used for acquiring a file identifier of the electronic file to be verified;

the searching module is used for acquiring second certificate storing information corresponding to the electronic file to be verified according to the file identification;

the splitting module is used for splitting the second certificate storage information to obtain a digital signature;

and the verification module is used for verifying the digital signature according to a preset asymmetric decryption key to obtain a first verification result.

A fifth aspect of the embodiments of the present application provides a terminal device, the terminal device including a memory, and a processor, the memory storing a computer program executable on the processor, the processor implementing the steps of the electronic document authentication method according to any one of the first aspect or the electronic document authentication method according to any one of the second aspect when the computer program is executed.

A sixth aspect of embodiments of the present application provides a computer-readable storage medium comprising: a computer program is stored, characterized in that the computer program, when being executed by a processor, implements the steps of the electronic document authentication method according to any one of the above first aspects or the electronic document verification method according to any one of the above second aspects.

A seventh aspect of the embodiments of the present application provides a computer program product, which when run on a terminal device, causes the terminal device to perform the steps of the electronic document authentication method according to any of the first aspect or the electronic document authentication method according to any of the second aspect.

Compared with the prior art, the embodiment of the application has the beneficial effects that: the method comprises the steps of firstly, obtaining initial certificate storage information of a signed electronic file; then, carrying out hash operation on the signed electronic file to generate a hash value; then, the hash value and the initial certificate information are packaged into first certificate information; then signing the first certificate information according to a preset asymmetric encryption key to generate a digital signature, and performing timestamp operation on the first certificate information to generate a timestamp; and finally, packaging the first certification information, the digital signature and the time stamp into second certification information corresponding to the signed electronic file. According to the embodiment of the application, the hash operation, the asymmetric encryption operation and the time stamp operation are carried out on the certificate storage information of the signed electronic file, so that the certificate storage safety of the electronic file is remarkably improved.

It will be appreciated that the advantages of the second to seventh aspects may be found in the relevant description of the first and second aspects, and are not described here again.

Other features and advantages of the present application will be apparent from the following detailed description, or may be learned in part by the practice of the application.

It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the application.

Drawings

In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings that are required for the embodiments or the description of the prior art will be briefly described below, it being obvious that the drawings in the following description are only some embodiments of the present application, and that other drawings may be obtained according to these drawings without inventive effort for a person skilled in the art.

FIG. 1 is a schematic diagram of a system architecture of an exemplary application environment of an electronic document authentication method, a verification method, and a corresponding apparatus in one embodiment of the present application;

FIG. 2 is a flowchart of a method for storing and verifying an electronic document according to an embodiment of the present application;

FIG. 3 is a flowchart showing a step S210 in an electronic document authentication method according to an embodiment of the present application;

FIG. 4 is a flowchart of an electronic document verification method according to one embodiment of the present application;

FIG. 5 is a flowchart illustrating another method for verifying an electronic document according to one embodiment of the present application;

FIG. 6 is a schematic block diagram of an electronic document storage device according to an embodiment of the present application;

fig. 7 is a schematic block diagram of an electronic document verification device according to an embodiment of the present application.

Detailed Description

In order to make the objects, features and advantages of the present invention more obvious and understandable, the technical solutions of the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application, and it is apparent that the embodiments described below are only some embodiments of the present application, but not all embodiments. All other embodiments, which can be made by one of ordinary skill in the art without undue burden from the present disclosure, are within the scope of the present disclosure.

It should be understood that the terms "comprises" and/or "comprising," when used in this specification and the appended claims, specify the presence of stated features, integers, steps, operations, elements, and/or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and/or groups thereof.

It is also to be understood that the terminology used in the description of the present application is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. As used in this specification and the appended claims, the singular forms "a," "an," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise.

It should be further understood that the term "and/or" as used in this specification and the appended claims refers to any and all possible combinations of one or more of the associated listed items, and includes such combinations.

As used in this specification and the appended claims, the term "if" may be interpreted as "when..once" or "in response to a determination" or "in response to detection" depending on the context. Similarly, the phrase "if a determination" or "if a [ described condition or event ] is detected" may be interpreted in the context of meaning "upon determination" or "in response to determination" or "upon detection of a [ described condition or event ]" or "in response to detection of a [ described condition or event ]".

In addition, in the description of the present application, the terms "first," "second," "third," etc. are used merely to distinguish between descriptions and are not to be construed as indicating or implying relative importance.

Fig. 1 is a schematic diagram of a system architecture of an exemplary application environment to which an electronic document authentication method, a verification method, and a corresponding apparatus according to an embodiment of the present disclosure may be applied.

As shown in fig. 1, the system architecture 100 may include a terminal device (such as one or more of the smart phone 101, the tablet 102, and the portable computer 103 shown in fig. 1, but may also be other terminal devices with electronic file receiving and transmitting functions), a network 104, a certification server 105, a third party trusted timestamp server 106, and a backup server 107. The network 104 is a medium for providing a communication link between the terminal device and the forensic server 105, the forensic server 105 and the third party trusted timestamp server 106 (typically one or more trusted timestamp servers of a national time service center), the forensic server 105 and the backup server 107. The network 104 may include various connection types, such as wired communication links, wireless communication links, and the like.

It should be understood that the number of terminal devices, networks and servers in fig. 1 is merely illustrative. There may be any number of terminal devices, networks, and servers, as desired for implementation. For example, the certification server 105 may be a server cluster formed by a plurality of servers.

In an application scenario embodiment of the present application, the certification server 105 (for example, a certification cloud platform) may obtain a signed electronic file uploaded by a user through a terminal device (such as a smart phone 101, a tablet computer 102, and a portable computer 103 shown in fig. 1), a website, etc., the certification server 105 may analyze the signed electronic file to obtain certification information (including a signing party name, a signing time, a signing condition of a seal, etc. of the electronic file) of the signed electronic file, and then may perform Hash operation on the certification information by using a Hash algorithm to obtain a corresponding Hash value and package the Hash value and the certification information to obtain first certification information. Then, according to a preset asymmetric encryption key, carrying out asymmetric encryption operation on the first certificate information; meanwhile, the first certificate information is sent to a third party trusted time stamp server 106, and a trusted time stamp corresponding to the first certificate information and fed back by the third party trusted time stamp server 106 is obtained. And finally, packaging the first certification information, the digital signature and the trusted timestamp into second certification information corresponding to the signed electronic file. In addition, the second certificate information may be copied and sent to the backup server 107 for backup.

In another application scenario embodiment of the present application, the certification server 105 may further perform certification on the unsigned document, and specifically includes the following steps:

after a user logs in the electronic file signing system correctly, a signing function is started;

signing by the user to generate certification information;

when the signing of the user is detected to be finished, the electronic file signing system verifies whether the signing is the operation performed by the user;

if the user operates the electronic file, carrying out hash operation on the signed electronic file by using a standard hash algorithm SHA256 to generate a hash value;

packaging the SHA256 hash value and the certificate information of the signed electronic file to obtain first certificate information;

digitally signing the first forensic information using an asymmetric encryption algorithm;

the method comprises the steps of sending a time stamp authentication service for first certificate information to a third party trusted time stamp server, and receiving the first certificate information with the trusted time stamp sent by the third party trusted time stamp server;

and packaging the first certification information, the digital signature and the trusted timestamp into second certification information corresponding to the signed electronic file and storing the second certification information.

It should be noted that, the method for storing and verifying the electronic file provided in the embodiment of the present invention is generally executed by the storing and verifying server 105, and accordingly, the electronic file storing and verifying device is generally disposed in the server 105. However, in other embodiments of the present invention, the backup server 106 and the terminal device may have similar functions to the server, so as to execute the electronic document verification method and the verification method provided in the embodiments of the present invention, which are not limited in particular in the present exemplary embodiment.

The implementation details of the technical solutions of the embodiments of the present application are described in detail below:

as shown in fig. 2, an embodiment of the present application provides a flowchart for implementing an electronic document certification method, where the method may be specifically executed by the certification server 105 in fig. 1, and the method includes:

step S210, obtaining initial certification information of a signed electronic file;

step S220, carrying out hash operation on the signed electronic file to generate a hash value;

step S230, packaging the hash value and the initial certificate information into first certificate information;

step S240, signing the first certificate information according to a preset asymmetric encryption key to generate a digital signature;

step S250, obtaining a trusted time stamp corresponding to the first certificate information;

step S260, packaging the first certification information, the digital signature and the trusted timestamp into second certification information corresponding to the signed electronic file.

The above steps are described in detail below.

In step S210, initial certification information of the signed electronic file is acquired.

It will be appreciated that the electronic files, depending on the computer system access and may be transmitted over a communications network. It mainly includes electronic document, electronic letter, electronic report form, electronic drawing, etc. Typically, the signing process for an electronic document is completed after each party has completed signing and/or stamping, written the signing party name and signing date for the electronic document. The information content contained in the initial certification information can be selected or set according to the actual application scene requirement, and for example, one or more of the names of all signing parties, the names of specific signing parties and the signing time of the electronic file can be included. Further, the initial forensic information may be presented according to the actual requirement of the user, for example, the initial forensic information may be presented in the form of a forensic report.

As shown in fig. 3, in one embodiment of the present application, step S210 specifically includes the following steps:

step S310, the signed electronic file is obtained.

It will be appreciated that the certification server may obtain signed electronic documents uploaded by the user through a mobile terminal, website, or the like.

In one embodiment of the application, the signed electronic file uploaded by the user through a mobile terminal, website, or the like is in the form of a compressed package, so that the compressed package needs to be decompressed first to obtain the signed electronic file.

In one embodiment of the present application, before step S210, the method may further include:

firstly, acquiring an electronic file to be signed;

secondly, identity verification is carried out on the identity information of the signing main body;

and finally, when the identity verification of the signing main body is passed, opening signing authority of the signing main body to the electronic file to be signed so that the signing main body signs the electronic file to be signed to form initial certificate storage information of the signed electronic file.

The method has the advantages that the user can sign the electronic file on line and generate the certification information, so that the operation of the user is convenient, and the safety of the certification information is improved.

Step 320, analyzing the signed electronic file to obtain initial certification information of the signed electronic file.

It will be appreciated that the signed electronic file includes portions of header information, body information, signed content information, etc., so that the initial certificate information can be extracted from the original signed electronic file. The specific method for analyzing the initial certificate information is not limited herein, and may be set or selected by a skilled person according to the actual situation. For example, in some embodiments, a pre-trained forensic information recognition model may be utilized to obtain corresponding initial forensic information for a signed electronic file. Where the forensic information recognition model refers to a model that can be extracted from the original forensic information in the signed electronic file, the specific model type is not limited herein, including, but not limited to, as image recognition models and OCR image recognition models. Of course, other manners may be adopted, and the embodiments of the present application are not limited thereto in particular.

In another embodiment of the present application, the obtaining the initial certification information of the signed electronic document may include:

It will be appreciated that when the user is analyzing a signed electronic document at the user's local server, the initial forensic information obtained by analysis of the signed electronic document may be obtained directly from the user's local server.

In step S220, a hash operation is performed on the signed electronic file, and a hash value is generated.

It will be appreciated that the Hash Function (Hash Function) is a one-way cryptosystem, i.e. an irreversible mapping from plaintext to ciphertext, with only encryption and no decryption, also known as a Hash Function or Hash Function. The hash function is a function that can map binary messages M of arbitrary length into a fixed length binary value H (M) that is converted into a hash, which is called a hash value. The hash value is a unique and extremely compact numerical representation form of a section of data, reflects the mapping relation between the data content and the data storage address, and can be used for verifying that abnormal behaviors such as tampering, data loss, data increase and the like do not occur in the verification process of the signed electronic file.

It can be appreciated that a Hash operation is performed on a section of plaintext to obtain a target Hash value. If the plaintext is changed randomly in the subsequent process (for example, only one letter in a paragraph is changed), hash operation is performed on the changed plaintext, so that a new Hash value is obtained. By comparing the new hash value with the target hash value, it can be determined whether the plaintext has been altered in a subsequent process, so that the integrity of the data can be verified.

The Hash encryption may typically employ an MD5 Message-Digest Algorithm (MD 5 Message-Digest Algorithm). The MD5 message digest algorithm may generate a 128 bit (16 byte) hash value that may be used to ensure that the message transmission is completely consistent. However, the algorithm proves to have a certain weakness and the possibility of being broken. Thus, for electronic files requiring a high degree of security, other algorithms, such as the SHA message digest algorithm (SHA Secure Hash Algorithm), may be used instead.

In one embodiment of the application, the signed electronic file may be Hash encrypted using a SHA-256 message digest algorithm to generate a Hash value.

It will be appreciated that for signed electronic files of arbitrary length, SHA-256 will generate a hash value of 256 bits long, called a message digest.

For example, assume that C represents a Hash operation, C represents a signed electronic file, and d represents a Hash value. Then, the hash value d=c (C).

The method has the advantages that whether abnormal actions such as data tampering, data loss, data addition and the like occur in the verification process of the signed electronic file can be verified, so that the verification safety of the electronic file is ensured.

In another embodiment of the present application, steps S210, S220 may be combined into the following steps:

initial forensic information of a signed electronic file is obtained, the initial forensic information including a hash value of the signed electronic file.

It will be appreciated that if the signed electronic file has a corresponding hash value before uploading to the forensic server, the hash value may be used as part of the initial forensic information.

The method has the advantages that the operation steps of storing the electronic file are simplified, and the efficiency of storing the file is improved.

Step S230, the hash value and the initial certificate information are packaged into first certificate information.

It will be appreciated that the hash value used to verify the data integrity of the forensic information may be encapsulated with the initial forensic information to obtain the first forensic information. Specifically, a hash value may be embedded in a head position or a tail position of the authentication information. Of course, other packaging methods are also possible, and the embodiments of the present application are not limited in particular.

Step S240, signing the first certificate information according to a predetermined asymmetric encryption key, and generating a digital signature.

It will be appreciated that the digital signature (digital signature) actually means that some data is appended to the original data unit or that the original data unit is cryptographically transformed. This additional data or data transformation facilitates the verification of the source, integrity, and protection of the data unit from forgery and tampering by third parties (e.g., hackers) by the intended recipient of the data unit.

It can be understood that the asymmetric encryption algorithm adopts two different passwords of public key and private key to encrypt and decrypt. The public key and the private key are in pairs, and the public key is extracted from the private key and is disclosed to the owner. The information encrypted by the public key is decrypted by a person knowing the corresponding private key, and the asymmetric encryption and decryption mode is used for transmitting information needing to be kept secret, so that the security of the information in the transmission process is ensured. The asymmetric encryption scheme is used to digitally sign, using private key encryption and public key decryption, since public keys are public to the owner and can be used to verify whether specific information originated from the owner of the private key. The asymmetric encryption algorithm includes, but is not limited to: RSA algorithm, elgamal algorithm, knapsack algorithm, rabin algorithm, ECC (elliptic curve cryptography) algorithm, and the like.

In this embodiment of the present application, the predetermined asymmetric key may be a certificate server private key or a certificate server public key. For example, let K denote a signature operation, a denote first certificate information, and b denote a generated digital signature. Then, the digital signature b=k (a).

Step S250, obtaining a trusted timestamp corresponding to the first certificate information.

It will be appreciated that the time stamp (timestamp) is a complete, verifiable data that can indicate that a piece of data has existed before a particular time. The time stamp is typically a sequence of characters that uniquely identifies the time at a moment. The time stamps are divided into two types, one is a self-built time stamp: such time stamps are obtained by a time receiving device (e.g. GPS, CDMA, beidou satellite) to a time stamp server and a time stamp certificate is issued by the time stamp server. Such a timestamp may be used for intra-enterprise liability approval, but is not legally effective at litigation because of the possibility of tampering as it receives time through the time receiving device. The other is a time stamp which is fair, reliable and has legal effectiveness, and the national time service center provides time service and time monitoring service of the trusted time stamp, thereby ensuring the accuracy and non-falsification of the time in the time stamp certificate. In particular, the trusted time stamped time service and the time keeping monitoring service may be provided by one or more trusted time stamp servers of a national time service center.

In one embodiment of the present application, before step S250, the method further includes:

and sending the first certification information to a third party trusted time stamp server.

Correspondingly, the step S250 specifically includes: and receiving the first certification information with the trusted time stamp fed back by the third party trusted time stamp server.

It will be appreciated that the trusted timestamp (time stamp), which is an encrypted formed credential document, may include the following two parts: (1) first authentication information to be time stamped; (2) The third party trusted time stamp server receives date and/or time information of the first certificate information. Of course, the specific content of the trusted timestamp may further include other content such as digital signature of the first certificate information by the third party trusted timestamp server, which is not limited in particular in the embodiment of the present application.

In one embodiment of the present application, the third party trusted time stamp server may embed the date and/or time information on which the first forensic information was received in the received first forensic information, and send the first forensic information with the trusted time stamp to the forensic server. Accordingly, the forensic server may receive the first forensic information with the trusted time stamp.

The method has the advantages that parties of the electronic file cannot deny signing actions of the parties to the electronic file, and therefore the purpose of storing the electronic file is achieved in legal sense.

Specifically, the digital signature may be embedded in a head position of the first forensic information and the trusted timestamp may be embedded in a tail position of the first forensic information to form the second forensic information. In addition, the digital signature may be embedded in a tail portion of the first certificate information, and the trusted timestamp may be embedded in a head portion of the first certificate information, so as to form the second certificate information. Of course, other packaging methods are also possible, and the embodiments of the present application are not limited in particular.

In one embodiment of the present application, after step S260, further includes:

It can be understood that after the second certificate information is obtained, the second certificate information and the electronic file may be stored in a local database, that is, a database of the certificate server, according to the file identifier such as the electronic file name, the unique number, etc. In addition, in order to ensure the security of the second certificate information, the second certificate information may be sent to a backup database for backup, where the backup database may be a database of a trusted third party.

As shown in fig. 4, an embodiment of the present application provides a flowchart of an implementation of an electronic document verification method, where the method may be performed by the certification server 105 in fig. 1, and the method includes:

step S410, acquiring a file identifier of an electronic file to be verified;

step S420, obtaining second certificate storing information corresponding to the electronic file to be verified according to the file identification;

step S430, splitting the second certificate information to obtain a digital signature;

step S440, verifying the digital signature according to a preset asymmetric decryption key to obtain a first verification result.

The above steps are described in detail below.

In step S410, a file identifier of the electronic file to be verified is obtained.

It can be appreciated that the file identifier of the electronic file to be verified may be a file name, a file unique number, etc. of the electronic file to be verified. Therefore, when the certification server receives the electronic file to be verified, which is sent by the user, the file identification can be extracted from the electronic file to be verified.

In step S420, second certificate information corresponding to the electronic file to be verified is obtained according to the file identifier.

It can be understood that the second certification information corresponding to the electronic file to be verified can be obtained from a local database of the certification server or the backup server according to the file identification.

It should be noted that, the corresponding second certificate information of the electronic document to be verified is the second certificate information obtained after being processed by the electronic document certificate method provided by the embodiment shown in fig. 2 or 3.

In one embodiment of the present application, when the second document storage information corresponding to the electronic document to be verified is not obtained according to the document identification, a prompt operation of first storing the document to be verified is displayed.

The method has the advantages that the relationship between the electronic file certification process and the electronic file verification process can be distinguished conveniently and rapidly by a user, so that the operation time of the user is saved, and the operation efficiency of the user is improved.

And step S430, splitting the second certificate information to obtain a digital signature.

In one embodiment of the present application, the first forensic information is signed by the forensic server using a forensic server private key. Correspondingly, the certificate server can verify the digital signature obtained by splitting by utilizing the public key of the corresponding certificate server, so as to determine whether abnormal behaviors such as data tampering, data loss, data increase and the like occur in the process of verifying the electronic file to be verified. Specifically, when the certificate storage server can utilize the corresponding public key of the certificate storage server to carry out inverse operation on the digital signature obtained by the disassembly, a private key value is obtained, and the private key value is compared with a preset private key value of the certificate storage server, so that a first verification result is obtained. If the verification result is inconsistent, the first verification result is that the verification is not passed; otherwise, the first verification result is verification passing.

In one embodiment of the present application, the first forensic information is signed by the forensic server using a forensic server public key. Correspondingly, the certificate storage server can verify the digital signature obtained by splitting by utilizing the private key of the corresponding certificate storage server, so as to determine whether abnormal behaviors such as data tampering, data loss, data increase and the like occur in the process of the verification of the electronic file to be verified. Specifically, when the certificate server can utilize the corresponding certificate server private key to perform inverse operation on the digital signature obtained by splitting, a public key value is obtained, and the public key value is compared with a preset certificate server public key value to obtain a first verification result. If the verification result is inconsistent, the first verification result is that the verification is not passed; otherwise, the first verification result is verification passing.

In one embodiment of the present application, the method further comprises: and splitting the second certificate information to obtain a trusted time stamp.

It can be appreciated that by splitting the second certification information to obtain a trusted timestamp, the certification start time of the electronic file to be verified can be determined. Therefore, when the related body of the electronic file to be verified is inconsistent with the electronic file certification time, the trusted timestamp can be used as legal basis for identifying the start time of the electronic file certification to be verified.

As shown in fig. 5, in one embodiment of the present application, the electronic document verification method further includes:

and S510, splitting the second certificate information to obtain a hash value.

It can be appreciated that by splitting the second certification information, a hash value of the original electronic file can be obtained.

And step S520, carrying out hash operation on the electronic file to be verified to generate a hash value to be verified.

It can be understood that the hash operation is performed on the electronic file to be verified, so that the hash value to be verified can be obtained.

Step S530, comparing the hash value with the hash value to be verified, and generating a second verification result.

It will be appreciated that if the original electronic file is changed at will (e.g. only one letter in a paragraph is changed) in the subsequent process, a new Hash value is obtained by performing a Hash operation on the changed original electronic file. These two hash values tend to be inconsistent.

Therefore, in the embodiment of the application, the second verification result may be generated by comparing the hash value with the hash value to be verified. If the hash value is consistent with the hash value to be verified, a second verification result is that verification is passed; and if the hash value is inconsistent with the hash value to be verified, the second verification result is that verification is not passed.

In one embodiment of the present application, the electronic document verification method further includes:

The verification method has the advantages that verification results can be timely notified to the user, and the user can reasonably arrange follow-up certificates or other operations according to the prompt results.

Fig. 6 is a diagram illustrating an embodiment of a structure of an electronic document authentication device according to an embodiment of the present application, where the electronic document authentication device includes:

a first obtaining module 610, configured to obtain initial certification information of a signed electronic file;

a calculation module 620, configured to perform a hash operation on the signed electronic file to generate a hash value;

a first encapsulation module 630, configured to encapsulate the hash value and the initial certificate information into first certificate information;

a signature module 640, configured to sign the first certificate information according to a predetermined asymmetric encryption key, and generate a digital signature;

a second obtaining module 650, configured to obtain a trusted timestamp corresponding to the first certificate information;

and a second packaging module 660, configured to package the first certificate information, the digital signature and the trusted timestamp into second certificate information corresponding to the signed electronic file.

In some embodiments of the present application, the first obtaining module 610 may include:

a file acquisition subunit, configured to acquire the signed electronic file;

Fig. 7 is a diagram showing an embodiment of a structure of an electronic document verification device according to an embodiment of the present application, where the electronic document verification device includes:

a first obtaining module 710, configured to obtain a file identifier of an electronic file to be verified;

the searching module 720 is configured to obtain second certificate storing information corresponding to the electronic file to be verified according to the file identifier;

a splitting module 730, configured to split the second certificate information to obtain a digital signature;

and the verification module 740 is configured to verify the digital signature according to a predetermined asymmetric decryption key, so as to obtain a first verification result.

In one embodiment of the present application, the splitting module 730 may also be configured to:

Compared with the prior art, the embodiment of the application has the beneficial effects that: the method comprises the steps of firstly, obtaining initial certificate storage information of a signed electronic file; then, carrying out hash operation on the signed electronic file to generate a hash value; then, the hash value and the initial certificate information are packaged into first certificate information; then signing the first certificate information according to a preset asymmetric encryption key to generate a digital signature, and performing timestamp operation on the first certificate information to generate a timestamp; and finally, packaging the first certification information, the digital signature and the time stamp into second certification information corresponding to the signed electronic file. According to the embodiment of the application, the hash operation, the asymmetric encryption operation and the time stamp operation are carried out on the certification information of the signed electronic file, so that the certification safety of the electronic file is remarkably improved, and the certification risks such as falsification, counterfeiting, repudiation and the like possibly existing in the certification of the electronic file are eliminated.

It will be clearly understood by those skilled in the art that, for convenience and brevity of description, specific working procedures of the above-described apparatus, modules and units may refer to corresponding procedures in the foregoing method embodiments, and are not repeated herein.

In the foregoing embodiments, the descriptions of the embodiments are emphasized, and in part, not described or illustrated in any particular embodiment, reference is made to the related descriptions of other embodiments.

It will be apparent to those skilled in the art that, for convenience and brevity of description, only the above-described division of the functional units and modules is illustrated, and in practical application, the above-described functional distribution may be performed by different functional units and modules according to needs, i.e. the internal structure of the apparatus is divided into different functional units or modules to perform all or part of the above-described functions. The functional units and modules in the embodiment may be integrated in one processing unit, or each unit may exist alone physically, or two or more units may be integrated in one unit, where the integrated units may be implemented in a form of hardware or a form of a software functional unit. In addition, specific names of the functional units and modules are only for convenience of distinguishing from each other, and are not used for limiting the protection scope of the present application. The specific working process of the units and modules in the above system may refer to the corresponding process in the foregoing method embodiment, which is not described herein again.

Those of ordinary skill in the art will appreciate that the various illustrative elements and algorithm steps described in connection with the embodiments disclosed herein may be implemented as electronic hardware, or combinations of computer software and electronic hardware. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the solution. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present application.

In the embodiments provided in the present application, it should be understood that the disclosed apparatus and method may be implemented in other manners. For example, the apparatus embodiments described above are merely illustrative, e.g., the division of the modules or units is merely a logical functional division, and there may be additional divisions when actually implemented, e.g., multiple units or components may be combined or integrated into another system, or some features may be omitted, or not performed. Alternatively, the coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection via interfaces, devices or units, which may be in electrical, mechanical or other forms.

The units described as separate units may or may not be physically separate, and units shown as units may or may not be physical units, may be located in one place, or may be distributed on a plurality of network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional unit in each embodiment of the present application may be integrated in one processing unit, or each unit may exist alone physically, or two or more units may be integrated in one unit. The integrated units may be implemented in hardware or in software functional units.

The integrated modules/units, if implemented in the form of software functional units and sold or used as stand-alone products, may be stored in a computer readable storage medium. Based on such understanding, the present application may implement all or part of the flow of the method of the above embodiment, or may be implemented by a computer program to instruct related hardware, where the computer program may be stored in a computer readable storage medium, and when the computer program is executed by a processor, the computer program may implement the steps of each method embodiment described above. Wherein the computer program comprises computer program code which may be in source code form, object code form, executable file or some intermediate form etc. The computer readable medium may include: any entity or device capable of carrying the computer program code, a recording medium, a U disk, a removable hard disk, a magnetic disk, an optical disk, a computer Memory, a Read-Only Memory (ROM), a random access Memory (RAM, random Access Memory), an electrical carrier signal, a telecommunications signal, a software distribution medium, and so forth. It should be noted that the computer readable medium contains content that can be appropriately scaled according to the requirements of jurisdictions in which such content is subject to legislation and patent practice, such as in certain jurisdictions in which such content is subject to legislation and patent practice, the computer readable medium does not include electrical carrier signals and telecommunication signals.

The above embodiments are only for illustrating the technical solution of the present application, and are not limiting; although the present application has been described in detail with reference to the foregoing embodiments, it should be understood by those of ordinary skill in the art that: the technical scheme described in the foregoing embodiments can be modified or some technical features thereof can be replaced by equivalents; such modifications and substitutions do not depart from the spirit and scope of the technical solutions of the embodiments of the present application, and are intended to be included in the scope of the present application.

Claims

1. A method for the certification of an electronic document, said method comprising:

acquiring initial certification information of a signed electronic file, wherein the initial certification information comprises one or more of signing party names, specific signer names and signing time of the electronic file;

the method for obtaining the trusted timestamp corresponding to the first certificate information specifically comprises the following steps: the first certificate information is sent to a third party trusted time stamp server, the first certificate information with the trusted time stamp fed back by the third party trusted time stamp server is received, and the trusted time stamp comprises: (1) The first forensic information to be time stamped, (2) date and/or time information of the first forensic information received by the third party trusted time stamp server;

2. The method of claim 1, wherein the obtaining initial certification information for the signed electronic file comprises:

acquiring the signed electronic file;

and analyzing the signed electronic file to obtain the initial certification information of the signed electronic file.

3. The method of claim 1, wherein the obtaining initial certification information for the signed electronic file comprises:

4. The electronic document certification method of claim 2, wherein after said packaging the first certification information, the digital signature and the trusted time stamp into second certification information corresponding to a signed electronic document, further comprising:

5. An electronic document verification method, wherein second certificate information corresponding to an electronic document verified by the verification method is second certificate information obtained after being processed by the electronic document certificate method provided by any one of claims 1 to 4, the method comprising:

acquiring a file identifier of an electronic file to be verified;

splitting the second certificate information to obtain a digital signature;

6. The electronic document verification method of claim 5, wherein the method further comprises:

7. The electronic document verification method of claim 5, wherein the method further comprises:

splitting the second certificate information to obtain a hash value;

8. The electronic document verification method of claim 6 or 7, wherein the method further comprises:

9. An electronic document authentication device, the device comprising:

the electronic document signing system comprises a first acquisition module, a second acquisition module and a first verification module, wherein the first acquisition module is used for acquiring initial verification information of a signed electronic document, and the initial verification information comprises one or more of names of signing parties, names of specific signatory and signing time of the electronic document;

the second obtaining module is configured to obtain a trusted timestamp corresponding to the first certificate information, and specifically includes: the first certificate information is sent to a third party trusted time stamp server, the first certificate information with the trusted time stamp fed back by the third party trusted time stamp server is received, and the trusted time stamp comprises: (1) The first forensic information to be time stamped, (2) date and/or time information of the first forensic information received by the third party trusted time stamp server;

And the second packaging module is used for packaging the first certification information, the digital signature and the trusted timestamp into second certification information corresponding to the signed electronic file.

10. An electronic document verification device, wherein second certificate information corresponding to an electronic document verified by the device is second certificate information obtained after being processed by the electronic document certificate method provided in any one of claims 1 to 4, the device comprising: