RU2637991C1 - Method of electronic signature - Google Patents

Abstract

FIELD: information technology.

SUBSTANCE: method of electronic signature of a document, the server-generated electronic signature, after receiving from the user's device hash of the document and match of received hash of the document with hash of the document computed by the electronic signature server, wherein the electronic signature server stores the electronic signature key of the user in encrypted form, and the encryption key is stored in the mobile application installed on the user's phone and is encrypted in its turn with the user's password.

EFFECT: improving reliability.

6 cl, 1 dwg

Description

Technical field

The invention relates to methods for protecting data using certificates or electronic signatures.

State of the art

It is known to use a mobile phone for electronic signature (ES) of a document hash, since the screen sizes of a mobile phone can make it difficult for a user to familiarize themselves with a document, for example, the publication of European patent application EP 2582115 of 04.17.2013. However, this well-known technical solution does not provide for authentication of the document submitted for signature.

The prior art US patent US 6453416 from 09/17/2002, which describes the method of electronic signature generated by the electronic signature server after it receives a document hash from the user device and the received document hash matches the document hash computed by the electronic signature server.

This known method provides for user identification and authentication and is a prototype for the claimed method of electronic signature.

The disadvantage of this method is that it does not provide for authentication by the user of the signed document and, accordingly, does not ensure non-repudiation of the user from his instruction to the ES server to sign the document. To eliminate this drawback and directed the claimed invention.

Disclosure of inventions

The technical result, to which the claimed invention is directed, is the implementation of the user's non-repudiation from his instruction to the ES server to sign a document based on the authentication of both the user and the document signed by the user. To achieve this technical result, the operation of authenticating the user and receiving his instructions to sign the document provided for in the prototype is divided in the claimed technical solution. In the claimed invention, the ES server first authenticates the user by a message received from the user's mobile phone in response to a push notification, then it sends the document hash to the user and the user authenticates the document, and only then instructs the ES server to sign the document or refuses to sign.

Another technical result is to increase the security of the electronic signature of the document when it enters the electronic signature server from the outside, since the electronic signature key is stored on the electronic signature server in encrypted form, and the encryption key is stored in the mobile application on the user's phone, and is encrypted with the user's password. Moreover, there are two messaging between the user's mobile phone and the electronic signature server. The first messaging initiated by push notification takes place over a secure channel and allows mutual authentication of correspondents, and the second messaging is completed by sending the encryption key to the electronic signature server only after the user makes a decision after reviewing the document and comparing the document hashes received for different communication channels.

An additional technical result achieved in the claimed invention is the use of one mobile means of communication (mobile phone) and to familiarize yourself with the document, and to authenticate this document, and to indicate the signature of this document due to the use of various communication channels in these operations.

The indicated technical results are achieved in the method of electronic signature of a document generated by the electronic signature server that stores the user’s electronic signature key in encrypted form, and the encryption key, which may be symmetric or asymmetric, is stored in the mobile application installed on the user's phone and can be optionally turn also be encrypted, for example, with a user password. In accordance with the claimed method, upon receipt of a document, the electronic signature server calculates the hash of this document, provides the document and its hash for familiarization with the user, and sends a notification, for example, a push notification to the user's phone equipped with a mobile application opened by the user, in particular by pressing push- notification, then the user, opening the mobile application, can enter the password, if one is provided, and the mobile application:

- if a password is provided, decrypts the key to create a secure channel (for example, TLS) and the encryption key using a password,

- establishes a secure connection with an electronic signature server with two-way certificate authentication,

- receives the electronic signature from the server and displays the hash of the signed document on the user's phone screen, which the user compares with the hash displayed in a browser installed on the user's equipment, and

upon successful comparison and consent to sign the document, the user initiates sending a message through the mobile application interface, then:

- a mobile application sends a hash of a document and an encryption key to a digital signature server over a secure connection,

- the electronic signature server compares the received document hash with the document hash computed by him earlier, if they match, using the encryption key received from the mobile application installed on the user's phone, decrypts the applicant’s signature, generates and returns the hash of the document.

To familiarize the user, the electronic signature server, using its WEB interface, can place the document and its hash on the Internet, while the browser installed on the user's equipment is redirected by the document sender - a server with software that uses application programming interfaces (API) application programming interface) of the ES server, by the link provided by the electronic signature server.

It is also possible that the link is not provided by the ES Server, but the push notification is immediately transmitted to the user's phone. In this case, the user is familiarized with the document only on his phone. The browser can be installed on the user's phone.

The electronic signature server can provide the document and its hash to the user for review by e-mail, the address of which can be indicated in the message when the document arrives at the electronic signature server.

A mobile application may contain a user-encrypted key for creating a secure channel (for example, TLS) and an encryption key.

Brief Description of the Drawings

The drawing shows an algorithm for implementing the claimed method of electronic signature.

Use cases of inventions

The use of inventions, for example, is possible when applying for state registration of an individual entrepreneur or limited liability company.

A user on the site of the Automated Information System (hereinafter AIS) on the Internet fills out a questionnaire and AIS on the basis of user data creates a document "Application for company registration" and sends this document to the electronic signature server, which stores the electronic signature key of the user, encrypted with the key stored in mobile application on the user's phone.

Then the electronic signature server:

- calculates the hash of the document and, using its WEB interface, places the document and its hash on the Internet and returns to AIS a link to which AIS redirects the browser installed on the user's computer (this link allows the user to familiarize himself with the document and its hash), and

- sends a push notification to a user's phone equipped with a mobile application that the user opens when clicking on a push notification.

Then the user, having opened the mobile application, enters the password and the mobile application:

- decrypts using the password the private key to create a secure connection and the encryption key,

- establishes a secure connection with an electronic signature server with two-way certificate authentication,

- receives the electronic signature from the server and displays the hash of the signed document on the user's phone screen, which the user compares with the hash displayed in the browser installed on the user's computer.

Upon successful comparison and consent to sign the document, the user initiates sending a message via the mobile application interface, then the mobile application sends the document hash and encryption key to the electronic signature server using the secure connection, and the electronic signature server compares the received document hash with the document hash calculated earlier , and if they match, using the encryption key received from the mobile application installed on the user's phone, decrypts the key electronically pisi applicant generates and returns a signed document in the AIS, which sends the document and electronic signature to it in the body of state registration of legal entities and entrepreneurs.

Another example is the use of the invention to sign a loan agreement between a bank and a borrower. The loan manager generates and places a loan agreement between the bank and the borrower on the bank's server. The bank server sends the loan agreement to the Electronic Signature Server 2 times - for signing by the borrower and the authorized person of the bank and each time receives a link for signing the loan agreement, which is provided together with the agreement, respectively, to the borrower and the authorized person of the bank, for example, by e-mail. Each time one of them receives a push notification, opens a mobile application, enters a password and a mobile application:

- decrypts using a password a key to create a secure channel and an encryption key,

- establishes a secure connection with an electronic signature server with two-way certificate authentication,

- receives the electronic signature from the server and displays the hash of the loan agreement on the user's phone screen, which the user compares with the hash provided to him by the bank server.

Upon successful comparison and agreement to sign a loan agreement, both the borrower and the authorized person of the bank initiate sending a message through the mobile application interface, then the mobile application sends the hash of the loan agreement and encryption key to the electronic signature server using the secure channel, and the electronic signature server compares the received hash the loan agreement with the hash of the loan agreement calculated by him earlier, and if they match, using the encryption key received from the mobile application, set ennogo on the user's phone decrypts the signature of the applicant, forms and returns a hash signature of a loan agreement on the bank's server, which instructs to transfer funds to the borrower.

The algorithm for implementing the claimed method of electronic signature in a generalized form, shown in the drawing, includes the following operations:

1. Entering data from the user's computer into a form stored on the application software server (software).

2. Generation by the application server of a document for signature.

3. Transfer of the document for signature from the application server to the signature server.

4. A request for a document to be signed by a signature server from a user's smartphone.

5. User input password.

6. Verification by the user of the displayed document.

7. Expression by the user of consent to sign the document using the smartphone interface, in the simplest case, by clicking the "Agree" button.

8. Transfer of the decryption key of the signature key from the smartphone to the signature server.

9. Signature generation by the signature server.

10. Returning the signature from the signature server to the application server.

Claims (6)

1. The method of electronic signature of a document generated by the electronic signature server after it receives the document hash from the user device and the received document hash matches the document hash computed by the electronic signature server, characterized in that the electronic signature server stores the user’s electronic signature key in encrypted form, and the key The encryption is stored in the mobile application installed on the user's phone and is encrypted in turn with the user's password. the throne signature calculates the hash of this document and provides the document and its hash for familiarization with the user, and sends a notification to the user's phone equipped with the mobile application opened by the user, then the mobile application establishes a secure connection to the electronic signature server with two-way certificate authentication, receives from the electronic server signature and displays the hash of the document on the user's phone screen, which the user compares with the hash of the document provided by To familiarize yourself with the document, and if the document is successfully compared and agreed to be signed, the user initiates sending a message through the mobile application interface, then the mobile application sends the document hash and encryption key to the electronic signature server over the secure connection, the electronic signature server compares the received document hash with the hash document, calculated by him earlier, if they match, using the encryption key received from the mobile application installed on the user's phone, expanded frovyvaet signature of the applicant, forms and sends a hash signature of the document to the sender incoming document. 2. The method according to p. 1, characterized in that the notification sent by the electronic signature server to the user's telephone is a push notification, and the mobile application is opened by the user by clicking on the push notification. 3. The method according to p. 1, characterized in that the mobile application contains a key to create a secure communication channel and an encryption key encrypted with the user's password, and after opening the mobile application, the user enters a password, and the mobile application first decrypts the key to create a secure one using the password channel and encryption key. 4. The method according to p. 1, characterized in that for familiarization of the user, the electronic signature server, using its WEB interface, places the document and its hash on the Internet, while the browser installed on the user’s equipment is redirected to the document sender’s server by the link provided electronic signature server. 5. The method according to p. 4, characterized in that the browser is installed on the user's phone. 6. The method according to p. 1, characterized in that the electronic signature server provides the document and its hash to the user for review by e-mail, the address of which was specified when the document was received on the electronic signature server.

Images