TWI392321B - System and method for digitally signing electronic documents - Google Patents

Description

Electronic document digital signing system and method

The invention relates to an electronic document digital signing system and method.

The electronic document digital sign-off is mainly implemented by the application of the digest algorithm and the public key cryptographic algorithm to encrypt and decrypt the electronic document. The digest algorithm (such as MD5, SHA-1, etc.) is also called a one-way hash algorithm. The function is to convert any variable length file into a fixed length string or bit string, generally 128 bits, 160 bits, 256 bits or 512 bits, etc., in order to shorten the length of the electronic signature file and improve the efficiency of the signature.

Public key cryptographic algorithms (such as RSA, ECC, etc.), also known as asymmetric cryptographic algorithms, use different keys for encryption and decryption. Each pair has a pair of keys (public and private), and the parties have private keys. Strictly confidential, the public key is disclosed to the other party. When the electronic signature is signed, the sender signs with his private key, and the recipient authenticates with the sender's public key. The credibility of the public key is the basis of the "trust relationship". Generally, a third-party authentication authority (CA) is required to sign and publish the public key. This third-party authentication and authorization unit signs and The collective name of the published public key and related information is the so-called digital certificate.

The feature of the electronic sign-off is that it represents the characteristics of the file. If the file changes, the value of the electronic sign-off will change accordingly. Different files get different digital sign-off values. In the transmission process, if a third person tampers with the file, but he does not know the sender's private key, therefore, the decrypted electronic sign-off value is inevitably different from the calculated electronic sign-off value, which provides A secure way to confirm the identity of the sender.

The process of the electronic sign-off is as follows: the sender of the message generates a message digest (or hash value) from the message text, and the sender encrypts the hash value with its own private key to form the sender's electronic signature. The core value; then, the electronic sign-off value will be sent to the receiver of the message as an attachment to the message and the message; the receiver of the message first calculates the message digest (or hash) from the original message received. Value), then use the sender's public key to decrypt the electronic sign-off value attached to the message. If the two digests are the same, the receiver can confirm that the e-signature is the sender.

Under normal circumstances, the general electronic document digital signing must be completed on a personal computer. The disadvantage of this method is that the signing supervisor cannot perform digital signing of electronic documents anytime and anywhere.

In view of the above, it is necessary to provide an electronic document digital signing system and method, which can perform digital signing of electronic documents anytime and anywhere through a mobile device.

An electronic document digital signing system, comprising a mobile device, an application server and a database, wherein the application server is connected to the mobile device and a database, wherein the database stores an electronic file to be signed a digital certificate for digital signing of the electronic document by the user is installed in the mobile device, where the digital certificate includes a private key for digital signing; the mobile device is used when the user selects the electronic file to be signed Sending a digital sign-off request to the application server; the application server acquiring the electronic file to be signed from the database according to the digital sign-off request, and generating a location according to a one-way hash algorithm Determining a digest value of the signed electronic file and transmitting a digest value of the electronic file to be signed to the mobile device; the mobile device encrypting with a private key of the digital certificate according to a public key cryptographic algorithm Generating a digest value of the electronic file to be signed to generate a first sign-off value, and transmitting the first sign-off value to the application server; the application server according to the encrypted message syntax standard a sign value and the electronic file to be signed are combined to obtain a composite file, and then a digest value of the synthesized file is generated according to a one-way hash algorithm, and the digest value of the synthesized file is transmitted to the a mobile device, according to a public key cryptographic algorithm, encrypting a digest value of the composite file with a private key of the digital certificate to generate a second sign-off value, and transmitting the second sign-off value to an application server; The application server synthesizes the first sign-off value, the second sign-off value, and the electronic file to be signed according to the encrypted message syntax standard to generate the signed electronic file.

An electronic document digital signing method includes the following steps: selecting an electronic file to be signed by a mobile device, and sending a digital signing request to an application server connected thereto, where the mobile device is installed with a digital signing for electronic document a digital certificate, the digital certificate includes a private key for digital signing; the application server obtains the electronic file to be signed from the database connected thereto according to the digital signing request, according to The one-way hash algorithm generates a digest value of the electronic file to be signed, and transmits a digest value of the electronic file to be signed to the mobile device; the mobile device uses the public key cryptographic algorithm The private key of the digital certificate encrypts the digest value of the electronic file to be signed to generate a first sign-off value, and transmits the first sign-off value to the application server; the application server is based on the encrypted message The grammar standard synthesizes the first sign-off value and the electronic file to be signed to obtain a composite file, and then generates a digest value of the synthesized file according to a one-way hash algorithm, and the synthesizing The digest value is transmitted to the mobile device; the mobile device encrypts the digest value of the synthesized file with a private key of the digital certificate according to a public key cryptographic algorithm to generate a second signing value, and the second signing core The value is transmitted to the application server; the application server synthesizes the first sign-off value, the second sign-off value and the electronic file to be signed according to the encrypted message syntax standard to generate the signed electronic file.

Compared with the prior art, the electronic document digital signing system and method can perform digital signing of electronic documents anytime and anywhere through a mobile device, thereby improving the flexibility of digital signing of electronic documents.

Referring to FIG. 1, a system architecture diagram of a preferred embodiment of the electronic document digital sign-off system of the present invention is shown. The system mainly includes a mobile device 10, an application server 20, and a database 30. The application server 20 and the mobile device 10 are connected to a database 30, wherein the mobile device 10 is connected to the application server 20 via Bluetooth technology (a short-range wireless communication technology). In addition, the mobile device 10 can also be connected to the application server 20 through a physical connection.

The mobile device 10 is installed with a digital certificate for the electronic document digital signing by the user, and the digital certificate includes the user's information, the private key, the expiration date, and the like. The private key is used to encrypt the digest value of the electronic document. The mobile device 10 can be a mobile phone, a personal digital assistant (PDA), or the like.

The database 30 is configured to store an electronic file to be signed, and the mobile device 10 is configured to send a digital sign-off request to the application server 20, that is, request an electronic file to be signed. The application server 20 obtains the electronic file to be signed from the database 30 according to the digital sign-off request sent by the mobile device 10, and generates a digest value of the electronic file to be signed, and the The digest value of the signed electronic file is transmitted to the mobile device 10. The mobile device 10 encrypts the digest value of the electronic file to be signed with the private key of the digital certificate to generate a first sign-off value, and transmits the first sign-off value to the application server 20. The application server 20 synthesizes the first sign-off value and the electronic file to be signed together to obtain a synthesized file, and generates a digest value of the synthesized file, and transmits the digest value of the synthesized file to the mobile Device 10. The mobile device 10 encrypts the digest value of the synthesized file with the private key of the digital certificate to generate a second sign-off value, and transmits the second sign-off value to the application server 20. Then, the application server 20 synthesizes the first sign-off value, the second sign-off value and the electronic file to be signed together, generates the signed electronic file, and saves the signed electronic file. Go to the database 30.

Referring to FIG. 2, it is a functional module association diagram of a preferred embodiment of the electronic document digital signcryption system of the present invention. The mobile device 10 includes a request module 110 and a digest encryption module 111. The application server 20 includes an acquisition module 210, a summary generation module 211, a synthesis module 212, and a save module 213. The module referred to in the present invention is a computer program segment for performing a specific function, and is more suitable for describing the execution process of the software in the computer than the program. Therefore, the following description of the software is described in the module.

First, the user turns on the mobile device 10 and selects the electronic file to be signed. Then, the requesting module 110 sends a digital sign-off request to the application server 20, that is, requests an electronic file to be signed. The mobile device 10 is installed with a digital certificate for the electronic document digital signing by the user, and the digital certificate includes the user's information, the private key, the expiration date, and the like. The private key is used to encrypt the digest value of the electronic document.

After the application server 20 receives the digital sign-off request sent by the mobile device 10, the obtaining module 210 acquires the electronic file to be signed from the database 30 according to the digital sign-off request. The summary generation module 211 generates a digest value of the electronic file to be signed according to a one-way hash algorithm (such as the secure hash algorithm SHA1, Secure Hash Algorithm 1), and the digest value of the electronic file to be signed Transfer to mobile device 10.

The cryptographic module 111 encrypts the digest value of the electronic file to be signed with the private key of the digital certificate to generate a first signing value according to a public key cryptographic algorithm (such as an RSA algorithm), and the first signing value is generated. The core value is transmitted to the application server 20.

The synthesizing module 212 synthesizes the first sign-off value and the electronic file to be signed according to the encrypted message syntax standard (PKCS7) to obtain a synthesized file. The PKCS7 is used under a PKI (Public Key Infrastructure) architecture.

The digest generating module 211 generates a digest value of the synthesized file according to a one-way hash algorithm (such as a secure hash algorithm SHA1, Secure Hash Algorithm 1), and transmits the digest value of the synthesized file to the mobile device 10.

The cryptographic module 111 encrypts the digest value of the synthesized file with a private key of the digital certificate to generate a second sign-off value according to a public key cryptographic algorithm (such as an RSA algorithm), and transmits the second sign-off value to The server 20 is applied.

Then, the synthesizing module 212 synthesizes the first sign-off value, the second sign-off value and the electronic file to be signed according to the encrypted message syntax standard (PKCS7) to generate the signed electronic file, and The signed electronic file is saved in the database 30.

Referring to FIG. 3, it is a flow chart of a preferred embodiment of the electronic document digital sign-off method of the present invention. First, in step S401, the user turns on the mobile device 10 and selects an electronic file to be signed. Then, the requesting module 110 sends a digital sign-off request to the application server 20, that is, requests an electronic file to be signed. The mobile device 10 is installed with a digital certificate for the electronic document digital signing by the user, and the digital certificate includes the user's information, the private key, the expiration date, and the like. The private key is used to encrypt the digest value of the electronic document.

In step S402, after the application server 20 receives the digital sign-off request sent by the mobile device 10, the obtaining module 210 acquires the electronic file to be signed from the database 30 according to the digital sign-off request. The summary generation module 211 generates a digest value of the electronic file to be signed according to a one-way hash algorithm (such as the secure hash algorithm SHA1, Secure Hash Algorithm 1), and the digest value of the electronic file to be signed Transfer to mobile device 10.

Step S403, the digest encryption module 111 encrypts the digest value of the electronic file to be signed with the private key of the digital certificate to generate a first sign-off value according to a public key cryptographic algorithm (such as an RSA algorithm), and the The first signoff value is transmitted to the application server 20.

Step S404, the synthesizing module 212 synthesizes the first sign-off value and the electronic file to be signed according to the encrypted message syntax standard (PKCS7) to obtain a synthesized file. The PKCS7 is used under a PKI (Public Key Infrastructure) architecture. The digest generating module 211 generates a digest value of the synthesized file according to a one-way hash algorithm (such as a secure hash algorithm SHA1, Secure Hash Algorithm 1), and transmits the digest value of the synthesized file to the mobile device 10.

Step S405, the digest encryption module 111 encrypts the digest value of the composite file with a private key of the digital certificate to generate a second sign-off value according to a public key cryptographic algorithm (such as an RSA algorithm), and the second sign-off value is generated. The value is passed to the application server 20.

Step S406, the synthesizing module 212 synthesizes the first signing value, the second signing value and the electronic file to be signed according to the encrypted message syntax standard (PKCS7) to generate the signed electronic file, and The signed electronic file is saved in the database 30.

The electronic document digital signing system and method of the present invention are disclosed above in the preferred embodiments, but are not intended to limit the present invention. Any person skilled in the art will be able to make changes and refinements without departing from the spirit and scope of the invention, and the scope of the invention is defined by the scope of the appended claims.

Mobile devices. . . 10

Application server. . . 20

database. . . 30

Request module. . . 110

Abstract encryption module. . . 111

Get the module. . . 210

Abstract generation module. . . 211

Synthetic module. . . 212

Save the module. . . 213

1 is a hardware architecture diagram of a preferred embodiment of an electronic document digital signcryption system of the present invention.

2 is a functional module association diagram of a preferred embodiment of the electronic document digital signcryption system of the present invention.

3 is a flow chart of a preferred embodiment of the electronic document digital sign-off method of the present invention.

Mobile devices. . . 10

Application server. . . 20

database. . . 30

Claims (8)

An electronic document digital signing system, comprising a mobile device, an application server and a database, wherein the application server is connected to the mobile device and a database, wherein the database stores an electronic file to be signed. The mobile device is installed with a digital certificate for digital signing of the electronic document, and the digital certificate includes a private key for digital signing; the mobile device is configured to: when the user selects the electronic file to be signed, The application server sends a digital sign-off request; the application server obtains the electronic file to be signed from the database according to the digital sign-off request, and generates the to-be-set according to a one-way hash algorithm And a digest value of the signed electronic file, and transmitting the digest value of the electronic file to be signed to the mobile device; the mobile device encrypts the to-be-received with the private key of the digital certificate according to a public key cryptographic algorithm Generating a digest value of the signed electronic file to generate a first sign-off value, and transmitting the first sign-off value to the application server; the application server is to perform the first sign according to an encrypted message syntax standard And synthesizing the electronic file to be signed to obtain a composite file, and then generating a digest value of the synthesized file according to a one-way hash algorithm, and transmitting the digest value of the synthesized file to the mobile device; And the mobile device encrypts the digest value of the composite file by using a private key of the digital certificate to generate a second sign-off value, and transmits the second sign-off value to an application server according to a public key cryptographic algorithm; The server combines the first sign-off value, the second sign-off value and the electronic file to be signed according to the encrypted message syntax standard to generate the signed electronic file. The electronic document digital sign-off system according to claim 1, wherein the one-way hash algorithm is a Secure Hash Algorithm (SHA1). The electronic document digital sign-off system according to claim 1, wherein the public key cryptographic algorithm is an RSA algorithm. The electronic document digital sign-off system of claim 1, wherein the encrypted message syntax standard is used under a public key infrastructure PKI (Public Key Infrastructure) architecture. An electronic document digital signing method, the method comprising the steps of: selecting an electronic file to be signed by a mobile device, and transmitting a digital signing request to an application server connected thereto, wherein the mobile device is installed with an electronic document digital device a signed digital certificate, the digital certificate includes a private key for digital signing; the application server obtains the electronic file to be signed from the database connected thereto according to the digital signing request Generating, according to a one-way hash algorithm, a digest value of the electronic file to be signed, and transmitting a digest value of the electronic file to be signed to the mobile device; the mobile device according to a public key cryptographic algorithm Encrypting the digest value of the electronic file to be signed with the private key of the digital certificate to generate a first sign-off value, and transmitting the first sign-off value to the application server; the application server is configured according to Encrypting message syntax standard synthesizing the first sign-off value and the electronic file to be signed to obtain a composite file, and then generating a digest value of the synthesized file according to a one-way hash algorithm, Generating a digest value of the synthesized file to the mobile device; the mobile device encrypts the digest value of the synthesized file with a private key of the digital certificate according to a public key cryptographic algorithm to generate a second signing value, and the second The sign-off value is transmitted to the application server; the application server synthesizes the first sign-off value, the second sign-off value and the electronic file to be signed according to the encrypted message syntax standard to generate the signed-out electronic files. The electronic document digital sign-off method according to claim 5, wherein the one-way hash algorithm is a secure hash algorithm SHA1 (Secure Hash Algorithm 1). The electronic document digital sign-off method according to claim 5, wherein the public key cryptographic algorithm is an RSA algorithm. The electronic document digital sign-off method of claim 5, wherein the encrypted message syntax standard is used under a Public Key Infrastructure (PKI) architecture.