TWI698823B - System for verifying user identity when processing digital signature and method thereof - Google Patents

Abstract

A system for verifying user identity when processing digital signature and a method thereof are provided. By verifying user’s identity when determining a private key corresponding to a certificate without password is encrypted by a default password, and decrypting the private key by the default password if the user’s identity is approved, the system and the method can confirm user identity when certificate without password is used for digital signature, and can achieve the effect of no need to remember password of certificate.

Description

System and method for verifying user identity when signing

A signing system and method, in particular, a system and method for verifying the identity of a user when signing.

Digital Signature is a technology that uses a key to encrypt data. In more detail, a digital signature is a mathematical algorithm or other method that uses a key to calculate the data generated by the data, not a signature Scanning into a digital image is not a signature entered using the touchpad. A set of digital signatures usually defines two complementary operations, one for signature and the other for verification. The integrity of the digitally signed data is easy to verify, and the digitally signed data is undeniable. Therefore, the digital signature can identify and confirm the identity of the signatory of the electronic document and the authenticity of the electronic document.

Because digital signatures are undeniable, they are often used in online transactions. Online transactions that use digital signatures have two security measures in the transaction process: user account verification and certificate password confirmation. Generally speaking, the device storing the digital certificate will also store the private key corresponding to the public key contained in the digital certificate, and the device will store the private key after being encrypted with the certificate password of the corresponding digital certificate. When a digital signature operation is required, the user needs to enter the certificate password of the corresponding digital certificate so that the device can decrypt the private key and use the decrypted private key for digital signature.

However, in some cases, the user does not set the certificate password of the digital certificate. For example, the user thinks that there is already a process of verifying the user account, so the user thinks that there is no need to set the certificate password of the digital certificate to avoid forgetting the certificate password. In this case, the digital certificate is usually encrypted with a default password by the device storing the digital certificate. In this way, when the digital signature is performed, the device storing the digital certificate will also directly decrypt the digital certificate with the default password. In other words, once the user account password is obtained by others, the other person who obtains the user account password can fraudulently use the user's identity to complete online transactions.

To sum up, it can be known that the private key corresponding to the certificate will be directly used for digital signature when the user has not set the certificate password of the certificate for a long time in the prior art. Therefore, it is necessary to propose improved technical means to Solve this problem.

In view of the problem in the prior art that the private key corresponding to the certificate will be directly used for digital signing when the user does not set the certificate password of the certificate, the present invention discloses a system and method for verifying the user's identity when signing. among them:

The system for verifying the identity of a user when signing a seal disclosed in the present invention at least includes: a certificate selection module for providing a selected target certificate; a key access module for determining whether the private key corresponding to the target certificate is Specify password or default password encryption; input module used to provide input specified password when private key is encrypted by specified password; identity verification module used to verify user identity when private key is encrypted by default password; The decryption module is used to decrypt the private key with the specified password, and used to decrypt the private key with the default password when the user's identity is verified; the signing module is used to sign the seal with the private key.

The method for verifying the user's identity at the time of signing disclosed in the present invention includes at least the steps of: providing a selected target certificate; when judging that the private key corresponding to the target certificate is encrypted by a designated password, providing the designated password and using the designated password to decrypt After the private key, use the private key to sign; when it is determined that the private key is encrypted by the preset password, verify the user's identity, and when the user's identity is verified, use the preset password to decrypt the private key and use the private key to sign.

The system and method disclosed in the present invention are as above. The difference between the present invention and the prior art is that the present invention verifies the user's identity when determining that the private key corresponding to the selected target certificate is encrypted by a preset password, and confirms the user identity. When the authentication is passed, the private key is decrypted with the preset password, so as to solve the problems of the previous technology, and can achieve the technical effect that the user only needs to memorize the mobile phone unlocking password without needing to memorize the certificate password.

The following will describe the features and implementation of the present invention in detail with the drawings and embodiments. The content is sufficient to enable anyone familiar with the relevant art to easily and fully understand the technical means used by the present invention to solve the technical problems and implement them accordingly. The achievable effect of the present invention.

The present invention can force the user to perform an input action to confirm that the user is allowed to perform the signing operation when the application program executed by the computing device uses the private key corresponding to the selected target certificate to sign.

The computing device mentioned in the present invention includes, but is not limited to, one or more processors, one or more memory modules, and components such as a bus connecting different components (including memory modules and processors), such as computing The equipment can be a mobile phone, a tablet, a navigation device, a multimedia player, an e-book reader, an electronic dictionary, a handheld electric toy, etc. Through the included multiple components, the computing device can load and execute the operating system including the application program 100, so that the operating system runs on the computing device.

The bus of the computing device mentioned in the present invention may include one or more types, for example, including data bus, address bus, control bus, and extended function bus ( expansion bus), and/or local bus (local bus). The bus of computing equipment includes, but is not limited to, parallel industry standard architecture (ISA) bus, peripheral component interconnect (PCI) bus, Video Electronics Standards Association (VESA) local bus, and serial universal serial bus (USB), PCI-E bus, etc.

The processor of the computing device provided by the present invention is coupled with the bus. The processor contains a register group or register space. The register group or register space can be completely set on the processing chip used as the processor, or all or part of it can be set outside the processing chip And it is coupled to the processor via a dedicated electrical connection and/or via a bus. The processor may be a processing unit, a microprocessor, or any suitable processing element. If the computing device is a multi-processor device, that is, the computing device includes multiple processors, the processors included in the computing device are all the same or similar, and they are coupled and communicated through a bus.

The processor of the computing device can be coupled to the chipset or electrically connected to the chipset through a bus. The chipset is composed of one or more integrated circuits (ICs), including a memory controller and peripheral input/output (I/O) controllers, that is, the memory controller and peripheral input/output controllers can be included in In an integrated circuit, two or more integrated circuits can also be used. Chipsets usually provide I/O and memory management functions, as well as multiple general-purpose and/or special-purpose registers, timers, etc., among which the aforementioned general-purpose and/or special-purpose registers and timers can be coupled or One or more processors electrically connected to the chipset are accessed or used.

The processor of the computing device can also access the data in the memory module and mass storage area installed on the computing device through the memory controller. The above-mentioned memory modules include any type of volatile memory (volatile memory) and/or non-volatile memory (NVRAM), such as static random access memory (SRAM), dynamic random access Memory (DRAM), flash memory (Flash), read-only memory (ROM), etc. The aforementioned mass storage area can include any type of storage device or storage medium, such as hard disk drives, optical discs, tape drives, flash drives (flash memory), solid state disks (Solid State Disk, SSD), or any Other storage devices, etc. In other words, the memory controller can access data in static random access memory, dynamic random access memory, flash memory, hard disk drives, and solid state drives.

The processor of the computing device can also communicate with peripheral output devices, peripheral input devices, communication interfaces, and GPS receivers and other peripheral devices or interfaces through the peripheral I/O bus through the peripheral I/O controller. The peripheral input device can be any type of input device, such as a keyboard, mouse, trackball, touchpad, joystick, etc. The peripheral output device can be any type of output device, such as a display, a printer, etc., a peripheral input device It can also be the same device as the peripheral output device, such as a touch screen. The communication interface can include a wireless communication interface and/or a wired communication interface. The wireless communication interface can include a mobile communication network that supports Wi-Fi, Zigbee and other wireless local area networks, Bluetooth, infrared, near field communication (NFC), 3G/4G/5G, etc. The wired communication interface can be Ethernet equipment, asynchronous transmission mode (ATM) equipment, DSL modem, cable modem, etc. The processor can periodically poll various peripheral devices and interfaces, so that the computing device can input and output data, and can also communicate with another computing device having the above-described components.

Hereinafter, the system architecture diagram of verifying the user's identity at the time of signing mentioned in the "Figure 1" of the present invention is used to illustrate the system operation of the present invention. As shown in "Figure 1", the system of the present invention includes a certificate selection module 110, a key access module 120, an input module 130, an identity verification module 150, a decryption module 170, and a signature module 180. And a unit judgment module 160 that can be added. In some embodiments, the aforementioned modules may be generated after the computing device 10 executes the application program 100, but the present invention is not limited thereto.

The certificate selection module 110 is responsible for providing the selected target certificate. Generally speaking, the application 100 includes a database (not shown in the figure). The database stores one or more certificates and the private key corresponding to each certificate. The certificate selection module 110 can list the database locations through peripheral output devices. The stored certificate is provided and the listed certificate is selected through the input module 130. The selected certificate is the target certificate, but the method provided by the certificate selection module 110 to select the target certificate is not limited to the above.

The key access module 120 is responsible for determining whether the private key corresponding to the target certificate selected by the certificate selection module 110 is encrypted by a designated password or a preset password. For example, the key access module 120 can determine the encryption method of the private key corresponding to the selected target certificate according to the data recorded in the database corresponding to the selected target certificate, but the present invention does not use this method. Is limited.

Wherein, the designated password is the password set by the user, usually the password set when applying for the certificate, or the password used by the user to change the applied certificate, but the present invention is not limited to this; The set password is the password used by the application 100 to encrypt the private key corresponding to the certificate that is not encrypted by the specified password. It is usually the device identification data such as the device ID of the device running the application 100, but the default password is not based on the above Is limited.

The input module 130 is responsible for providing the input of the specified password when the key access module 120 determines that the private key corresponding to the target certificate selected by the certificate selection module 110 is encrypted by the specified password. The input module 130 can call the input application program interface (API) provided by the operating system running the application 100 to provide input of a designated password, or it can display specific keys through peripheral output devices and provide input of designated passwords through peripheral input devices. The invention is not particularly limited.

The input module 130 can also provide input biometrics through peripheral input devices, such as inputting fingerprints or capturing images containing human faces, etc., but the biometrics mentioned in the present invention are not limited to the above; the input module 130 can also use The peripheral input device provides a screen unlocking password for inputting the computing device 10.

The identity verification module 150 is responsible for verifying the user's identity when the key access module 120 determines that the private key corresponding to the target certificate selected by the certificate selection module 110 is encrypted by a preset password. In some embodiments, the identity verification module 150 can provide biometrics to verify the user's identity through the input module 130. For example, the identity verification module 150 can call the biometric capture provided by the operating system running the application 100 The feature application program interface captures biometrics, and uses biometric identification technology to identify the captured biometrics to verify user identity.

In another part of the embodiment, the identity verification module 150 can also verify the user's identity through the screen unlock password. For example, the identity verification module 150 can request the input module 130 to input the screen unlock password, and confirm whether the entered screen unlock password is correct through the operating system of the application 100 to verify the user identity; the identity verification module 150 can also Call the screen unlock application interface to provide the input screen unlock password, and use the screen unlock application interface to determine whether the entered screen unlock password is correct to verify the user's identity; the authentication module 150 can also close the screen and wait for the user to open the screen and Complete the screen unlock and return to the application 100 to confirm the user's identity, etc. However, the method for the identity verification module 150 to verify the user's identity is not limited to the above.

In addition, the identity verification module 150 can also determine whether the screen unlock password has been set when the screen unlock password is used to verify the identity of the user. If the screen unlock password has not been set, the identity verification module 150 can display a prompt to request first Set a screen unlock password. That is, if the identity verification module 150 will use the screen unlock password to verify the user's identity, the identity verification module 150 will first confirm that the screen unlock password has been set.

The unit judgment module 160 can judge whether the issuing unit of the target certificate selected by the certificate selection module 110 is the same as the signing and calling unit. For example, the unit judgment module 160 can read the issuing unit information of the issuing unit of the target certificate from the selected target certificate, and compare the read issuing unit information and the calling unit information of the signed calling unit. It is used to determine whether the issuing unit of the selected target certificate is the same as the signing and calling unit. Wherein, the above-mentioned issuing unit information can be the identification code or name of the issuing unit, and similarly, the above-mentioned calling unit information can be the identification code or name of the signing and calling unit. However, the way that the unit judgment module 160 judges whether the issuing unit of the selected target certificate is the same as the signing and calling unit is not limited to the above.

In addition, the signature calling unit is the provider of the program or web page to be signed. For example, if the target to be signed is another application running on the same device as the application 100, the signing calling unit is For the person, company, group, or organization that provides the other application; similarly, if the object to be signed is a webpage opened by the embedded browser of the application 100, the signing calling unit is the containing application The owner, company, group, or organization of the website of 100 opened pages.

The decryption module 170 is responsible for when the key access module 120 determines that the private key corresponding to the target certificate selected by the certificate selection module 110 is encrypted with a specified password, decrypts and is encrypted with the specified password provided by the input module 130 The private key corresponding to the selected target certificate; the decryption module 170 is also responsible for determining in the key access module 120 that the private key corresponding to the target certificate selected by the certificate selection module 110 is encrypted by the default password, and the user When the identity is verified by the identity verification module 150, a preset password is used to decrypt the private key corresponding to the selected target certificate.

The decryption module 170 may also directly use the preset password to decrypt the selected private key when the unit determination module 160 determines that the issuing unit of the target certificate selected by the certificate selection module 110 is the same as the signing and calling unit. That is, in some embodiments, when the key access module 120 determines that the private key corresponding to the selected target certificate is encrypted by a preset password, and the unit determination module 160 determines the value of the selected target certificate When the issuing unit is the same as the signing and calling unit, the decryption module 170 can use the preset password to decrypt the private key corresponding to the selected target certificate; and when the key access module 120 determines that the key corresponds to the selected target certificate The private key is encrypted by the preset password, and the unit judgment module 160 judges that the issuing unit of the selected target certificate is different from the signing and calling unit, and the user identity is verified by the identity verification module 150, the decryption module 170 can also Use the preset password to decrypt the private key corresponding to the selected target certificate.

The signing module 180 is responsible for using the private key decrypted by the decryption module 170 to sign the data provided by the signing calling unit.

Next, the first embodiment is used to explain the operating system and method of the present invention, and please refer to the flowchart of the method of verifying the user's identity when signing the seal in "Figure 2A" of the present invention.

In this embodiment, it is assumed that the user executes the securities order application program provided by the securities company on the computing device 10 and places an order in the securities order application program. If the securities order application program needs to perform a signature operation, Then the securities order application program can call the application program 100. At this time, the signature calling unit is the securities company that provides the securities order application program. However, this embodiment is not limited to this. For example, the user can also use the embedded browser of the application 100 to open the order page provided by the securities company to place an order.

After the user operates the securities order application program so that the securities order application program calls the application program 100, the certificate selection module 110 may provide a selection target certificate (step 210). In this embodiment, it is assumed that the certificate selection module 110 can display a list of all certificates recorded in the database of the application 100, so as to provide the user to select a target certificate from the list.

After the certificate selection module 110 provides the selected target certificate (step 210), the key access module 120 can determine whether the private key corresponding to the selected target certificate provided by the certificate selection module 110 is encrypted by the specified password (step 222) .

If the key access module 120 determines that the private key corresponding to the selected target certificate is encrypted by the designated password, the input module 130 can provide the designated password for input (step 230). In this embodiment, it is assumed that the input module 130 can display an input interface of the designated password, so as to provide the user to input the designated password.

After the user enters the designated password through the input module 130, the decryption module 170 can use the designated password entered by the user to decrypt the private key corresponding to the selected target certificate provided by the certificate selection module 110 of the application 100 (step 240) , The signing module 180 can use the private key decrypted by the decryption module 170 to sign (step 250). In this embodiment, the signature module 180 uses the decrypted private key to provide the user with the signature of the order data to the securities order application that calls the application 100.

And if the key access module 120 determines that the private key corresponding to the selected target certificate is not encrypted by the specified password, it usually means that the private key corresponding to the selected target certificate is encrypted by the default password, then the identity verification module The group 150 can verify the user's identity through the operating system running the application 100, and determine whether the user's identity is verified (step 280). In this embodiment, it is assumed that the identity verification module 150 can detect the operating system running the application 100 (that is, the operating system running on the computing device 10) when the application 100 is installed for the first time. The system information is used to determine whether the operating system running the application 100 is a version that can use biometrics to identify the user's identity. If so, the user is provided with the option of using biometrics or a screen lock password to verify the user's identity. If the user chooses to use biometrics to verify the user's identity, the identity verification module 150 can call the biometrics application program interface provided by the operating system of the application 100 when the user's identity needs to be verified The application program interface provides the user to input biometrics such as fingerprints or faces, and recognizes the biometrics entered by the user. In this way, the identity verification module 150 can determine whether the user's identity is based on the recognition result of the biometric application interface Pass verification; and if the user chooses not to use biometrics to verify user identity, or the identity verification module 150 determines that the operating system running the application 100 is not a version that can use biometrics to identify the user identity, the identity verification module 150 When you need to verify the user's identity, you can call the screen unlocking application interface provided by the operating system running the application 100, so that the screen unlocking application interface provides the user to enter the screen unlocking password, and to determine whether the entered screen unlocking password is Correct, in this way, the identity verification module 150 can determine whether the user identity is verified based on whether the screen unlocking password determined by the screen unlocking application interface is correct.

If the identity verification module 150 determines that the user's identity has not been verified (step 280), the identity verification module 150 can terminate the application 100, so that the application 100 refuses to call the application 100 for signing the securities order application; If the identity verification module 150 determines that the user's identity is verified (step 280), the decryption module 170 can use the preset password to decrypt the private key corresponding to the selected target certificate provided by the certificate selection module 110 (step 290), and sign The chapter module 180 may use the private key decrypted by the decryption module 170 to sign (step 250). In this embodiment, the signature module 180 uses the decrypted private key to provide the user with the signature of the order data to the securities order application that calls the application 100.

Continue to use the second embodiment to explain the operating system and method of the present invention. Please also refer to "Figure 2A". In this embodiment, it is assumed that the user uses the embedded browser of the application 100 executed by the computing device 10 to open the tax declaration webpage and perform tax declaration operations. In the process of tax declaration, if it is necessary to perform the signature operation, the Java Script in the tax declaration webpage can call the application 100. At this time, the signature calling unit is the IRS that provides the tax declaration webpage. However, this embodiment is not limited to this. For example, users can also use tax reporting software to perform tax reporting operations.

After the user operates the tax declaration webpage so that the Java Script in the tax declaration webpage calls the application 100, the certificate selection module 110 can provide the target certificate for selection (step 210). In this embodiment, it is assumed that the certificate selection module 110 can display a list of all certificates recorded in the database of the application 100, so as to provide the user to select a target certificate from the list.

After the certificate selection module 110 provides the selected target certificate (step 210), the key access module 120 can determine whether the private key corresponding to the selected target certificate provided by the certificate selection module 110 is encrypted by the specified password (step 222) .

If the key access module 120 determines that the private key corresponding to the selected target certificate is encrypted by the designated password, the input module 130 can provide the designated password for input (step 230). In this embodiment, it is assumed that the input module 130 can display an input interface of the designated password, so as to provide the user to input the designated password.

After the user enters the designated password through the input module 130, the decryption module 170 can use the designated password entered by the user to decrypt the private key corresponding to the selected target certificate provided by the certificate selection module 110 of the application 100 (step 240) , The signing module 180 can use the private key decrypted by the decryption module 170 to sign (step 250). In this embodiment, the signature module 180 uses the decrypted private key to sign the tax declaration order data entered by the user into the tax declaration web page of the calling application 100.

And if the key access module 120 determines that the private key corresponding to the selected target certificate is not encrypted by the specified password, it usually means that the private key corresponding to the selected target certificate is encrypted by the default password, then the identity verification module The group 150 can verify the user's identity and determine whether the user's identity is verified (step 280). In this embodiment, it is assumed that the identity verification module 150 can detect the system information of the operating system running the application 100 (that is, the operating system running in the computing device 10) to determine whether the operating system running the application 100 is You can call the version of the screen unlocking application program interface. If so, the authentication module 150 can call the screen unlocking application interface provided by the operating system running the application 100, so that the screen unlocking application interface provides the user to enter the screen unlocking password. And determine whether the entered screen unlocking password is correct. The authentication module 150 can determine whether the user's identity is verified according to the judgment result of the screen unlocking application interface; if the operating system running the application 100 is unable to call the screen unlocking application interface Version, the authentication module 150 can prompt the user to allow the application 100 to have administrator rights. If the user does not agree to grant the application 100 administrator rights, the authentication module 150 can end the application 100 and make the application 100 100 refuses to call the application 100's tax declaration webpage signature operation, but if the user agrees to grant the application 100 administrator permissions, the identity verification module 150 can turn off the screen and determine whether the user opened the screen within a predetermined time and completed After the screen is unlocked, return to the application 100 to determine whether the user identity is verified.

If the authentication module 150 determines that the user's identity has not been verified, that is, the screen unlocking application interface determines that the screen unlocking password entered by the user is incorrect for a predetermined number of times, or the user has not turned on the screen within the predetermined time and completed the screen unlocking To return to the application 100, the identity verification module 150 can terminate the application 100, so that the application 100 refuses to call the application 100 to sign the securities order application; and if the identity verification module 150 determines the user identity Through verification, that is, the screen unlocking application interface determines that the user’s screen unlocking password is correct, or the user turns on the screen within a predetermined time and completes the screen unlock and returns to the application 100, the decryption module 170 can use the pre- Assuming that the password decryption and the private key corresponding to the selected target certificate provided by the certificate selection module 110 (step 290), the signing module 180 can use the private key decrypted by the decryption module 170 to sign (step 250). In this embodiment, the signature module 180 uses the decrypted private key to sign the tax declaration order data entered by the user into the tax declaration web page of the calling application 100.

In this way, when the application 100 executes the signing operation, the present invention may require the user to input a designated password, input biometrics, or input a screen unlocking password, so that the application 100 can confirm that the user allows the signing operation.

In the above two embodiments, after the key access module 120 determines that the private key corresponding to the selected target certificate is not encrypted by a specified password (step 222), the key access module 120 can further determine whether the private key is selected. Whether the private key corresponding to the target certificate is encrypted by the preset password (step 226).

In addition, in the above two embodiments, if the application 100 further includes the unit determination module 160, as shown in the flow of "Figure 2B", the key access module 120 determines that it corresponds to the selected target certificate The private key of is encrypted by a default password, or when the key access module 120 determines that the private key corresponding to the selected target certificate is not encrypted by a specified password, the unit judgment module 160 may first determine the issuance of the target certificate Whether the unit is the same as the signing calling unit (step 260). If the two are different, as described above, the identity verification module 150 can verify the user identity and determine whether the user identity is verified (step 280), and the decryption module 170 can determine the user identity in the identity verification module 150 When verifying, use the preset password to decrypt the private key corresponding to the selected target certificate (step 290); and if the unit determining module 160 determines that the issuing unit of the target certificate is the same as the signing and calling unit, the decryption module 170 can directly Use the preset password to decrypt the private key corresponding to the selected target certificate (step 290). Under this condition, the identity verification module 150 may not execute, that is, the identity verification module 150 may not determine whether the user identity is verified .

In addition, in the above two embodiments, when the identity verification module 150 determines whether the user's identity is verified (step 280), if the identity verification module 150 executes the operating system of the application 100 (that is, in the computing device 10) by calling The screen unlocking application interface provided by the running operating system determines whether the user’s identity has been verified. Then, before the identity verification module 150 determines whether the user’s identity has been verified, the identity verification module 150 can be as shown in "Figure 2C" As shown in the process, it is first judged whether the screen lock password is set (step 202), if not, the identity verification module 150 can prompt the user to set the screen unlock password (step 206). For example, the identity verification module 150 can determine whether the screen lock password is set for the first time after the application 100 is installed (step 202), but the present invention is not limited to this.

In summary, it can be seen that the difference between the present invention and the prior art is that when it is determined that the private key corresponding to the selected target certificate is encrypted by the preset password, the user identity is first verified, and when the user identity is verified , And then use the technical means of decrypting the private key with the preset password. This technical means can solve the problem that the private key corresponding to the certificate will be directly used for digital signature when the user in the prior art does not set the certificate password of the certificate. The problem is to achieve the technical effect that the user only needs to memorize the mobile phone unlocking password without needing to memorize the credential password.

Furthermore, the method of verifying the user's identity at the time of signing of the present invention can be implemented in hardware, software, or a combination of hardware and software, and can also be implemented in a centralized manner in a computer system or distributed in a number of different components. The decentralized implementation of interconnected computer systems.

Although the embodiments of the present invention are disclosed as above, the content described is not intended to directly limit the scope of patent protection of the present invention. Anyone with ordinary knowledge in the technical field to which the present invention belongs, without departing from the spirit and scope of the present invention, makes some modifications in the form and details of the implementation of the present invention, all belong to the patent protection of the present invention range. The scope of patent protection of the present invention shall still be determined by the scope of the attached patent application.

The computing device 10 100 110 document application module selection key 120 whether or not the input access module 130 module 150 module 160 to authenticate the decryption unit determining module 170 module 180 module signature is determined in step 202 has set the lock screen passcode Step 206 Request to set a screen unlock password Step 210 Provide a target certificate selection Step 222 Determine whether the private key corresponding to the target certificate is assigned a password encryption Step 226 Determine whether the private key corresponding to the target certificate is specified by a preset password Encryption step 230 Step 240 Use the designated password to decrypt the private key Step 250 Use the private key to sign step 260 Determine whether the issuing unit of the target certificate is the same as the signing and calling unit Step 280 Determine whether the user's identity has passed the verification step 290 Use the default private key to decrypt

Figure 1 is a diagram of the system architecture for verifying user identity when signing a seal according to the present invention. Figure 2A is a flow chart of the method for verifying the user's identity when signing a seal according to the present invention. Figure 2B is a flowchart of the additional method for verifying user identity when signing a seal according to the present invention. Figure 2C is a flowchart of the method for requesting to set a screen unlocking password according to the present invention.

Step 210 Provide selection of target certificate Step 222 Determine whether the private key corresponding to the target certificate is encrypted by a specified password Step 226 Determine whether the private key corresponding to the target certificate is encrypted by a preset password Step 230 Provide a specified password for decryption Step 240 Key step 250 Use private key to sign step 280 Determine whether the user's identity has passed the verification step 290 Use the preset password to decrypt the private key

Claims (10)

A method for verifying the user's identity when signing a seal is applied to an application. The method includes at least the following steps: providing to select a target certificate; judging whether a private key corresponding to the target certificate is assigned a specified password or a preset Set password encryption; when the private key is encrypted by the specified password, provide the specified password, and use the specified password to decrypt the private key, then use the private key to sign; and when the private key is encrypted by the preset password When the identity of a user is verified, and when the identity of the user is verified, the private key is decrypted using the preset password, and the private key is used to sign. For example, the method for verifying the user's identity at the time of signing as described in item 1 of the scope of patent application, wherein the method further includes determining the issuing unit of the target certificate and a step of determining that the private key is encrypted with the preset password When the signing and calling unit is the same, use the preset password to decrypt the private key, and use the private key to sign the step. For example, the method for verifying the user's identity at the time of signing as described in item 1 of the scope of patent application, wherein the step of verifying the user's identity is to capture biometrics to verify the user's identity using biometric identification technology. For example, the method for verifying the user's identity when signing a seal as described in item 1 of the scope of patent application, wherein the step of verifying the user's identity is to require the input of a screen unlock password to verify the user's identity. For example, the method for verifying the user's identity when signing a seal as described in item 4 of the scope of patent application, where the method includes requesting to set the screen when the screen unlocking password is not set before providing the step of selecting the target certificate for the participating unit Steps to unlock the password. A system for verifying user identity when signing a seal is applied to an application. The system at least includes: a certificate selection module for selecting a target certificate; a key access module for determining Whether a private key corresponding to the target certificate is encrypted by a designated password or a preset password; an input module for providing input of the designated password when the private key is encrypted by the designated password; an identity verification module , Used to verify the identity of a user when the private key is encrypted by a preset password; a decryption module used to decrypt the private key with the specified password, and used when the user’s identity is verified The preset password decrypts the private key; and a signing module for signing the private key. For example, the system for verifying the user's identity at the time of signing as described in item 6 of the scope of patent application, wherein the system further includes a unit judgment module for judging whether the issuing unit of the target certificate is the same as a signing calling unit, The decryption module is further used to decrypt the private key using the preset password when the issuing unit of the target certificate is the same as the signing calling unit. For example, the system for verifying the user's identity at the time of signing as described in item 6 of the scope of patent application, wherein the identity verification module captures biometrics to verify the user's identity using biometric identification technology. For example, the system for verifying the user's identity at the time of signing as described in item 6 of the scope of patent application, wherein the identity verification module requires the input of a screen unlock password to verify the user's identity. For example, the system for verifying the user's identity at the time of signing as described in item 9 of the scope of patent application, wherein the identity verification module is used to determine that the screen unlocking password is not set, and the screen unlocking password is required to be set.

Images