TWI734729B - Method and device for realizing electronic signature and signature server - Google Patents

Abstract

The present invention provides a method and device for implementing electronic signature. The method includes: determining a hash value of an electronic document to be signed; and encrypting the hash value with a private key corresponding to a public key in a digital certificate ; Combine the encrypted hash value, the digital certificate and the picture of the electronic signature into the electronic document. The technical solution of the present invention can solve the problem of high implementation cost of the USB-shield signature scheme in the prior art, realize the Internet signature mode, and reduce user costs.

Description

Method and device for realizing electronic signature and signature server

The present invention relates to the field of Internet technology, in particular to a method, a device and a signature server for implementing electronic signatures.

When it is necessary to electronically sign an electronic file provided by a large Internet financial enterprise for users, the private key used by the prior art through the electronic signature is placed in the USB shield. When the user uses the electronic signature, Insert the USB-shield into the computer, and the electronic signature system signs the electronic document by obtaining the private key corresponding to the public key in the digital certificate. Therefore, when a large number of users need electronic signatures, implementation costs are high and promotion is difficult.

In view of this, the present invention provides a new technical solution that can solve the technical problem of real-time application of electronic signatures of electronic documents through the Internet when the number of users is large, and the hardware cost of the electronic signature process is reduced.

In order to achieve the above objectives, the present invention provides technical solutions as follows: According to the first aspect of the present invention, a method for implementing electronic signatures is proposed. The method includes: determining the hash value of the electronic document to be signed; encrypting the hash value with a private key corresponding to the public key in the digital certificate; and encrypting the encrypted hash value and the digital The voucher and the picture of the electronic signature are combined into the electronic document.

According to a second aspect of the present invention, a method for implementing electronic signatures is proposed, which includes: determining the hash value of an electronic document to be signed; passing the hash value and the second secret key of the electronic document through a second private network Route to the third-party service platform, the second secret key is a secret key preset between the signing server and the third-party service platform; the second secret key pair is used on the third-party service platform After the hash value is encrypted, the encrypted hash value is received via the second private network; the encrypted hash value, the digital certificate, and the image of the electronic signature are combined into the electronic document middle.

According to a third aspect of the present invention, an apparatus for implementing electronic signatures is proposed, which includes: a determination module for determining the hash value of an electronic document to be signed; a first encryption module for determining the determination module The hash value determined by the group is encrypted with the private key corresponding to the public key in the digital certificate; the signature synthesis module is used to encrypt all the encrypted values of the first encryption module. The hash value, the digital certificate and the picture of the electronic signature are combined into the electronic document.

According to a fourth aspect of the present invention, a signature server is provided, including: a processor; a memory for storing executable instructions of the processor; wherein the processor is configured to: determine the to-be-signed The hash value of the electronic document; the hash value is encrypted with a private key corresponding to the public key in the digital certificate; the encrypted hash value, the digital certificate and the picture of the electronic signature Synthesize into the electronic document.

According to a fifth aspect of the present invention, a signing server is proposed, including: a processor; a memory for storing executable instructions of the processor; wherein the processor is configured to: determine the to-be-signed The hash value of the electronic document; the hash value and the second secret key of the electronic document are sent to the third-party service platform via a second private network, and the second secret key is used by the signing server and the A secret key preset between third-party service platforms; after the third-party service platform uses the second secret key to encrypt the hash value, the encrypted hash value is received via the second private network Value; synthesize the encrypted hash value, the digital certificate and the picture of the electronic signature into the electronic document.

It can be seen from the above technical solutions that the present invention uses the private key corresponding to the public key in the digital certificate to encrypt the hash value, and synthesizes the encrypted hash value, the image of the digital certificate and the electronic signature into the electronic document. In this way, the problem of high implementation cost of the USB-shield signature scheme in the prior art is solved, the Internet signature mode is realized, and the user cost is reduced. By encrypting the hash value and the encrypted hash value and The digital certificate is integrated into the electronic document, which improves the security and credibility of the electronic signature.

21: Third-party certification center

22: Signature Server

23: Cloud database

24: The first business platform

31: Signature Server

32: Third-party certification center

41: Signature Server

42: Third-party business platform

61: Confirm module

62: The first encryption module

63: Signature Synthesis Module

64: The second encryption module

65: storage module

66: Signature Synthesis Module

67: receiving module

621: get unit

622: Decryption Unit

623: encryption unit

624: first sending unit

625: first receiving unit

Fig. 1A shows a schematic flow chart of a method for implementing an electronic signature according to an exemplary embodiment of the present invention; Fig. 1B shows a schematic diagram of a picture of an electronic signature according to an exemplary embodiment of the present invention; Fig. 1C Shows a schematic diagram of a digital certificate according to an exemplary embodiment of the present invention; FIG. 2A shows a schematic flowchart of a method for implementing electronic signatures according to another exemplary embodiment of the present invention; A scene diagram of another exemplary embodiment of the present invention; FIG. 3A shows a schematic flowchart of a method for implementing an electronic signature according to another exemplary embodiment of the present invention; FIG. 3B shows another exemplary embodiment of the present invention. A scene diagram of an exemplary embodiment; FIG. 4A shows an implementation according to another exemplary embodiment of the present invention Figure 4B shows a scene diagram according to another exemplary embodiment of the present invention; Figure 5 shows a schematic structural diagram of a signature server according to an exemplary embodiment of the present invention Figure 6 shows a schematic structural diagram of an electronic signature device according to an exemplary embodiment of the present invention; Figure 7 shows a schematic structural diagram of an electronic signature device according to another exemplary embodiment of the present invention.

The exemplary embodiments will be described in detail here, and examples thereof are shown in the accompanying drawings. When the following description refers to the accompanying drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The implementation manners described in the following exemplary embodiments do not represent all implementation manners consistent with the present invention. On the contrary, they are merely examples of devices and methods consistent with some aspects of the present invention as detailed in the scope of the appended application.

The terms used in the present invention are only for the purpose of describing specific embodiments, and are not intended to limit the present invention. The singular forms of "a", "said" and "the" used in the scope of the present invention and the appended applications are also intended to include plural forms, unless the context clearly indicates other meanings. It should also be understood that the term "and/or" as used herein refers to and includes any or all possible combinations of one or more associated listed items.

It should be understood that although the terms first, second, The third class describes various information, but the information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of the present invention, the first information can also be referred to as second information, and similarly, the second information can also be referred to as first information. Depending on the context, the word "if" as used herein can be interpreted as "when" or "when" or "in response to certainty".

To further illustrate the present invention, the following embodiments are provided: According to an embodiment of the present invention, by encrypting the hash value with a private key corresponding to the public key in the digital certificate, the encrypted hash value, digital The image of the certificate and the electronic signature is combined into the electronic document, thereby solving the problem of high implementation cost of the USB-shield signature scheme in the prior art, realizing the Internet signature mode, reducing user costs, and reducing user costs. The hash value encryption and the combination of the encrypted hash value and the digital certificate into the electronic document improve the security and credibility of the electronic signature.

FIG. 1A shows a schematic flow chart of a method for implementing an electronic signature according to an exemplary embodiment of the present invention, FIG. 1B shows a schematic diagram of an electronic signature according to an exemplary embodiment of the present invention, and FIG. 1C shows A schematic diagram of a digital certificate according to an exemplary embodiment of the present invention; it can be applied to a signing server. As shown in FIG. 1A, the method for implementing electronic signature includes the following steps: Step 101, determine the hash value of the electronic document to be signed; Step 102, use the private key corresponding to the public key in the digital certificate for the hash value Key is encrypted; step 103, the encrypted hash value, digital certificate and electronic signature The pictures are combined into an electronic document.

In step 101, in one embodiment, the electronic document may be a local file (for example, a certification file, an electronic receipt, etc.); in another embodiment, the electronic document may come from the first business platform, and the first business platform may It is a payment-type financial service platform (for example, Alipay). Correspondingly, the electronic documents may be asset certificates, bills, or electronic receipts; in another embodiment, the electronic documents may come from the second business platform, and the second business platform may It is a deposit-type financial business platform (for example, Zhao Caibao), and correspondingly, the electronic document can be a loan and interest certificate; in another embodiment, the electronic document can be from a third business platform, and the third business platform can be the Internet For financial service platforms (for example, online merchant banks), correspondingly, the electronic document can be an electronic certificate applied by the end user, etc. It can be seen that the present invention does not limit the source of the electronic document.

In an embodiment, the electronic signature may be the electronic signature of the company corresponding to the first business platform, the electronic signature of the company corresponding to the second business platform, and the electronic signature of the company corresponding to the third business platform. In one embodiment, the hash value of the electronic document can be extracted by a hash algorithm.

In step 102, in one embodiment, the method of encrypting the hash value can be determined according to the source of the electronic document. For example, if the electronic document comes from the first business platform, an encryption machine can be set in the signing server. The first secret key (also known as the MainKey) of the computer is used to encrypt the private key in the digital certificate; for another example, if the electronic document comes from the second business platform, the hash value can be sent to the first private network via the first private network. Third-party certification center (for example, CA center), used by a third-party certification center The private key corresponding to the public key in the digital certificate encrypts the hash value, and then returns the encrypted hash value to the signing server via the first private network; for another example, if the electronic document comes from a third service The platform can send the hash value, the second secret key set between the signature server and the third-party financial platform to the encryption machine of the third business platform via the second private network, and the third business platform uses both parties through the encryption machine. The set second secret key encrypts the hash value, and then the third service platform returns the encrypted hash value to the signing server. By using different encryption methods to encrypt the hash value for electronic documents from different sources, individualized business needs can also be met.

In step 103, in one embodiment, the corresponding electronic signature picture can be obtained from the corresponding service platform (the first service platform, the second service platform, and the third service platform), and the encrypted hash value and digital The method for synthesizing the image of the voucher and the electronic signature into the electronic document can be referred to the related description of the prior art, which will not be described in detail here.

As shown in Figure 1B, the electronic signature synthesized on the electronic document is "AB Company". When a click event on the electronic signature of "AB Company" is monitored, the relevant information of the digital certificate shown in Figure 1C will be displayed. Since the digital certificate is obtained through a third-party authentication center, the user can verify the authenticity of the electronic signature by using the digital certificate.

It can be seen from the above description that the embodiment of the present invention implements the Internet signing mode through steps S101-S103, which solves the problem of the high implementation cost of the USB-shield signature scheme in the prior art, and reduces the user cost. Hash value encryption and synthesize the encrypted hash value and digital certificate into an electronic document The above has improved the security and credibility of electronic signatures.

FIG. 2A shows a schematic flowchart of a method for implementing electronic signatures according to another exemplary embodiment of the present invention, and FIG. 2B shows a scene of a method for implementing electronic signatures according to another exemplary embodiment of the present invention Figure; In this embodiment, the electronic document is provided from the first service platform as an example for illustrative description. As shown in Fig. 2A, the method of implementing electronic signature includes the following steps: step 201, determine the hash value of the electronic document to be signed; step 202, obtain the digital certificate and the private key corresponding to the public key in the digital certificate, The private key is encrypted; step 203, decrypt the encrypted private key; step 204, use the decrypted private key to encrypt the hash value; step 205, combine the encrypted hash value, digital certificate, and The picture of the electronic signature is combined into an electronic document.

For the description of the foregoing step 201, reference may be made to the related description of the foregoing step 101, which will not be described in detail here.

In step 202 to step 204, in one embodiment, the digital certificate and the encrypted private key can be obtained from the cloud database, where the first key of the encryption machine on the signing server (or the first key) can be obtained from the cloud database. Known as the master key) encrypts the private key corresponding to the public key in the digital certificate, then stores it in the cloud database, and decrypts the encrypted private key stored in the cloud database when needed . In another embodiment, the cloud database can store a large number of digital certificates and private keys corresponding to the public keys in the digital certificates, so as to realize a large number of digital certificates. The secure storage of the certificate and the private key corresponding to the public key in the digital certificate.

For the description of the foregoing step 205, reference may be made to the relevant description of the foregoing step 103, which will not be described in detail here.

As an exemplary scenario, as shown in FIG. 2B, the signing server 22 applies for a digital certificate from the third-party certification center 21, and the first key of the local encryption machine (not shown) of the signing server 22 is used to obtain the digital certificate. The private key corresponding to the public key in the digital certificate is encrypted, and the encrypted private key and digital certificate are stored in the cloud database 23. The signing server 22 obtains the electronic document that needs to be electronically signed from the first business platform 24, uses the hash algorithm to extract the hash value of the electronic document, and obtains the digital certificate and the encrypted private key from the cloud database 23, together with The hash value is sent together to the local encryption machine of the signing server 22, and the private key corresponding to the public key in the digital certificate is decrypted in the local encryption machine of the signing server 22, and the digital certificate is obtained. The private key corresponding to the public key of, the encryption machine then uses the private key to encrypt the hash value, and finally, the signing server 22 combines the encrypted hash value, digital certificate and electronic signature into the electronic document , And then can provide electronic documents to users. Since the first secret key is used to decrypt the private key corresponding to the public key in the digital certificate, and the process of encrypting the hash value with the private key corresponding to the public key of the digital certificate is in the signing server The internal processing of the encryption machine of the digital certificate ensures the safety of the private key corresponding to the public key in the digital certificate during use.

In this embodiment, since the digital certificate and add-on are stored in the cloud database The encrypted private key, when the electronic document needs to be electronically signed, the digital certificate and the encrypted private key of the digital certificate are obtained from the cloud database, which can avoid the encryption machine in the third-party certification center in the prior art. It can save a limited number of private keys corresponding to the public key in the digital certificate, so that it can support the large amount of data and high concurrency of Internet signatures, and ensure that it is consistent with the public key in the digital certificate. The security of the corresponding private key.

FIG. 3A shows a schematic flowchart of a method for implementing an electronic signature according to another exemplary embodiment of the present invention, and FIG. 3B shows a scene of a method for implementing an electronic signature according to another exemplary embodiment of the present invention Figure; In this embodiment, an electronic document is provided by the second service platform for exemplary description. As shown in FIG. 3A, the method for implementing electronic signature includes the following steps: step 301, determine the hash value of the electronic document to be signed; step 302, send the hash value of the electronic document to a third-party authentication via the first private network The third-party certification center is used to generate a digital certificate and encrypt the hash value with a private key corresponding to the public key in the digital certificate; step 303, receive the encryption from the third-party certification center via the first private network After the hash value; Step 304, the encrypted hash value, the digital certificate and the image of the electronic signature are combined into the electronic document.

For the description of the foregoing step 301, reference may be made to the relevant description of the foregoing step 101, which will not be described in detail here.

In step 302 and step 303, in one embodiment, the first private The network can be a dedicated communication network connected to the signing server and the certification center. No other equipment is connected to the dedicated communication network. The hash value and the encrypted hash value are transmitted via the first private network to ensure The security of the hash value.

For the description of the foregoing step 304, refer to the related description of the foregoing step 103, which is not detailed here.

As an exemplary scenario, as shown in FIG. 3B, the signing server 31 and the third-party certification center 32 jointly sign. In the joint signing process, the signing server 31 extracts the hash value of the electronic document through the hash algorithm, and the signing server 31 sends the hash value to the third-party authentication center 32 via the first private network, and the third-party authentication The center 32 encrypts the hash value using the private key corresponding to the public key in the digital certificate, and then returns the encrypted hash value to the signing server 31 via the first private network. The signing server 31 The encrypted hash value, digital certificate, and electronic signature are combined into an electronic document, and then the electronic document can be provided to the user.

In this embodiment, the hash value of the electronic document is sent to a third-party certification center via the first private network, and the third-party certification center encrypts the hash value with a private key corresponding to the public key in the digital certificate Later, the encrypted hash value is received via the first private network, and the encrypted hash value, digital certificate and electronic signature image are combined into the electronic document, which solves the high implementation cost of the USB-shield signature scheme in the prior art This reduces the user’s cost. By using the private key corresponding to the public key in the digital certificate stored in the third-party certification center to encrypt the hash value, the digital certificate and the encrypted hash value are combined into On the electronic document, the electronic The credibility of the signature, at the same time, can prevent electronic documents from being leaked to other unrelated enterprises, ensuring the commercial security of electronic documents.

FIG. 4A shows a schematic flowchart of a method for implementing an electronic signature according to another exemplary embodiment of the present invention, and FIG. 4B shows a scene of a method for implementing an electronic signature according to another exemplary embodiment of the present invention Figure; In this embodiment, the electronic document is provided by a third-party service platform as an example for illustrative description. As shown in FIG. 4A, the method for implementing electronic signature includes the following steps: step 401, determine the hash value of the electronic document to be signed; step 402, send the hash value and the second secret key of the electronic document via a second private network To a third-party business platform, where the second secret key is a preset secret key or a jointly negotiated key between the signing server and the third-party business platform; step 403, receive the encrypted hash value via the second private network; Step 404: Synthesize the encrypted hash value, the digital certificate and the image of the electronic signature into the electronic document.

For the description of the foregoing step 401, reference may be made to the relevant description of the foregoing step 101, which will not be described in detail here.

In step 402 and step 403, in one embodiment, the second private network may be a dedicated communication network connected to the signature server and a third-party service platform, and no other equipment is connected to the dedicated communication network. , Transmit the hash value and the encrypted hash value via the second private network to ensure the security of the hash value. In an embodiment, the third-party service platform may be the first service platform, the second service platform, the third service platform, etc. in the above embodiment A platform that can provide electronic documents.

For the description of the foregoing step 404, reference may be made to the relevant description of the foregoing step 103, which is not detailed here.

As an exemplary scenario, as shown in FIG. 4B, the signature server 41 obtains an electronic document from a third-party service platform 42, uses a hash algorithm to extract the hash value of the electronic document, and transmits the hash value to the encryption of the third-party service platform 42 The encryption machine of the third-party service platform 42 encrypts the hash value with the second secret key, and then the third service platform 42 returns the encrypted hash value to the signing server 41, and the signing server 41 encrypts it. The resulting hash value, digital certificate, and electronic signature are combined into an electronic document, and the electronic document can then be provided to the user.

This embodiment can meet the requirement of the third-party service platform 42 to keep the private key corresponding to the public key in the digital certificate, and improve the flexibility of the electronic signature method.

With the above-mentioned embodiments, different application solutions for electronic signatures can be available in different business scenarios, and therefore, when the advantages of various electronic signature usage solutions are used, personalized business needs are met.

Corresponding to the foregoing method for implementing electronic signatures, the present invention also proposes a schematic structural diagram of the signature server according to an exemplary embodiment of the present invention shown in FIG. 5. Please refer to Figure 5. At the hardware level, the network server includes a processor, internal bus, network interface, memory, and non-volatile memory, and of course, it may also include hardware required for other services. The processor reads the corresponding computer program from the non-volatile memory to the memory and then runs it to form a device that realizes the electronic signature on the logical level. Of course, except In addition to the software implementation, the present invention does not exclude other implementations, such as logic devices or a combination of software and hardware, etc. That is to say, the execution body of the following processing flow is not limited to each logic unit, and can also be hardware Body or logic device.

FIG. 6 is a schematic structural diagram of an apparatus for implementing electronic signatures according to an exemplary embodiment of the present invention; as shown in FIG. 6, the apparatus for implementing electronic signatures may include: a determination module 61 and a first encryption module 62 , Signature Synthesis Module 63. Wherein: the determination module 61 is used to determine the hash value of the electronic document to be signed; the first encryption module 62 is used to use the hash value determined by the determination module 61 corresponding to the public key in the digital certificate The private key is encrypted; the signature synthesis module 63 is used to synthesize the hash value encrypted by the first encryption module 62, the digital certificate, and the image of the electronic signature into an electronic document.

FIG. 7 is a schematic structural diagram of an apparatus for implementing electronic signatures according to an exemplary embodiment of the present invention; as shown in FIG. 7, based on the embodiment shown in FIG. 6, the first encryption module 62 may include: The obtaining unit 621 is used to obtain the digital certificate and the private key corresponding to the public key in the digital certificate, the private key is encrypted; the decryption unit 622 is used to encrypt the obtained 621 by the obtaining unit The private key for decryption; the encryption unit 623 is used to decrypt the private key by the decryption unit 622 The key encrypts the hash value.

In an embodiment, the device may further include: a second encryption module 64 for encrypting the private key corresponding to the public key in the digital certificate by the first secret key; and a storage module 65 for The private key and digital certificate encrypted by the second encryption module 64 are stored.

In one embodiment, the digital certificate and the encrypted private key are obtained from the cloud database.

In an embodiment, the first encryption module 62 may include: a first sending unit 624, configured to send the hash value of the electronic document to a third-party certification center via a first private network, where the third-party certification center is used for A digital certificate is generated and a private key corresponding to the public key in the digital certificate is used to encrypt the hash value; the first receiving unit 625 is configured to receive the encrypted hash value from a third-party authentication center via the first private network.

In one embodiment, the first private network is a dedicated communication network connected to the signing server and the third-party certification center.

In an embodiment, the device may further include: a sending module 66 for sending the hash value and the second secret key of the electronic document to the third-party service platform via the second private network, where the second secret key is the signature server The secret key preset between the server and the third-party service platform; the receiving module 67 is used to receive the encrypted hash value from the third-party certification center via the second private network.

It can be seen from the above embodiment that it can be different in different business scenarios. The application plan of the electronic signature, so when the advantages of the use of various electronic signatures are used, it meets the needs of personalized business.

Those skilled in the art will easily think of other embodiments of the present invention after considering the specification and practicing the invention disclosed herein. The present invention is intended to cover any variations, uses, or adaptive changes of the present invention. These variations, uses, or adaptive changes follow the general principles of the present invention and include common knowledge or conventional technical means in the technical field not disclosed by the present invention. . The specification and embodiments are only regarded as exemplary, and the true scope and spirit of the present invention are pointed out by the following patent application scope.

It should also be noted that the terms "include", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or equipment including a series of elements not only includes those elements, but also includes Other elements that are not explicitly listed, or also include elements inherent to such processes, methods, commodities, or equipment. If there are no more restrictions, the element defined by the sentence "including a..." does not exclude the existence of other identical elements in the process, method, commodity, or equipment that includes the element.

The above descriptions are only the preferred embodiments of the present invention and are not intended to limit the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the present invention Within the scope of protection.

Claims (16)

A method for implementing electronic signatures, characterized in that it is applied to a signature server, and the method includes: determining the hash value of the electronic document to be signed; and passing the hash value of the electronic document through a first private The network is sent to a third-party certification center, where the third-party certification center is used to generate the digital certificate and encrypt the hash value with a private key corresponding to the public key in the digital certificate; The first private network receives the encrypted hash value from the third-party authentication center; and synthesizes the encrypted hash value, the digital certificate and the image of the electronic signature into the electronic document. The method according to item 1 of the scope of patent application, wherein the encrypting the hash value with a private key corresponding to the public key in the digital certificate includes: obtaining a digital certificate and communicating with the digital certificate The private key corresponding to the public key in, the private key is encrypted; the encrypted private key is decrypted; the decrypted private key is used to encrypt the hash value. The method according to item 2 of the scope of patent application, wherein the method further comprises: encrypting the private key with a first secret key; and storing the digital certificate and the encrypted private key. The method according to item 2 of the scope of patent application, wherein the The digital certificate and the encrypted private key are obtained from the cloud database. The method according to item 4 of the scope of patent application, wherein the first private network is a dedicated communication network connected to the signing server and the third-party authentication center. A method for implementing electronic signatures, characterized in that it is applied to a signature server, and the method includes: determining the hash value of the electronic document to be signed; and combining the hash value and the second secret key of the electronic document It is sent to a third-party service platform via a second private network, and the second secret key is a preset secret key between the signing server and the third-party service platform; the third-party service platform uses the first After the two secret keys encrypt the hash value, receive the encrypted hash value via the second private network; synthesize the encrypted hash value, the digital certificate, and the image of the electronic signature into the electronic document . The method according to item 6 of the scope of patent application, wherein the second private network is a dedicated communication network connected to the signing server and the third-party service platform. A device for implementing electronic signatures, characterized in that, the device comprises: a determining module for determining the hash value of an electronic document to be signed; a first encryption module for determining the value of the determining module The hash value is encrypted with a private key corresponding to the public key in the digital certificate, wherein the encryption method of the hash value is based on the source of the electronic document. Source determination; signature synthesis module for synthesizing the hash value encrypted by the first encryption module, the digital certificate and the picture of the electronic signature into the electronic document; wherein, The first encryption module includes: a first sending unit, configured to send the hash value of the electronic document to the third-party certification center via a first private network, wherein the third-party certification center is used for Generate the digital certificate and use the private key corresponding to the public key in the digital certificate to encrypt the hash value; the first receiving unit is configured to receive from the first private network via the first private network The hash value encrypted by the third-party authentication center. The device according to item 8 of the scope of patent application, wherein the first encryption module includes: an acquiring unit for acquiring a digital certificate and a private key corresponding to a public key in the digital certificate, the The private key is encrypted; the decryption unit is used to decrypt the encrypted private key obtained by the obtaining unit; the encryption unit is used to use the private key decrypted by the decryption unit The hash value is encrypted. The device according to item 8 of the scope of patent application, wherein the device further includes: a second encryption module for using a first key pair to correspond to a private key in the digital certificate Encrypt The storage module is used to store the digital certificate and the private key corresponding to the public key in the digital certificate. The device according to item 9 of the scope of patent application, wherein the digital certificate and the encrypted private key are obtained from a cloud database. The device according to item 11 of the scope of patent application, wherein the first private network is a dedicated communication network connected to the signing server and the third-party authentication center. The device according to item 8 of the scope of patent application, wherein the device further includes a sending module for sending the hash value and the second key of the electronic document to a third party via a second private network. Business platform, the second secret key is a secret key preset between the signing server and the third-party business platform; a receiving module is used to receive the third-party certification via the second private network The hash value encrypted by the center. The device according to item 13 of the scope of patent application, wherein the second private network is a dedicated communication network connected to the signing server and the third service platform. A signature server, characterized in that, the signature server includes: a processor; a memory for storing executable instructions of the processor; wherein the processor is configured to: determine an electronic document to be signed Hash value of The hash value of the electronic document is sent to a third-party certification center via a first private network, where the third-party certification center is used to generate the digital certificate and use the public key in the digital certificate The corresponding private key encrypts the hash value; receives the encrypted hash value from the third-party authentication center via the first private network; encrypts the encrypted hash value and the digital certificate The picture with the electronic signature is combined into the electronic document. A signature server, characterized in that, the signature server includes: a processor; a memory for storing executable instructions of the processor; wherein the processor is configured to: determine an electronic document to be signed The hash value of the electronic document; the hash value and the second secret key of the electronic document are sent to a third-party service platform via a second private network, and the second secret key is used by the signature server and the third-party service platform After the third-party service platform uses the second secret key to encrypt the hash value, the encrypted hash value is received via the second private network; The encrypted hash value, the digital certificate and the picture of the electronic signature are combined into the electronic document.

Images