TWM576681U - Computing device validating user identity during signing - Google Patents

Abstract

A computing device for verifying a user identity at the time of signing, which first verifies the user identity by encrypting the private key corresponding to the selected target voucher, and when the user identity passes the verification, The technical means of decrypting the private key by using the preset password can confirm the user identity when the user uses the private key signature corresponding to the voucher without the voucher password, and achieve the technical effect that the user does not need to additionally memorize the voucher password.

Description

Computing device for verifying user identity at the time of signature

A signing device, in particular, a computing device that verifies the identity of a user at the time of signing.

Digital Signature is a technique for encrypting data using keys. In more detail, digital signatures are generated by mathematical algorithms or other means using data to calculate data, rather than signing Scan into a digital image, not a signature entered using the touchpad. A set of digital signatures usually defines two complementary operations, one for signature and one for verification. The integrity of the digital signature is easy to verify, and the digital signature is non-repudiation. Therefore, the digital signature can identify and confirm the identity of the signatory of the electronic document and the authenticity of the electronic document.

Because digital signatures are non-repudiation, they are often used in online transactions. The online transaction using the digital signature has two security measures for the verification of the user account and the confirmation of the voucher password during the transaction. Generally, the device storing the digital certificate also stores the private key corresponding to the public key included in the digital certificate, and the device encrypts the private key after being encrypted by the corresponding password of the digital certificate. When a digital signature job is required, the user needs to input the voucher password of the corresponding digital certificate, and the device can decrypt the private key and use the decrypted private key to perform the digital signature.

However, in some cases, the user does not set a voucher password for the digital certificate. For example, the user believes that there is already a program for verifying the user account, so the user thinks that there is no need to additionally set the voucher password of the digital certificate to avoid forgetting the voucher. password. In this case, the digital voucher is usually encrypted by the device storing the digital voucher with a preset password. Thus, when the digital signature is performed, the device storing the digital voucher directly decrypts the digital voucher with the preset password. That is to say, once the user account password is obtained by others, the person who obtains the user account password can use the identity of the user to complete the online transaction.

In summary, it can be known that in the prior art, the private key corresponding to the voucher when the user does not set the voucher password of the voucher has been directly used for the digital signature, so it is necessary to propose an improved technical means. Solve this problem.

In view of the prior art, when the user does not have a voucher password for setting a voucher, the private key corresponding to the voucher will be directly used for the digital signature. The author discloses a computing device for verifying the user identity at the time of signing, wherein :

The computing device disclosed in the present invention for verifying the identity of the user at the time of signing includes at least: a voucher selection module for providing a selection target voucher; and a key access module for determining whether the private key corresponding to the target voucher is The password is encrypted by the designated password or the preset password; the input module is configured to provide an input designated password when the private key is encrypted by the specified password; and the authentication module is configured to verify the user identity when the private key is encrypted by the preset password. The decryption module is configured to decrypt the private key by using the specified password, and is used to decrypt the private key when the user identity passes the verification, and the signature module is used to use the private key signature.

The computing device disclosed in the present application is as above, and the difference from the prior art is that the author authenticates the user identity by encrypting the private key corresponding to the selected target credential, and passes the user identity. In the verification, the private key is decrypted by using the preset password, so as to solve the problems existing in the prior art, and the technical effect that the user only needs to memorize the unlocking password of the mobile phone without additionally remembering the password of the password can be achieved.

The features and implementations of the present invention will be described in detail below in conjunction with the drawings and the embodiments, which are sufficient to enable any skilled person to fully understand the technical means to which the present invention solves the technical problems and implement them accordingly. The achievable effect of this creation.

The author can force the user to perform an input behavior to confirm that the user is allowed to perform the signature job when the application executed by the computing device uses the private key corresponding to the selected target voucher to sign.

The computing device proposed by the present invention includes, but is not limited to, one or more processors, one or more memory modules, and components such as bus bars connecting different components (including memory modules and processors), for example, calculations The device can be a mobile phone, a tablet, a navigation device, a multimedia player, an e-book reader, an electronic dictionary, a palm-type electric toy, and the like. Through the various components included, the computing device can load and execute the operating system to cause the operating system to run on the computing device.

The bus of the computing device proposed by the present application may include one or more types, for example, including a data bus, an address bus, a control bus, and an expansion bus ( Expansion bus), and / or local bus and other types of bus. Busbars for computing devices include, but are not limited to, side-by-side industry standard architecture (ISA) busses, peripheral component interconnect (PCI) busses, video electronic standards associations (VESA) local busses, and tandem universal sequence busses (USB), Fast Peripheral Component Interconnect (PCI-E) bus, etc.

The processor of the computing device proposed by the present invention is coupled to the bus bar. The processor includes a register group or a scratchpad space, and the scratchpad group or the scratchpad space can be completely disposed on the processing chip as a processor, or all or part of the processing chip is disposed outside the processing chip. And coupled to the processor via a dedicated electrical connection and/or via a bus bar. The processor can be a processing unit, a microprocessor, or any suitable processing element. If the computing device is a multi-processor device, that is, the computing device includes multiple processors, the computing device includes the same or similar processors and is coupled and communicated through the bus.

The processor of the computing device can be coupled to the chip set or electrically connected to the chip set through the bus bar. The chipset is composed of one or more integrated circuits (ICs), including a memory controller and a peripheral input/output (I/O) controller, that is, the memory controller and the peripheral output controller can be included in In an integrated circuit, two or more integrated circuits can also be used. The chipset typically provides input and memory management functions, as well as providing a plurality of general purpose and/or dedicated registers, timers, etc., wherein the general purpose and/or dedicated registers and timers are coupled or One or more processors electrically coupled to the chip set are accessed or used.

The processor of the computing device can also access the data stored in the memory module and the large-capacity storage area of the computing device through the memory controller. The above memory module includes any type of volatile memory and/or non-volatile memory (NVRAM) memory, such as static random access memory (SRAM), dynamic random access. Memory (DRAM), flash memory (Flash), read-only memory (ROM), etc. The mass storage area described above may include any type of storage device or storage medium, such as a hard disk drive, a compact disc, a tape drive, a flash drive (flash memory), a solid state disk (SSD), or any Other storage devices, etc. That is to say, the memory controller can access data in the static random access memory, the dynamic random access memory, the flash memory, the hard disk drive, and the solid state hard disk.

The processor of the computing device can also communicate with the peripheral device or interface such as the peripheral output device, the peripheral input device, the communication interface, and the GPS receiver through the peripheral output/input bus through the peripheral output/input controller. The peripheral input device can be any type of input device, such as a keyboard, a mouse, a trackball, a trackpad, a rocker, etc., and the peripheral output device can be any type of output device, such as a display, a printer, etc., peripheral input device It can also be the same device as the peripheral output device, such as a touch screen. The communication interface can include a wireless communication interface and/or a wired communication interface, and the wireless communication interface can include a wireless communication network such as Wi-Fi, Zigbee, Bluetooth, infrared, near field communication (NFC), 3G/4G/5G, etc. The interface of the road or other wireless data transmission protocol, the wired communication interface can be an Ethernet device, an asynchronous transfer mode (ATM) device, a DSL data machine, a cable (data) data machine, and the like. The processor can periodically poll various peripheral devices and interfaces to enable the computing device to perform input and output of data, as well as to communicate with another computing device having the elements described above.

The following is a description of the operation of the creation of the computing device by verifying the identity of the user at the time of signature in the "Picture 1". As shown in FIG. 1, the computing device 10 of the present invention includes a voucher selection module 110, a key access module 120, an input module 130, an identity verification module 150, a decryption module 170, and a signature module. 180, and a unit judgment module 160 that can be attached. In some embodiments, the above modules may be generated after the computing device 10 executes the application 100, but the invention is not limited thereto.

The voucher selection module 110 is responsible for providing the selection target voucher. Generally, the application 100 includes a database (not shown), the database stores one or more credentials and a private key corresponding to each credential, and the credential selection module 110 can list the database through the peripheral output device. The stored voucher is provided through the input module 130 to select the listed voucher, and the selected voucher is the target voucher, but the manner in which the voucher selection module 110 provides the selected target voucher is not limited to the above.

The key access module 120 is responsible for determining whether the private key corresponding to the target credential selected by the credential selection module 110 is encrypted by a designated password or a preset password. For example, the key access module 120 can determine the encryption method of the private key corresponding to the selected target voucher according to the data recorded in the database corresponding to the selected target voucher, but the creation does not use this Limited.

The designated password is a password set by the user, usually a password set when the application for the voucher, or a password for the user to change the voucher applied for, but the creation is not limited thereto; The password is the password used by the application 100 to encrypt the private key corresponding to the certificate encrypted without the specified password, and is usually the device identification data such as the device identification code of the device executing the application 100, but the default password is not the above. Limited.

The input module 130 is responsible for providing an input designated password when the key access module 120 determines that the private key corresponding to the target credential selected by the credential selection module 110 is encrypted by the designated password. The input module 130 can call the input application interface (API) provided by the operating system of the execution application 100 to provide an input designated password, or can display a specific button through the peripheral output device and provide a designated password through the peripheral input device. There are no special restrictions on creation.

The input module 130 can also provide input biometrics through the peripheral input device, such as inputting a fingerprint or capturing an image including a human face, but the biometrics proposed in the present application are not limited to the above; the input module 130 can also pass through The peripheral input device provides a screen unlock password for input to computing device 10.

The authentication module 150 is responsible for verifying the identity of the user when the key access module 120 determines that the private key corresponding to the target credential selected by the credential selection module 110 is encrypted by the default password. In some embodiments, the authentication module 150 can provide an input biometric verification user identity through the input module 130. For example, the authentication module 150 can call the execution entity provided by the execution system of the application 100. The feature's application interface captures biometrics and uses biometrics to identify captured biometrics to verify user identity.

In another embodiment, the authentication module 150 can also verify the user identity through the screen unlock password. For example, the authentication module 150 may require that the screen unlock password be input through the input module 130, and confirm that the input screen unlock password is correct by the execution system of the application 100 to verify the user identity; the identity verification module 150 may also The screen unlock application interface is provided to provide an input screen unlock password, and the screen unlock application interface is used to determine whether the entered screen unlock password is correct to verify the user identity; the authentication module 150 can also close the screen and wait for the user to turn on the screen. The screen is unlocked and returned to the application 100 to confirm the user's identity and the like. However, the manner in which the identity verification module 150 verifies the identity of the user is not limited to the above.

In addition, the identity verification module 150 can also determine whether the screen unlock password has been set when the screen unlock password is used to verify the user identity. If the screen unlock password has not been set, the identity verification module 150 can display a prompt to request Set the screen unlock password. That is, if the authentication module 150 will verify the user identity using the screen unlock password, the authentication module 150 will first confirm that the screen unlock password has been set.

The unit judging module 160 can determine whether the issuing unit of the target credential selected by the credential selection module 110 is the same as the signature calling unit. For example, the unit judgment module 160 may read out the issue unit information of the issue unit of the target voucher from the selected target voucher, and compare the read release unit message and the call unit message of the signature call unit. It is judged whether the issuing unit of the selected target certificate is the same as the signature calling unit. The above-mentioned issuing unit message may be an identification code or a name of the issuing unit, and similarly, the above-mentioned calling unit message may be an identification code or a name of the signature calling unit. However, the unit judgment module 160 determines whether the issuing unit of the selected target document is the same as the signature calling unit, and is not limited to the above.

In addition, the signature calling unit is a provider of an object such as a program or a web page to be signed, for example, if the object to be signed is another application executed on the same device as the application 100, the signature calling unit is For the person, company, group, or organization that provides the other application; similarly, if the object to be signed is the web page opened by the embedded browser of the application 100, the signature calling unit is the application containing the application. The owner, company, group, or organization of the website of the 100-opened web page.

The decryption module 170 is responsible for decrypting and decrypting the specified password provided by the input module 130 when the key access module 120 determines that the private key corresponding to the target credential selected by the credential selection module 110 is encrypted by the designated password. The private key corresponding to the selected target credential; the decryption module 170 is also responsible for determining, at the key access module 120, that the private key corresponding to the target credential selected by the credential selection module 110 is encrypted by the preset password, and the user When the identity is verified by the authentication module 150, the private key corresponding to the selected target credential is decrypted using the preset password.

The decryption module 170 can also directly decrypt the selected private key by using the preset password when the unit judgment module 160 determines that the issuing unit of the target credential selected by the credential selection module 110 is the same as the signature calling unit. That is, in some embodiments, when the key access module 120 determines that the private key corresponding to the selected target credential is encrypted by the preset password, and the unit judging module 160 judges the selected target credential. When the issuing unit is the same as the signature calling unit, the decryption module 170 may decrypt the private key corresponding to the selected target document by using the preset password; and when the key access module 120 determines the corresponding corresponding to the selected target document, The private key is encrypted by the preset password, and the unit determining module 160 determines that the issuing unit of the selected target credential is different from the signature calling unit, and the decryption module 170 can also be used when the user identity is verified by the authentication module 150. The private key corresponding to the selected target credential is decrypted using the preset password.

The signature module 180 is responsible for signing the information provided by the signature calling unit using the decrypted private key decrypted by the decryption module 170.

Next, the operation of the present creation will be explained in the first embodiment, and please refer to the flowchart of the method for verifying the identity of the user at the time of signature in the "Phase 2A".

In this embodiment, it is assumed that when the user executes the securities order application provided by the securities company on the computing device 10 and places an order in the securities order application, if the securities order application needs to perform the signing operation, The securities order application can call the application 100. At this time, the signature call unit is a securities company that provides a securities order application. However, the embodiment is not limited thereto. For example, the user can use the embedded browser of the application 100 to open a single webpage provided by the securities company to place an order.

After the user operates the securities order application so that the securities order application calls the application 100, the voucher selection module 110 can provide the selection target voucher (step 210). In this embodiment, it is assumed that the credential selection module 110 can display a list of all the vouchers recorded in the database of the application 100, thereby providing the user with the target vouchers selected from the list.

After the credential selection module 110 provides the selection target credential (step 210), the key access module 120 can determine whether the private key corresponding to the selected target credential provided by the credential selection module 110 is encrypted by the specified password (step 222). .

If the key access module 120 determines that the private key corresponding to the selected target credential is encrypted by the specified password, the input module 130 may provide an input designation password (step 230). In this embodiment, it is assumed that the input module 130 can display an input interface for specifying a password, thereby providing a user to input a designated password.

After the user inputs the designated password through the input module 130, the decryption module 170 can decrypt the private key corresponding to the selected target document provided by the credential selection module 110 of the application 100 using the specified password input by the user (step 240). The signature module 180 can use the private key decrypted by the decryption module 170 to sign (step 250). In this embodiment, the signature module 180 provides the user-entered single-item signature to the securities placing application of the calling application 100 using the decrypted private key.

If the key access module 120 determines that the private key corresponding to the selected target credential is not encrypted by the specified password, and generally indicates that the private key corresponding to the selected target credential is encrypted by the preset password, the identity verification module The group 150 can verify the identity of the user by executing the operating system of the application 100 and determine whether the user identity has passed verification (step 280). In this embodiment, it is assumed that the identity verification module 150 can detect the operating system of the execution application 100 (that is, the operating system running in the computing device 10) when the application 100 is installed for the first time. The system message is used to determine whether the operating system executing the application 100 is a version that can use the biometric identification user identity, and if so, the user is selected to use the biometric or screen lock password to verify the user identity. If the user chooses to use the biometric to verify the user identity, the authentication module 150 can call the biometric application interface provided by the operating system of the application 100 to enable biometric identification when the user identity needs to be verified. The application interface provides the user with input biometrics such as a fingerprint or a human face, and recognizes the biometric input by the user. Thus, the authentication module 150 can determine whether the user identity is based on the identification result of the biometric identification application interface. If the user chooses not to use the biometrics to verify the user identity, or the authentication module 150 determines that the operating system of the execution application 100 is not a version that can use the biometric identification user identity, the authentication module 150, when the user identity needs to be verified, the screen unlocking application interface provided by the operating system of the execution application 100 can be called, so that the screen unlocking application interface provides the user input screen unlocking password and determines whether the screen unlocking password is input. Right, so, Part verification module 150 can unlock the API judged the screen unlock password is correct or not by judging whether the user identity verification based on the screen.

If the identity verification module 150 determines that the user identity has not passed the verification (step 280), the identity verification module 150 can end the application 100, so that the application 100 rejects the signature operation of the securities order application of the calling application 100; If the identity verification module 150 determines that the user identity has passed the verification (step 280), the decryption module 170 can decrypt the private key corresponding to the selected target voucher provided by the voucher selection module 110 by using the preset password (step 290). The chapter module 180 can sign using the decrypted private key decrypted by the decryption module 170 (step 250). In this embodiment, the signature module 180 provides the user-entered single-item signature to the securities placing application of the calling application 100 using the decrypted private key.

Continuing with the second embodiment to illustrate the operation of this creation, please also refer to "2A". In this embodiment, it is assumed that the user uses the embedded browser of the application 100 executed by the computing device 10 to open the tax return webpage and perform a tax return operation. In the process of filing a tax return, if a signature job is required, the Java Script in the tax return page can call the application 100. At this time, the signature calling unit is the IRS that provides the tax return page. However, the embodiment is not limited thereto. For example, the user can also use the tax filing software to perform the tax return operation.

After the user operates the tax return page to cause the Java Script in the tax return webpage to call the application 100, the credential selection module 110 can provide a selection target credential (step 210). In this embodiment, it is assumed that the credential selection module 110 can display a list of all the vouchers recorded in the database of the application 100, thereby providing the user with the target vouchers selected from the list.

After the credential selection module 110 provides the selection target credential (step 210), the key access module 120 can determine whether the private key corresponding to the selected target credential provided by the credential selection module 110 is encrypted by the specified password (step 222). .

If the key access module 120 determines that the private key corresponding to the selected target credential is encrypted by the specified password, the input module 130 may provide an input designation password (step 230). In this embodiment, it is assumed that the input module 130 can display an input interface for specifying a password, thereby providing a user to input a designated password.

After the user inputs the designated password through the input module 130, the decryption module 170 can decrypt the private key corresponding to the selected target document provided by the credential selection module 110 of the application 100 using the specified password input by the user (step 240). The signature module 180 can use the private key decrypted by the decryption module 170 to sign (step 250). In this embodiment, the signature module 180 is a tax return order data signature that is entered into the tax return webpage of the call application 100 by the user using the decrypted private key.

If the key access module 120 determines that the private key corresponding to the selected target credential is not encrypted by the specified password, and generally indicates that the private key corresponding to the selected target credential is encrypted by the preset password, the identity verification module Group 150 can verify the identity of the user and determine if the user's identity has passed verification (step 280). In this embodiment, it is assumed that the identity verification module 150 can detect the system information of the operating system of the application 100 (that is, the operating system running in the computing device 10), thereby determining whether the operating system of the executing application 100 is The screen unlocking application version can be called, and if so, the authentication module 150 can call the screen unlocking application interface provided by the operating system of the application 100 to enable the screen unlocking application interface to provide the user with a screen unlocking password. And determining whether the input screen unlocking password is correct, the identity verification module 150 can determine whether the user identity is verified according to the judgment result of the screen unlocking application interface; if the operating system of the executing application 100 is unable to call the screen unlocking application interface The authentication module 150 can prompt the user to allow the application 100 to have administrator rights. If the user does not agree to give the application 100 administrator authority, the authentication module 150 can end the application 100 and make the application 100 rejects the call should The signature operation of the tax return page of the program 100, but if the user agrees to give the application 100 administrator authority, the authentication module 150 can close the screen and determine whether the user opens the screen within a predetermined time and completes the screen unlocking. Go to the application 100 to determine if the user's identity has passed verification.

If the identity verification module 150 determines that the user identity has not passed the verification, that is, the screen unlocking application interface determines that the screen unlock password input by the user is incorrect for a predetermined number of times, or the user does not open the screen and complete the screen unlocking within the predetermined time. To return to the application 100, the authentication module 150 can end the application 100, so that the application 100 rejects the signature operation of the securities order application of the calling application 100; and if the identity verification module 150 determines the user identity By verifying, that is, the screen unlocking application interface determines that the screen unlocking password input by the user is correct, or the user opens the screen within a predetermined time and completes the screen unlocking and returns to the application 100, the decrypting module 170 can use the pre-reading The password decryption and credential selection module 110 provides the private key corresponding to the selected target credential (step 290), and the signature module 180 can use the private key decrypted by the decryption module 170 to sign (step 250). In this embodiment, the signature module 180 is a tax return order data signature that is entered into the tax return webpage of the call application 100 by the user using the decrypted private key.

Thus, when the application 100 executes the signature job, the author can request to use the specified password, enter the biometric, or enter the screen unlock password, so that the application 100 can confirm that the user is allowed to perform the signature job.

In the above two embodiments, the key access module 120 determines that the private key corresponding to the selected target credential is not encrypted by the specified password (step 222), and the key access module 120 can further determine and select the selected key. Whether the private key corresponding to the target credential is encrypted by the default password (step 226).

In addition, in the above two embodiments, if the application 100 further includes the unit determination module 160, as shown in the flow of "2B", the key access module 120 determines that it corresponds to the selected target certificate. The private key is encrypted by the default password, or when the key access module 120 determines that the private key corresponding to the selected target credential is not encrypted by the specified password, the unit judging module 160 may first determine the issuance of the target credential. Whether the unit is the same as the signature call unit (step 260). If the two are different, as described above, the identity verification module 150 can verify the user identity and determine whether the user identity passes the verification (step 280). The decryption module 170 can determine the user identity through the identity verification module 150. At the time of verification, the private key corresponding to the selected target document is decrypted using the preset password (step 290); and if the unit judgment module 160 determines that the issuing unit of the target certificate is the same as the signature calling unit, the decryption module 170 may directly The private key corresponding to the selected target certificate is decrypted using the preset password (step 290). Under this condition, the identity verification module 150 may not execute, that is, the identity verification module 150 may not determine whether the user identity passes the verification. .

In addition, in the foregoing two embodiments, when the identity verification module 150 determines whether the user identity passes the verification (step 280), if the identity verification module 150 executes the operation system of the application 100 through the call (that is, in the computing device 10) The screen unlocking application interface provided by the operating system determines whether the user identity has passed the verification. Before the identity verification module 150 determines whether the user identity passes the verification, the identity verification module 150 can be as shown in FIG. 2C. As shown in the flow, it is first determined whether the screen lock password is set (step 202). If not, the identity verification module 150 can prompt the user to set a screen unlock password (step 206). For example, the authentication module 150 can determine whether the screen lock password is set when the application 100 is installed for the first time (step 202), but the creation is not limited thereto.

In summary, it can be seen that the difference between the present creation and the prior art is that when the private key corresponding to the selected target voucher is determined to be encrypted by the preset password, the user identity is first verified, and when the user identity passes the verification. And the technical means for decrypting the private key by using the preset password, by using a technical means, the private key corresponding to the voucher when the user has not set the voucher password of the prior art will be directly used for the digital signature. The problem, in turn, achieves the technical effect that the user only needs to memorize the mobile phone unlocking password without additionally remembering the credential password.

Furthermore, the method of verifying the identity of the user at the time of signing can be implemented in hardware, software or a combination of hardware and software, or can be implemented in a centralized manner in a computer system or distributed in different components. The decentralized implementation of interconnected computer systems.

Although the embodiments disclosed in the present disclosure are as above, the contents are not intended to directly limit the scope of the patent protection of the present invention. Anyone who has the usual knowledge in the technical field of this creation, without any departure from the spirit and scope disclosed in this creation, makes some modifications to the form and details of the implementation of this creation, which are the patent protection of this creation. range. The scope of patent protection of this creation must be determined by the scope of the attached patent application.

10‧‧‧ Computing equipment

100‧‧‧Application

110‧‧‧Voucher selection module

120‧‧‧Key Access Module

130‧‧‧Input module

150‧‧‧Authentication module

160‧‧‧Unit Judgment Module

170‧‧‧ decryption module

180‧‧‧Signature Module

Step 202‧‧‧Check if the screen lock password has been set

Step 206‧‧‧Request to set the screen unlock password

Step 210‧‧‧ Provide selection target credentials

Step 222‧‧‧ Determine whether the private key corresponding to the target certificate is encrypted by the specified password

Step 226‧‧‧ Determine whether the private key corresponding to the target voucher is encrypted by the default password

Step 230‧‧‧ Provide input password

Step 240‧‧‧ Decrypt the private key with the specified password

Step 250‧‧‧Use private key signature

Step 260‧‧‧ Determine whether the issuing unit of the target document is the same as the signature calling unit

Step 280‧‧‧Determine whether the user's identity has passed verification

Step 290‧‧‧Use the default password to decrypt the private key

Figure 1 is a schematic diagram of the components of the computing device that validates the user's identity at the time of signing. Figure 2A is a flow chart of the method for verifying the identity of the user at the time of signature. Figure 2B is a flow chart of an additional method for verifying the identity of a user at the time of signature. Figure 2C is a flow chart of the method for setting the screen unlock password for the author.

Claims (10)

A computing device for verifying a user identity at the time of signing, the computing device at least comprising: a voucher selection module for providing a selection of a target voucher; and a key access module for determining a correspondence with the target voucher Whether a private key is encrypted by a specified password or a predetermined password; an input module for providing the specified password when the private key is encrypted by the specified password; an identity verification module for the private When the key is encrypted by a predetermined password, the user identity is verified; a decryption module is configured to decrypt the private key by using the specified password, and when the user identity is verified, the preset password is used to decrypt the key. a private key; and a signature module for signing with the private key. The computing device for verifying the user identity at the time of signing, as described in claim 1, wherein the computing device further comprises a unit determining module for determining one of the target voucher issuing units and a signing calling unit. If the same, the decryption module is used to decrypt the private key by using the preset password when the issuing unit is the same as the signature calling unit. The computing device for verifying the identity of the user at the time of signing as claimed in claim 2, wherein the unit determining module determines the issuance according to the issuing unit message of the issuing unit and the calling unit message of the signing call unit Whether the unit is the same as the signature call unit. The computing device for verifying the identity of a user at the time of signing as described in claim 1, wherein the authentication module captures a biometric to verify the identity of the user using a biometric identification technique. The computing device for verifying the identity of the user at the time of signing, as described in claim 4, wherein the authentication module is further configured to detect a system message of one of the operating systems running in the computing device, and The system message determines if the user identity can be verified using the biometric. A computing device for verifying a user's identity at the time of signing as described in claim 4 of the patent application, wherein the biometric is a fingerprint or a human face. The computing device for verifying the identity of the user at the time of signing as claimed in claim 1, wherein the authentication module is required to input a screen unlocking password to verify the identity of the user. The computing device for verifying the identity of the user at the time of signing, as described in claim 7, wherein the authentication module detects system information of one of the operating systems running in the computing device, and according to the system The message selects the call screen to unlock the application interface to request the screen unlock password, or select to turn off one of the computing devices, so that the screen unlock password is required when the screen is turned on. The computing device for verifying the identity of the user at the time of signing, as described in claim 7, wherein the authentication module is further configured to determine that the screen unlocking password is not set, and the screen unlocking password is required to be set. A computing device for verifying a user identity at the time of signing as described in claim 1, wherein the input module is an input application interface (API) provided by an operating system running in the computing device to provide Enter the specified password.