WO2017024934A1

WO2017024934A1 - Electronic signing method, device and signing server

Info

Publication number: WO2017024934A1
Application number: PCT/CN2016/091524
Authority: WO
Inventors: 高翔; 胡远平; 刘凯; 贡鹏; 汪卫国
Original assignee: 阿里巴巴集团控股有限公司; 高翔; 胡远平; 刘凯; 贡鹏; 汪卫国
Priority date: 2015-08-07
Filing date: 2016-07-25
Publication date: 2017-02-16
Also published as: CN106452775A; CN106452775B

Abstract

The present application provides an electronic signing method and device. The method comprises: determining a hash value of an electronic document to be signed; performing encryption on the hash value by using a private key corresponding to a public key of a digital certificate; and synthesizing the encrypted hash value, the digital certificate and an image of an electronic signature in the electronic document. The technical solution of the present invention addresses the problem of a high implementation cost of a USBKey signing solution in the prior art, thus providing an Internet signing mode and reducing costs for users.

Description

Method, device and signature server for realizing electronic signature

Technical field

The present application relates to the field of Internet technologies, and in particular, to a method, an apparatus, and a signature server for implementing an electronic signature.

Background technique

When it is necessary to electronically sign an electronic file provided by a large Internet financial enterprise for a user, the private key used in the prior art through the electronic signature is placed in the U shield, and when the user uses the electronic signature, the U shield is inserted into the computer. The electronic signature system signs the electronic document by obtaining the private key corresponding to the public key in the digital certificate in the U shield. The premise of using the scheme is that the user must purchase the U shield, so when a large number of users need electronic When signing, the implementation cost is high and the promotion is difficult.

Summary of the invention

In view of this, the present application provides a new technical solution, which can solve the technical problem of reducing the hardware cost of the electronic signature process by applying an electronic signature of an electronic document in real time on the Internet when the amount of users is large.

To achieve the above objective, the present application provides the following technical solutions:

According to a first aspect of the present application, a method for implementing an electronic signature is provided, comprising:

Determining the hash value of the electronic document to be signed;

Encrypting the hash value with a private key corresponding to the public key in the digital certificate;

And synthesizing the encrypted hash value, the digital certificate, and the picture of the electronic signature into the electronic document.

According to a second aspect of the present application, a method for implementing an electronic signature is provided, comprising:

Determining the hash value of the electronic document to be signed;

Sending the hash value and the second key of the electronic document to the a third-party service platform, where the second key is a key preset between the signature server and the third-party service platform;

After the third-party service platform encrypts the hash value by using the second key, receiving the encrypted hash value through the second private network;

The encrypted hash value, digital certificate, and electronic signature picture are synthesized into the electronic document.

According to a third aspect of the present application, an apparatus for implementing an electronic signature is provided, comprising:

a determining module for determining a hash value of the electronic document to be signed;

a first encryption module, configured to encrypt, by using a private key corresponding to the public key in the digital certificate, the hash value determined by the determining module;

And a signature synthesizing module, configured to synthesize the hash value encrypted by the first encryption module, the digital certificate, and the picture of the electronic signature into the electronic document.

According to a fourth aspect of the present application, a signature server is provided, comprising:

a processor; a memory for storing the processor executable instructions;

Wherein the processor is configured to:

Determining the hash value of the electronic document to be signed;

According to a fifth aspect of the present application, a signature server is provided, comprising:

a processor; a memory for storing the processor executable instructions;

Wherein the processor is configured to:

Determining the hash value of the electronic document to be signed;

Transmitting the hash value and the second key of the electronic document to the third-party service platform by using a second private network, where the second key is used by the signature server and the third-party service platform Pre-set secret key;

It can be seen from the above technical solution that the present application encrypts the hash value by using the private key corresponding to the public key in the digital certificate, and synthesizes the encrypted hash value, the digital certificate and the electronic signature picture into the electronic document. Therefore, the problem of high implementation cost of the U shield signature scheme in the prior art is solved, the mode of the Internet signature is realized, the user cost is reduced, the hash value is encrypted, and the encrypted hash value and the digital certificate are obtained. Synthesizing into electronic documents enhances the security and credibility of electronic signatures.

DRAWINGS

FIG. 1A is a flow chart showing a method of implementing an electronic signature according to an exemplary embodiment of the present invention; FIG.

FIG. 1B shows a schematic diagram of a picture of an electronic signature in accordance with an exemplary embodiment of the present invention; FIG.

FIG. 1C shows a schematic diagram of a digital certificate in accordance with an exemplary embodiment of the present invention; FIG.

2A is a flow chart showing a method of implementing an electronic signature in accordance with another exemplary embodiment of the present invention;

FIG. 2B illustrates a scene graph in accordance with another exemplary embodiment of the present invention; FIG.

FIG. 3A illustrates a flow diagram of a method of implementing an electronic signature in accordance with yet another exemplary embodiment of the present invention; FIG.

FIG. 3B illustrates a scene graph in accordance with yet another exemplary embodiment of the present invention; FIG.

4A is a flow chart showing a method of implementing an electronic signature in accordance with still another exemplary embodiment of the present invention;

FIG. 4B illustrates a scene graph in accordance with yet another exemplary embodiment of the present invention; FIG.

FIG. 5 is a schematic structural diagram of a signature server according to an exemplary embodiment of the present invention; FIG.

FIG. 6 is a block diagram showing the structure of an electronic signature device according to an exemplary embodiment of the present invention; FIG.

FIG. 7 shows a schematic structural diagram of implementing an electronic signature device according to another exemplary embodiment of the present invention.

detailed description

Exemplary embodiments will be described in detail herein, examples of which are illustrated in the accompanying drawings. The following description refers to the same or similar elements in the different figures unless otherwise indicated. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present application. Instead, they are merely examples of devices and methods consistent with aspects of the present application as detailed in the appended claims.

The terminology used in the present application is for the purpose of describing particular embodiments, and is not intended to be limiting. The singular forms "a", "the" and "the" It should also be understood that the term "and/or" as used herein refers to and encompasses any and all possible combinations of one or more of the associated listed items.

It should be understood that although the terms first, second, third, etc. may be used to describe various information in this application, such information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, the first information may also be referred to as the second information without departing from the scope of the present application. Similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein may be interpreted as "when" or "when" or "in response to a determination."

In order to further illustrate this application, the following examples are provided:

According to an embodiment of the present application, the encrypted hash value, the digital certificate, and the electronic signature image are synthesized into an electronic document by encrypting the hash value with a private key corresponding to the public key in the digital certificate. Therefore, the problem of high implementation cost of the U shield signature scheme in the prior art is solved, the mode of the Internet signature is realized, the user cost is reduced, the hash value is encrypted, and the encrypted hash value and the digital certificate are synthesized. The electronic document has improved the security and credibility of the electronic signature.

FIG. 1A illustrates a flow of a method of implementing an electronic signature in accordance with an exemplary embodiment of the present invention. Schematic diagram, FIG. 1B shows a schematic diagram of an electronic signature in accordance with an exemplary embodiment of the present invention, and FIG. 1C shows a schematic diagram of a digital certificate according to an exemplary embodiment of the present invention; on. As shown in FIG. 1A, the method for implementing an electronic signature includes the following steps:

Step 101: Determine a hash value of the electronic document to be signed;

Step 102: Encrypt the hash value by using a private key corresponding to the public key in the digital certificate;

Step 103: Synthesize the encrypted hash value, the digital certificate, and the electronic signature picture into an electronic document.

In step 101, in an embodiment, the electronic document may be a local file (eg, a certification file, an electronic receipt, etc.); in another embodiment, the electronic document may be from a first service platform, and the first service platform may For a payment-type financial service platform (for example, Alipay), correspondingly, the electronic document may be an asset certificate, a bill, or an electronic receipt; in another embodiment, the electronic document may be from the second service platform, and the second service platform may be Deposit-based financial business platform (for example, Lucky Fort), correspondingly, the electronic document can be a loan and interest certificate; in another embodiment, the electronic document can be from the third business platform, and the third business platform can be the Internet financial service platform. (For example, the network merchant bank), correspondingly, the electronic document can be an electronic certificate applied by the end user, etc., and thus, the source of the electronic document is not limited in this application.

In an embodiment, the electronic signature may be an electronic signature of the enterprise corresponding to the first service platform, an electronic signature of the enterprise corresponding to the second service platform, and an electronic signature of the enterprise corresponding to the third service platform. In an embodiment, the hash value of the electronic document may be extracted by a hash algorithm.

In step 102, in an embodiment, the encryption method of the hash value may be determined according to the source of the electronic document. For example, if the electronic document is from the first service platform, the encryption machine may be set in the signature server, and the encryption machine is used. The first key (also known as the primary key, MainKey) to encrypt the private key in the digital certificate; for example, if the electronic document is from the second service platform, the hash value can be sent to the first private network The three-party authentication center (for example, the CA center), the third-party authentication center encrypts the hash value by using the private key corresponding to the public key in the digital certificate, and then returns the encrypted hash value through the first private network. Give the signature server; for example, if the electronic document comes from the third business platform, you can use hash values, signature servers, and third-party financial platforms. The second key set between the two is sent to the encryption machine of the third service platform by the second private network, and the third service platform encrypts the hash value by using the second key set by the encryption machine, and then The three service platforms then return the encrypted hash value to the signature server. Hash values can be encrypted by using different encryption methods for electronic documents from different sources to meet personalized business needs.

In step 103, in an embodiment, a picture of the corresponding electronic signature may be obtained from the corresponding service platform (the first service platform, the second service platform, and the third service platform), and the encrypted hash value, For the synthesis of the digital certificate and the electronic signature image into the electronic document, refer to the related description of the prior art, which will not be described in detail herein.

As shown in FIG. 1B, the electronic signature synthesized on the electronic document is "AB company", and when the click event on the electronic signature of "AB company" is monitored, the related information of the digital certificate shown in FIG. 1C is displayed. Since the digital certificate is obtained through a third-party certification center, the user can verify the authenticity of the electronic signature through the digital certificate.

It can be seen from the above description that the embodiment of the present invention implements the mode of the Internet signature by the steps S101-S103, and solves the problem that the U shield signature scheme in the prior art has a high implementation cost, reduces the user cost, and passes the hash value. Encryption and the synthesis of encrypted hashes and digital certificates onto electronic documents enhance the security and credibility of electronic signatures.

2A shows a flow diagram of a method of implementing an electronic signature in accordance with another exemplary embodiment of the present invention, and FIG. 2B illustrates a scenario of a method of implementing an electronic signature in accordance with another exemplary embodiment of the present invention. The embodiment is exemplified by taking an electronic document from the first service platform as an example. As shown in FIG. 2A, the method for implementing an electronic signature includes the following steps:

Step 201: Determine a hash value of the electronic document to be signed;

Step 202: Obtain a digital certificate and a private key corresponding to the public key in the digital certificate, where the private key is encrypted;

Step 203: decrypt the encrypted private key;

Step 204: Encrypt the hash value by using the decrypted private key;

Step 205: Synthesize the encrypted hash value, the digital certificate, and the electronic signature picture into an electronic document.

For the description of the foregoing step 201, refer to the related description of the foregoing step 101, which will not be described in detail herein.

In step 202 to step 204, in an embodiment, the digital certificate and the encrypted private key may be obtained from the cloud database, wherein the first key of the encryption machine on the signature server may be passed (also referred to as the main The secret key encrypts the private key corresponding to the public key in the digital certificate, and then stores it in the cloud database, and decrypts the encrypted private key stored in the cloud database when needed. In another embodiment, the cloud database may store a large number of digital certificates and a private key corresponding to the public key in the digital certificate, thereby implementing a large number of digital certificates and a private key corresponding to the public key in the digital certificate. Safe to save.

For the description of the foregoing step 205, refer to the related description of the foregoing step 103, and details are not described herein.

As an exemplary scenario, as shown in FIG. 2B, the signature server 22 applies for a digital certificate from the third-party authentication center 21, and encrypts it with the first key of the local encryption machine (not shown) of the signature server 22. The private key corresponding to the public key in the digital certificate stores the encrypted private key and the digital certificate into the cloud database 23. The signature server 22 obtains an electronic document that needs to be electronically signed from the first service platform 24, extracts a hash value of the electronic document by using a hash algorithm, and obtains a digital certificate and an encrypted private key from the cloud database 23, together with a hash. The values are transmitted together to the encryption machine local to the signature server 22, and the private key corresponding to the public key in the digital certificate is decrypted in the encryption machine local to the signature server 22, and the public key corresponding to the digital certificate is obtained. The private key, the encryption machine then encrypts the hash value by using the private key. Finally, the signature server 22 synthesizes the encrypted hash value, the digital certificate and the electronic signature onto the electronic document, thereby providing the electronic document. To the user. Since the private key corresponding to the public key in the digital certificate is decrypted by the first key, and the hash value is encrypted by the private key corresponding to the digital certificate public key, the encryption machine of the signature server is Internal processing, thus ensuring the security of the private key corresponding to the public key in the digital certificate during use.

In this embodiment, since the digital certificate and the encrypted private key are stored in the cloud database, when the electronic signature needs to be electronically signed, the encrypted private key of the digital certificate and the digital certificate is obtained from the cloud database, thereby avoiding the present In the technology, the encryption machine in the third-party authentication center can only store a limited number of private keys corresponding to the public key in the digital certificate, thereby supporting the large amount of data and high concurrency of the Internet signature, and ensuring The security of the private key corresponding to the public key in the digital certificate.

FIG. 3A illustrates a flow diagram of a method of implementing an electronic signature in accordance with yet another exemplary embodiment of the present invention, and FIG. 3B illustrates a scenario of a method of implementing an electronic signature in accordance with yet another exemplary embodiment of the present invention. FIG. 1 is an exemplary illustration of an electronic document provided by a second service platform. As shown in FIG. 3A, the method for implementing an electronic signature includes the following steps:

Step 301: Determine a hash value of the electronic document to be signed;

Step 302: Send a hash value of the electronic document to the third-party authentication center through the first private network, where the third-party authentication center is configured to generate a digital certificate and adopt a private key pair hash corresponding to the public key in the digital certificate. Value encryption

Step 303: Receive, by using the first private network, the encrypted hash value from the third-party authentication center.

Step 304: Synthesize the encrypted hash value, the digital certificate, and the electronic signature picture into an electronic document.

For the description of the foregoing step 301, refer to the related description of step 101 above, and details are not described herein.

In step 302 and step 303, in an embodiment, the first private network may be a dedicated communication network connected to the signature server and the authentication center, in which no other devices are accessed, through the first private network. The hash value and the encrypted hash value are transmitted to ensure the security of the hash value.

For the description of the foregoing step 304, refer to the related description of the foregoing step 103, which is not detailed here.

As an exemplary scenario, as shown in FIG. 3B, the signature server 31 is jointly signed with the third party certification center 32. In the joint signature process, the signature server 31 extracts the hash value of the electronic document through the hash algorithm, and the signature server 31 transmits the hash value to the third-party authentication center 32 through the first private network, and the third-party authentication center 32 The hash value is encrypted using the private key corresponding to the public key in the digital certificate, after which the encrypted hash value is returned to the signature server 31 via the first private network, and the signature server 31 encrypts the hash. The hash value, digital certificate, and electronic signature are combined into an electronic document, and the electronic document can be provided to the user.

In this embodiment, the hash value of the electronic document is sent to the third-party authentication center through the first private network, and the hash value is encrypted by the third-party authentication center by using the private key corresponding to the public key in the digital certificate. Receiving the encrypted hash value through the first private network, and encrypting the hash value and number The image of the word certificate and the electronic signature is synthesized into an electronic document, which solves the problem of high implementation cost of the U-Shield signature scheme in the prior art, reduces the user cost, and utilizes the digital certificate stored in the third-party certification center. The private key corresponding to the public key encrypts the hash value, and then combines the digital certificate and the encrypted hash value into the electronic document, thereby improving the credibility of the electronic signature, and at the same time, the electronic document can be leaked to the electronic document. Other unrelated businesses ensure the commercial security of electronic documents.

4A shows a flow diagram of a method of implementing an electronic signature in accordance with yet another exemplary embodiment of the present invention, and FIG. 4B illustrates a scenario of a method of implementing an electronic signature in accordance with yet another exemplary embodiment of the present invention. FIG. 1 is an exemplary embodiment of an electronic document provided from a third service platform. As shown in FIG. 4A, the method for implementing an electronic signature includes the following steps:

Step 401: Determine a hash value of the electronic document to be signed;

Step 402: Send the hash value and the second key of the electronic document to the third-party service platform through the second private network, where the second key is a preset key between the signature server and the third-party service platform or Keys for mutual negotiation;

Step 403: Receive an encrypted hash value through the second private network.

Step 404: Synthesize the encrypted hash value, the digital certificate, and the electronic signature picture into an electronic document.

For the description of the above step 401, refer to the related description of the above step 101, which will not be described in detail herein.

In step 402 and step 403, in an embodiment, the second private network may be a dedicated communication network connected to the signature server and the third-party service platform, in which no other device is accessed, and the second The private network transmits the hash value and the encrypted hash value to ensure the security of the hash value. In an embodiment, the third-party service platform may be a platform that can provide an electronic document, such as the first service platform, the second service platform, and the third service platform in the foregoing embodiment.

For the description of the above step 404, refer to the related description of the above step 103, which will not be described in detail herein.

As an exemplary scenario, as shown in FIG. 4B, the signature server 41 acquires an electronic document from the third-party service platform 42, extracts a hash value of the electronic document by using a hash algorithm, and transmits the hash value to the third-party service platform 42. The encryption machine encrypts the hash value by the encryption machine of the third-party service platform 42 through the second key, and then the third service platform 42 returns the encrypted hash value to the signature service. The signature server 41 synthesizes the encrypted hash value, the digital certificate, and the electronic signature into the electronic document, thereby providing the electronic document to the user.

This embodiment can meet the requirement that the third-party service platform 42 requires the private key corresponding to the public key in the digital certificate to be stored, and the flexibility of the electronic signature mode is improved.

Through the above embodiments, different electronic signatures can be applied in different service scenarios. Therefore, when the advantages of various electronic signatures are utilized, personalized service requirements are satisfied.

Corresponding to the above method for implementing an electronic signature, the present application also proposes a schematic structural diagram of the signature server according to an exemplary embodiment of the present application shown in FIG. 5. Referring to FIG. 5, at the hardware level, the network server includes a processor, an internal bus, a network interface, a memory, and a non-volatile memory, and may of course include hardware required for other services. The processor reads the corresponding computer program from the non-volatile memory into memory and then runs, forming a device implementing the electronic signature on a logical level. Of course, in addition to the software implementation, the present application does not exclude other implementation manners, such as a logic device or a combination of software and hardware, etc., that is, the execution body of the following processing flow is not limited to each logical unit, and may be Hardware or logic device.

FIG. 6 is a schematic structural diagram of an apparatus for implementing an electronic signature according to an exemplary embodiment of the present invention; as shown in FIG. 6, the apparatus for implementing an electronic signature may include: a determining module 61, a first encryption module 62, and a signing Chapter Synthesis Module 63. among them:

a determining module 61, configured to determine a hash value of the electronic document to be signed;

The first encryption module 62 is configured to encrypt the hash value determined by the determining module 61 by using a private key corresponding to the public key in the digital certificate;

The signature synthesizing module 63 is configured to synthesize the hashed value of the first encryption module 62, the digital certificate, and the electronic signature into the electronic document.

FIG. 7 is a schematic structural diagram of an apparatus for implementing an electronic signature according to an exemplary embodiment of the present invention; as shown in FIG. 7, on the basis of the foregoing embodiment shown in FIG. 6, the first encryption module 62 may include:

The obtaining unit 621 is configured to obtain a digital certificate and a private key corresponding to the public key in the digital certificate, where the private key is encrypted;

The decrypting unit 622 is configured to decrypt the encrypted private key obtained by the obtaining unit 621;

The encryption unit 623 is configured to encrypt the hash value by using the private key decrypted by the decryption unit 622.

In an embodiment, the apparatus may further include:

a second encryption module 64, configured to encrypt, by using the first key, a private key corresponding to the public key in the digital certificate;

The storage module 65 is configured to store the encrypted private key and the digital certificate by the second encryption module 64.

In an embodiment, the digital certificate and the encrypted private key are obtained from a cloud database.

In an embodiment, the first encryption module 62 can include:

The first sending unit 624 is configured to send the hash value of the electronic document to the third-party authentication center by using the first private network, where the third-party authentication center is configured to generate a digital certificate and adopt a public key corresponding to the digital certificate. The private key encrypts the hash value;

The first receiving unit 625 is configured to receive, by using the first private network, the encrypted hash value from the third-party authentication center.

In an embodiment, the first private network is a dedicated communication network connected to the signature server and the third party certificate authority.

In an embodiment, the apparatus may further include:

The sending module 66 is configured to send the hash value and the second key of the electronic document to the third-party service platform by using the second private network, where the second key is preset between the signature server and the third-party service platform. Secret key;

The receiving module 67 is configured to receive the encrypted hash value from the third-party authentication center through the second private network.

The above embodiments can be seen that different electronic signatures can be applied in different service scenarios. Therefore, when the advantages of various electronic signatures are utilized, the personalized service requirements are met.

Other embodiments of the present application will be readily apparent to those skilled in the <RTIgt; The application is intended to cover any variations, uses, or adaptations of the application, which are in accordance with the general principles of the application and include the present application. Common knowledge or conventional techniques in the art are not disclosed. The specification and examples are to be regarded as illustrative only,

It is also to be understood that the terms "comprises" or "comprising" or "comprising" or any other variations are intended to encompass a non-exclusive inclusion, such that a process, method, article, Other elements not explicitly listed, or elements that are inherent to such a process, method, commodity, or equipment. An element defined by the phrase "comprising a ..." does not exclude the presence of additional equivalent elements in the process, method, item, or device including the element.

The above is only the preferred embodiment of the present application, and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc., which are made within the spirit and principles of the present application, should be included in the present application. Within the scope of protection.

Claims

A method for implementing an electronic signature, characterized in that it is applied to a signature server, the method comprising:

Determining the hash value of the electronic document to be signed;

Encrypting the hash value with a private key corresponding to the public key in the digital certificate;

The encrypted hash value, digital certificate, and electronic signature picture are synthesized into the electronic document.
The method according to claim 1, wherein said encrypting said hash value with a private key corresponding to a public key in a digital certificate comprises:

Obtaining a digital certificate and a private key corresponding to the public key in the digital certificate, the private key being encrypted;

Decrypting the encrypted private key;

The hash value is encrypted using the decrypted private key.
The method of claim 2, wherein the method further comprises:

Encrypting the private key by using a first key;

The digital certificate and the encrypted private key are stored.
The method of claim 2 wherein said digital certificate and said encrypted private key are obtained from a cloud database.
The method according to claim 1, wherein said encrypting said hash value with a private key corresponding to a public key in a digital certificate comprises:

Sending the hash value of the electronic document to a third-party authentication center through a first private network, where the third-party authentication center is configured to generate the digital certificate and adopt a public key in the digital certificate The corresponding private key encrypts the hash value;

Receiving, by the first private network, the hash value encrypted from the third-party authentication center.
The method of claim 5 wherein said first private network is a connection A dedicated communication network at the signature server and the third party certification authority.
A method for implementing an electronic signature, characterized in that it is applied to a signature server, the method comprising:

Determining the hash value of the electronic document to be signed;

Transmitting the hash value and the second key of the electronic document to the third-party service platform by using a second private network, where the second key is the signature server and the third-party service platform Pre-set secret key;

After the third-party service platform encrypts the hash value by using the second key, receiving the encrypted hash value through the second private network;

The encrypted hash value, digital certificate, and electronic signature picture are synthesized into the electronic document.
The method of claim 7 wherein said second private network is a private communication network coupled between the signature server and said third service platform.
An apparatus for implementing an electronic signature, characterized in that the apparatus comprises:

a determining module for determining a hash value of the electronic document to be signed;

a first encryption module, configured to encrypt, by using a private key corresponding to the public key in the digital certificate, the hash value determined by the determining module;

And a signature synthesizing module, configured to synthesize the hash value encrypted by the first encryption module, the digital certificate, and the picture of the electronic signature into the electronic document.
The apparatus according to claim 9, wherein the first encryption module comprises:

An obtaining unit, configured to obtain a digital certificate and a private key corresponding to the public key in the digital certificate, the private key is encrypted;

a decryption unit, configured to decrypt the encrypted private key acquired by the acquiring unit;

And an encryption unit, configured to encrypt the hash value by using the private key decrypted by the decryption unit.
The device according to claim 10, wherein the device further comprises:

a second encryption module, configured to correspond to a public key in the digital certificate by using a first key pair The private key is encrypted;

And a storage module, configured to store the digital certificate and a private key corresponding to the public key in the digital certificate.
The apparatus according to claim 10, wherein said digital certificate and said encrypted private key are obtained from a cloud database.
The apparatus according to claim 9, wherein the first encryption module comprises:

a first sending unit, configured to send the hash value of the electronic document to the third-party authentication center by using a first private network, where the third-party authentication center is configured to generate the digital certificate and adopt Encrypting the hash value by a private key corresponding to the public key in the digital certificate;

And a first receiving unit, configured to receive, by using the first private network, the hash value encrypted by the third-party authentication center.
The apparatus of claim 13 wherein said first private network is a private communication network coupled to said signature server and said third party authentication center.
The device according to claim 9, wherein the device further comprises:

a sending module, configured to send the hash value and the second key of the electronic document to the third service platform by using a second private network, where the second key is the signature server and the a preset key between third-party service platforms;

And a receiving module, configured to receive, by using the second private network, the hash value encrypted by the third-party authentication center.
The apparatus of claim 15 wherein said second private network is a private communication network coupled between the signature server and said third service platform.
A signature server, wherein the signature server comprises:

processor;

a memory for storing processor executable instructions;

Wherein the processor is configured to:

Determining the hash value of the electronic document to be signed;

Encrypting the hash value with a private key corresponding to the public key in the digital certificate;

The encrypted hash value, the digital certificate, and the picture of the electronic signature are synthesized into the electronic document.
A signature server, wherein the signature server comprises:

processor;

a memory for storing processor executable instructions;

Wherein the processor is configured to:

Determining the hash value of the electronic document to be signed;

Transmitting the hash value and the second key of the electronic document to the third-party service platform by using a second private network, where the second key is used by the signature server and the third-party service platform Pre-set secret key;

After the third-party service platform encrypts the hash value by using the second key, receiving the encrypted hash value through the second private network;

The encrypted hash value, digital certificate, and electronic signature picture are synthesized into the electronic document.