WO2020001103A1 - 基于区块链的电子签名方法及装置、电子设备 - Google Patents

基于区块链的电子签名方法及装置、电子设备 Download PDF

Info

Publication number
WO2020001103A1
WO2020001103A1 PCT/CN2019/079885 CN2019079885W WO2020001103A1 WO 2020001103 A1 WO2020001103 A1 WO 2020001103A1 CN 2019079885 W CN2019079885 W CN 2019079885W WO 2020001103 A1 WO2020001103 A1 WO 2020001103A1
Authority
WO
WIPO (PCT)
Prior art keywords
certificate
blockchain
electronic
target
chain
Prior art date
Application number
PCT/CN2019/079885
Other languages
English (en)
French (fr)
Inventor
丁维
栗志果
Original Assignee
阿里巴巴集团控股有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 阿里巴巴集团控股有限公司 filed Critical 阿里巴巴集团控股有限公司
Publication of WO2020001103A1 publication Critical patent/WO2020001103A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
    • G06Q20/3825—Use of electronic signatures
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
    • G06Q20/3821—Electronic credentials
    • G06Q20/38215—Use of certificates or encrypted proofs of transaction rights

Definitions

  • One or more embodiments of the present specification relate to the field of blockchain technology, and in particular, to an electronic signature method, device, and electronic device based on the blockchain.
  • Blockchain technology also known as distributed ledger technology, is an emerging technology in which several computing devices participate in "accounting" and jointly maintain a complete distributed database. Because blockchain technology has the characteristics of decentralization, openness and transparency, each computing device can participate in database records, and the data can be quickly synchronized between computing devices, making blockchain technology widely used in many fields. Apply.
  • This specification proposes a blockchain-based electronic signature method, which includes:
  • a target transaction initiated by a contracted user through a client wherein the target transaction is used to trigger an electronic signature operation on a target electronic document;
  • a CA certificate corresponding to the contracted user is stored in the blockchain in advance;
  • the CA certificate stored in the blockchain is preset with an access right restricting access by a user account other than the contracted user;
  • the calling a smart contract corresponding to an electronic signature includes:
  • a smart contract corresponding to an electronic signature is triggered to be invoked.
  • triggering a smart contract corresponding to an electronic signature includes:
  • the target transaction includes the authorization information, it is further determined whether the target transaction is successfully stored in the blockchain; if it is, a smart contract corresponding to an electronic signature is triggered to be invoked.
  • the target electronic document is pre-stored on the blockchain; wherein the target electronic document stored in the blockchain is preset to restrict access to user accounts other than the smart contract. Authority
  • the electronically signing the target electronic document based on the CA certificate includes:
  • the CA certificate includes a private key of the contracted user
  • the performing electronic signature operation on the read target electronic document based on the CA certificate includes: performing the read target electronic document based on the private key of the contracted user in the CA certificate.
  • the blockchain includes a main chain and several sub-chains; the several sub-chains include a first sub-chain for storing an access address of the target electronic document, and a The second child chain of the original content;
  • the reading the target electronic document from the blockchain includes:
  • the original content of the target electronic document is read from the second sub-chain based on the access address of the target electronic document.
  • the several sub-chains further include a third sub-chain for storing the CA certificate
  • the reading the CA certificate corresponding to the contracted user from the blockchain includes:
  • the target electronic document is an electronic contract.
  • This specification also proposes a blockchain-based electronic signature device, which includes:
  • a receiving module receives a target transaction initiated by a contracted user through a client; wherein the target transaction is used to trigger an electronic signature operation on a target electronic document; a CA certificate corresponding to the contracted user is stored in the blockchain in advance ;
  • a signature module in response to the target transaction, invoking a smart contract corresponding to an electronic signature, executing an electronic signature program declared in the smart contract, and reading a CA certificate corresponding to the contracted user from a blockchain; and, Performing an electronic signature operation on the target electronic document based on the CA certificate.
  • the CA certificate stored in the blockchain is preset with an access right restricting access by a user account other than the contracted user;
  • the signature module :
  • a smart contract corresponding to an electronic signature is triggered to be invoked.
  • the signature module further:
  • the authorization information is included in the target transaction, it is further determined whether the target transaction is successfully stored in the blockchain; if so, a smart contract corresponding to an electronic signature is triggered to be invoked.
  • the target electronic document is pre-stored on the blockchain; wherein the target electronic document stored in the blockchain is preset to restrict access to user accounts other than the smart contract. Authority
  • the signature module :
  • the CA certificate includes a private key of the contracted user
  • the signature module :
  • the blockchain includes a main chain and several sub-chains; the several sub-chains include a first sub-chain for storing an access address of the target electronic document, and a The second child chain of the original content;
  • the signature module further:
  • the original content of the target electronic document is read from the second sub-chain based on the access address of the target electronic document.
  • the several sub-chains further include a third sub-chain for storing the CA certificate
  • the signature module further:
  • the target electronic document is an electronic contract.
  • This specification also proposes an electronic device, including:
  • Memory for storing machine-executable instructions
  • the processor is caused to:
  • a target transaction initiated by a contracted user through a client wherein the target transaction is used to trigger an electronic signature operation on a target electronic document;
  • a CA certificate corresponding to the contracted user is stored in the blockchain in advance;
  • CA certificate of the contracted user is stored in the blockchain in advance, and the CA certificate on the blockchain can only be used uniformly by smart contracts, it is possible to prevent illegal third party users from impersonating the contracted user.
  • the CA certificate method in the case of contrary to the intention of the contracted user, using the contracted user's CA certificate to electronically sign the electronic document can improve the security level when performing the electronic signature operation on the electronic document.
  • FIG. 1 is a flowchart of a blockchain-based electronic signature method according to an exemplary embodiment
  • FIG. 2 is an architecture diagram of a blockchain provided by an exemplary embodiment
  • FIG. 3 is a flowchart of a contracting user signing an electronic document according to an exemplary embodiment
  • FIG. 4 is a schematic structural diagram of an electronic device according to an exemplary embodiment
  • FIG. 5 is a logic block diagram of a blockchain-based electronic signature device according to an exemplary embodiment.
  • the purpose of this specification is to propose a method that uses the smart contract deployed on the blockchain to use the CA certificate of the signatory issued on the blockchain instead of the signatory to use the signatory to automatically sign the electronic document for electronic signing.
  • smart contracts for electronic signature operations on electronic documents can be deployed on the blockchain in advance; on the other hand, after issuing a CA certificate for signatories, CA institutions can also issue The CA certificate is issued to the blockchain and stored in the blockchain's distributed database (that is, the distributed ledger).
  • the contractor can initiate a transaction for triggering the electronic signature operation on the electronic document through the client.
  • the node device in the blockchain can initiate a call to the smart contract, execute the electronic signature program declared in the smart contract, and read the CA certificate with the contracted user from the blockchain. Then, based on the read CA certificate, the electronic signature is automatically performed on the electronic document.
  • CA certificate of the contracted user is stored in the blockchain in advance, and the CA certificate on the blockchain can only be used uniformly by smart contracts, it is possible to prevent illegal third party users from impersonating the contracted user.
  • the CA certificate method in the case of contrary to the intention of the contracted user, using the contracted user's CA certificate to electronically sign the electronic document can improve the security level when performing the electronic signature operation on the electronic document.
  • FIG. 1 is a block chain-based electronic signature method provided by an embodiment of this specification, which is applied to a node device in the block chain, and performs the following steps:
  • Step 102 Receive a target transaction initiated by a contracted user through a client; wherein the target transaction is used to trigger an electronic signature operation on a target electronic document; a CA certificate corresponding to the contracted user is stored in the blockchain in advance ;
  • Step 104 In response to the target transaction, call a smart contract corresponding to an electronic signature, execute an electronic signature program declared in the smart contract, and read a CA certificate corresponding to the contracted user from a blockchain; and, Performing an electronic signature operation on the target electronic document based on the CA certificate.
  • the blockchain described in this specification may specifically include any type of blockchain network; for example, in practical applications, any one of a common chain, a private chain, or an alliance chain may be used.
  • the above-mentioned blockchain network may specifically be an alliance chain composed of a main chain and several sub-chains.
  • the transaction described in this specification refers to a piece of data created by the user through the client of the blockchain and which needs to be finally released to the blockchain.
  • a narrow transaction refers to a value transfer issued by a user to the blockchain; for example, in a traditional Bitcoin blockchain network, a transaction can be a transfer initiated by a user in the blockchain.
  • the generalized transaction refers to a piece of business data with business intent issued by the user to the blockchain; for example, an operator can build an alliance chain based on actual business needs and rely on the alliance chain to deploy other types that are not related to value transfer Online business (such as renting business, vehicle scheduling business, insurance claims business, credit services, medical services, etc.), and in this type of alliance chain, the transaction can be a business with business intent issued by the user in the alliance chain Message or business request.
  • the above-mentioned target transaction refers to a call message or call request created by a user through a client and used to trigger a call to a smart contract deployed on a blockchain.
  • the above electronic document may include any form of text to be signed in digital form; for example, in one example, the above electronic document may specifically be an electronic contract.
  • a contracted user can apply for a CA certificate from a CA agency based on personal identity information.
  • the CA agency may perform identity authentication on the contracted user based on the identity information submitted by the contracted user, and may issue a CA certificate to the contracted user after the identity authentication is passed.
  • a contracted user applies for a CA certificate by submitting identity information to a CA agency, and the CA agency can assign a public key private key pair to the contracted user after the identity information of the contracted user is verified, and the assigned public key pair After the private key of the key is bound to the identity information of the contracted user, the private key held by the CA institution is used for electronic signature to form a CA certificate to be issued to the contracted user.
  • the CA certificate issued to the contracted user can be issued to the blockchain and stored in the blockchain's distributed database
  • the contracted user can issue the above-mentioned CA certificate in the blockchain in the form of a transaction through the client (the CA certificate is carried in the transaction in the form of cipher text) ),
  • the node device in the blockchain after receiving the CA certificate, can initiate consensus processing on the CA certificate, and after the consensus is passed, store the CA certificate in the distributed database of the blockchain .
  • the CA certificate issued by the CA agency for the contracted user after the CA certificate issued by the CA agency for the contracted user has been processed by consensus and successfully stored in the distributed database of the blockchain, it can be Set access permissions for the CA certificates stored on the chain to restrict access to user accounts other than the contracted user.
  • the access authority list can be pre-configured for the CA certificate stored on the chain, and the identity information of the above-mentioned contracted user is written into the above access authority list, which is used to indicate that only the contracted user can have access authority to the CA certificate
  • the user's identity is indicated by using the public key of the contracted user, or public key derived data (such as the account address obtained by calculating the public key), so the public key of the above contracted user or The public key derived data is configured to be the only legal identity that can access the CA certificate mentioned above.
  • the operator of the blockchain can rely on the above-mentioned blockchain to deploy an online business that electronically signs electronic documents stored on the blockchain on the blockchain, so that signing users are signing electronic documents. At this time, it is no longer necessary to manually perform an electronic signature operation on an electronic document based on the held private key, but to complete the electronic signature operation for the electronic document online on the chain.
  • the operator of the blockchain can develop a smart contract for online electronic signature of electronic documents on the blockchain, and an electronic signature program for electronic signature operation of the electronic document is declared in the smart contract. .
  • the above electronic signature program may specifically be a program code (such as some program methods or functions that can be called) declared in a smart contract and related to the execution logic of the electronic signature operation on the electronic document.
  • the operator of the blockchain can publish the smart contract to the blockchain through any node device in the blockchain.
  • the node device in the blockchain can initiate consensus processing on the smart contract, and after the consensus is passed, the smart contract can be stored in the blockchain's distributed database.
  • the contracted user can access any node device in the blockchain through the client and issue a target transaction to the blockchain to trigger the electronic signature operation of the target electronic document to initiate a smart contract that has been deployed. Calling triggers the execution of the electronic signature program declared in the smart contract to perform the electronic signature operation on the target electronic document online.
  • the operator of the blockchain can also deploy on the blockchain an online business that electronically signs electronic documents stored on the blockchain, as well as relying on the above.
  • Blockchain an online business that is deployed on the blockchain to trigger the online display of electronic documents stored on the blockchain.
  • the operator of the blockchain can develop a smart contract for online display of electronic documents on the blockchain, and declare a verification procedure for content verification of the electronic documents in the smart contract.
  • the above verification program may specifically be a program code declared in a smart contract and related to the execution logic of the verification operation of the original content of the electronic document.
  • the operator of the blockchain can still publish the smart contract to the blockchain through any node device in the blockchain.
  • the node device in the blockchain can initiate consensus processing on the smart contract, and after the consensus is passed, the smart contract can be stored in the blockchain's distributed database.
  • the contracted user can access any node device in the blockchain through the client and issue a target transaction to the blockchain to trigger the online display of the target electronic document to initiate the smart contract that has been deployed.
  • Call trigger the execution of the verification procedure declared in the smart contract, verify the content of the target electronic document, and return the target electronic document and the content verification result of the target electronic document to the client after the content verification is passed (such as whether the contents of electronic documents have been tampered with).
  • the smart contract described above for online electronic signature of electronic documents on the blockchain and the smart contract used for online display of electronic instruments on the blockchain are in practical applications.
  • Can be integrated into a smart contract for deployment on the blockchain (shown in Figure 3 to integrate the above two smart contracts into a smart contract), or can be carried out on the blockchain as two different smart contracts Deployment is not particularly limited in this specification.
  • the main chain-sub-chain architecture that can be specifically adopted by the above-mentioned blockchain may include a main chain and several child chains.
  • the number of sub-chains in the above-mentioned blockchain network can be planned based on actual business requirements, and is not particularly limited in this specification.
  • FIG. 2 is a block diagram of a blockchain shown in this specification.
  • the above-mentioned blockchain can be divided into “certificate chain”, “contract summary sub-chain” (first sub-chain), and “ Contract sub-chain “(second sub-chain),” CA certificate sub-chain "(third sub-chain).
  • the above-mentioned certificate chain can be the main chain of the above-mentioned blockchain; that is, the above-mentioned main chain of the blockchain can be used as the certificate chain for transactions related to a series of operations performed by the contracted users on the blockchain.
  • the data is stored and stored to facilitate the traceability of the operation behavior of the contracted users in the future.
  • the smart contracts deployed by the operators of the blockchain can be stored in the main chain after the consensus is passed.
  • the above contract summary sub-chain is used to store the summary data of the electronic contract (a hash value obtained by hashing the contract content) and the access address of the original content of the electronic contract.
  • the above contract sub-chain is used to store the original content of the electronic contract.
  • an access right may be set for the original content of the electronic contract stored on the chain to restrict access to user accounts other than the smart contract. That is, by setting access rights for the original content of the electronic contract stored on the chain, it is ensured that only the above smart contract can have access to the original content of the electronic contract stored on the chain, view the original content of the electronic contract, operating.
  • the CA certificate sub-chain is used to store the CA certificate issued by the CA agency to the contracted users.
  • sub-chain division method described above is only exemplary. In actual applications, the sub-chains shown above can be further subdivided based on actual needs, and the above can also be Multiple subchains shown are merged;
  • the above contract summary sub-chain can be further divided into “contract summary sub-chain” and "contract address sub-chain”.
  • the contract summary sub-chain stores the summary information of the electronic contract
  • the contract address sub-chain stores the electronic contract's information.
  • Access address for another example, the above contract summary sub-chain and contract sub-chain can also be combined into the same sub-chain, and the summary information, access address, and original content of the electronic contract are stored in this sub-chain.
  • the following uses the architecture of the blockchain shown in FIG. 2 to describe in detail the process for signing a user to sign an electronic document.
  • FIG. 3 is a flowchart of a contracting user signing an electronic document shown in the specification.
  • the original content of the electronic contract can be uploaded to the electronic contract system through the client, and the electronic contract system can further publish the original content of the electronic contract in the contract sub-chain in the form of a transaction (the original content of the electronic contract is in cipher text) (The form is carried in the transaction); and the node device in the contract sub-chain, after receiving the original content of the electronic contract, can initiate a consensus process on the original content of the electronic contract, and after the consensus is passed, the above
  • the original content of the electronic contract is stored in the distributed database of the contract sub-chain.
  • the contract sub-chain can return a notification message of successful preservation to the electronic contract system, and the original content of the electronic contract is stored in the contract sub-chain.
  • the access address on the chain is returned to the above-mentioned electronic contract system; and after receiving the feedback from the above-mentioned contract sub-chain, the above-mentioned electronic contract system may return a notification message of upload success to the above-mentioned client, and place the original content of the above-mentioned electronic contract in the The access address on the contract sub-chain is further returned to the client;
  • the access address of the original content of the electronic contract may specifically include information such as a hash value of a transaction containing the original content of the electronic contract, and a block number of a block containing the transaction.
  • the electronic documents stored on the chain can be electronically stored on the chain.
  • the original content of the document sets access permissions to restrict access to user accounts other than the smart contracts described above.
  • the drafter of the electronic contract can also calculate the summary information of the electronic contract through the client. And upload the summary information of the electronic contract to the electronic contract system.
  • the above electronic contract system can further publish the summary information of the electronic contract and the access address of the electronic contract (both carried in the transaction in the form of cipher text) in the contract abstract sub-chain in the form of a transaction.
  • the node device in the contract summary sub-chain may initiate a consensus process on the summary information of the electronic contract and the access address of the electronic contract, and After the consensus is passed, the summary information of the electronic contract and the access address of the electronic contract are stored in the distributed database of the contract summary sub-chain.
  • the contract summary sub-chain may also return a notification message of successful storage to the electronic contract system, and The summary information of the electronic contract and the access address of the access address of the electronic contract in the contract summary sub-chain are returned to the electronic contract system.
  • the electronic contract system may further return a notification message of upload success to the client, and the summary information of the electronic contract and the access address of the electronic contract are in the contract summary.
  • the access address in the sub-chain is further returned to the client.
  • the drafter of the electronic contract successfully stored the original content of the electronic contract, the summary information of the electronic contract, and the access address of the electronic contract into different sub-chains.
  • the signing user can send a signing request to the electronic contract system through the client to initiate an online signing of the electronic contract; and the electronic contract system can respond to the signing request after receiving the signing request.
  • the contracted user is authenticated.
  • the above-mentioned signing request may perform an electronic signature operation based on the private key held by the signing user, and the electronic contract system may use the public key corresponding to the private key held by the signing user to perform the electronic signature of the above signing request. Verification to determine whether the signing request is a signing request initiated by the signing user holding the private key.
  • other forms of authentication technology such as face recognition can also be used to complete the identity authentication of the above-mentioned contracted users, which will not be enumerated one by one in this specification.
  • the electronic contract system After the electronic contract system completes the identity verification of the contracted user, it can generate an authentication record that the contracted user has passed identity authentication, and build a transaction based on the generated authentication record, and then place the transaction in the above-mentioned certificate chain (i.e. The main chain) is issued to initiate a call to a smart contract that has been deployed and is used for online display of electronic contracts on the blockchain to trigger online display of electronic contracts that need to be signed.
  • the main chain is issued to initiate a call to a smart contract that has been deployed and is used for online display of electronic contracts on the blockchain to trigger online display of electronic contracts that need to be signed.
  • the node device in the certificate storage chain may initiate a consensus process on the transaction, and after the consensus is passed, store the transaction in the distributed database of the certificate storage chain for certificate storage. Then, the address of the transaction on the certificate chain is returned to the electronic contract system. Subsequently, the electronic contract system can retrospectively query the identity authentication results of the contracted user based on the transaction's access address on the certificate chain.
  • the above-mentioned electronic contract system passes the transaction consensus constructed based on the generated authentication records, and after completing the certificate deposit on the certificate deposit chain, the node device on the certificate deposit chain can immediately trigger the call to the deployed
  • the completed smart contract for online display of the electronic contract on the blockchain executes the verification procedure stated in the smart contract, and verifies the original content of the electronic contract to determine whether the original content of the electronic contract has occurred tamper.
  • the invocation of the smart contract before triggering the invocation of the smart contract, it is first determined whether the transaction is successfully stored in the certificate chain; if the transaction is successfully stored in the certificate chain, it is initiated at this time.
  • the invocation of the above-mentioned smart contract that is, the invocation of the above-mentioned smart contract will be triggered only after the transaction initiated by the user for triggering the online display of the above-mentioned electronic contract is completed on the above-mentioned certificate-chain.
  • the smart contract when the smart contract executes the verification procedure, it can first read the summary information of the electronic document and the access address of the electronic document from the contract summary sub-chain;
  • the summary information of the electronic contract and the access address of the electronic contract, the access address in the contract summary sub-chain, and the smart contract may be based on the access address from the contract summary sub-chain.
  • the above smart contract can construct a transaction for querying the original content of the electronic contract, and electronically sign the transaction based on the private key held; and in the above contract sub-chain, the public key of the smart contract can be Configured as an authorized public key with access.
  • the node device in the contract subchain receives the transaction, it can verify the electronic signature of the transaction based on the authorized public key; if the verification is passed, it indicates that the smart contract has access to the electronic contract stored in the contract subchain.
  • the access rights of the original content can normally respond to the transaction and return the original content of the queried electronic contract to the smart contract.
  • the original content of the electronic contract after reading the original content of the electronic contract from the above-mentioned contract sub-chain, it can further calculate the summary information of the original content of the read electronic contract; for example, taking the above-mentioned summary information as a hash value, it can be based on The hash algorithm re-hashes the original content of the read electronic contract to obtain the corresponding hash value; then, the digest information of the original content of the recalculated electronic contract can be read from the contract summary sub-chain.
  • the above-mentioned electronic contract summary information is matched; if the recalculated summary information matches the summary information of the above-mentioned electronic contract read from the above-mentioned contract summary sub-chain, it indicates that the original content of the electronic contract read from the above-mentioned contract sub-chain , Exactly the same as the original content of the electronic contract that the contract drafter originally uploaded to the above contract sub-chain, without tampering; at this time, the original content of the electronic contract passed content verification; otherwise, If the recalculated summary information matches the summary information of the above-mentioned electronic contract read from the above-mentioned contract summary sub-chain, it indicates that the original content of the electronic contract read from the above-mentioned contract sub-chain is originally uploaded to the above by the contract drafter The original content of the electronic contract of the contract sub-chain is inconsistent and may have been tampered with; the original content of the electronic contract failed the content verification at this time.
  • the smart contract may return the read original content of the electronic contract and the content verification result of the original content of the electronic contract to the electronic contract system, and then The client returned to the contracted user through the above-mentioned electronic contract system performs online display to the contracted user, and the contracted user confirms the original content of the displayed electronic contract.
  • the node device in the certificate storage chain may initiate a consensus process on the transaction, and after the consensus is passed, store the transaction in the distributed database of the certificate storage chain for certificate storage. Then, the address of the transaction on the certificate chain is returned to the electronic contract system. Subsequently, the electronic contract system may perform a retrospective inquiry on the content confirmation operation performed by the contracted user on the above-mentioned electronic contract based on the access address of the transaction on the certificate storage chain.
  • the contracted user when the contracted user confirms the content of the original content of the electronic contract that needs to be signed, and the content confirmation successfully completes the certificate deposit on the certificate deposit chain, the contracted user can send to the above electronic contract system through the client An electronic signature request initiates an online electronic signature of the aforementioned electronic contract.
  • the electronic contract system may construct a transaction for triggering the electronic signature operation on the electronic contract based on the electronic signature request, and then place the transaction in the certificate chain (i.e., the main chain) )
  • the certificate chain i.e., the main chain
  • the node device in the certificate storage chain may initiate a consensus process on the transaction, and after the consensus is passed, store the transaction in the distributed database of the certificate storage chain for certificate storage. Then, the address of the transaction on the certificate chain is returned to the electronic contract system. Subsequently, the electronic contract system can retrospectively query the electronic signature operation of the electronic contract initiated by the contracted user on the electronic contract based on the access address of the transaction on the certificate deposit chain.
  • the electronic signature request may carry authorization information for a contracted user to electronically sign the electronic contract.
  • the transaction constructed by the electronic contract system according to the electronic signature request will also carry the authorization information,
  • the authorization information is specifically used to indicate the access right of the contracted user's CA certificate that has been stored on the CA certificate sub-chain, and is authorized to be deployed on the blockchain to electronically sign the electronic contract. Smart contract for operation.
  • the content form of the above authorization information is not particularly limited in this specification; for example, in practical applications, the above authorization information may specifically be an electronic form of an arbitrary form for obtaining the access authority of the CA certificate Credentials; for example, strings, passwords, or other forms of verifiable electronic credentials.
  • the above-mentioned electronic contract system passes the transaction consensus constructed according to the above-mentioned electronic signature request, and after completing the certificate deposit on the above-mentioned certificate chain, the node device on the above-mentioned certificate chain can immediately trigger the call to be deployed.
  • a smart contract for electronically signing an electronic contract on the blockchain executes the electronic signature program declared in the smart contract, and electronically signs the electronic contract online.
  • the transaction before triggering the invocation of the smart contract, it may be determined whether the transaction carries the authorization information. If the transaction carries the authorization information, it indicates that the contracted user has stored the CA certificate. The access rights of the individual's CA certificate on the sub-chain are authorized to the above-mentioned smart contract (that is, the contracted user has agreed to complete the electronic signature operation by the smart contract itself), and then the call to the above-mentioned smart contract is initiated. That is, the above-mentioned smart contract will be triggered only after the contracted user authorizes the access right of the personal CA certificate to the above-mentioned smart contract.
  • the above-mentioned transaction carries the above-mentioned authorization information, it can further confirm whether the transaction was successfully stored in the above-mentioned certificate storage chain; if the transaction is successfully stored in the above-mentioned certificate storage Chain at this time, and then initiate the call to the above-mentioned smart contract; that is, only the signed user authorizes the access right of the personal CA certificate to the above-mentioned smart contract, and is initiated by the user to trigger the electronic signature operation on the above-mentioned electronic contract The transaction of the above mentioned smart contract will not be triggered until the transaction is completed on the certificate deposit chain.
  • the original content of the electronic contract can be read from the contract sub-chain; for example, because of the original content of the electronic contract stored on the contract sub-chain, Only the above-mentioned smart contracts deployed on the blockchain have access rights, so the above-mentioned smart contracts can normally read the original content of the electronic contract from the above-mentioned contract sub-chain;
  • the CA certificate of the contracted user can also be read from the CA certificate sub-chain;
  • the above smart contract can construct a transaction for querying the CA certificate, carry the electronic certificate as the authorization information in the transaction, and then publish the transaction in the CA certificate sub-chain; and the CA certificate sub-chain
  • the nodes on the device can verify the electronic credentials in the transaction to confirm whether the smart contract has access to the CA certificate of the contracted user; if the verification is passed, the contracted user's
  • the CA certificate is returned to the smart contract; that is, the smart contract can be read from the CA certificate sub-chain with the access rights of the contracted user by submitting the electronic certificate as the authorization information to the node device in the CA certificate sub-chain. Take the CA certificate.
  • the CA user may also re-apply for a CA certificate with the authorized status of the contracted user, and the specific implementation is not described again.
  • the CA certificate of the contracted user usually carries the public key private key pair of the contracted user; in this case , Based on the private key carried in the CA certificate, the electronic signature operation of the original content of the electronic contract to be signed may be performed.
  • the public key and private key of the contracted user are not uniformly distributed by the CA agency, but are generated by the contracted user independently; for example, a key generation algorithm is deployed in the security environment of the user client, Or the key generation algorithm is installed in the security hardware (such as USB key) held by the user, and the contracted user can create the private key public key pair for himself by triggering the above-mentioned key generation algorithm; in this case, the above-mentioned CA certificate It usually only carries the public key of the contracted user.
  • the contracted user can encrypt the personal private key and submit the personal private key to the above smart contract separately.
  • the smart contract can decrypt the signed user's private key and then use the private key to sign the original content of the electronic contract to be signed. Electronic signature operation is sufficient.
  • the CA certificate when performing the electronic signature operation on the original content of the electronic contract based on the CA certificate, the CA certificate may also be carried in the electronic signature as a payload; in this case, when the contracted user needs to be
  • the CA certificate carried in the electronic signature can be decrypted based on the public key of the CA agency, the public key of the contracted user can be obtained, and then the electronic signature can be verified based on the public key of the contracted user. It is no longer necessary to separately query the public key of the above contracted users.
  • the smart contract can generate a signature record indicating that the contracted user has completed the electronic signature operation on the electronic contract, and based on The signature record constructs a transaction, and is published on the certificate storage chain.
  • the node device on the certificate storage chain processes the transaction consensus, it is stored on the certificate storage chain, so that the electronic contract system can subsequently verify the transaction.
  • the signatory user conducts a retrospective inquiry on the electronic signature operation of the electronic contract.
  • CA certificate of the contracted user is stored in the blockchain in advance, and the CA certificate on the blockchain can only be used uniformly by smart contracts, it is possible to prevent illegal third party users from impersonating the contracted user.
  • the CA certificate method in the case of contrary to the intention of the contracted user, using the contracted user's CA certificate to electronically sign the electronic document can improve the security level when performing the electronic signature operation on the electronic document.
  • this specification also provides an embodiment of an electronic signature device based on a blockchain.
  • the embodiments of the electronic signature device based on the blockchain in this specification can be applied to electronic devices.
  • the device embodiments can be implemented by software, or by hardware or a combination of software and hardware. Taking software implementation as an example, as a device in a logical sense, it is formed by reading the corresponding computer program instructions in the non-volatile memory into the memory through the processor of the electronic device where it is located.
  • FIG. 4 this is a hardware structure diagram of the electronic device where the blockchain-based electronic signature device is located in this specification, except for the processor, memory, network interface, and non-processor shown in FIG. 4.
  • the electronic device in which the device is located in the embodiment may generally include other hardware according to the actual function of the electronic device, and details are not described herein again.
  • Fig. 5 is a block diagram of a blockchain-based electronic signature device, according to an exemplary embodiment of the present specification.
  • the blockchain-based electronic signature device 50 may be applied to the electronic device shown in FIG. 3 and includes a receiving module 501 and a signature module 502.
  • the receiving module 501 receives a target transaction initiated by a contracted user through a client; wherein the target transaction is used to trigger an electronic signature operation on a target electronic document; a CA certificate corresponding to the contracted user is stored in the block in advance chain;
  • a signature module 502 in response to the target transaction, calling a smart contract corresponding to an electronic signature, executing an electronic signature program declared in the smart contract, and reading a CA certificate corresponding to the contracted user from a blockchain; and , Performing an electronic signature operation on the target electronic document based on the CA certificate.
  • the CA certificate stored in the blockchain is preset with an access right restricting access to a user account other than the contracted user;
  • the signature module 502 is the signature module 502:
  • a smart contract corresponding to an electronic signature is triggered to be invoked.
  • the signature module 502 further:
  • the authorization information is included in the target transaction, it is further determined whether the target transaction is successfully stored in the blockchain; if so, a smart contract corresponding to an electronic signature is triggered to be invoked.
  • the target electronic document is stored in advance on the blockchain; wherein the target electronic document stored in the blockchain is preset to restrict access to user accounts other than the smart contract Access rights
  • the signature module 502 is the signature module 502:
  • the CA certificate includes a private key of the contracted user
  • the signature module 502 is the signature module 502:
  • the block chain includes a main chain and a number of sub-chains; the number of sub-chains includes a first sub-chain for storing an access address of the target electronic document, and for storing the target electronic The second sub-chain of the original content of the instrument;
  • the signature module 502 further:
  • the original content of the target electronic document is read from the second sub-chain based on the access address of the target electronic document.
  • the several sub-chains further include a third sub-chain for storing the CA certificate
  • the signature module 502 further:
  • the target electronic document is an electronic contract.
  • the relevant part may refer to the description of the method embodiment.
  • the device embodiments described above are only schematic, and the modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical modules, that is, may be located in One place, or can be distributed to multiple network modules. Some or all of these modules can be selected according to actual needs to achieve the purpose of the solution in this specification. Those of ordinary skill in the art can understand and implement without creative efforts.
  • the system, device, module, or module described in the foregoing embodiments may be specifically implemented by a computer chip or entity, or a product with a certain function.
  • a typical implementation device is a computer, and the specific form of the computer may be a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email sending and receiving device, and a game control Desk, tablet computer, wearable device, or a combination of any of these devices.
  • the electronic device includes a processor and a memory for storing machine-executable instructions; wherein the processor and the memory are usually connected to each other through an internal bus.
  • the device may further include an external interface to enable communication with other devices or components.
  • the processor by reading and executing machine-executable instructions corresponding to control logic based on a blockchain-based electronic signature stored in the memory, the processor is caused to:
  • a target transaction initiated by a contracted user through a client wherein the target transaction is used to trigger an electronic signature operation on a target electronic document;
  • a CA certificate corresponding to the contracted user is stored in the blockchain in advance;
  • the CA certificate stored in the blockchain is preset with an access right restricting access to a user account other than the contracted user;
  • the processor By reading and executing the machine-executable instructions corresponding to the control logic based on the blockchain-based electronic signature stored in the memory, the processor is caused to:
  • a smart contract corresponding to an electronic signature is triggered to be invoked.
  • the processor by reading and executing machine-executable instructions corresponding to control logic based on a blockchain-based electronic signature stored in the memory, the processor is caused to:
  • the authorization information is included in the target transaction, it is further determined whether the target transaction is successfully stored in the blockchain; if so, a smart contract corresponding to an electronic signature is triggered to be invoked.
  • the target electronic document is stored in advance on the blockchain; wherein the target electronic document stored in the blockchain is preset to restrict access to user accounts other than the smart contract Access rights
  • the processor By reading and executing the machine-executable instructions corresponding to the control logic based on the blockchain-based electronic signature stored in the memory, the processor is caused to:
  • the CA certificate includes a private key of the contracted user
  • the processor By reading and executing the machine-executable instructions corresponding to the control logic based on the blockchain-based electronic signature stored in the memory, the processor is caused to:
  • the block chain includes a main chain and a number of sub-chains; the number of sub-chains includes a first sub-chain for storing an access address of the target electronic document, and for storing the target electronic The second sub-chain of the original content of the instrument;
  • the processor By reading and executing the machine-executable instructions corresponding to the control logic based on the blockchain-based electronic signature stored in the memory, the processor is caused to:
  • the original content of the target electronic document is read from the second sub-chain based on the access address of the target electronic document.
  • the several sub-chains further include a third sub-chain for storing the CA certificate
  • the processor By reading and executing the machine-executable instructions corresponding to the control logic based on the blockchain-based electronic signature stored in the memory, the processor is caused to:

Landscapes

  • Business, Economics & Management (AREA)
  • Engineering & Computer Science (AREA)
  • Accounting & Taxation (AREA)
  • Computer Security & Cryptography (AREA)
  • Finance (AREA)
  • Strategic Management (AREA)
  • Physics & Mathematics (AREA)
  • General Business, Economics & Management (AREA)
  • General Physics & Mathematics (AREA)
  • Theoretical Computer Science (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)

Abstract

一种基于区块链的电子签名方法及装置、电子设备，该方法可以包括：接收签约用户通过客户端发起的目标交易；其中，所述目标交易用于触发对目标电子文书进行电子签名操作；与所述签约用户对应的CA证书被预先存储至所述区块链（102）；响应于所述目标交易，调用与电子签名对应的智能合约，执行所述智能合约中声明的电子签名程序，从区块链中读取与所述签约用户对应的CA证书；以及，基于所述CA证书对所述目标电子文书进行电子签名操作（104）。

Description

基于区块链的电子签名方法及装置、电子设备 技术领域
本说明书一个或多个实施例涉及区块链技术领域，尤其涉及一种基于区块链的电子签名方法及装置、电子设备。
背景技术
区块链技术，也被称之为分布式账本技术，是一种由若干台计算设备共同参与“记账”，共同维护一份完整的分布式数据库的新兴技术。由于区块链技术具有去中心化、公开透明、每台计算设备可以参与数据库记录、并且各计算设备之间可以快速的进行数据同步的特性，使得区块链技术已在众多的领域中广泛的进行应用。
发明内容
本说明书提出一种基于区块链的电子签名方法，所述方法包括：
接收签约用户通过客户端发起的目标交易；其中，所述目标交易用于触发对目标电子文书进行电子签名操作；与所述签约用户对应的CA证书被预先存储至所述区块链；
响应于所述目标交易，调用与电子签名对应的智能合约，执行所述智能合约中声明的电子签名程序，从区块链中读取与所述签约用户对应的CA证书；以及，
基于所述CA证书对所述目标电子文书进行电子签名操作。
可选的，所述区块链中存储的所述CA证书，被预设了限制所述签约用户以外的用户账户进行访问的访问权限；
所述调用与电子签名对应的智能合约，包括：
确定所述目标交易中是否包括所述签约用户对所述目标文本进行电子签名的授权信息；其中，所述授权信息用于指示将所述CA证书的访问权限授权给所述智能合约；
如果所述目标交易中包括所述授权信息，则触发调用与电子签名对应的智能合约。
可选的，所述如果所述目标交易中包括所述授权信息，则触发调用与电子签名对应的智能合约，包括：
如果所述目标交易中包括所述授权信息，进一步确定所述目标交易是否被成功存储 至所述区块链；如果是，则触发调用与电子签名对应的智能合约。
可选的，所述目标电子文书被预先存储至区块链；其中，所述区块链中存储的所述目标电子文书，被预设了限制所述智能合约以外的用户账户进行访问的访问权限；
所述基于所述CA证书对所述目标电子文书进行电子签名操作，包括：
从所述区块链中读取所述目标电子文书；
基于所述CA证书对读取到的所述目标电子文书进行电子签名操作。
可选的，所述CA证书包括所述签约用户的私钥；
所述基于所述CA证书对读取到的所述目标电子文书进行电子签名操作，包括：基于所述CA证书中的所述签约用户的私钥，对读取到的所述目标电子文书进行电子签名操作
可选的，所述区块链包括主链以及若干子链；所述若干子链包括用于存储所述目标电子文书的访问地址的第一子链，以及用于存储所述目标电子文书的原始内容的第二子链；
所述从所述区块链中读取所述目标电子文书，包括：
从所述第一子链中读取所述目标电子文书的访问地址；
基于所述目标电子文书的访问地址从所述第二子链中读取所述目标电子文书的原始内容。
可选的，所述若干子链还包括用于于存储所述CA证书的第三子链；
所述从区块链中读取与所述签约用户对应的CA证书，包括：
从所述第三子链中读取与所述签约用户对应的CA证书。
可选的，所述目标电子文书为电子合同。
本说明书还提出一种基于区块链的电子签名装置，所述装置包括：
接收模块，接收签约用户通过客户端发起的目标交易；其中，所述目标交易用于触发对目标电子文书进行电子签名操作；与所述签约用户对应的CA证书被预先存储至所述区块链；
签名模块，响应于所述目标交易，调用与电子签名对应的智能合约，执行所述智能合约中声明的电子签名程序，从区块链中读取与所述签约用户对应的CA证书；以及， 基于所述CA证书对所述目标电子文书进行电子签名操作。
可选的，所述区块链中存储的所述CA证书，被预设了限制所述签约用户以外的用户账户进行访问的访问权限；
所述签名模块：
确定所述目标交易中是否包括所述签约用户对所述目标文本进行电子签名的授权信息；其中，所述授权信息用于指示将所述CA证书的访问权限授权给所述智能合约；
如果所述目标交易中包括所述授权信息，则触发调用与电子签名对应的智能合约。
可选的，所述签名模块进一步：
如果所述目标交易中包括所述授权信息，进一步确定所述目标交易是否被成功存储至所述区块链；如果是，则触发调用与电子签名对应的智能合约。
可选的，所述目标电子文书被预先存储至区块链；其中，所述区块链中存储的所述目标电子文书，被预设了限制所述智能合约以外的用户账户进行访问的访问权限；
所述签名模块：
从所述区块链中读取所述目标电子文书；
基于所述CA证书对读取到的所述目标电子文书进行电子签名操作。
可选的，所述CA证书包括所述签约用户的私钥；
所述签名模块：
基于所述CA证书中的所述签约用户的私钥，对读取到的所述目标电子文书进行电子签名操作
可选的，所述区块链包括主链以及若干子链；所述若干子链包括用于存储所述目标电子文书的访问地址的第一子链，以及用于存储所述目标电子文书的原始内容的第二子链；
所述签名模块进一步：
从所述第一子链中读取所述目标电子文书的访问地址；
基于所述目标电子文书的访问地址从所述第二子链中读取所述目标电子文书的原始内容。
可选的，所述若干子链还包括用于于存储所述CA证书的第三子链；
所述签名模块进一步：
从所述第三子链中读取与所述签约用户对应的CA证书。
可选的，所述目标电子文书为电子合同。
本说明书还提出一种电子设备，包括：
处理器；
用于存储机器可执行指令的存储器；
其中，通过读取并执行所述存储器存储的与基于区块链的基于区块链的电子签名的控制逻辑对应的机器可执行指令，所述处理器被促使：
接收签约用户通过客户端发起的目标交易；其中，所述目标交易用于触发对目标电子文书进行电子签名操作；与所述签约用户对应的CA证书被预先存储至所述区块链；
响应于所述目标交易，调用与电子签名对应的智能合约，执行所述智能合约中声明的电子签名程序，从区块链中读取与所述签约用户对应的CA证书；以及，
基于所述CA证书对所述目标电子文书进行电子签名操作。
通过以上技术方案，一方面，由于用户可以通过调用智能合约的方式，来触发智能合约从区块链中读取与签约用户对应的CA证书，并基于读取到的CA证书对电子文书进行电子签名操作；因此，可以避免由用户手动对电子文书进行签名，简化电子签名操作的复杂度；
另一方面，由于签约用户的CA证书被预先存储至区块链，并且区块链上的CA证书，只能由智能合约来统一使用，因此可以避免非法的第三方用户通过冒用签约用户的CA证书的方式，在违背签约用户的意愿的情况下，使用签约用户的CA证书对电子文书进行电子签名操作，可以提升对电子文书进行电子签名操作时的安全等级。
附图说明
图1是一示例性实施例提供的一种基于区块链的电子签名方法的流程图；
图2是一示例性实施例提供的一种区块链的架构图；
图3是一示例性实施例提供的一种签约用户对电子文书进行签约的流程图；
图4是一示例性实施例提供的一种电子设备的结构示意图；
图5是一示例性实施例提供的一种基于区块链的电子签名装置的逻辑框图。
具体实施方式
本说明书旨在提出一种，通过调用部署在区块链上的智能合约，利用发布在区块链上的签约者的CA证书，来代替签约者利用签约者自动对待签约的电子文书进行电子签名的技术方案。
在实现时，一方面，可以在区块链上提前部署用于对电子文书进行电子签名操作的智能合约；另一方面，CA机构在为签约者颁发CA证书后，也可以将为签约者颁发的CA证书发布至区块链，在区块链的分布式数据库(即分布式账本)中进行存储。
而签约者在需要对电子文书进行电子签名时，可以通过客户端发起一笔用于触发对电子文书进行电子签名操作的交易。而区块链中的节点设备在收到该交易后，可以发起对上述智能合约的调用，执行该智能合约中声明的电子签名程序，从区块链中读取与上述签约用户的CA证书，然后基于读取到的CA证书对自动对上述电子文书进行电子签名操作。
通过以上技术方案，一方面，由于用户可以通过调用智能合约的方式，来触发智能合约从区块链中读取与签约用户对应的CA证书，并基于读取到的CA证书对电子文书进行电子签名操作；因此，可以避免由用户手动对电子文书进行签名，简化电子签名操作的复杂度；
另一方面，由于签约用户的CA证书被预先存储至区块链，并且区块链上的CA证书，只能由智能合约来统一使用，因此可以避免非法的第三方用户通过冒用签约用户的CA证书的方式，在违背签约用户的意愿的情况下，使用签约用户的CA证书对电子文书进行电子签名操作，可以提升对电子文书进行电子签名操作时的安全等级。
下面通过具体实施例并结合具体的应用场景对本说明书进行描述。
请参考图1，图1是本说明书一实施例提供的一种基于区块链的电子签名方法，应用于区块链中的节点设备，执行以下步骤：
步骤102，接收签约用户通过客户端发起的目标交易；其中，所述目标交易用于触发对目标电子文书进行电子签名操作；与所述签约用户对应的CA证书被预先存储至所述区块链；
步骤104，响应于所述目标交易，调用与电子签名对应的智能合约，执行所述智能合约中声明的电子签名程序，从区块链中读取与所述签约用户对应的CA证书；以及，基于所述CA证书对所述目标电子文书进行电子签名操作。
在本说明书描述的区块链，具体可以包括任意类型的区块链网络；例如，在实际应用中，可以采用共有链、私有链、或者联盟链中的任意一种。
例如，在示出的是一种实施方式中，上述区块链网络具体可以是一个由主链，以及若干子链构成的联盟链。
在本说明书中所描述的交易，是指用户通过区块链的客户端创建，并需要最终发布至区块链中的一笔数据。
其中，区块链中的交易，存在狭义的交易以及广义的交易之分。狭义的交易是指用户向区块链发布的一笔价值转移；例如，在传统的比特币区块链网络中，交易可以是用户在区块链中发起的一笔转账。而广义的交易是指用户向区块链发布的一笔具有业务意图的业务数据；例如，运营方可以基于实际的业务需求搭建一个联盟链，依托于联盟链部署一些与价值转移无关的其它类型的在线业务(比如，租房业务、车辆调度业务、保险理赔业务、信用服务、医疗服务等)，而在这类联盟链中，交易可以是用户在联盟链中发布的一笔具有业务意图的业务消息或者业务请求。
而上述目标交易，则是指由用户通过客户端创建的，用于触发对区块链上部署的智能合约进行调用的调用消息或者调用请求。
上述电子文书，可以包括任意形式的以数字形式存在的待签约文本；例如，在一个例子中，上述电子文书具体可以是电子合同。
在本说明书中，签约用户可以基于个人的身份信息，向CA机构申请CA证书。而CA机构收到签约用户的CA证书申请后，可以基于签约用户提交的身份信息，对签约用户进行身份认证，并在身份认证通过后，可以为上述签约用户颁发CA证书。
其中，签约用户向CA机构申请CA证书的具体过程，在本说明书中不再进行详细描述；
例如，在实际应用中，签约用户用向CA机构提交身份信息申请CA证书，而CA机构在对签约用户的身份信息验证通过后，可以为签约用户分配公钥私钥对，并将分配的公钥私钥对与该签约用户的身份信息进行绑定后，使用CA机构持有的私钥进行电子签名，形成CA证书颁发给签约用户。
在本说明书中，对于颁发给签约用户的CA证书，可以发布至区块链，在区块链的分布式数据库中进行存储；
例如，在一个例子中，CA证书在将CA证书颁发给签约用户后，签约用户可以通过客户端以交易的形式在区块链中发布上述CA证书(CA证书以密文的形式携带在交易中)，而区块链中的节点设备，在收到上述CA证书后，可以发起对上述CA证书进行共识处理，并在共识通过后，将上述CA证书收录存储至上述区块链的分布式数据库。
在示出的一种实施方式中，为了提升签约用户的CA证书的使用安全，当CA机构为签约用户颁发的CA证书经过共识处理，被成功收录存储至区块链的分布式数据库之后，可以为链上存储的CA证书设置访问权限，来限制该签约用户以外的用户账户进行访问。
也即，通过为链上存储的CA证书设置访问权限，来确保只有该签约用户本人，能够具有访问链上存储的CA证书的权限，对该CA证书进行查看、操作。
例如，在实现时，可以为链上存储的CA证书预配置访问权限列表，并将上述签约用户的身份信息写入上述访问权限列表，用于指示只有该签约用户能够具有该CA证书的访问权限；比如，在区块链中，通过利用签约用户的公钥，或者公钥衍生数据(如对公钥进行计算得到的账户地址)来指示用户的身份，因此可以将上述签约用户的公钥或者公钥衍生数据，配置为唯一能够访问上述CA证书的合法身份。
在本说明书中，区块链的运营方，可以依托于上述区块链，在区块链上部署对存储在区块链上的电子文书进行电子签名的在线业务，使得签约用户在签署电子文书时，可以不再需要基于持有的私钥，手动的对电子文书进行电子签名操作，而是在链上在线完成针对电子文书的电子签名操作。
在实现时，区块链的运营方，可以开发用于对区块链上的电子文书进行在线电子签名的智能合约，在该智能合约中声明用于对电子文书进行电子签名操作的电子签名程序。
其中，上述电子签名程序具体可以是声明在智能合约中的，与对电子文书进行电子签名操作的执行逻辑相关的程序代码(比如一些可供调用的程序方法或者函数)。
而对于开发完成的上述智能合约，区块链的运营方可以通过区块链中的任一节点设备，将该智能合约发布至区块链。而区块链中的节点设备，在收到上述智能合约后，可以发起对上述智能合约进行共识处理，并在共识通过后，将上述智能合约收录存储至上述区块链的分布式数据库。
后续，签约用户可以通过客户端接入区块链中的任一节点设备，向区块链中发布用于触发对目标电子文书进行电子签名操作的目标交易，来发起对已经部署完成的智能合约的调用，触发执行上述智能合约中声明的电子签名程序，来在线的对上述目标电子文书进行电子签名操作。
在本说明书中，区块链的运营方，除了可以依托于上述区块链，在区块链上部署对存储在区块链上的电子文书进行电子签名的在线业务以外，还可以依托于上述区块链，在区块链上部署用于触发对存储在区块链上的电子文书进行在线展示的在线业务。
在实现时，区块链的运营方，可以开发用于对区块链上的电子文书进行在线展示的智能合约，在该智能合约中声明用于对电子文书进行内容验证的验证程序。
其中，上述验证程序具体可以是声明在智能合约中的，与对电子文书的原始内容进行验证操作的执行逻辑相关的程序代码。
而对于开发完成的上述智能合约，区块链的运营方仍然可以通过区块链中的任一节点设备，将该智能合约发布至区块链。而区块链中的节点设备，在收到上述智能合约后，可以发起对上述智能合约进行共识处理，并在共识通过后，将上述智能合约收录存储至上述区块链的分布式数据库。
后续，签约用户可以通过客户端接入区块链中的任一节点设备，向区块链中发布用于触发对目标电子文书进行在线展示的目标交易，来发起对已经部署完成的该智能合约的调用，触发执行上述智能合约中声明的验证程序，对上述目标电子文书的内容进行验证，并在内容验证通过后，向上述客户端返回上述目标电子文书以及上述目标电子文书的内容验证结果(比如电子文书内容是否被篡改)。
其中，需要说明的是，以上描述的用于对区块链上的电子文书进行在线电子签名的智能合约、和用于对区块链上的电子文书进行在线展示的智能合约，在实际应用中，可以整合为一个智能合约在区块链上进行部署(图3中示出的为将上述两种智能合约整合成为一个智能合约)，也可以作为两个不同的智能合约在区块链上进行部署，在本说明书中不进行特别限定。
以下以上述目标电子文书为签约用户需要签署的电子合同为例进行说明。
在示出的一种实施方式中，上述区块链具体可以采用的主链-子链的架构，可以包括一主链(Main Chain)和若干子链(Child Chain)。其中，上述区块链网络中的子链的数量，可以基于实际的业务需求进行规划，在本说明书中不进行特别限定。
请参见图2，图2为本说明书示出的一种区块链的架构图。
如图2所示，在示出的一种实施方式中，上述区块链可以按照收录存储的数据类型，划分为“存证链”、“合同摘要子链”(第一子链)、“合同子链”(第二子链)、“CA证书子链”(第三子链)。
上述存证链，可以是上述区块链的主链；也即，可以将上述区块链的主链作为存证链，用于对签约用户在区块链上完成的一系列操作相关的交易数据进行存储存证，以便于未来对签约用户的操作行为进行追溯；其中，区块链的运营方部署的上述智能合约，可以在共识通过后，收录存储至主链。
上述合同摘要子链，用于存储电子合同的摘要数据(对合同内容进行哈希计算得到的hash值)和电子合同的原始内容的访问地址。
上述合同子链，用于存储电子合同的原始内容。
其中，在示出的一种实施方式中，为了提升电子合同的原始内容的数据安全，可以为链上存储的电子合同的原始内容设置访问权限，来限制上述智能合约以外的用户账户进行访问。也即，通过为链上存储的电子合同的原始内容设置访问权限，来确保只有上述智能合约，能够具有访问链上存储的电子合同的原始内容的权限，对该电子合同的原始内容进行查看、操作。
上述CA证书子链，用于存储由CA机构颁发给签约用户的CA证书。
其中，需要说明的是，以上描述的子链划分方式，仅为示例性的，在实际应用中，可以基于实际的需求，对以上示出的各个子链进行进一步的细分，也可以对以上示出的多个子链进行合并处理；
例如，可以将上述合同摘要子链，进一步划分为“合同摘要子链”和“合同地址子链”，在合同摘要子链中存储电子合同的摘要信息，在合同地址子链中存储电子合同的访问地址；又如，也可以将上述合同摘要子链和合同子链，合并为同一个子链，将电子合同的摘要信息、访问地址、原始内容均存储在该子链中。
以下以采用图2中示出的区块链的架构，来详细描述签约用户对电子文书进行签约的流程。
请参见图3，图3为本说明书示出的一种签约用户对电子文书进行签约的流程图。
如图3所示，在本说明书示出的电子文书的签约流程中，可以划分为电子合同 上传、签约用户身份认证、签约用户合同确认、签约用户电子签名等四个阶段。
1)电子合同上传
如图3所示，电子合同的起草方，在完成电子合同的起草后：
一方面，可以通过客户端将电子合同的原始内容上传给电子合约系统，而电子合约系统可以进一步以交易的形式在上述合同子链中发布电子合同的原始内容(电子合同的原始内容以密文的形式携带在交易中)；而上述合同子链中的节点设备，在收到上述电子合同的原始内容后，可以发起对上述电子合同的原始内容进行共识处理，并在共识通过后，将上述电子合同的原始内容收录存储至上述合同子链的分布式数据库。
当上述电子合同的原始内容被成功收录至上述合同子链的分布式数据库后，上述合同子链可以向上述电子合约系统返回一个保存成功的通知消息，将上述电子合同的原始内容在上述合同子链上的访问地址，返回给上述电子合约系统；而上述电子合约系统在收到上述合同子链的反馈后，可以向上述客户端返回一个上传成功的通知消息，将上述电子合同的原始内容在上述合同子链上的访问地址，进一步返回给上述客户端；。
例如，上述电子合同的原始内容的访问地址，具体可以包括收录该电子合同的原始内容的交易的hash值，以及收录该交易的区块的区块编号等信息。
在示出的一种实施方式中，为了提升电子文书的使用安全，当电子文书的原始内容经过共识处理，被成功收录存储至上述存证链的分布式数据库之后，可以为链上存储的电子文书的原始内容设置访问权限，来限制除了以上描述的智能合约以外的用户账户进行访问。
也即，通过为链上存储的电子文书设置访问权限，来确保只有链上部署的智能合约，能够具有访问链上存储的电子文书的原始内容的权限，对电子文书的原始内容进行查看、操作。
其中，为链上存储的电子文书的原始内容设置访问权限的具体过程，不再进行赘述。
另一方面，电子合同的起草方在通过客户端收到上述合同子链返回的电子合同的原始内容在上述合同子链上的访问地址后，还可以通过客户端计算该电子合同的摘要信息，并将该电子合同的摘要信息上传给电子合约系统。而上述电子合约系统，可以进一步以交易的形式在上述合同摘要子链中发布该电子合同的摘要信息和该电子合同的访问地址(均以密文的形式携带在交易中)。上述合同摘要子链中的节点设备，在收到 上述电子合同的摘要信息和该电子合同的访问地址后，可以发起对上述电子合同的摘要信息和该电子合同的访问地址进行共识处理，并在共识通过后，将上述电子合同的摘要信息和该电子合同的访问地址收录存储至上述合同摘要子链的分布式数据库。
当上述电子合同的摘要信息和该电子合同的访问地址被成功收录至上述合同摘要子链的分布式数据库后，上述合同摘要子链也可以向上述电子合约系统返回一个保存成功的通知消息，将上述电子合同的摘要信息和该电子合同的访问地址在上述合同摘要子链中的访问地址，返回给上述电子合约系统。而上述电子合约系统在收到上述合同摘要子链的反馈后，也可以进一步向上述客户端返回一个上传成功的通知消息，将上述电子合同的摘要信息和该电子合同的访问地址在上述合同摘要子链中的访问地址，进一步返回给上述客户端。
此时，电子合同起草方，成功将电子合同的原始内容、电子合同的摘要信息和该电子合同的访问地址，分别收录存储至不同的子链。
2)签约用户身份认证
如图3所示，签约用户可以通过客户端向上述电子合约系统发送签约请求，发起对上述电子合同的在线签约；而上述电子合约系统在收到该签约请求后，可以响应该签约请求，对该签约用户进行身份认证。
其中，对签约用户进行身份认证的具体方式，在本说明书中将不进行特别限定；
例如，在一个例子中，上述签约请求可以基于签约用户持有的私钥进行电子签名操作，而电子合约系统可以通过与签约用户持有的私钥对应的公钥对上述签约请求的电子签名进行验证，以确定该签约请求是否由持有该私钥的签约用户本人发起的签约请求。当然，在实际应用中，也可以借助人脸识别等其它形式的认证技术，来完成对上述签约用户的身份认证，在本说明书中不再进行一一列举。
当电子合约系统完成对上述签约用户的身份认证后，可以生成一条该签约用户已经通过身份认证的认证记录，并根据生成的认证记录构建一笔交易，然后将该交易在上述存证链(即主链)上进行发布，以发起对已经部署完成的，用于对区块链上的电子合同进行在线展示的智能合约进行调用，来触发在线展示需要签署的电子合同。
而上述存证链中的节点设备，在收到上述交易后，可以发起对上述交易进行共识处理，并在共识通过后，将上述交易收录存储至上述存证链的分布式数据库进行存证，然后向上述电子合约系统返回上述交易在存证链上的访问地址。后续，电子合约系统可 以基于该交易在存证链上的访问地址，对该签约用户的身份认证结果进行追溯查询。
3)签约用户合同确认
请继续参见图3，上述电子合约系统根据生成的上述认证记录构建的交易共识通过，在上述存证链上完成存证后，此时上述存证链上的节点设备，可以立即触发调用已经部署完成的，用于对区块链上的电子合同进行在线展示的智能合约，执行该智能合约中声明的验证程序，对该电子合同的原始内容进行验证，以确定该电子合同的原始内容是否发生篡改。
在示出的一种实施方式中，在触发调用上述智能合约之前，首先确定该笔交易是否被成功存储至上述存证链；如果该笔交易被成功存储至上述存证链，此时再发起对上述智能合约的调用；也即，只有由用户发起的用于触发对上述电子合同进行在线展示的交易在上述存证链上完成存证后，才会触发调用上述智能合约。
在本说明书中，上述智能合约在执行上述验证程序时，首先可以从上述合同摘要子链中读取上述电子文书的摘要信息和上述电子文书的访问地址；
例如，在上述交易中，可以携带上述电子合同的摘要信息和上述电子合同的访问地址，在上述合同摘要子链中的访问地址，而上述智能合约可以基于该访问地址，从上述合同摘要子链读取上述电子合同的摘要信息和访问地址。然后，可以基于上述电子合同的访问地址，从上述合同子链中读取上述电子合同的原始内容；
例如，上述智能合约可以构建一笔用于查询电子合同的原始内容的交易，并基于持有的私钥对该交易进行电子签名；而在上述合同子链中，可以将该智能合约的公钥配置为具有访问权限的授权公钥。当该合同子链中的节点设备收到该交易后，可以基于上述授权公钥对该交易的电子签名进行验证；如果验证通过，表明该智能合约具有访问该合同子链中存储的电子合同的原始内容的访问权限，可以正常响应该笔交易，向该智能合约返回被查询的电子合同的原始内容。
进一步的，在从上述合同子链读取到电子合同的原始内容后，可以进一步计算出读取到的电子合同的原始内容的摘要信息；例如，以上述摘要信息为hash值为例，可以基于哈希算法对读取到的电子合同的原始内容重新进行哈希计算得到对应的hash值；然后，可以将重新计算得到的电子合同的原始内容的摘要信息，与从上述合同摘要子链读取上述电子合同的摘要信息进行匹配；如果重新计算得到的摘要信息，与从上述合同摘要子链读取上述电子合同的摘要信息匹配，表明从上述合同子链中读取到的电子 合同的原始内容，与合同起草方最初上传至上述合同子链的电子合同的原始内容完全一致，并没有发生篡改；此时，该电子合同的原始内容通过了内容验证；反之。如果重新计算得到的摘要信息，与从上述合同摘要子链读取上述电子合同的摘要信息匹配，表明从上述合同子链中读取到的电子合同的原始内容，与合同起草方最初上传至上述合同子链的电子合同的原始内容不一致，可能发生了篡改；此时，该电子合同的原始内容未通过内容验证。
当完成针对上述电子合同的原始内容的内容验证后，上述智能合约可以将读取到的电子合同的原始内容，以及针对该电子合同的原始内容的内容验证结果，返回给上述电子合约系统，再通过上述电子合约系统返回给上述签约用户的客户端向签约用户进行在线展示，由签约用户对展示的电子合同的原始内容进行签约确认。
在本说明书中，当签约用户对展示的电子合同的原始内容进行确认后，可以通过客户端向上述电子合约系统发送一笔内容确认消息；而上述电子合约系统在收到该内容确认消息后，可以响应该内容确认消息，根据该内容确认消息构建一笔交易，然后将该交易在上述存证链(即主链)上进行发布。
而上述存证链中的节点设备，在收到上述交易后，可以发起对上述交易进行共识处理，并在共识通过后，将上述交易收录存储至上述存证链的分布式数据库进行存证，然后向上述电子合约系统返回上述交易在存证链上的访问地址。后续，电子合约系统可以基于该交易在存证链上的访问地址，对该签约用户对上述电子合同进行的内容确认操作进行追溯查询。
4)签约用户电子签名
请继续参见图3，当签约用户对需要签署的电子合同的原始内容进行内容确认，并且该笔内容确认成功在存证链上完成存证后，签约用户可以通过客户端向上述电子合约系统发送电子签名请求，发起对上述电子合同的在线电子签名。
上述电子合约系统在收到该电子签名请求后，可以基于该电子签名请求来构建一笔用于触发对上述电子合同进行电子签名操作的交易，然后将该交易在上述存证链(即主链)上进行发布，以发起对已经部署完成的，用于对区块链上的电子合同进行在线电子签名操作的智能合约进行调用，来触发对需要签署的电子合同进行在线电子签名操作。
而上述存证链中的节点设备，在收到上述交易后，可以发起对上述交易进行共 识处理，并在共识通过后，将上述交易收录存储至上述存证链的分布式数据库进行存证，然后向上述电子合约系统返回上述交易在存证链上的访问地址。后续，电子合约系统可以基于该交易在存证链上的访问地址，对该签约用户对上述电子合同发起的本次对上述电子合同的电子签名操作进行追溯查询。
在示出的一种实施方式中，在上述电子签名请求中，可以携带签约用户对上述电子合同进行电子签名的授权信息。相应的，电子合约系统根据该电子签名请求构建的交易中，也会携带该授权信息，
其中，上述授权信息，具体用于指示将已经存储至上述CA证书子链上的该签约用户的CA证书的访问权限，授权给上述区块链上已经部署的用于对上述电子合同进行电子签名操作的智能合约。
需要说明的是，上述授权信息的内容形式，在本说明书中不进行特别限定；例如，在实际应用中，上述授权信息具体可以是一个任意形式的用于取得上述CA证书的访问权限的一个电子凭证；比如，字符串、密码或者其它形式的可供验证的电子凭证。
请继续参见图3，上述电子合约系统根据上述电子签名请求构建的交易共识通过，在上述存证链上完成存证后，此时上述存证链上的节点设备，可以立即触发调用已经部署完成的，用于对区块链上的电子合同进行电子签名操作的智能合约，执行该智能合约中声明的电子签名程序，对该电子合同进行在线电子签名。
在示出的一种实施方式中，在触发调用上述智能合约之前，首先可以确定上述交易中是否携带上述授权信息；如果上述交易中携带上述授权信息，表明上述签约用户已经将存储在上述CA证书子链上的个人的CA证书的访问权限，授权给上述智能合约(即签约用户同意了由智能合约代替自己完成电子签名操作)，此时再发起对上述智能合约的调用。也即，只有签约用户将个人的CA证书的访问权限授权给了上述智能合约后，才会触发调用上述智能合约。
其中，在示出的另一种实施方式中，如果上述交易中携带上述授权信息，还可以进一步确认该笔交易是否被成功存储至上述存证链；如果该笔交易被成功存储至上述存证链，此时再发起对上述智能合约的调用；也即，只有签约用户将个人的CA证书的访问权限授权给了上述智能合约，并且由用户发起的用于触发对上述电子合同进行电子签名操作的交易在上述存证链上完成存证后，才会触发调用上述智能合约。
在本说明书中，上述智能合约在执行上述电子签名程序时，一方面，可以从上 述合同子链上来读取电子合同的原始内容；例如，由于上述合同子链上存储的电子合同的原始内容，只有区块链上部署的上述智能合约具有访问权限，因此上述智能合约可以从上述合同子链正常读取电子合同的原始内容；
另一方面，还可以从上述CA证书子链中来读取上述签约用户的CA证书；
例如，上述智能合约可以构建一笔用于查询CA证书的交易，在该交易中携带作为上述授权信息的电子凭证,然后将该交易在上述CA证书子链中进行发布；而上述CA证书子链上的节点设备收到该笔交易后们可以对该交易中的电子凭证进行验证，以确认该智能合约是否具有访问上述签约用户的CA证书的访问权限；如果验证通过，可以将上述签约用户的CA证书返回给上述智能合约；也即，上述智能合约可以通过向上述CA证书子链中的节点设备提交作为上述授权信息的电子凭证，从CA证书子链中以上述签约用户的访问权限来读取CA证书。
当然，在实际应用中，如果上述CA证书子链中未存储上述签约用户的CA证书，也可以以签约用户的授权身份，向CA机构重新申请CA证书，具体的实施不再赘述。
进一步，当从上述合同子链上读取到了待签署的电子合同的原始内容，并且从上述CA证书子链中读取到上述签约用户的个人CA证书后，可以基于读取到的CA证书，对该电子合同的原始内容进行电子签名操作。
在示出的一种实施方式中，如果签约用户的公钥私钥由CA机构统一分配，在签约用户的CA证书中，通常会携带该签约用户的公钥私钥对；在这种情况下，可以基于该CA证书中携带的私钥，对待签署的电子合同的原始内容进行电子签名操作即可。
在示出的另一种实施方式中，如果签约用户的公钥私钥并不是由CA机构统一分配，而是由签约用户自主生成；例如，在用户客户端的安全环境中搭载密钥生成算法，或者在用户持有的安全硬件(比如USB key)中搭载密钥生成算法，签约用户可以通过触发运行上述密钥生成算法，为自己创建私钥公钥对；在这种情况下，上述CA证书中通常只会携带签约用户的公钥。签约用户可以对个人私钥进行加密后，将个人私钥单独提交给上述智能合约，进而上述智能合约可以对签约用户的私钥进行解密后，基于该私钥对待签署的电子合同的原始内容进行电子签名操作即可。
其中，需要强调的是，在基于CA证书对上述电子合同的原始内容进行电子签名操作时，也可以将上述CA证书也作为载荷携带在电子签名中；在这种情况下，在需要对签约用户的电子签名进行验证时，可以基于CA机构的公钥对上述电子签名中携带 的CA证书进行解密，获得上述签约用户的公钥，然后基于上述签约用户的公钥对电子签名进行验证即可，而不再需要单独查询上述签约用户的公钥。
请继续参见图3，当完成针对上述电子签名的原始内容的电子签名操作后，上述智能合约可以生成一笔用于指示上述签约用户已完成对上述电子合同进行电子签名操作的签名记录，并基于该签名记录构建一笔交易，在上述存证链上进行发布，由上述存证链上的节点设备对该交易共识处理后，在上述存证链上进行存储，以便于电子合约系统后续可以对签约用户本次对该电子合同的电子签名操作进行追溯查询。
通过以上技术方案，一方面，由于用户可以通过调用智能合约的方式，来触发智能合约从区块链中读取与签约用户对应的CA证书，并基于读取到的CA证书对电子文书进行电子签名操作；因此，可以避免由用户手动对电子文书进行签名，简化电子签名操作的复杂度；
另一方面，由于签约用户的CA证书被预先存储至区块链，并且区块链上的CA证书，只能由智能合约来统一使用，因此可以避免非法的第三方用户通过冒用签约用户的CA证书的方式，在违背签约用户的意愿的情况下，使用签约用户的CA证书对电子文书进行电子签名操作，可以提升对电子文书进行电子签名操作时的安全等级。
与上述方法实施例相对应，本说明书还提供了一种基于区块链的电子签名装置的实施例。本说明书的基于区块链的电子签名装置的实施例可以应用在电子设备上。装置实施例可以通过软件实现，也可以通过硬件或者软硬件结合的方式实现。以软件实现为例，作为一个逻辑意义上的装置，是通过其所在电子设备的处理器将非易失性存储器中对应的计算机程序指令读取到内存中运行形成的。从硬件层面而言，如图4所示，为本说明书的基于区块链的电子签名装置所在电子设备的一种硬件结构图，除了图4所示的处理器、内存、网络接口、以及非易失性存储器之外，实施例中装置所在的电子设备通常根据该电子设备的实际功能，还可以包括其他硬件，对此不再赘述。
图5是本说明书一示例性实施例示出的一种基于区块链的电子签名装置的框图。
请参考图5，所述基于区块链的电子签名装置50可以应用在前述图3所示的电子设备中，包括有：接收模块501和签名模块502。
接收模块501，接收签约用户通过客户端发起的目标交易；其中，所述目标交易用于触发对目标电子文书进行电子签名操作；与所述签约用户对应的CA证书被预先存储至所述区块链；
签名模块502，响应于所述目标交易，调用与电子签名对应的智能合约，执行所述智能合约中声明的电子签名程序，从区块链中读取与所述签约用户对应的CA证书；以及，基于所述CA证书对所述目标电子文书进行电子签名操作。
在本实施例中，所述区块链中存储的所述CA证书，被预设了限制所述签约用户以外的用户账户进行访问的访问权限；
所述签名模块502：
确定所述目标交易中是否包括所述签约用户对所述目标文本进行电子签名的授权信息；其中，所述授权信息用于指示将所述CA证书的访问权限授权给所述智能合约；
如果所述目标交易中包括所述授权信息，则触发调用与电子签名对应的智能合约。
在本实施例中，所述签名模块502进一步：
如果所述目标交易中包括所述授权信息，进一步确定所述目标交易是否被成功存储至所述区块链；如果是，则触发调用与电子签名对应的智能合约。
在本实施例中，所述目标电子文书被预先存储至区块链；其中，所述区块链中存储的所述目标电子文书，被预设了限制所述智能合约以外的用户账户进行访问的访问权限；
所述签名模块502：
从所述区块链中读取所述目标电子文书；
基于所述CA证书对读取到的所述目标电子文书进行电子签名操作。
在本实施例中，所述CA证书包括所述签约用户的私钥；
所述签名模块502：
基于所述CA证书中的所述签约用户的私钥，对读取到的所述目标电子文书进行电子签名操作
在本实施例中，所述区块链包括主链以及若干子链；所述若干子链包括用于存储所述目标电子文书的访问地址的第一子链，以及用于存储所述目标电子文书的原始内容的第二子链；
所述签名模块502进一步：
从所述第一子链中读取所述目标电子文书的访问地址；
基于所述目标电子文书的访问地址从所述第二子链中读取所述目标电子文书的原始内容。
在本实施例中，所述若干子链还包括用于于存储所述CA证书的第三子链；
所述签名模块502进一步：
从所述第三子链中读取与所述签约用户对应的CA证书。
在本实施例中，所述目标电子文书为电子合同。
上述装置中各个模块的功能和作用的实现过程具体详见上述方法中对应步骤的实现过程，在此不再赘述。
对于装置实施例而言，由于其基本对应于方法实施例，所以相关之处参见方法实施例的部分说明即可。以上所描述的装置实施例仅仅是示意性的，其中所述作为分离部件说明的模块可以是或者也可以不是物理上分开的，作为模块显示的部件可以是或者也可以不是物理模块，即可以位于一个地方，或者也可以分布到多个网络模块上。可以根据实际的需要选择其中的部分或者全部模块来实现本说明书方案的目的。本领域普通技术人员在不付出创造性劳动的情况下，即可以理解并实施。
上述实施例阐明的系统、装置、模块或模块，具体可以由计算机芯片或实体实现，或者由具有某种功能的产品来实现。一种典型的实现设备为计算机，计算机的具体形式可以是个人计算机、膝上型计算机、蜂窝电话、相机电话、智能电话、个人数字助理、媒体播放器、导航设备、电子邮件收发设备、游戏控制台、平板计算机、可穿戴设备或者这些设备中的任意几种设备的组合。
与上述方法实施例相对应，本说明书还提供了一种电子设备的实施例。该电子设备包括：处理器以及用于存储机器可执行指令的存储器；其中，处理器和存储器通常通过内部总线相互连接。在其他可能的实现方式中，所述设备还可能包括外部接口，以能够与其他设备或者部件进行通信。
在本实施例中，通过读取并执行所述存储器存储的与基于区块链的电子签名的控制逻辑对应的机器可执行指令，所述处理器被促使：
接收签约用户通过客户端发起的目标交易；其中，所述目标交易用于触发对目标电子文书进行电子签名操作；与所述签约用户对应的CA证书被预先存储至所述区块 链；
响应于所述目标交易，调用与电子签名对应的智能合约，执行所述智能合约中声明的电子签名程序，从区块链中读取与所述签约用户对应的CA证书；以及，
基于所述CA证书对所述目标电子文书进行电子签名操作。
在本实施例中，所述区块链中存储的所述CA证书，被预设了限制所述签约用户以外的用户账户进行访问的访问权限；
通过读取并执行所述存储器存储的与基于区块链的电子签名的控制逻辑对应的机器可执行指令，所述处理器被促使：
确定所述目标交易中是否包括所述签约用户对所述目标文本进行电子签名的授权信息；其中，所述授权信息用于指示将所述CA证书的访问权限授权给所述智能合约；
如果所述目标交易中包括所述授权信息，则触发调用与电子签名对应的智能合约。
在本实施例中，通过读取并执行所述存储器存储的与基于区块链的电子签名的控制逻辑对应的机器可执行指令，所述处理器被促使：
如果所述目标交易中包括所述授权信息，进一步确定所述目标交易是否被成功存储至所述区块链；如果是，则触发调用与电子签名对应的智能合约。
在本实施例中，所述目标电子文书被预先存储至区块链；其中，所述区块链中存储的所述目标电子文书，被预设了限制所述智能合约以外的用户账户进行访问的访问权限；
通过读取并执行所述存储器存储的与基于区块链的电子签名的控制逻辑对应的机器可执行指令，所述处理器被促使：
从所述区块链中读取所述目标电子文书；
基于所述CA证书对读取到的所述目标电子文书进行电子签名操作。
在本实施例中，所述CA证书包括所述签约用户的私钥；
通过读取并执行所述存储器存储的与基于区块链的电子签名的控制逻辑对应的机器可执行指令，所述处理器被促使：
基于所述CA证书中的所述签约用户的私钥，对读取到的所述目标电子文书进 行电子签名操作。
在本实施例中，所述区块链包括主链以及若干子链；所述若干子链包括用于存储所述目标电子文书的访问地址的第一子链，以及用于存储所述目标电子文书的原始内容的第二子链；
通过读取并执行所述存储器存储的与基于区块链的电子签名的控制逻辑对应的机器可执行指令，所述处理器被促使：
从所述第一子链中读取所述目标电子文书的访问地址；
基于所述目标电子文书的访问地址从所述第二子链中读取所述目标电子文书的原始内容。
在本实施例中，所述若干子链还包括用于于存储所述CA证书的第三子链；
通过读取并执行所述存储器存储的与基于区块链的电子签名的控制逻辑对应的机器可执行指令，所述处理器被促使：
从所述第三子链中读取与所述签约用户对应的CA证书。
本领域技术人员在考虑说明书及实践这里公开的发明后，将容易想到本说明书的其它实施方案。本说明书旨在涵盖本说明书的任何变型、用途或者适应性变化，这些变型、用途或者适应性变化遵循本说明书的一般性原理并包括本说明书未公开的本技术领域中的公知常识或惯用技术手段。说明书和实施例仅被视为示例性的，本说明书的真正范围和精神由下面的权利要求指出。
应当理解的是，本说明书并不局限于上面已经描述并在附图中示出的精确结构，并且可以在不脱离其范围进行各种修改和改变。本说明书的范围仅由所附的权利要求来限制。
以上所述仅为本说明书的较佳实施例而已，并不用以限制本说明书，凡在本说明书的精神和原则之内，所做的任何修改、等同替换、改进等，均应包含在本说明书保护的范围之内。

Claims (17)

  1. 一种基于区块链的电子签名方法，所述方法包括：
    接收签约用户通过客户端发起的目标交易；其中，所述目标交易用于触发对目标电子文书进行电子签名操作；与所述签约用户对应的CA证书被预先存储至所述区块链；
    响应于所述目标交易，调用与电子签名对应的智能合约，执行所述智能合约中声明的电子签名程序，从区块链中读取与所述签约用户对应的CA证书；以及，
    基于所述CA证书对所述目标电子文书进行电子签名操作。
  2. 根据权利要求1所述的方法，所述区块链中存储的所述CA证书，被预设了限制所述签约用户以外的用户账户进行访问的访问权限；
    所述调用与电子签名对应的智能合约，包括：
    确定所述目标交易中是否包括所述签约用户对所述目标文本进行电子签名的授权信息；其中，所述授权信息用于指示将所述CA证书的访问权限授权给所述智能合约；
    如果所述目标交易中包括所述授权信息，则触发调用与电子签名对应的智能合约。
  3. 根据权利要求2所述的方法，所述如果所述目标交易中包括所述授权信息，则触发调用与电子签名对应的智能合约，包括：
    如果所述目标交易中包括所述授权信息，进一步确定所述目标交易是否被成功存储至所述区块链；如果是，则触发调用与电子签名对应的智能合约。
  4. 根据权利要求3所述的方法，所述目标电子文书被预先存储至区块链；其中，所述区块链中存储的所述目标电子文书，被预设了限制所述智能合约以外的用户账户进行访问的访问权限；
    所述基于所述CA证书对所述目标电子文书进行电子签名操作，包括：
    从所述区块链中读取所述目标电子文书；
    基于所述CA证书对读取到的所述目标电子文书进行电子签名操作。
  5. 根据权利要求4所述的方法，所述CA证书包括所述签约用户的私钥；
    所述基于所述CA证书对读取到的所述目标电子文书进行电子签名操作，包括：基于所述CA证书中的所述签约用户的私钥，对读取到的所述目标电子文书进行电子签名操作。
  6. 根据权利要求5所述的方法，所述区块链包括主链以及若干子链；所述若干子链包括用于存储所述目标电子文书的访问地址的第一子链，以及用于存储所述目标电子文书的原始内容的第二子链；
    所述从所述区块链中读取所述目标电子文书，包括：
    从所述第一子链中读取所述目标电子文书的访问地址；
    基于所述目标电子文书的访问地址从所述第二子链中读取所述目标电子文书的原始内容。
  7. 根据权利要求5所述的方法，所述若干子链还包括用于于存储所述CA证书的第三子链；
    所述从区块链中读取与所述签约用户对应的CA证书，包括：
    从所述第三子链中读取与所述签约用户对应的CA证书。
  8. 根据权利要求1所述的方法，所述目标电子文书为电子合同。
  9. 一种基于区块链的电子签名装置，所述装置包括：
    接收模块，接收签约用户通过客户端发起的目标交易；其中，所述目标交易用于触发对目标电子文书进行电子签名操作；与所述签约用户对应的CA证书被预先存储至所述区块链；
    签名模块，响应于所述目标交易，调用与电子签名对应的智能合约，执行所述智能合约中声明的电子签名程序，从区块链中读取与所述签约用户对应的CA证书；以及，基于所述CA证书对所述目标电子文书进行电子签名操作。
  10. 根据权利要求9所述的装置，所述区块链中存储的所述CA证书，被预设了限制所述签约用户以外的用户账户进行访问的访问权限；
    所述签名模块：
    确定所述目标交易中是否包括所述签约用户对所述目标文本进行电子签名的授权信息；其中，所述授权信息用于指示将所述CA证书的访问权限授权给所述智能合约；
    如果所述目标交易中包括所述授权信息，则触发调用与电子签名对应的智能合约。
  11. 根据权利要求10所述的装置，所述签名模块进一步：
    如果所述目标交易中包括所述授权信息，进一步确定所述目标交易是否被成功存储至所述区块链；如果是，则触发调用与电子签名对应的智能合约。
  12. 根据权利要求11所述的装置，所述目标电子文书被预先存储至区块链；其中，所述区块链中存储的所述目标电子文书，被预设了限制所述智能合约以外的用户账户进行访问的访问权限；
    所述签名模块：
    从所述区块链中读取所述目标电子文书；
    基于所述CA证书对读取到的所述目标电子文书进行电子签名操作。
  13. 根据权利要求12所述的装置，所述CA证书包括所述签约用户的私钥；
    所述签名模块：
    基于所述CA证书中的所述签约用户的私钥，对读取到的所述目标电子文书进行电子签名操作。
  14. 根据权利要求13所述的装置，所述区块链包括主链以及若干子链；所述若干子链包括用于存储所述目标电子文书的访问地址的第一子链，以及用于存储所述目标电子文书的原始内容的第二子链；
    所述签名模块进一步：
    从所述第一子链中读取所述目标电子文书的访问地址；
    基于所述目标电子文书的访问地址从所述第二子链中读取所述目标电子文书的原始内容。
  15. 根据权利要求13所述的装置，所述若干子链还包括用于于存储所述CA证书的第三子链；
    所述签名模块进一步：
    从所述第三子链中读取与所述签约用户对应的CA证书。
  16. 根据权利要求9所述的装置，所述目标电子文书为电子合同。
  17. 一种电子设备，包括：
    处理器；
    用于存储机器可执行指令的存储器；
    其中，通过读取并执行所述存储器存储的与基于区块链的基于区块链的电子签名的控制逻辑对应的机器可执行指令，所述处理器被促使：
    接收签约用户通过客户端发起的目标交易；其中，所述目标交易用于触发对目标电子文书进行电子签名操作；与所述签约用户对应的CA证书被预先存储至所述区块链；
    响应于所述目标交易，调用与电子签名对应的智能合约，执行所述智能合约中声明的电子签名程序，从区块链中读取与所述签约用户对应的CA证书；以及，
    基于所述CA证书对所述目标电子文书进行电子签名操作。
PCT/CN2019/079885 2018-06-26 2019-03-27 基于区块链的电子签名方法及装置、电子设备 WO2020001103A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201810672943.7A CN108960825A (zh) 2018-06-26 2018-06-26 基于区块链的电子签名方法及装置、电子设备
CN201810672943.7 2018-06-26

Publications (1)

Publication Number Publication Date
WO2020001103A1 true WO2020001103A1 (zh) 2020-01-02

Family

ID=64487103

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/079885 WO2020001103A1 (zh) 2018-06-26 2019-03-27 基于区块链的电子签名方法及装置、电子设备

Country Status (3)

Country Link
CN (1) CN108960825A (zh)
TW (1) TWI694709B (zh)
WO (1) WO2020001103A1 (zh)

Families Citing this family (19)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108960825A (zh) * 2018-06-26 2018-12-07 阿里巴巴集团控股有限公司 基于区块链的电子签名方法及装置、电子设备
CN109818957B (zh) * 2019-01-25 2020-12-22 上海淳麒金融信息服务有限公司 基于可视化界面的智能合约调用方法、装置及系统
CN111901402A (zh) * 2019-02-19 2020-11-06 创新先进技术有限公司 区块链中实现隐私保护的方法、节点和存储介质
CN111612615A (zh) * 2019-02-26 2020-09-01 傲为信息技术(江苏)有限公司 基于公链的区块链子链创建方法及系统
CN109948351B (zh) * 2019-02-28 2023-12-05 深圳市元征科技股份有限公司 一种信息处理方法及装置
WO2019101231A2 (en) 2019-03-04 2019-05-31 Alibaba Group Holding Limited Methods and devices for processing certificates in blockchain system
CN110086608B (zh) * 2019-03-21 2022-03-25 深圳壹账通智能科技有限公司 用户认证方法、装置、计算机设备及计算机可读存储介质
CN109978543B (zh) * 2019-04-03 2022-03-22 恒生电子股份有限公司 一种合同签署的方法、装置、电子设备及存储介质
CN110059136A (zh) * 2019-04-17 2019-07-26 江苏全链通信息科技有限公司 基于域名区块链的信息存储方法、设备及存储介质
CN110287739B (zh) * 2019-06-17 2020-12-29 西安纸贵互联网科技有限公司 基于硬件私钥存储技术的数据安全管理方法及系统
CN110601858B (zh) * 2019-09-27 2021-05-28 腾讯科技（深圳）有限公司 证书管理方法及装置
CN110598460B (zh) * 2019-09-27 2022-08-05 腾讯科技（深圳）有限公司 基于区块链的电子签字方法、装置及存储介质
CN111010367B (zh) * 2019-11-07 2022-11-29 深圳市电子商务安全证书管理有限公司 数据存证方法、装置、计算机设备和存储介质
CN111626731A (zh) * 2020-04-10 2020-09-04 南京优物链科技有限公司 一种基于区块链技术的合同签约身份认证和签名系统
CN111460509B (zh) * 2020-04-16 2024-02-02 福建首众信息科技有限公司 一种基于区块链的电子签名应用方法
CN112258189A (zh) * 2020-12-03 2021-01-22 支付宝(杭州)信息技术有限公司 基于区块链的签约管理方法及装置和电子设备
CN112597545B (zh) * 2020-12-28 2024-04-12 山西云时代研发创新中心有限公司 一种基于区块链技术的医疗电子合同存证方法
CN113609527A (zh) * 2021-07-06 2021-11-05 微易签(杭州)科技有限公司 一种基于区块链创建数字签名的方法、系统及设备
CN114897527B (zh) * 2022-05-20 2023-03-14 西南交通大学 一种基于工作量证明实现商业保理债权价值的认证方法

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105893042A (zh) * 2016-03-31 2016-08-24 北京航空航天大学 一种基于区块链的智能合约的实现方法
CN106372941A (zh) * 2016-08-31 2017-02-01 江苏通付盾科技有限公司 基于区块链的ca认证管理方法、装置及系统
CN107171794A (zh) * 2017-06-27 2017-09-15 葛峰 一种基于区块链和智能合约的电子文书签署方法
CN107203368A (zh) * 2016-03-16 2017-09-26 蓝树荣 一种建立智能合约模型的方法
CN108960825A (zh) * 2018-06-26 2018-12-07 阿里巴巴集团控股有限公司 基于区块链的电子签名方法及装置、电子设备

Family Cites Families (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104506552B (zh) * 2015-01-05 2017-09-12 山东金佳园科技股份有限公司 一种信息系统安全监控及访问控制方法
RU2673842C1 (ru) * 2015-03-20 2018-11-30 Ривец Корп. Автоматическая аттестация сохранности устройства с применением цепочки блоков
WO2018087836A1 (ja) * 2016-11-09 2018-05-17 株式会社日立製作所 ブロックチェーン取引システムおよびブロックチェーン取引方法
CN107122673A (zh) * 2017-03-09 2017-09-01 深圳市金立通信设备有限公司 一种信息加密方法及终端
CN106960165B (zh) * 2017-03-13 2020-12-22 广东网金控股股份有限公司 一种基于区块链智能合约实现电子合同多方会签的方法
CN107347008A (zh) * 2017-06-30 2017-11-14 上海策赢网络科技有限公司 电子文书验证方法、设备及系统
CN107592293A (zh) * 2017-07-26 2018-01-16 阿里巴巴集团控股有限公司 区块链节点间通讯方法、数字证书管理方法、装置和电子设备
CN112865982A (zh) * 2017-07-26 2021-05-28 创新先进技术有限公司 数字证书管理方法、装置及电子设备
CN108197913B (zh) * 2017-12-18 2021-01-05 深圳前海微众银行股份有限公司 基于区块链的支付方法、系统以及计算机可读存储介质

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107203368A (zh) * 2016-03-16 2017-09-26 蓝树荣 一种建立智能合约模型的方法
CN105893042A (zh) * 2016-03-31 2016-08-24 北京航空航天大学 一种基于区块链的智能合约的实现方法
CN106372941A (zh) * 2016-08-31 2017-02-01 江苏通付盾科技有限公司 基于区块链的ca认证管理方法、装置及系统
CN107171794A (zh) * 2017-06-27 2017-09-15 葛峰 一种基于区块链和智能合约的电子文书签署方法
CN108960825A (zh) * 2018-06-26 2018-12-07 阿里巴巴集团控股有限公司 基于区块链的电子签名方法及装置、电子设备

Also Published As

Publication number Publication date
TW202002570A (zh) 2020-01-01
CN108960825A (zh) 2018-12-07
TWI694709B (zh) 2020-05-21

Similar Documents

Publication Publication Date Title
WO2020001104A1 (zh) 基于区块链的内容验证方法及装置、电子设备
WO2020001103A1 (zh) 基于区块链的电子签名方法及装置、电子设备
TWI701573B (zh) 基於區塊鏈的資料存證方法及裝置、電子設備
US11171782B2 (en) Identity and electronic signature verification in blockchain
US11533164B2 (en) System and method for blockchain-based cross-entity authentication
CN109951489B (zh) 一种数字身份认证方法、设备、装置、系统及存储介质
US10917246B2 (en) System and method for blockchain-based cross-entity authentication
US11170092B1 (en) Document authentication certification with blockchain and distributed ledger techniques
US11038883B2 (en) System and method for decentralized-identifier creation
TWI741314B (zh) 基於區塊鏈的資料存證方法及裝置、電子設備
US10915552B2 (en) Delegating credentials with a blockchain member service
US9740849B2 (en) Registration and authentication of computing devices using a digital skeleton key
US20190190723A1 (en) Authentication system and method, and user equipment, authentication server, and service server for performing same method
WO2020108114A1 (zh) 基于区块链的数据存证方法及装置、电子设备
TW201516733A (zh) 用以核對ｕｅｆｉ認證變量變化之系統及方法
US20200193420A1 (en) Data management systems and methods
WO2020258858A1 (zh) 块链式账本中的授权方法、系统、装置及设备
US11876915B2 (en) Method, apparatus, and computer-readable medium for authentication and authorization of networked data transactions
WO2021190197A1 (zh) 生物支付设备的认证方法、装置、计算机设备和存储介质
WO2020108130A1 (zh) 基于区块链的业务处理方法及装置、电子设备
CN116263834A (zh) 许可区块链的多发布者匿名证书
US20240112177A1 (en) Systems and methods for identity verification to authorize transactions in decentralized networks
TWM652839U (zh) 電子名片驗證系統
CN116167766A (zh) 一种资产通证化方法及相关装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19827109

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 19827109

Country of ref document: EP

Kind code of ref document: A1