CN112487778B

CN112487778B - Multi-user online signing system and method

Info

Publication number: CN112487778B
Application number: CN202011280123.7A
Authority: CN
Inventors: 丁彤; 田堃
Original assignee: China Citic Bank Corp Ltd
Current assignee: China Citic Bank Corp Ltd
Priority date: 2020-11-16
Filing date: 2020-11-16
Publication date: 2024-06-25
Anticipated expiration: 2040-11-16
Also published as: CN112487778A

Abstract

The invention discloses a multi-user online signing system and method.A business processing subsystem generates a contract file according to contract parameters and contract templates when receiving a signing instruction, a first client subsystem displays the contract file, a user confirms and completes a digital signature to obtain an electronic contract, the business processing subsystem randomly generates a secret key and obtains an encrypted ciphertext according to the secret key to generate a file to be processed, the file to be processed is encrypted according to a public key of a second client subsystem to obtain an encrypted data packet, the second client subsystem decrypts the encrypted data packet, and completes the signature after data verification of decrypted data, the business processing subsystem stores information in a block chain node after detecting that all contract signing parties complete a signing process, and the information of each link in the signing process can be conveniently queried in a block chain, so that the traceability of the signing process is improved, and the safety of online signing is further improved.

Description

Multi-user online signing system and method

Technical Field

The invention relates to the technical field of online signing, in particular to a multi-user online signing system and method.

Background

It is currently generally assumed that CA authorities are trusted and that digital certificates issued by CA authorities are both reliable and valid, but in practice digital certificates may come from counterfeit CA authorities or be cracked and tampered with during digital certificate issuance, and are extremely vulnerable to attacks from third parties. In addition, the traceability of the whole signing process is difficult to achieve by the existing signing technology, and each link of the signing process is not traceable, so that the electronic contract cannot be completely trusted and lacks of safety.

The foregoing is provided merely for the purpose of facilitating understanding of the technical solutions of the present invention and is not intended to represent an admission that the foregoing is prior art.

Disclosure of Invention

The invention mainly aims to provide a multi-user online signing system and method, and aims to solve the technical problems that links in signing process are not traceable and safety is lacking in the prior art.

In order to achieve the above object, the present invention provides a multi-user online subscription system, including: a business processing subsystem and a customer subsystem, the customer subsystem comprising: a first client subsystem and a second client subsystem;

the business processing subsystem is used for determining user identity information and business scene information according to a signing instruction when receiving the signing instruction, determining contract parameters and contract templates according to the user identity information and the business scene information, configuring the contract templates according to the contract parameters to obtain a contract file, and sending the contract file to the first client subsystem;

The first customer subsystem is further configured to display the contract file, obtain an electronic contract obtained after the user completes a digital signature based on the contract file, and send the electronic contract to the service processing subsystem;

The service processing subsystem is further used for randomly generating a secret key, obtaining an encrypted ciphertext through a symmetric encryption algorithm according to the secret key, generating a file to be processed according to the electronic contract, the encrypted ciphertext and the secret key, obtaining a public key corresponding to the second client subsystem, encrypting the file to be processed through an asymmetric encryption algorithm according to the public key, obtaining an encrypted data packet, and sending the encrypted data packet to the second client subsystem;

the second client subsystem is used for decrypting the encrypted data packet to obtain decrypted data, carrying out data verification on the decrypted data, extracting contract plaintext from the decrypted data when verification passes, calling a digital certificate based on the contract plaintext to complete signature, stamping a time stamp, and uploading the signature to a distributed account book;

the business processing subsystem is also used for storing the information in the signing process into the blockchain node after detecting that all contract signing parties complete the signing process.

Optionally, the multi-user online subscription system further comprises a PKI subsystem;

the client subsystem is used for carrying out user registration according to a registration request when receiving the registration request input by a user, carrying out real-name authentication after the registration is completed, and displaying authentication passing information when the real-name authentication is passed;

The client subsystem is further used for sending the certificate application request and the biological characteristic information to the service processing subsystem when receiving the certificate application request and the biological characteristic information input by a user;

the service processing subsystem is used for determining personal information of a user according to the certificate application request, carrying out validity verification on the personal information of the user and the biological characteristic information, generating a certificate issuing instruction when the validity verification passes, and sending the certificate issuing instruction to the PKI subsystem;

the PKI subsystem is further used for searching a CA (certificate authority) mechanism based on the certificate issuing instruction, issuing a digital certificate for a user and a server by the CA mechanism, and storing user identity information and a public key of user real-name authentication in a blockchain;

the service processing subsystem is further used for acquiring user identity information from the blockchain according to the signing instruction when receiving the signing instruction, and determining service scene information according to the signing instruction.

Optionally, the first client subsystem is further configured to display the contract document, so that a user browses the contract document and performs a digital signature operation after confirming that the contract information in the contract document is correct;

The first client subsystem is further configured to digitally sign the contract document based on a digital signature operation of a user, obtain an electronic contract, store a signing process, the electronic contract and a context in a distributed ledger, and send the electronic contract to a business processing subsystem for verification.

Optionally, the service processing subsystem is further configured to verify the electronic contract, obtain a server digital certificate from a blockchain when the verification passes, complete signing according to the server digital certificate, obtain a hash value through a hash encryption algorithm, use the hash value as a digital fingerprint of the electronic contract, and encrypt the electronic contract according to the digital fingerprint to obtain an encrypted electronic contract;

the service processing subsystem is also used for randomly generating a 128-bit key, obtaining an encrypted ciphertext through a symmetric encryption algorithm according to the key, and generating a file to be processed according to the encrypted electronic contract, the hash value, the encrypted ciphertext and the key;

The service processing subsystem is further configured to obtain a public key corresponding to the second client subsystem from the blockchain, encrypt the file to be processed according to the public key through an asymmetric encryption algorithm, and obtain an encrypted data packet.

Optionally, the second client subsystem is further configured to obtain a private key corresponding to the public key, decrypt the encrypted data packet according to the private key to obtain decrypted data, extract an electronic contract, a hash value, an encrypted ciphertext and a secret key from the decrypted data, perform data verification on the hash value, the encrypted ciphertext and the secret key, and extract a contract plaintext from the electronic contract when verification passes;

the second client subsystem is further used for displaying the contract plaintext, so that a user browses the contract plaintext, digital signature operation is performed after the contract information in the contract plaintext is confirmed to be correct, and digital certificate is called to complete signature based on the digital signature operation of the user.

In addition, in order to achieve the above objective, the present invention further provides a multi-user online signing method, where the multi-user online signing method is based on a multi-user online signing system, and the multi-user online signing system includes: a business processing subsystem and a customer subsystem, the customer subsystem comprising: the multi-user online signing method comprises the following steps of:

When receiving a signing instruction, the service processing subsystem determines user identity information and service scene information according to the signing instruction, determines contract parameters and contract templates according to the user identity information and the service scene information, configures the contract templates according to the contract parameters to obtain a contract file, and sends the contract file to the first client subsystem;

The first client terminal system displays the contract file, acquires an electronic contract obtained after the user completes digital signature based on the contract file, and sends the electronic contract to the service processing subsystem;

The service processing subsystem randomly generates a secret key, obtains an encrypted ciphertext through a symmetric encryption algorithm according to the secret key, generates a file to be processed according to the electronic contract, the encrypted ciphertext and the secret key, acquires a public key corresponding to the second client subsystem, encrypts the file to be processed through an asymmetric encryption algorithm according to the public key, obtains an encrypted data packet, and sends the encrypted data packet to the second client subsystem;

The second client subsystem decrypts the encrypted data packet to obtain decrypted data, performs data verification on the decrypted data, extracts contract plaintext from the decrypted data when verification passes, invokes a digital certificate based on the contract plaintext to complete signature, and adds a time stamp and uploads the signature to a distributed account book;

And the business processing subsystem stores information in the signing process into the blockchain node after detecting that all contract signing parties complete the signing process.

When receiving a signing instruction, the service processing subsystem determines user identity information and service scene information according to the signing instruction, determines contract parameters and contract templates according to the user identity information and the service scene information, configures the contract templates according to the contract parameters to obtain a contract file, and before sending the contract file to the first client terminal system, the service processing subsystem further comprises:

When receiving a registration request input by a user, the client terminal system carries out user registration according to the registration request, carries out real-name authentication after the registration is completed, and displays authentication passing information when the real-name authentication is passed;

The client subsystem sends a certificate application request and biological characteristic information to the service processing subsystem when receiving the certificate application request and the biological characteristic information input by a user;

The service processing subsystem determines personal information of a user according to the certificate application request, performs validity verification on the personal information of the user and the biological characteristic information, generates a certificate issuing instruction when the validity verification passes, and sends the certificate issuing instruction to the PKI subsystem;

the PKI subsystem searches a CA (certificate authority) based on the certificate issuing instruction, the CA issues a digital certificate for a user and a server, and user identity information and a public key of user real-name authentication are stored in a blockchain;

Correspondingly, when receiving a signing instruction, the service processing subsystem determines user identity information and service scene information according to the signing instruction, and comprises the following steps:

And when receiving a signing instruction, the service processing subsystem acquires user identity information from the blockchain according to the signing instruction, and determines service scene information according to the signing instruction.

Optionally, the first client subsystem displays the contract document, obtains an electronic contract obtained after the user completes digital signature based on the contract document, and sends the electronic contract to the service processing subsystem, including:

The first client terminal system displays the contract file so that a user browses the contract file and performs digital signature operation after confirming that the contract information in the contract file is correct;

The first customer subsystem digitally signs the contract document based on a digital signature operation of the user, obtains an electronic contract, stores the signing process, the electronic contract and the context in a distributed ledger, and sends the electronic contract to a business processing subsystem for verification.

Optionally, the service processing subsystem randomly generates a key, obtains an encrypted ciphertext through a symmetric encryption algorithm according to the key, generates a file to be processed according to the electronic contract, the encrypted ciphertext and the key, obtains a public key corresponding to the second client subsystem, encrypts the file to be processed through an asymmetric encryption algorithm according to the public key, obtains an encrypted data packet, and before sending the encrypted data packet to the second client subsystem, the method further includes:

The service processing subsystem verifies the electronic contract, acquires a server digital certificate from a blockchain when the verification passes, completes signature according to the server digital certificate, obtains a hash value through a hash encryption algorithm, takes the hash value as a digital fingerprint of the electronic contract, encrypts the electronic contract according to the digital fingerprint, and obtains an encrypted electronic contract;

Correspondingly, the service processing subsystem randomly generates a key, obtains an encrypted ciphertext through a symmetric encryption algorithm according to the key, generates a file to be processed according to the electronic contract, the encrypted ciphertext and the key, obtains a public key corresponding to the second client subsystem, encrypts the file to be processed through an asymmetric encryption algorithm according to the public key, and obtains an encrypted data packet, and the method comprises the following steps:

The service processing subsystem randomly generates a 128-bit key, obtains an encrypted ciphertext through a symmetric encryption algorithm according to the key, and generates a file to be processed according to the encrypted electronic contract, the hash value, the encrypted ciphertext and the key;

and the service processing subsystem acquires a public key corresponding to the second client subsystem from the blockchain, encrypts the file to be processed through an asymmetric encryption algorithm according to the public key, and acquires an encrypted data packet.

Optionally, the second client subsystem decrypts the encrypted data packet to obtain decrypted data, performs data verification on the decrypted data, extracts a contract plaintext from the decrypted data when verification passes, and invokes a digital certificate based on the contract plaintext to complete signature, including:

The second client subsystem obtains a private key corresponding to the public key, decrypts the encrypted data packet according to the private key to obtain decrypted data, extracts an electronic contract, a hash value, an encrypted ciphertext and a secret key from the decrypted data, performs data verification on the hash value, the encrypted ciphertext and the secret key, and extracts a contract plaintext from the electronic contract when verification passes;

and the second client subsystem displays the contract plaintext so that a user browses the contract plaintext, performs digital signature operation after confirming contract information in the contract plaintext, and calls a digital certificate to complete signature based on the digital signature operation of the user.

The multi-user online signing system provided by the invention comprises: a business processing subsystem and a customer subsystem, the customer subsystem comprising: the system comprises a first client subsystem and a second client subsystem, wherein when a signing instruction is received, a business processing subsystem determines contract parameters and contract templates according to the signing instruction and generates a contract file, the first client subsystem displays the contract file, a user confirms and completes digital signature to obtain an electronic contract, the business processing subsystem randomly generates a secret key and obtains an encryption ciphertext according to the secret key, generates a file to be processed according to the electronic contract, the encryption ciphertext and the secret key, encrypts the file to be processed according to a public key of the second client subsystem to obtain an encryption data packet, the second client subsystem decrypts the encryption data packet, verifies the decryption data and completes signature after detecting all contract signing parties, the business processing subsystem stores information in a signing process into a blockchain node, and can conveniently inquire information of each link in the signing process in a blockchain, so that traceability of the signing process is improved, and safety of online signing is further improved.

Drawings

FIG. 1 is a schematic diagram of a functional module of a first embodiment of the multi-user online subscription system of the present invention;

FIG. 2 is a flow chart of a first embodiment of the multi-user online subscription method of the present invention;

Fig. 3 is a flowchart of a second embodiment of the multi-user online subscription method of the present invention.

The achievement of the objects, functional features and advantages of the present invention will be further described with reference to the accompanying drawings, in conjunction with the embodiments.

Detailed Description

It should be understood that the specific embodiments described herein are for purposes of illustration only and are not intended to limit the scope of the invention.

Referring to fig. 1, fig. 1 is a schematic functional block diagram of a first embodiment of a multi-user online subscription system according to the present invention. The multi-user online signing system comprises: a business processing subsystem 10 and a customer subsystem 20, said customer subsystem 20 comprising: a first client subsystem and a second client subsystem;

The service processing subsystem 10 is configured to determine, when receiving a subscription instruction, user identity information and service scenario information according to the subscription instruction, determine a contract parameter and a contract template according to the user identity information and the service scenario information, configure the contract template according to the contract parameter, obtain a contract file, and send the contract file to the first client subsystem.

It should be noted that PKI (PublicKeyInfrastruture, public key infrastructure) is the basis and core of security implementation of network-based applications (e.g. online banking, e-commerce), and adopts digital certificate authentication technology, and guarantees secure transmission of information by using an x.509 standard digital certificate provided by CA (CertificateAuthority ), so as to realize validity and integrity of data. Conventional PKI assumes that the CA institution is completely trusted, however in practice security and privacy events caused by counterfeit or corrupted CAs are endless, and in order to solve these problems, researchers have proposed various technical solutions such as independent key encryption technology, increasing certificate transparency, and the like.

The blockchain (Blockchain) is essentially a shared, non-tamperable "distributed ledger" consisting of an ever-growing list of blocks, a data structure that records the transaction information of each block node over a period of time, each block being linked to the previous block by a hash algorithm, so that the data stored in the block is intrinsically secure from tampering. The blockchain is based on key technologies such as distributed data storage, a consensus mechanism, an encryption algorithm and the like, realizes cooperative trust and consistent action among a plurality of main bodies, solves the problem of information asymmetry, and has the characteristics of whole-course trace, traceability, openness and transparency and the like.

The embodiment provides a novel PKI architecture with certificate transparency based on a blockchain technology, provides a unique and effective certificate verification process, and avoids fake certificates issued by a fake CA organization, thereby eliminating malicious attacks from a third party. The multi-user online signing system and method based on the framework stores digital certificates, user identity information, keys, electronic contract information and the like which are related in the signing process in a distributed account book, all data are shared by all participants, and the information of a network space is more transparent, so that the complete and compliant contract signing flow and data authentication and the integrity, confidentiality and non-repudiation of the data are realized. By providing a valid, trusted certificate verification process, traditional inappropriateness and incompatibility caused by different software vendor implementations is eliminated.

In this embodiment, the x.509 certificate management is implemented using a distributed ledger technique, using a distributed ledger of blockchain to manage x.509 digital certificates issued by CA authorities, accurately detect any improper behavior of PKI participants while maintaining the existing PKI infrastructure, with the following specific solutions: all users in the blockchain, including individual users, group organizations and CA institutions, check the validity of the digital certificate; the structure of the checking stage must be stored in the distributed account book for sharing after the consensus of all users; the content stored in the ledger must remain unchanged and tamper resistant.

The blockchain manages x.509 certificates that verify membership and role of users by executing intelligent contracts, accessing ledger data, and only users who possess digital certificates issued by one of the CA authorities configured in the blockchain can launch intelligent contracts, each user possessing private keys and public certificates issued by the blockchain. The blockchain used includes 3 classes of peer entities:

(1) Client side: establishing a secure connection based on TLS (TransportLayerSecurity, transport layer security protocol) with a server, and receiving a server certificate;

(2) And (3) a server: when a server issues a new certificate or cancels a certificate, synchronously issuing or canceling the certificate for a client;

(3) CA certification authority: is responsible for issuing and revoking X.509 digital certificates and for checking the validity of public keys in PKI systems.

In this embodiment a new consensus algorithm is also proposed, considering that the goal is to prove to the user/client that an X.509 public key certificate was received (i.e. the protocol from the server is valid (correctly sent out, not stolen, not cracked) and therefore even a small delay (20 seconds) is not acceptable-according to this requirement the new consensus algorithm has the feature that the nodes participating in the consensus are a random subset of all nodes connected to the blockchain-this assumption is followed by two reasons-firstly, that we need to do certificate verification quickly, and secondly, that the authentication must be secure-random choices of peer nodes can protect them from attacks, since no one knows who will do certificate verification in the next subset-implementation details are as follows:

Assuming that the server is S, the X.509 digital certificate issued by the CA authority to the server is CA, and the ith client Ci is associated with the blockchain ith peer node. When the intelligent contract checks that the certificate validity returns to TRUE or FALSE, ci accepts/rejects the CA certificate issued by S, which means that other nodes in the random node set selected by the consensus algorithm all participate in the consensus and give the result TRUE or FALSE, and writes the positive/negative attribute of the (S, CA) pair into the distributed ledger. When Ci connects to a fake server S, the intelligent contract verifies the validity of its certificate, determines the positive/negative attribute of (S, CA'):

(1) Returning FALSE, a negative attribute, when there is a (S, CA') pair in the ledger and there is a negative attribute;

(2) When the account book has the (S, CA) pair and has the positive attribute, judging that the (S, CA') pair is the negative attribute, and returning FALSE, namely the negative attribute;

(3) And when the account book has no relevant record, entering a consensus phase.

It should be appreciated that for the smart contract verification process in this embodiment to verify the validity of a certificate, the required parameters are a public key certificate, a server domain name, and a server IP. The status of certificates within the blockchain may be determined by other smart contracts (i.e., when a CA revokes a certificate, information will be stored in the blockchain using a particular smart contract). The detailed steps are as follows:

(1) The intelligence closes up to the local check tuple, in particular the (certificate, domain name) tuple, to see if the certificate is misformatted, if the issued digital certificate is authentic, and if other static and structural checks are completed. If the execution return status of the smart contract is FALSE, EXPIRED, or MALFORM (fake), all indicate that the check result is FALSE and add a simple log to the blockchain.

(2) The intelligent contract checks whether the tuple (certificate, domain name, IP address) is already present in the blockchain. The following cases indicate that a tuple is already in the blockchain:

(a) Certificates and servers exist in the blockchain and tuples are written in a certificate issuing event;

(b) Tuples are marked as revoked or expired;

(c) The tuples were checked in the past, resulting in TRUE/FALSE;

(d) The tuples (certificate, domain name, IP) are in the blockchain, the IP addresses are different and have TRUE/FALSE authentication results.

It should be understood that the client sub-system 20 in this embodiment includes a first client sub-system and a second client sub-system, where the first client sub-system and the second client sub-system correspond to a contract signing party in a signing process, for example, the user a and the user b are about to sign up online, and the terminal device used by the user a may be used as the first client sub-system and the terminal device used by the user b may be used as the second client sub-system. Meanwhile, when signing up, there may be more than two users, but there are a plurality of users, for example, when user a signs up online with user b and user d, the terminal device used by user a may be used as the first client subsystem, and the terminal device used by user b and user d may be used as the second client subsystem. Further, there can be other cases where the number of users makes an online subscription, that is, the number of the first client sub-system and the second client sub-system is not fixed, in addition to the two cases listed above, which is not limited in this embodiment.

It may be appreciated that, upon receiving the subscription instruction, the service processing subsystem 10 determines user identity information and service scenario information according to the subscription instruction, determines contract parameters and contract templates according to the user identity information and the service scenario information, and configures the contract templates according to the contract parameters to obtain a contract document. In a specific implementation, different contract templates may be preset according to different service scenarios, for example, the mortgage loan scenario corresponds to the mortgage loan contract template, the bank financial service scenario corresponds to the bank financial contract template, and the embodiment is not limited thereto.

The first customer subsystem is further configured to display the contract document, obtain an electronic contract obtained after the user completes a digital signature based on the contract document, and send the electronic contract to the service processing subsystem 10.

It should be appreciated that the first customer subsystem may present the contract document to the user for viewing, the user completes the digital signature to obtain the electronic contract after confirming the contract information in the contract document, and the electronic contract is sent to the business process subsystem 10.

Further, the first client terminal system is further configured to display the contract document, so that a user browses the contract document and performs a digital signature operation after confirming that the contract information in the contract document is correct; the first client subsystem is further configured to digitally sign the contract document based on a digital signature operation of the user, obtain an electronic contract, store a signing process, the electronic contract and a context in a distributed ledger, and send the electronic contract to the service processing subsystem 10 for verification.

It can be understood that the first client subsystem can display the same file, the user can browse the displayed contract file and confirm whether the contract information in the contract file has problems, and after confirming that the contract information has problems, the first client subsystem performs digital signature on the same file in response to the digital signature operation of the user, so as to obtain an electronic contract, wherein the electronic contract can be the contract file after the digital signature is completed. At the same time, the signing process, electronic contract and context may also be stored in a distributed ledger and the electronic contract sent to the business processing subsystem 10 for verification.

The service processing subsystem 10 is further configured to randomly generate a key, obtain an encrypted ciphertext according to the key through a symmetric encryption algorithm, generate a file to be processed according to the electronic contract, the encrypted ciphertext and the key, obtain a public key corresponding to the second client subsystem, encrypt the file to be processed according to the public key through an asymmetric encryption algorithm, obtain an encrypted data packet, and send the encrypted data packet to the second client subsystem.

It should be understood that the service processing subsystem 10 may randomly generate a key, obtain an encrypted ciphertext according to the key through a symmetric encryption algorithm, generate a file to be processed according to an electronic contract, the encrypted ciphertext and the key, then obtain a public key corresponding to the second client subsystem, encrypt the public key to obtain an encrypted data packet, and improve the security of data verification in a multiple encryption manner.

Further, in order to further improve the security of the data, the electronic contract may be encrypted by combining with a hash value on the basis of the multiple encryption, and the service processing subsystem 10 is further configured to verify the electronic contract, obtain a server digital certificate from a blockchain when the verification passes, complete the signature according to the server digital certificate, obtain a hash value through a hash encryption algorithm, use the hash value as a digital fingerprint of the electronic contract, and encrypt the electronic contract according to the digital fingerprint to obtain an encrypted electronic contract;

the service processing subsystem 10 is further configured to randomly generate a 128-bit key, obtain an encrypted ciphertext according to the key through a symmetric encryption algorithm, and generate a file to be processed according to the encrypted electronic contract, the hash value, the encrypted ciphertext and the key;

The service processing subsystem 10 is further configured to obtain a public key corresponding to the second client subsystem from the blockchain, encrypt the file to be processed according to the public key through an asymmetric encryption algorithm, and obtain an encrypted data packet.

It should be understood that, after receiving the electronic contract signed by the initiator and completing verification, the service processing subsystem 10 obtains a server digital certificate from the blockchain, completes signing according to the server digital certificate, obtains a hash value through a hash encryption algorithm, encrypts the electronic contract as a data fingerprint of the electronic contract, and obtains a confidential electronic contract.

It should be understood that the service processing subsystem 10 may randomly generate 128-bit keys, obtain encrypted ciphertexts through a symmetric encryption algorithm, integrate the encrypted electronic contracts, hash values, encrypted ciphertexts and keys to form a to-be-processed file, obtain the public key of the receiver to encrypt, and complete encryption through an asymmetric encryption algorithm to obtain a final encrypted data packet.

The second client subsystem is used for decrypting the encrypted data packet to obtain decrypted data, carrying out data verification on the decrypted data, extracting contract plaintext from the decrypted data when verification passes, calling a digital certificate based on the contract plaintext to complete signature, stamping a time stamp, and uploading the signature to a distributed account book.

It should be appreciated that the second client subsystem may decrypt the encrypted data packet to obtain encrypted data, and when the data verification passes, extract the contract plaintext from the decrypted data to present the user, invoke the digital certificate to complete the signature, time stamp, and upload to the distributed ledger.

Further, the second client subsystem is further configured to obtain a private key corresponding to the public key, decrypt the encrypted data packet according to the private key, obtain decrypted data, extract an electronic contract, a hash value, an encrypted ciphertext and a secret key from the decrypted data, perform data verification on the hash value, the encrypted ciphertext and the secret key, and extract a contract plaintext from the electronic contract when verification passes;

It should be understood that the second client subsystem may search the private key corresponding to the public key, decrypt the encrypted data packet according to the private key to obtain decrypted data, and verify the validity of the information in the packet, specifically, the validity of the signature, whether the hash value of the contract is consistent, and so on. And extracting the electronic contract, the hash value, the encrypted ciphertext and the secret key from the decrypted data, carrying out data verification on the hash value, the encrypted ciphertext and the secret key, extracting contract plaintext from the electronic contract when verification passes, displaying the contract plaintext for a user to browse, calling the digital certificate to complete signature after the user browses the contract plaintext and confirms that contract information in the contract plaintext is correct, stamping a time stamp, and uploading the digital certificate to a distributed account book.

The service processing subsystem 10 is further configured to store information in the signing process in the blockchain node after detecting that all contract signing parties complete the signing process.

It should be understood that after all contract signing parties are detected to complete the signing process, all information in the signing process such as file abstracts, time stamps, signer information and the like is packaged and stored in the blockchain node, and when the signing information in the signing process needs to be searched, the signing information can be directly searched from the blockchain node. By the technical scheme in the embodiment, each link of the whole signing process can be traced, the attack of a third party is eliminated, the receipt of a fake certificate issued by a fake CA organization is avoided, the transparency of trusted digital certificate management is realized, the electronic contract is ensured to be non-tamperable, and the evidence collection and business transaction by interested parties are facilitated.

In a specific implementation, the technical scheme of the embodiment can be applied to a mortgage loan scene, so that online confirmation and signing of contracts by a plurality of associated users such as a main borrower, a common borrower and the like are realized, and personalized display of contract information is realized through a self-defined contract template, contract parameters based on identity and a user signing sequence in a contract parameterization configuration module of a business system. Paper contracts without handwritten signatures may be challenged by a rating agency, affecting the registration and acquisition of mortgage rights. By means of the blockchain technology introduced by the embodiment, the contract information is stored in the distributed account book of the blockchain, and the safety and the integrity of the contract information are guaranteed.

In this embodiment, when receiving the signing instruction, the service processing subsystem 10 determines the contract parameters and the contract templates according to the signing instruction and generates the contract file, the first client subsystem displays the contract file, the user completes the digital signature after confirming to obtain the electronic contract, the service processing subsystem 10 randomly generates the secret key and obtains the encrypted ciphertext according to the secret key, generates the file to be processed according to the electronic contract, the encrypted ciphertext and the secret key, encrypts the file to be processed according to the public key of the second client subsystem to obtain the encrypted data packet, the second client subsystem decrypts the encrypted data packet, and completes the signature after verifying the decrypted data, the service processing subsystem 10 stores the information in the signing process into the blockchain node after detecting all the contractual parties complete the signing process, and can conveniently inquire the information of each link in the signing process in the blockchain, thereby improving the traceability of the signing process and further improving the security of online signing.

Further, the multi-user online subscription system further comprises a PKI subsystem;

The client subsystem 20 is configured to perform user registration according to a registration request when receiving the registration request input by a user, perform real-name authentication after the registration is completed, and display authentication passing information when the real-name authentication is passed;

The client subsystem 20 is further configured to, when receiving a credential application request and biometric information input by a user, send the credential application request and the biometric information to the service processing subsystem 10;

The service processing subsystem 10 is configured to determine personal information of a user according to the certificate application request, perform validity verification on the personal information of the user and the biometric information, generate a certificate issuing instruction when the validity verification passes, and send the certificate issuing instruction to the PKI subsystem;

The service processing subsystem 10 is further configured to, when receiving a subscription instruction, obtain user identity information from the blockchain according to the subscription instruction, and determine service scenario information according to the subscription instruction.

It should be noted that, the multi-person online subscription system in this embodiment includes a PKI subsystem in addition to the client subsystem 20 and the service processing subsystem 10. Customer subsystem 20 includes functions for user registration, user login, browsing contracts, signing/returning contracts, and the like. And collecting user identity information, sending the user identity information to a service system for identity verification, and displaying contract details to be signed for the user after the verification is passed. The identity information comprises an identity card photo, a confidential problem, a mobile phone number, account information and the like, and user information is collected by adopting multiple means, multiple angles and multiple channels, so that the identity counterfeiting difficulty and the anti-repudiation are improved. And providing contract browsing, signing and returning functions for the user, and returning the contract and filling in the returning reason when the contract is browsed and related information is questioned.

The service processing subsystem 10 includes functions such as identity information verification, data consistency verification, contract parameterization configuration, and the like, and can support parallel signing by multiple associated parties of the same service. Firstly, performing user identity information verification by adopting the modes of OCR recognition and networking verification, confidential question answer verification, mobile phone dynamic verification code verification, banking system verification and the like, if verification is passed, matching related data according to user identities and business scenes, completing contract parameterization configuration, generating a final contract file, sending the final contract file to a client, signing and encrypting the contract after signing by a user, and sending the signed contract file to a PKI subsystem based on a blockchain for storage.

The PKI subsystem provides digital certificate management, consensus mechanism, intelligent contract, distributed account book and other functions for digital certificate issuing/withdrawing and electronic contract storing/evidence obtaining. The distributed ledger is used for storing various information such as user certificates, keys, CRLs (CertificateRevocationLists ), logs and the like. And providing an API interface for the application system, wherein the API interface comprises a distributed account book API and an intelligent contract API and is used for realizing interaction between the business application and the blockchain platform.

The user can register in the client terminal system 20, then perform real-name authentication and pass, and the user requests a certificate application through the client terminal system, and simultaneously provides the own biological characteristics.

It should be appreciated that upon receipt of the user-entered credential application request and biometric information, client subsystem 20 may send such information to business processing subsystem 10 for subsequent processing.

It will be appreciated that the service processing subsystem 10 may determine personal information of a user according to a request for a certificate application, perform validity verification on the personal information of the user and the biometric information, generate a certificate issuing instruction when the validity verification passes, and issue a digital certificate according to the certificate issuing instruction by the PKI subsystem.

It will be appreciated that after verifying the validity of the personal information and the biometric features of the user, the service processing subsystem 10 invokes the PKI subsystem, and the trusted CA authority issues digital certificates for the user and the server, and stores the identity information and the public key of the user real-name authentication in the blockchain.

It should be appreciated that since the user identity information is stored in the blockchain, the service processing subsystem 10 may obtain the user identity information from the blockchain according to the subscription instruction, thereby improving the security of information acquisition.

In this embodiment, when the user registers, the service processing subsystem 10 performs validity verification on the personal information and the biological characteristics of the user, and then invokes the PKI subsystem, the trusted CA institution issues a digital certificate for the user and the server, and stores the identity information and the public key of the real name authentication of the user in the blockchain, thereby further improving the security of information acquisition.

Referring to fig. 2, the present invention proposes a multi-user online subscription method based on a multi-user online subscription system, the multi-user online subscription system comprising: a business processing subsystem and a customer subsystem, the customer subsystem comprising: the multi-user online signing method comprises the following steps of:

Step S10, when receiving a signing instruction, the service processing subsystem determines user identity information and service scene information according to the signing instruction, determines contract parameters and contract templates according to the user identity information and the service scene information, configures the contract templates according to the contract parameters to obtain a contract file, and sends the contract file to the first client subsystem.

(b) Tuples are marked as revoked or expired;

(c) The tuples were checked in the past, resulting in TRUE/FALSE;

It should be understood that the client sub-system in this embodiment includes a first client sub-system and a second client sub-system, where the first client sub-system and the second client sub-system correspond to a contract signing party in a signing process, respectively, for example, the user a and the user b are about to sign up online, and then the terminal device used by the user a may be used as the first client sub-system, and the terminal device used by the user b may be used as the second client sub-system. Meanwhile, when signing up, there may be more than two users, but there are a plurality of users, for example, when user a signs up online with user b and user d, the terminal device used by user a may be used as the first client subsystem, and the terminal device used by user b and user d may be used as the second client subsystem. Further, there can be other cases where the number of users makes an online subscription, that is, the number of the first client sub-system and the second client sub-system is not fixed, in addition to the two cases listed above, which is not limited in this embodiment.

It can be understood that, when the service processing subsystem receives the signing instruction, it determines user identity information and service scene information according to the signing instruction, determines contract parameters and contract templates according to the user identity information and the service scene information, and configures the contract templates according to the contract parameters to obtain a contract file. In a specific implementation, different contract templates may be preset according to different service scenarios, for example, the mortgage loan scenario corresponds to the mortgage loan contract template, the bank financial service scenario corresponds to the bank financial contract template, and the embodiment is not limited thereto.

And step S20, the first client terminal system displays the contract file, acquires an electronic contract obtained after the user completes digital signature based on the contract file, and sends the electronic contract to the service processing subsystem.

It should be appreciated that the first customer subsystem may present the contract document to the user for browsing, the user completes the digital signature to obtain the electronic contract after confirming the contract information in the contract document, and the electronic contract is sent to the business processing subsystem.

Further, the step S20 includes:

The first client terminal system displays the contract file so that a user browses the contract file and performs digital signature operation after confirming that the contract information in the contract file is correct; the first customer subsystem digitally signs the contract document based on a digital signature operation of the user, obtains an electronic contract, stores the signing process, the electronic contract and the context in a distributed ledger, and sends the electronic contract to a business processing subsystem for verification.

It can be understood that the first client subsystem can display the same file, the user can browse the displayed contract file and confirm whether the contract information in the contract file has problems, and after confirming that the contract information has problems, the first client subsystem performs digital signature on the same file in response to the digital signature operation of the user, so as to obtain an electronic contract, wherein the electronic contract can be the contract file after the digital signature is completed. Meanwhile, the signature process, the electronic contract and the context can be stored in the distributed account book, and the electronic contract is sent to the service processing subsystem for verification.

Step S30, the service processing subsystem randomly generates a secret key, obtains an encrypted ciphertext through a symmetric encryption algorithm according to the secret key, generates a file to be processed according to the electronic contract, the encrypted ciphertext and the secret key, acquires a public key corresponding to the second client subsystem, encrypts the file to be processed through an asymmetric encryption algorithm according to the public key, obtains an encrypted data packet, and sends the encrypted data packet to the second client subsystem.

It should be understood that the service processing subsystem may randomly generate a key, obtain an encrypted ciphertext according to the key through a symmetric encryption algorithm, generate a file to be processed according to the electronic contract, the encrypted ciphertext and the key, then obtain a public key corresponding to the second client subsystem, encrypt the public key to obtain an encrypted data packet, and improve the security of data verification in a multiple encryption manner.

Further, in order to further improve the security of the data, the electronic contract may be encrypted by combining the hash value on the basis of the multiple encryption, and before the step S30, the method further includes:

And the service processing subsystem verifies the electronic contract, acquires a server digital certificate from a blockchain when the verification passes, completes signature according to the server digital certificate, obtains a hash value through a hash encryption algorithm, takes the hash value as a digital fingerprint of the electronic contract, encrypts the electronic contract according to the digital fingerprint, and obtains the encrypted electronic contract.

It should be understood that after receiving the electronic contract signed by the initiator and completing verification, the service processing subsystem obtains a server digital certificate from the blockchain, completes the signature according to the server digital certificate, obtains a hash value through a hash encryption algorithm, encrypts the electronic contract as a data fingerprint of the electronic contract, and obtains the confidential electronic contract.

The service processing subsystem randomly generates a 128-bit key, obtains an encrypted ciphertext through a symmetric encryption algorithm according to the key, generates a file to be processed according to the encrypted electronic contract, the hash value, the encrypted ciphertext and the key, acquires a public key corresponding to the second client subsystem from the blockchain, encrypts the file to be processed through an asymmetric encryption algorithm according to the public key, and obtains an encrypted data packet.

It should be understood that the service processing subsystem may randomly generate 128-bit keys, obtain encrypted ciphertexts through a symmetric encryption algorithm, integrate the encrypted electronic contracts, hash values, encrypted ciphertexts and keys to form a to-be-processed file, obtain the public key of the receiver to encrypt, and complete encryption through an asymmetric encryption algorithm to obtain a final encrypted data packet.

And S40, the second client subsystem decrypts the encrypted data packet to obtain decrypted data, performs data verification on the decrypted data, extracts contract plaintext from the decrypted data when verification passes, calls a digital certificate based on the contract plaintext to complete signature, and adds a timestamp to upload the signature to a distributed account book.

Further, the second client subsystem decrypts the encrypted data packet to obtain decrypted data, performs data verification on the decrypted data, extracts a contract plaintext from the decrypted data when verification passes, and invokes a digital certificate based on the contract plaintext to complete signature, including:

The second client subsystem obtains a private key corresponding to the public key, decrypts the encrypted data packet according to the private key to obtain decrypted data, extracts an electronic contract, a hash value, an encrypted ciphertext and a secret key from the decrypted data, performs data verification on the hash value, the encrypted ciphertext and the secret key, and extracts a contract plaintext from the electronic contract when verification passes; and the second client subsystem displays the contract plaintext so that a user browses the contract plaintext, performs digital signature operation after confirming contract information in the contract plaintext, and calls a digital certificate to complete signature based on the digital signature operation of the user.

And step S50, after detecting that all contract signing parties finish signing processes, the service processing subsystem stores information in the signing processes into the blockchain node.

In this embodiment, when receiving a signing instruction, the service processing subsystem determines a contract parameter and a contract template according to the signing instruction and generates a contract file, the first client subsystem displays the contract file, the user completes a digital signature after confirming to obtain an electronic contract, the service processing subsystem randomly generates a key and obtains an encrypted ciphertext according to the key, generates a file to be processed according to the electronic contract, the encrypted ciphertext and the key, encrypts the file to be processed according to a public key of the second client subsystem to obtain an encrypted data packet, the second client subsystem decrypts the encrypted data packet, and completes the signature after performing data verification on the decrypted data, the service processing subsystem stores information in a signing process into a blockchain node after detecting that all contract signing parties complete the signing process, and can conveniently inquire information of each link in the signing process in a blockchain, thereby improving the feasibility of the signing process and further improving the security of online signing.

Further, as shown in fig. 3, a second embodiment of the multi-user online subscription method according to the present invention is provided based on the first embodiment, in this embodiment, the multi-user online subscription system further includes a PKI subsystem, and before step S10, the method further includes:

And step S01, when receiving a registration request input by a user, the client terminal system carries out user registration according to the registration request, carries out real-name authentication after the registration is completed, and displays authentication passing information when the real-name authentication is passed.

It should be noted that, the multi-person online subscription system in this embodiment includes a PKI subsystem in addition to a client subsystem and a service processing subsystem. The client subsystem includes functions such as user registration, user login, contract browsing, signing/returning contracts, etc. And collecting user identity information, sending the user identity information to a service system for identity verification, and displaying contract details to be signed for the user after the verification is passed. The identity information comprises an identity card photo, a confidential problem, a mobile phone number, account information and the like, and user information is collected by adopting multiple means, multiple angles and multiple channels, so that the identity counterfeiting difficulty and the anti-repudiation are improved. And providing contract browsing, signing and returning functions for the user, and returning the contract and filling in the returning reason when the contract is browsed and related information is questioned.

The service processing subsystem comprises the functions of identity information verification, data consistency verification, contract parameterization configuration and the like, and can support parallel signing by a plurality of associated parties of the same service. Firstly, performing user identity information verification by adopting the modes of OCR recognition and networking verification, confidential question answer verification, mobile phone dynamic verification code verification, banking system verification and the like, if verification is passed, matching related data according to user identities and business scenes, completing contract parameterization configuration, generating a final contract file, sending the final contract file to a client, signing and encrypting the contract after signing by a user, and sending the signed contract file to a PKI subsystem based on a blockchain for storage.

The user can register in the client terminal system, then make real-name authentication and pass, and the user requests the certificate application through the client terminal system, and at the same time provides the biological characteristics of the user.

In step S02, the client subsystem sends the certificate application request and the biometric information to the service processing subsystem when receiving the certificate application request and the biometric information input by the user.

It should be appreciated that upon receipt of the user-entered credential application request and biometric information, the client subsystem may send such information to the business processing subsystem for subsequent processing.

Step S03, the service processing subsystem determines user personal information according to the certificate application request, performs validity verification on the user personal information and the biological characteristic information, generates a certificate issuing instruction when the validity verification passes, and sends the certificate issuing instruction to the PKI subsystem.

It can be understood that the service processing subsystem can determine the personal information of the user according to the certificate application request, perform validity verification on the personal information of the user and the biological characteristic information, generate a certificate issuing instruction when the validity verification passes, and issue a digital certificate according to the certificate issuing instruction by the PKI subsystem.

In step S04, the PKI subsystem searches a CA institution based on the certificate issuing instruction, issues a digital certificate for the user and the server by the CA institution, and stores user identity information and a public key of user real-name authentication in a blockchain.

It can be understood that after the service processing subsystem performs validity verification on the personal information and the biological characteristics of the user, the PKI subsystem is called, the trusted CA mechanism issues a digital certificate for the user and the server, and identity information and a public key of the user real-name authentication are stored in the blockchain.

Accordingly, the step S10 includes:

Step S101, when receiving a signing instruction, the service processing subsystem obtains user identity information from the blockchain according to the signing instruction, determines service scene information according to the signing instruction, determines contract parameters and contract templates according to the user identity information and the service scene information, configures the contract templates according to the contract parameters to obtain a contract file, and sends the contract file to the first client subsystem.

It should be appreciated that, because the user identity information is stored in the blockchain, the service processing subsystem may obtain the user identity information from the blockchain according to the subscription instruction, thereby improving the security of information acquisition.

In this embodiment, when the user registers, the service processing subsystem may invoke the PKI subsystem after verifying the validity of the personal information and the biometric feature of the user, and the trusted CA mechanism issues a digital certificate for the user and the server, and stores the identity information and the public key of the user real-name authentication in the blockchain, thereby further improving the security of information acquisition.

It should be noted that, in this document, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one … …" does not exclude the presence of other like elements in a process, method, article, or apparatus that comprises the element.

The foregoing embodiment numbers of the present invention are merely for the purpose of description, and do not represent the advantages or disadvantages of the embodiments.

From the above description of the embodiments, it will be clear to those skilled in the art that the above-described embodiment method may be implemented by means of software plus a necessary general hardware platform, but of course may also be implemented by means of hardware, but in many cases the former is a preferred embodiment. Based on such understanding, the technical solution of the present invention may be embodied essentially or in a part contributing to the prior art in the form of a software product stored in a computer readable storage medium (e.g. ROM/RAM, magnetic disk, optical disk) as described above, comprising several instructions for causing a smart terminal device (which may be a mobile phone, a computer, a terminal device, an air conditioner, or a network terminal device, etc.) to perform the method according to the embodiments of the present invention.

The foregoing description is only of the preferred embodiments of the present invention, and is not intended to limit the scope of the invention, but rather is intended to cover any equivalents of the structures or equivalent processes disclosed herein or in the alternative, which may be employed directly or indirectly in other related arts.

Claims

1. The utility model provides a multiuser online signing system which characterized in that, multiuser online signing system includes: a business processing subsystem and a customer subsystem, the customer subsystem comprising: a first client subsystem and a second client subsystem;

the business processing subsystem is also used for storing information in the signing process into the blockchain node after detecting that all contract signing parties finish the signing process;

The multi-user online signing system also comprises a PKI subsystem;

The business processing subsystem is further used for acquiring user identity information from the blockchain according to the signing instruction when receiving the signing instruction, and determining business scene information according to the signing instruction;

the first customer terminal system is further used for displaying the contract file, so that a user browses the contract file and performs digital signature operation after confirming that the contract information in the contract file is correct;

the first client subsystem is further used for digitally signing the contract file based on digital signature operation of a user, obtaining an electronic contract, storing a signing process, the electronic contract and a context in a distributed account book, and sending the electronic contract to a service processing subsystem for verification;

The business processing subsystem is further used for verifying the electronic contract, acquiring a server digital certificate from a blockchain when verification passes, completing signature according to the server digital certificate, obtaining a hash value through a hash encryption algorithm, taking the hash value as a digital fingerprint of the electronic contract, and encrypting the electronic contract according to the digital fingerprint to obtain an encrypted electronic contract;

2. The multi-user online subscription system of claim 1, wherein the second client subsystem is further configured to obtain a private key corresponding to the public key, decrypt the encrypted data packet according to the private key to obtain decrypted data, extract an electronic contract, a hash value, an encrypted ciphertext, and a secret key from the decrypted data, perform data verification on the hash value, the encrypted ciphertext, and the secret key, and extract a contract plaintext from the electronic contract when verification passes;

3. The multi-user online signing method is characterized by being based on a multi-user online signing system, and the multi-user online signing system comprises the following steps: a business processing subsystem and a customer subsystem, the customer subsystem comprising: a first client subsystem and a second client subsystem,

The multi-user online signing method comprises the following steps:

after detecting that all contract signing parties complete signing processes, the business processing subsystem stores information in the signing processes into a blockchain node;

The multi-user online signing system also comprises a PKI subsystem;

When receiving a signing instruction, the service processing subsystem acquires user identity information from the blockchain according to the signing instruction, and determines service scene information according to the signing instruction;

The first customer terminal system displays the contract file, acquires an electronic contract obtained after the user completes digital signature based on the contract file, and sends the electronic contract to the service processing subsystem, and the method comprises the following steps:

the first client terminal system performs digital signature on the contract file based on digital signature operation of a user to obtain an electronic contract, stores a signature process, the electronic contract and a context in a distributed account book, and sends the electronic contract to a service processing subsystem for verification;

The service processing subsystem randomly generates a secret key, obtains an encrypted ciphertext through a symmetric encryption algorithm according to the secret key, generates a file to be processed according to the electronic contract, the encrypted ciphertext and the secret key, acquires a public key corresponding to the second client subsystem, encrypts the file to be processed through an asymmetric encryption algorithm according to the public key, obtains an encrypted data packet, and before the encrypted data packet is sent to the second client subsystem, the method further comprises:

4. The multi-user online signing method of claim 3, wherein the second client subsystem decrypts the encrypted data packet to obtain decrypted data, performs data verification on the decrypted data, extracts contract plaintext from the decrypted data when verification passes, invokes a digital certificate based on the contract plaintext to complete signing, and comprises: