Nothing Special   »   [go: up one dir, main page]

CN109728914A - Digital signature authentication method, system, device and computer readable storage medium - Google Patents

Digital signature authentication method, system, device and computer readable storage medium Download PDF

Info

Publication number
CN109728914A
CN109728914A CN201910064678.9A CN201910064678A CN109728914A CN 109728914 A CN109728914 A CN 109728914A CN 201910064678 A CN201910064678 A CN 201910064678A CN 109728914 A CN109728914 A CN 109728914A
Authority
CN
China
Prior art keywords
client
algorithm
server
solicited message
digital signature
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
CN201910064678.9A
Other languages
Chinese (zh)
Other versions
CN109728914B (en
Inventor
刘姗
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Beijing QIYI Century Science and Technology Co Ltd
Original Assignee
Beijing QIYI Century Science and Technology Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Beijing QIYI Century Science and Technology Co Ltd filed Critical Beijing QIYI Century Science and Technology Co Ltd
Priority to CN201910064678.9A priority Critical patent/CN109728914B/en
Publication of CN109728914A publication Critical patent/CN109728914A/en
Application granted granted Critical
Publication of CN109728914B publication Critical patent/CN109728914B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Landscapes

  • Storage Device Security (AREA)

Abstract

The embodiment of the invention provides a kind of digital signature authentication method, system, device and computer readable storage mediums, are related to the communications field.Wherein, the client whitepack algorithm that client is sent according to server-side, generate the solicited message for carrying digital signature, the client whitepack algorithm is that server-side is generated using preset Encryption Algorithm and aliasing strategy according to client id, digital signature is the verification information generated using client whitepack algorithm, and solicited message is sent to server-side by client;And server-side utilizes first key corresponding with client id after the solicited message with digital signature for receiving client transmission, carries out verification operation to solicited message, to judge whether solicited message is legal.Therefore, in server-side without guaranteeing verification efficiency in the case where storing mass data;The use of client whitepack algorithm is not in any key plain in client, guarantees key safety.

Description

Digital signature authentication method, system, device and computer readable storage medium
Technical field
The present invention relates to Internet technical fields, more particularly to a kind of digital signature authentication method, system, device and meter Calculation machine readable storage medium storing program for executing.
Background technique
Currently, digital signature is widely used in the field of communication technology of mobile terminal, to realize the body of communicating pair Part verifying.
In the prior art, digital signature largely uses public key algorithm to realize, using private key signature, and public key verifications Mode, that is, client are sent plus the data encrypted using private key as digital signature behind the data of transmission After server-side, so that server-side is decrypted the digital signature received using public key, to verify the true and false of digital signature.
It is all to be present in plaintext version but due to mobile terminal usage scenario and the particularity of open source operating system Key in equipment all has hidden danger;And the digital signature authentication scheme realized using public key algorithm, in key In the case where exposure, the safety for guaranteeing communication data will be unable to.
Summary of the invention
In view of the above problems, it proposes the embodiment of the present invention and overcomes the above problem or at least partly in order to provide one kind A kind of digital signature authentication method, system, device and the computer readable storage medium to solve the above problems.
According to the first aspect of the invention, a kind of digital signature authentication method is provided, applied to including transmitting terminal and connecing The system of receiving end, which comprises
The client whitepack algorithm that the client is sent according to the server-side generates the request letter for carrying digital signature Breath, the client whitepack algorithm are that the server-side is given birth to according to client id using preset Encryption Algorithm and aliasing strategy At, the digital signature is the verification information generated using the client whitepack algorithm;
The solicited message is sent to the server-side by the client;
The server-side utilizes first key corresponding with the client id, carries out verifying behaviour to the solicited message Make, to judge whether the solicited message is legal.
According to the second aspect of the invention, another digital signature authentication method is provided, client, the side are applied to Method includes:
According to the client whitepack algorithm that server-side is sent, the solicited message for carrying digital signature, the client are generated Whitepack algorithm be the server-side according to client id using preset Encryption Algorithm and aliasing strategy generated, the number Signature is the verification information generated using the client whitepack algorithm;
The solicited message is sent to the server-side.
According to the third aspect of the invention we, another digital signature authentication method is provided, server-side, the side are applied to Method includes:
Receive the solicited message with digital signature that client is sent;
Using first key corresponding with client id, verification operation is carried out to the solicited message, to ask described in judgement Ask information whether legal.
According to the fourth aspect of the invention, provide a kind of digital signature authentication system, the system comprises: client and Server-side;
Wherein, the client, the client whitepack algorithm for being sent according to the server-side generate and carry number label The solicited message of name, the client whitepack algorithm are that the server-side utilizes preset Encryption Algorithm according to client id and mixes The strategy that confuses is generated, and the digital signature is the verification information generated using the client whitepack algorithm;
The client, for the solicited message to be sent to the server-side;
The server-side tests the solicited message for utilizing first key corresponding with the client id Card operation, to obtain the authentication result of the client.
According to the fifth aspect of the invention, another digital signature authentication device is provided, client, the dress are applied to It sets and includes:
Information generating module, the client whitepack algorithm for being sent according to server-side generate and carry asking for digital signature Seek information, the client whitepack algorithm is that the server-side according to client id utilizes preset Encryption Algorithm and aliasing strategy Generated, the digital signature is the verification information generated using the client whitepack algorithm;
Sending module, for the solicited message to be sent to the server-side.
According to the sixth aspect of the invention, another digital signature authentication device is provided, server-side, the dress are applied to It sets and includes:
Receiving module, for receiving the solicited message with digital signature of client transmission;
Authentication module carries out verification operation to the solicited message for utilizing first key corresponding with client id, To judge whether the solicited message is legal.
According to the seventh aspect of the invention, a kind of computer readable storage medium, the computer-readable storage are provided Computer program is stored on medium, the computer program realizes that number described in either side as above is signed when being executed by processor Name verification method.
The embodiment of the present invention includes following advantages:
The client whitepack algorithm that client described in the embodiment of the present invention can be sent according to the server-side, generates and carries The solicited message of digital signature, and the solicited message is sent to the server-side;The server-side receives the client The solicited message with digital signature sent recycles first key corresponding with the client id, believes the request Breath carries out verification operation, to judge whether the solicited message is legal.The embodiment of the present invention is mainly used in mobile terminal conduct Client and server-side carry out under the scene of two-way communication, are calculated the client whitepack generated according to client id by server-side Method is handed down to client, under the premise of server-side does not store mass data, guarantees verification efficiency;Client whitepack is used simultaneously Algorithm makes do not occur any key plain in client, guarantees key safety.
The above description is only an overview of the technical scheme of the present invention, in order to better understand the technical means of the present invention, And it can be implemented in accordance with the contents of the specification, and in order to allow above and other objects of the present invention, feature and advantage can It is clearer and more comprehensible, the followings are specific embodiments of the present invention.
Detailed description of the invention
By reading the following detailed description of the preferred embodiment, various other advantages and benefits are common for this field Technical staff will become clear.The drawings are only for the purpose of illustrating a preferred embodiment, and is not considered as to the present invention Limitation.And throughout the drawings, the same reference numbers will be used to refer to the same parts.In the accompanying drawings:
Fig. 1 is a kind of step flow chart of digital signature authentication method provided in an embodiment of the present invention;
Fig. 2 is the step flow chart of another digital signature authentication method provided in an embodiment of the present invention;
Fig. 3 is a kind of block diagram of digital signature generating process provided in an embodiment of the present invention;
Fig. 4 is the step flow chart of another digital signature authentication method provided in an embodiment of the present invention;
Fig. 5 is a kind of block diagram of digital signature authentication system provided in an embodiment of the present invention;
Fig. 6 is a kind of block diagram of digital signature authentication device provided in an embodiment of the present invention;
Fig. 7 is the block diagram of another digital signature authentication device provided in an embodiment of the present invention.
Specific embodiment
In order to make the foregoing objectives, features and advantages of the present invention clearer and more comprehensible, with reference to the accompanying drawing and specific real Applying mode, the present invention is described in further detail.
It should be appreciated that described herein, specific examples are only used to explain the present invention, and only present invention a part is real Example is applied, instead of all the embodiments, is not intended to limit the present invention.
The embodiment of the present invention provides a kind of digital signature authentication method, the digital signature authentication method can be applied to include The system of client and server-side, wherein the client whitepack algorithm that client is sent according to server-side generates and carries number label The solicited message of name, which, which is server-side, utilizes preset Encryption Algorithm and aliasing strategy according to client id Generated, digital signature is the verification information generated using client whitepack algorithm, and solicited message is sent to clothes by client Business end;And server-side receive client transmission the solicited message with digital signature after utilize it is corresponding with client id First key, to solicited message carry out verification operation, to judge whether solicited message legal.In the embodiment of the present invention, use The client whitepack algorithm generated according to client id is handed down to client by server-side, does not store mass data in server-side Under the premise of, guarantee verification efficiency;On the client be not in any key plain, guarantee key safety.It is mentioned below to above-mentioned To digital signature authentication method be specifically described.
Referring to Fig.1, a kind of step flow chart of digital signature authentication method is shown, is applied to include client and service The system at end.
In the embodiment of the present invention, client can specifically be mounted in the application program in all kinds of terminals, such as can be Mail applications etc. on computer, mobile terminal, the embodiment of the present invention to the particular content of client without limitation.
It is understood that server-side is the equipment communicated with client, server-side specifically can be corresponding server, Base station etc., the embodiment of the present invention to the particular content of client without limitation.
As shown in Figure 1, this method may include:
Step 101, client id is sent to server-side by client.
Step 102, server-side is generated according to the client id received using preset Encryption Algorithm and aliasing strategy Client whitepack algorithm corresponding with client id.
It should be noted that whitepack encryption belongs to symmetric cryptosystem, it is that the one of attack can be resisted under whitepack environment Kind special encryption method, core concept is to obscure, the meaning be exactly by obscure into plain text can not Direct Recognition character, make it It can only carry out identifying after solution is obscured by preset aliasing strategy, it may be said that encryption is hiding information, and is obscured just Refer to upset information.In order to further ensure the key safety stored in client, technical solution proposed by the present invention is used Whitepack cipher mode progress Obfuscating Algorithms and Encryption Algorithm encapsulation, wherein client whitepack algorithm be based on client send out The client id sent is corresponding to be generated, wherein may include at least one Obfuscating Algorithms and Encryption Algorithm, this at least one obscure Algorithm is to be generated based on aliasing strategy, such as can be and obscure operation by the generation of preset ad hoc approach according to client id Confusion matrix, recycle the confusion matrix to carry out encrypted content and obscure operation (solution obscures operation), visitor can be used for example The cryptographic Hash of family end ID is as confusion matrix;Or using the random number of client id generation as confusion matrix etc., to realize Each client whitepack algorithm is merely able to be suitable for its corresponding client.
Step 103, client whitepack algorithm is sent to client by server-side.
Step 104: the client whitepack algorithm that client is sent according to server-side generates the request letter for carrying digital signature Breath.
Wherein, to be server-side utilize preset Encryption Algorithm and aliasing strategy institute according to client id to client whitepack algorithm It generates, digital signature is the verification information generated using client whitepack algorithm.
In the embodiment of the present invention, during client is that server-side is communicated, solicited message is sent to service Before end, need that solicited message is encrypted while regenerating authentication information, such as plucking using solicited message It wants content to generate digital signature and realizes that authentication utilizes digital signature pair convenient for server-side after receiving the solicited message The legitimacy of solicited message is verified.
Illustratively, which can be issued to client by server-side in the form of one section of program code, In order to run the encryption realized to request content on the client;It either can directly be packaged into the shape of component or plug-in unit Formula is installed on the client to realize effect same.
Step 105: solicited message is sent to server-side by client.
In embodiments of the present invention, client, can be by the request after generating with the solicited message of digital signature Information is sent to server-side, to enable server-side corresponding requests information execute request content.
Step 106: server-side receives the solicited message with digital signature that client is sent.
In the embodiment of the present invention, client first will be with the request by the digital signature after client whitepack algorithm process Information is sent to server-side, and server-side after the receipt, will verify the digital signature in the solicited message, confirm the request Whether information is legal, such as when the client whitepack algorithm that other clients are utilized in client generates digital signature, the correspondence The digital signature of generation will be unable to be decrypted correctly in server-side using first key, i.e., is signed based on the first key to number Information (summary info) after name decryption and the original contents (summary info) in solicited message are inconsistent, or even can not identify, Then illustrate that the solicited message is invalid information;Otherwise, after digital signature is decrypted using first key, obtained data Content is consistent with the original contents in solicited message, then illustrates that solicited message belongs to legal information, can continue to execute request letter The corresponding request content of breath.
Step 107: server-side utilizes first key corresponding with client id, carries out verification operation to solicited message, with Judge whether solicited message is legal.
In the embodiment of the present invention, server-side will only be handed down to visitor after client whitepack algorithm is sent to client First key corresponding to Encryption Algorithm in the whitepack algorithm of family end is stored in server-side, in order to receive client again later Solicited message after, using first key to the digital signature authentication in solicited message, that is to say, that performed by server-side Operation or standard the solicited message to encryption the process that is decrypted of content.Public key is stored in server-side, phase When safer in client, and the content of first key is only stored in server-side, a large amount of data will not be caused to store Burden.
In concrete application, Encryption Algorithm then can be using AES (Chinese: Advanced Encryption Standard;English: Advanced Encryption Standard) algorithm, the block length of aes algorithm is fixed as 128 bits, and key length then can be 128, 192 or 256 bits, and quickly due to the decryption of the aes algorithm of standard, it not will cause big calculating waste.
In the embodiment of the present invention, server-side makes requests the decryption of the digital signature in information by first key, determines Whether solicited message is legal, further judges client with the presence or absence of security risk.If server-side is counted according to first key After the decryption of word signature, judge that the solicited message is invalid information, server-side, which can choose, does not execute the solicited message pair The request content answered, and client corresponding to the solicited message is marked, to show the client, there are security breaches.
In conclusion the client whitepack algorithm that client of the embodiment of the present invention is sent according to server-side, generates and carries number The solicited message of word signature, which is server-side using preset Encryption Algorithm and obscures according to client id Strategy is generated, and digital signature is the verification information generated using client whitepack algorithm, and client sends solicited message To server-side;And server-side utilizes after the solicited message with digital signature for receiving client transmission and client id Corresponding first key carries out verification operation to solicited message, to judge whether solicited message is legal.In the embodiment of the present invention, The client whitepack algorithm generated according to client id is handed down to client by server-side, is not stored largely in server-side Data, additionally it is possible to guarantee verification efficiency;It is on the client not in simultaneously any key plain, to guarantee key safety.Under It is specifically described in face of digital signature authentication method mentioned above.
Fig. 2 is the step flow chart of another digital signature authentication method provided in an embodiment of the present invention, is applied to client End, as shown in Fig. 2, this method may include:
Step 201: client id is sent to server-side.
Specifically, client id is sent to server-side by client, client is generated in order to which server-side corresponds to client id Whitepack algorithm is held, so that the client whitepack algorithm is corresponding with client id, i.e. Obfuscating Algorithms in client whitepack algorithm It is mutually inverse each other with the inverse Obfuscating Algorithms that are stored in client;And Obfuscating Algorithms are to be generated based on client id for carrying out obscuring behaviour The confusion matrix of work, therefore only can be corresponding to the inverse Obfuscating Algorithms in client using corresponding client whitepack algorithm Solution is obscured, to guarantee that other clients are not available.
Step 202: receiving the client whitepack algorithm that server-side is sent.
It optionally, include at least one Obfuscating Algorithms and Encryption Algorithm in client whitepack algorithm.
Preferably, in the client whitepack algorithm include the first Obfuscating Algorithms, Encryption Algorithm and the second Obfuscating Algorithms, In, the first Obfuscating Algorithms and the second Obfuscating Algorithms are to be generated according to client id using aliasing strategy is corresponding, and Encryption Algorithm is It is generated according to Advanced Encryption Standard aes algorithm.First Obfuscating Algorithms and the second Obfuscating Algorithms, which for example can be, carries out letter The Duan Chengxu obscured is ceased, which for example can be aes algorithm, or can also be that DES (Chinese: calculate by data encryption Method;English: Data Encryption Algorithm) algorithm etc., the present invention is not particularly limited.
Step 203: aliasing strategy being utilized according to client id, generates the first Obfuscating Algorithms corresponding first against Obfuscating Algorithms Corresponding with the second Obfuscating Algorithms second against Obfuscating Algorithms.
Specifically, this first against Obfuscating Algorithms and second against Obfuscating Algorithms is that client is respectively corresponded using client id First Obfuscating Algorithms and the second Obfuscating Algorithms are generated obscures part, the two parts without being issued by server-side, It is (to use the cryptographic Hash of client id raw as the matrix queue obscured or using client id according to preset aliasing strategy At random number as the matrix queue obscured) directly generate on the client.It should be noted that the first inverse mixed calculation of confusing Method and second against Obfuscating Algorithms generation strategy completely corresponding first Obfuscating Algorithms and the second Obfuscating Algorithms strategy, to guarantee the One is reciprocal against Obfuscating Algorithms and the first Obfuscating Algorithms, and second is reciprocal against Obfuscating Algorithms and the second Obfuscating Algorithms, to ensure passing through After first against Obfuscating Algorithms, client whitepack algorithm and second against Obfuscating Algorithms, generate only through Encryption Algorithm processing Data content.
Step 204: the client whitepack algorithm sent according to server-side generates the solicited message for carrying digital signature.
As the preferred embodiment of the embodiment of the present invention, the client whitepack algorithm sent according to server-side is raw At the solicited message for carrying digital signature, comprising:
Sub-step A1: by first against Obfuscating Algorithms, second against Obfuscating Algorithms and client whitepack algorithm, according to request Request content and client id in information generate digital signature.
Wherein, which may include: that the corresponding summary info of acquisition request content, summary info first can be The information generated after being handled using preset function request content, it is raw after being encrypted for example, by using hash function At corresponding summary info;Summary info is carried out against Obfuscating Algorithms by first again later to obscure processing;Visitor is successively utilized again The first Obfuscating Algorithms, Encryption Algorithm and the second Obfuscating Algorithms in the whitepack algorithm of family end obscure processing against Obfuscating Algorithms to through first Summary info afterwards is encrypted, and obscures encryption information to generate;Then laughter is encrypted against Obfuscating Algorithms by second Information carries out solution and obscures processing, to generate digital signature.
It should be noted that the number of the Obfuscating Algorithms in client whitepack algorithm, should with generated in client it is inverse mixed Confuse algorithm number it is corresponding.That is, when in client whitepack algorithm including an Obfuscating Algorithms, then on the client It is corresponding to generate an inverse Obfuscating Algorithms, and the Obfuscating Algorithms can be located at Encryption Algorithm in client whitepack algorithm after can also To be located at before Encryption Algorithm.The present invention to the numbers of specific Obfuscating Algorithms with no restriction, preferred reality given by the present invention Applying example is the Obfuscating Algorithms that two front and rears in Encryption Algorithm are arranged, and corresponds to and generate two inverse Obfuscating Algorithms in client, To offset the effect for obscuring processing twice.
In the embodiment of the present invention, as shown in figure 3, the summary info in request content, e.g. 7 are passed through first first Inverse Obfuscating Algorithms become 6, enter back into client whitepack algorithm later, obscure calculation first with first in client whitepack algorithm Method offsets first and obscures operation against Obfuscating Algorithms, that is, is reduced to 7, recycles the Encryption Algorithm in client whitepack algorithm Summary info is encrypted, 12 is generated, followed by the second Obfuscating Algorithms, encrypted summary info is obscured, it will Encryption information 12 obscures into 15, recycles second to be obscured processing again against Obfuscating Algorithms, offsets in client whitepack algorithm In the second Obfuscating Algorithms obscure processing, that is, 12 are reduced to, so that the digital signature (12) that ultimately generates is merely with adding It is that close algorithm has carried out cryptographic operation as a result, e.g. aes algorithm, after the solicited message is sent to server-side, clothes Business end can be directly decrypted by the corresponding first key of the client prestored.
Sub-step A2: according to digital signature, solicited message is generated.
Illustratively, after which being attached to the content of solicited message, as authentication information, retransmit to Server-side, to carry out authentication.
Fig. 4 is the step flow chart of another digital signature authentication method provided in an embodiment of the present invention, is applied to service End, as shown in figure 4, this method may include:
Step 401: receiving the client id that client is sent.
Step 402: utilizing preset Encryption Algorithm, generate the client whitepack algorithm of corresponding client id.
Wherein, client whitepack algorithm includes at least one Obfuscating Algorithms and Encryption Algorithm.
Specifically, the client id received using server-side, generates one using preset Encryption Algorithm and aliasing strategy A client whitepack algorithm for the client id.The cryptographic Hash that client id information can be used for example is obscured as generation The matrix queue of algorithm;Or using client id information as random number, the matrix queue of Obfuscating Algorithms is generated respectively, is utilized Basis of the matrix queue as Obfuscating Algorithms, to realize that client whitepack algorithm is associated with client id, and in whitepack There is no the cleartext informations of any key, to guarantee the safety of the communication information, and correspond to client whitepack algorithm being issued to visitor Family end, the solicited message with the digital signature generated by client whitepack algorithm sent in order to client.
Step 403: client whitepack algorithm is sent to client.
Step 404: the key of the corresponding Encryption Algorithm of storage client id, using as first key.
In the concrete realization, server-side only stores the corresponding key storage of Encryption Algorithm in client whitepack algorithm, example Such as the key of aes algorithm.
Step 405: receiving the solicited message with digital signature that client is sent.
Step 406: utilizing first key corresponding with client id, verification operation is carried out to solicited message, is asked with judgement Ask information whether legal.
It is described to utilize first key corresponding with client id as a kind of preferred embodiment of the embodiment of the present invention, Verification operation is carried out to solicited message, to judge whether solicited message is legal, comprising:
Sub-step B1: according to client id, first key is searched.
Wherein, first key is to utilize Advanced Encryption Standard aes algorithm encryption key generated.
In specific, first key is that corresponding client id is stored, in the solicited message that decryption client is sent It when the digital signature having, needs using corresponding key, first key is e.g. generated using the AES encryption of standard, other The Encryption Algorithm that can be realized ciphering process also can use in the inventive solutions, and the present invention is not particularly limited.
Sub-step B2: according to first key, verifying the digital signature in solicited message, to judge that solicited message is It is no legal.
Number in the embodiment of the present invention, by the decryption for being digitally signed first key, in legal solicited message Should be with the request content to solicited message after word signature decryption, e.g. summary info is consistent;Conversely, illegal solicited message It can not get corresponding request content after being decrypted using first key, i.e., be plucked with solicited message after digital signature decryption It wants information inconsistent, then illustrates that data signature entrained by the solicited message is illegal.
In conclusion the client whitepack algorithm that client of the embodiment of the present invention is sent according to server-side, generates and carries number The solicited message of word signature, which is server-side using preset Encryption Algorithm and obscures according to client id Strategy is generated, and digital signature is the verification information generated using client whitepack algorithm, and client sends solicited message To server-side;And server-side utilizes after the solicited message with digital signature for receiving client transmission and client id Corresponding first key carries out verification operation to solicited message, to judge whether solicited message is legal.In the embodiment of the present invention, The client whitepack algorithm generated according to client id is handed down to by client using server-side, does not store a large amount of numbers in server-side Under the premise of, guarantee verification efficiency;Store the client whitepack algorithm for generating authentication on the client simultaneously, by It further include Obfuscating Algorithms in client whitepack algorithm, so that will not occur any key plain on the client, and this is obscured Algorithm is corresponding with client id, can be while reducing the probability that key is leaked, since client whitepack algorithm can not be by Other clients are usurped, and the safety of key is further increased.
Fig. 5 is a kind of block diagram of digital signature authentication system provided in an embodiment of the present invention, as shown in figure 5, the system 500 It may include server-side 510 and client 520;
Wherein, client, the client whitepack algorithm for being sent according to the server-side generate and carry digital signature Solicited message, the client whitepack algorithm, which is server-side, utilizes preset Encryption Algorithm and aliasing strategy institute according to client id It generates, digital signature is the verification information generated using client whitepack algorithm.
Client, for solicited message to be sent to server-side.
Server-side carries out verification operation to solicited message, with judgement for utilizing first key corresponding with client id Whether solicited message is legal.
Optionally, system 500 further include:
Client, the client whitepack algorithm for being sent in client according to server-side generate and carry digital signature Before the step of solicited message, client id is sent to server-side;
Server-side, for using preset Encryption Algorithm and aliasing strategy, generating and visitor according to the client id received The corresponding client whitepack algorithm of family end ID;
Server-side is used for client whitepack algorithm to client.
Fig. 6 is a kind of block diagram of digital signature authentication device provided in an embodiment of the present invention, is applied to client, such as Fig. 6 Shown, which may include:
Information generating module 610, the client whitepack algorithm for being sent according to server-side generate and carry digital signature Solicited message, client whitepack algorithm are that server-side is generated according to client id using preset Encryption Algorithm and aliasing strategy , digital signature is the verification information generated using client whitepack algorithm.
Sending module 620, for the solicited message to be sent to server-side.
Preferably, which can also include:
The sending module is also used to generate in the client whitepack algorithm sent according to server-side and carry digital signature Solicited message before, client id is sent to server-side;
Receiving module, for receiving the client whitepack algorithm of server-side transmission.
Preferably, client whitepack algorithm includes at least one Obfuscating Algorithms and Encryption Algorithm.
Optionally, client whitepack algorithm includes the first Obfuscating Algorithms, Encryption Algorithm and the second Obfuscating Algorithms, the device 600 further include:
Generation module is obscured, for generating and carrying digital signature in the client whitepack algorithm sent according to server-side Before solicited message, aliasing strategy is utilized according to client id, generate the first Obfuscating Algorithms corresponding first against Obfuscating Algorithms and Second Obfuscating Algorithms corresponding second are against Obfuscating Algorithms.
Preferably, information generating module 610, comprising:
Signature generates submodule, for calculating against Obfuscating Algorithms, second against Obfuscating Algorithms and client whitepack by first Method generates digital signature according to the request content in solicited message.
It requests to determine submodule, for generating solicited message according to digital signature.
Preferably, signature generates submodule, comprising:
Information acquisition unit, for the summary info of acquisition request content, summary info is using preset function to request The information that content generates after being handled;
Obscure processing unit, obscures processing for carrying out against Obfuscating Algorithms to summary info by first;
Cryptographic processing unit, for successively utilizing the first Obfuscating Algorithms in client whitepack algorithm, Encryption Algorithm and the To against Obfuscating Algorithms obscuring that treated through first, summary info is encrypted two Obfuscating Algorithms, obscures encryption letter to generate Breath;
Solution obscures processing unit, for obscuring processing to obscuring encryption information and carry out solution against Obfuscating Algorithms by second, with Generate digital signature.
Fig. 7 is the block diagram of another digital signature authentication device provided in an embodiment of the present invention, is applied to server-side, such as schemes Shown in 7, which may include:
Receiving module 710, for receiving the solicited message with digital signature of client transmission.
Authentication module 720 carries out verification operation to solicited message for utilizing first key corresponding with client id, To judge whether solicited message is legal.
Preferably, described device 700 includes:
The receiving module is also used to before receiving the solicited message with digital signature that client is sent, and is received The client id that client is sent.
Generation module, for utilizing preset Encryption Algorithm and aliasing strategy, the client for generating corresponding client id is white Box algorithm, client whitepack algorithm include at least one Obfuscating Algorithms and Encryption Algorithm.
Sending module, for client whitepack algorithm to be sent to client.
Memory module, for storing the key of the corresponding Encryption Algorithm of client id, using as first key.
Preferably, the authentication module 720, comprising:
Cipher key lookup submodule, for searching first key according to the client id, first key is added using advanced Data Encryption Standard aes algorithm encryption key generated.
Submodule is decrypted, for according to first key, the digital signature in solicited message to be decrypted, to obtain signature Information.
Judging submodule is requested, for judging whether solicited message is legal according to signing messages and client id.
For device embodiment, since it is basically similar to the method embodiment, related so being described relatively simple Place illustrates referring to the part of embodiment of the method.
All the embodiments in this specification are described in a progressive manner, the highlights of each of the examples are with The difference of other embodiments, the same or similar parts between the embodiments can be referred to each other.
It should be understood by those skilled in the art that, the embodiment of the embodiment of the present invention can provide as method, apparatus or calculate Machine program product.Therefore, the embodiment of the present invention can be used complete hardware embodiment, complete software embodiment or combine software and The form of the embodiment of hardware aspect.Moreover, the embodiment of the present invention can be used one or more wherein include computer can With in the computer-usable storage medium (including but not limited to magnetic disk storage, CD-ROM, optical memory etc.) of program code The form of the computer program product of implementation.
In a typical configuration, the computer equipment includes one or more processors (CPU), input/output Interface, network interface and memory.Memory may include the non-volatile memory in computer-readable medium, random access memory The forms such as device (RAM) and/or Nonvolatile memory, such as read-only memory (ROM) or flash memory (flash RAM).Memory is to calculate The example of machine readable medium.Computer-readable medium includes that permanent and non-permanent, removable and non-removable media can be with Realize that information is stored by any method or technique.Information can be computer readable instructions, data structure, the module of program or Other data.The example of the storage medium of computer includes, but are not limited to phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other kinds of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory techniques, CD-ROM are read-only Memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, tape magnetic disk storage or Other magnetic storage devices or any other non-transmission medium, can be used for storage can be accessed by a computing device information.According to Herein defines, and computer-readable medium does not include non-persistent computer readable media (transitory media), such as The data-signal and carrier wave of modulation.
The embodiment of the present invention be referring to according to the method for the embodiment of the present invention, terminal device (system) and computer program The flowchart and/or the block diagram of product describes.It should be understood that flowchart and/or the block diagram can be realized by computer program instructions In each flow and/or block and flowchart and/or the block diagram in process and/or box combination.It can provide these Computer program instructions are filled to general purpose computer, special purpose computer, Embedded Processor or other programmable digital signature verifications The processor set is to generate a machine, so that being held by the processor of computer or other programmable digital signature verification devices Capable instruction generates for realizing in one or more flows of the flowchart and/or one or more blocks of the block diagram The device of specified function.
These computer program instructions, which may also be stored in, is able to guide computer or other programmable digital signature verification devices In computer-readable memory operate in a specific manner, so that instruction stored in the computer readable memory generates packet The manufacture of command device is included, which realizes in one side of one or more flows of the flowchart and/or block diagram The function of being specified in frame or multiple boxes.
These computer program instructions can also be loaded on computer or other programmable digital signature verification devices, so that Series of operation steps are executed on computer or other programmable terminal equipments to generate computer implemented processing, thus The instruction executed on computer or other programmable terminal equipments is provided for realizing in one or more flows of the flowchart And/or in one or more blocks of the block diagram specify function the step of.
Although the preferred embodiment of the embodiment of the present invention has been described, once a person skilled in the art knows bases This creative concept, then additional changes and modifications can be made to these embodiments.So the following claims are intended to be interpreted as Including preferred embodiment and fall into all change and modification of range of embodiment of the invention.
Finally, it is to be noted that, herein, relational terms such as first and second and the like be used merely to by One entity or operation are distinguished with another entity or operation, without necessarily requiring or implying these entities or operation Between there are any actual relationship or orders.Moreover, the terms "include", "comprise" or its any other variant meaning Covering non-exclusive inclusion, so that process, method, article or terminal device including a series of elements not only wrap Those elements are included, but also including other elements that are not explicitly listed, or further includes for this process, method, article Or the element that terminal device is intrinsic.In the absence of more restrictions, being wanted by what sentence "including a ..." limited Element, it is not excluded that there is also other identical elements in process, method, article or the terminal device for including the element.
Above to a kind of digital signature authentication method provided by the present invention, system, device and computer-readable storage medium Matter is described in detail, and used herein a specific example illustrates the principle and implementation of the invention, above The explanation of embodiment is merely used to help understand method and its core concept of the invention;Meanwhile for the general skill of this field Art personnel, according to the thought of the present invention, there will be changes in the specific implementation manner and application range, in conclusion this Description should not be construed as limiting the invention.

Claims (23)

1. a kind of digital signature authentication method, which is characterized in that applied to the system including server-side and client, the method Include:
The client whitepack algorithm that the client is sent according to the server-side generates the solicited message for carrying digital signature, The client whitepack algorithm is that the server-side is generated according to client id using preset Encryption Algorithm and aliasing strategy , the digital signature is the verification information generated using the client whitepack algorithm;
The solicited message is sent to the server-side by the client;
The server-side utilizes first key corresponding with the client id, carries out verification operation to the solicited message, with Judge whether the solicited message is legal.
2. the method according to claim 1, wherein the client that the client is sent according to the server-side Before the step of whitepack algorithm, generation carries the solicited message of digital signature, the method also includes:
The client id is sent to the server-side by the client;
The server-side is according to the client id received, using preset Encryption Algorithm and aliasing strategy, generation and institute State the corresponding client whitepack algorithm of client id;
The client whitepack algorithm is sent to the client by the server-side.
3. a kind of digital signature authentication method, which is characterized in that be applied to client, which comprises
According to the client whitepack algorithm that server-side is sent, the solicited message for carrying digital signature, the client whitepack are generated Algorithm be the server-side according to client id using preset Encryption Algorithm and aliasing strategy generated, the digital signature It is the verification information generated using the client whitepack algorithm;
The solicited message is sent to the server-side.
4. according to the method described in claim 3, it is characterized in that, being calculated in the client whitepack sent according to server-side Method, before generating the solicited message for carrying digital signature, the method also includes:
The client id is sent to the server-side;
Receive the client whitepack algorithm that the server-side is sent.
5. according to the method described in claim 4, it is characterized in that, the client whitepack algorithm includes that at least one obscures calculation Method and Encryption Algorithm.
6. according to the method described in claim 5, it is characterized in that, the client whitepack algorithm include the first Obfuscating Algorithms, Encryption Algorithm and the second Obfuscating Algorithms generate in the client whitepack algorithm sent according to server-side and carry digital signature Solicited message before, the method also includes:
The aliasing strategy is utilized according to the client id, generates first Obfuscating Algorithms corresponding first against Obfuscating Algorithms With second Obfuscating Algorithms corresponding second against Obfuscating Algorithms.
7. according to the method described in claim 5, it is characterized in that, it is described according to server-side send client whitepack algorithm, Generate the solicited message for carrying digital signature, comprising:
By described first against Obfuscating Algorithms, described second against Obfuscating Algorithms and the client whitepack algorithm, according to described Request content in solicited message generates the digital signature;
According to the digital signature, the solicited message is generated.
8. the method according to the description of claim 7 is characterized in that it is described by described first against Obfuscating Algorithms, described second Inverse Obfuscating Algorithms and the client whitepack algorithm generate the number according to the request content in the solicited message and sign Name, comprising:
Obtain the summary info of the request content, the summary info be using preset function to the request content at The information generated after reason;
The summary info is carried out against Obfuscating Algorithms by described first to obscure processing;
Successively obscured using first Obfuscating Algorithms in the client whitepack algorithm, the Encryption Algorithm and described second To against Obfuscating Algorithms obscuring that treated through described first, summary info is encrypted algorithm, obscures encryption letter to generate Breath;
By described second against Obfuscating Algorithms to it is described obscure encryption information and carry out solution obscure processing, to generate the number label Name.
9. a kind of digital signature authentication method, which is characterized in that be applied to server-side, which comprises
Receive the solicited message with digital signature that client is sent;
Using first key corresponding with client id, verification operation is carried out to the solicited message, to judge the request letter Whether cease legal.
10. according to the method described in claim 9, it is characterized in that, there is digital signature what the reception client was sent Solicited message before, the method also includes:
Receive the client id that the client is sent;
Using preset Encryption Algorithm and aliasing strategy, the client whitepack algorithm of the corresponding client id, the visitor are generated Family end whitepack algorithm includes at least one Obfuscating Algorithms and Encryption Algorithm;
The client whitepack algorithm is sent to the client;
The key for storing the corresponding Encryption Algorithm of the client id, using as the first key.
11. according to the method described in claim 10, it is characterized in that, it is described utilize first key corresponding with client id, Verification operation is carried out to the solicited message, to judge whether the solicited message is legal, comprising:
According to the client id, the first key is searched, the first key is to utilize Advanced Encryption Standard aes algorithm institute The encryption key of generation;
According to the first key, the digital signature in the solicited message is decrypted, to obtain signing messages;
According to the signing messages, judge whether the solicited message is legal.
12. a kind of digital signature authentication system, which is characterized in that the system comprises server-sides and client;
Wherein, the client, the client whitepack algorithm for being sent according to the server-side generate and carry digital signature Solicited message, the client whitepack algorithm, which is the server-side, using preset Encryption Algorithm and obscures plan according to client id Slightly generated, the digital signature is the verification information generated using the client whitepack algorithm;
The client, for the solicited message to be sent to the server-side;
The server-side carries out verifying behaviour to the solicited message for utilizing first key corresponding with the client id Make, to judge whether the solicited message is legal.
13. system according to claim 12, which is characterized in that the system also includes:
The client, the client whitepack algorithm for being sent in the client according to the server-side generate and carry number Before the step of solicited message of word signature, the client id is sent to the server-side;
The server-side, for being generated according to the client id received using preset Encryption Algorithm and aliasing strategy Client whitepack algorithm corresponding with the client id;
The server-side, for the client whitepack algorithm to be sent to the client.
14. a kind of digital signature authentication device, which is characterized in that be applied to client, described device includes:
Information generating module, the client whitepack algorithm for being sent according to server-side generate the request letter for carrying digital signature Breath, the client whitepack algorithm are that the server-side is given birth to according to client id using preset Encryption Algorithm and aliasing strategy At, the digital signature is the verification information generated using the client whitepack algorithm;
Sending module, for the solicited message to be sent to the server-side.
15. device according to claim 14, which is characterized in that described device includes:
The sending module is also used to generate in the client whitepack algorithm sent according to server-side and carry digital signature Solicited message before, the client id is sent to the server-side;
Receiving module, the client whitepack algorithm sent for receiving the server-side.
16. device according to claim 15, which is characterized in that the client whitepack algorithm includes that at least one is obscured Algorithm and Encryption Algorithm.
17. device according to claim 16, which is characterized in that the client whitepack algorithm obscures calculation including first Method, Encryption Algorithm and the second Obfuscating Algorithms, described device further include:
Generation module is obscured, for generating and carrying digital signature in the client whitepack algorithm sent according to server-side Before solicited message, the aliasing strategy is utilized according to the client id, generates first Obfuscating Algorithms corresponding first Inverse Obfuscating Algorithms and second Obfuscating Algorithms corresponding second are against Obfuscating Algorithms.
18. device according to claim 17, which is characterized in that the information generating module, comprising:
Signature generates submodule, for by described first against Obfuscating Algorithms, described second against Obfuscating Algorithms and the client Whitepack algorithm is held, the digital signature is generated according to the request content in the solicited message;
It requests to determine submodule, for generating the solicited message according to the digital signature.
19. device according to claim 18, which is characterized in that the signature generates submodule, comprising:
Information acquisition unit, for obtaining the summary info of the request content, the summary info is to utilize preset function pair The information that the request content generates after being handled;
Obscure processing unit, obscures processing for carrying out against Obfuscating Algorithms to the summary info by described first;
Cryptographic processing unit, for successively utilizing first Obfuscating Algorithms in the client whitepack algorithm, the encryption Summary info is encrypted to against Obfuscating Algorithms obscuring that treated through described first for algorithm and second Obfuscating Algorithms, Encryption information is obscured to generate;
Solution obscures processing unit, for by described second against Obfuscating Algorithms to it is described obscure encryption information and carry out solution obscure place Reason, to generate the digital signature.
20. a kind of digital signature authentication device, which is characterized in that be applied to server-side, described device includes:
Receiving module, for receiving the solicited message with digital signature of client transmission;
Authentication module carries out verification operation to the solicited message, to sentence for utilizing first key corresponding with client id Whether the solicited message of breaking is legal.
21. device according to claim 20, which is characterized in that described device further include:
The receiving module is also used to before the solicited message with digital signature that the reception client is sent, receives The client id that the client is sent;
Generation module, for utilizing preset Encryption Algorithm and aliasing strategy, the client for generating the corresponding client id is white Box algorithm, the client whitepack algorithm include at least one Obfuscating Algorithms and Encryption Algorithm;
Sending module, for the client whitepack algorithm to be sent to the client;
Memory module, for storing the key of the corresponding Encryption Algorithm of the client id, using as the first key.
22. device according to claim 21, which is characterized in that the authentication module, comprising:
Cipher key lookup submodule, for searching the first key according to the client id, the first key is to utilize height Grade Encryption Standard AES algorithm encryption key generated;
Submodule is decrypted, for according to the first key, the digital signature in the solicited message to be decrypted, with Obtain signing messages;
Judging submodule is requested, for judging whether the solicited message is legal according to the signing messages.
23. a kind of computer readable storage medium, which is characterized in that store computer journey on the computer readable storage medium Sequence realizes the digital signature authentication side as described in any in claim 1 to 11 when the computer program is executed by processor Method.
CN201910064678.9A 2019-01-23 2019-01-23 Digital signature verification method, system, device and computer readable storage medium Active CN109728914B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201910064678.9A CN109728914B (en) 2019-01-23 2019-01-23 Digital signature verification method, system, device and computer readable storage medium

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201910064678.9A CN109728914B (en) 2019-01-23 2019-01-23 Digital signature verification method, system, device and computer readable storage medium

Publications (2)

Publication Number Publication Date
CN109728914A true CN109728914A (en) 2019-05-07
CN109728914B CN109728914B (en) 2022-04-08

Family

ID=66299266

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201910064678.9A Active CN109728914B (en) 2019-01-23 2019-01-23 Digital signature verification method, system, device and computer readable storage medium

Country Status (1)

Country Link
CN (1) CN109728914B (en)

Cited By (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110149312A (en) * 2019-04-09 2019-08-20 北京奇艺世纪科技有限公司 Data processing method, device, system and computer readable storage medium
CN110602138A (en) * 2019-09-26 2019-12-20 腾讯科技(深圳)有限公司 Data processing method and device for block chain network, electronic equipment and storage medium
CN110855667A (en) * 2019-11-14 2020-02-28 宁夏吉虎科技有限公司 Block chain encryption method, device and system
CN110891061A (en) * 2019-11-26 2020-03-17 中国银联股份有限公司 Data encryption and decryption method and device, storage medium and encrypted file
CN111193751A (en) * 2020-01-13 2020-05-22 临沂大学 Factory setting restoration method and equipment
CN112073200A (en) * 2020-09-02 2020-12-11 北京五八信息技术有限公司 Signature processing method and device
CN112804184A (en) * 2019-11-13 2021-05-14 阿里巴巴集团控股有限公司 Data obfuscation method, device and equipment
CN113810178A (en) * 2020-06-12 2021-12-17 中国移动通信有限公司研究院 Key management method, device, system and storage medium
CN113806710A (en) * 2021-09-26 2021-12-17 北京沃东天骏信息技术有限公司 Data processing method, device, equipment and storage medium
CN114844645A (en) * 2022-03-28 2022-08-02 五八有限公司 Data verification method and device, electronic equipment and storage medium

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101211451A (en) * 2007-12-21 2008-07-02 北京飞天诚信科技有限公司 Redepositing system and method based on digital sign
CN101282222A (en) * 2008-05-28 2008-10-08 胡祥义 Digital signature method based on CSK
CN108111622A (en) * 2017-12-29 2018-06-01 北京梆梆安全科技有限公司 A kind of method, apparatus and system for downloading whitepack library file

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101211451A (en) * 2007-12-21 2008-07-02 北京飞天诚信科技有限公司 Redepositing system and method based on digital sign
CN101282222A (en) * 2008-05-28 2008-10-08 胡祥义 Digital signature method based on CSK
CN108111622A (en) * 2017-12-29 2018-06-01 北京梆梆安全科技有限公司 A kind of method, apparatus and system for downloading whitepack library file

Cited By (15)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110149312A (en) * 2019-04-09 2019-08-20 北京奇艺世纪科技有限公司 Data processing method, device, system and computer readable storage medium
CN110149312B (en) * 2019-04-09 2021-10-15 北京奇艺世纪科技有限公司 Data processing method, device, system and computer readable storage medium
CN110602138A (en) * 2019-09-26 2019-12-20 腾讯科技(深圳)有限公司 Data processing method and device for block chain network, electronic equipment and storage medium
CN112804184A (en) * 2019-11-13 2021-05-14 阿里巴巴集团控股有限公司 Data obfuscation method, device and equipment
CN112804184B (en) * 2019-11-13 2023-10-10 阿里巴巴集团控股有限公司 Data confusion method, device and equipment
CN110855667A (en) * 2019-11-14 2020-02-28 宁夏吉虎科技有限公司 Block chain encryption method, device and system
CN110891061A (en) * 2019-11-26 2020-03-17 中国银联股份有限公司 Data encryption and decryption method and device, storage medium and encrypted file
CN111193751B (en) * 2020-01-13 2022-02-08 临沂大学 Factory setting restoration method and equipment
CN111193751A (en) * 2020-01-13 2020-05-22 临沂大学 Factory setting restoration method and equipment
CN113810178A (en) * 2020-06-12 2021-12-17 中国移动通信有限公司研究院 Key management method, device, system and storage medium
CN113810178B (en) * 2020-06-12 2023-05-05 中国移动通信有限公司研究院 Key management method, device, system and storage medium
CN112073200A (en) * 2020-09-02 2020-12-11 北京五八信息技术有限公司 Signature processing method and device
CN113806710A (en) * 2021-09-26 2021-12-17 北京沃东天骏信息技术有限公司 Data processing method, device, equipment and storage medium
CN114844645A (en) * 2022-03-28 2022-08-02 五八有限公司 Data verification method and device, electronic equipment and storage medium
CN114844645B (en) * 2022-03-28 2024-06-14 五八有限公司 Data verification method and device, electronic equipment and storage medium

Also Published As

Publication number Publication date
CN109728914B (en) 2022-04-08

Similar Documents

Publication Publication Date Title
CN109728914A (en) Digital signature authentication method, system, device and computer readable storage medium
CN114726643B (en) Data storage and access methods and devices on cloud platform
CN105007279B (en) Authentication method and Verification System
CN106549940B (en) Vehicle data transmission method and system
CN109039628A (en) Cryptographic key negotiation method, Cloud Server, equipment, storage medium and system
CN109309565A (en) A kind of method and device of safety certification
CN114257382B (en) Key management and service processing method, device and system
CN109800588B (en) Dynamic bar code encryption method and device and dynamic bar code decryption method and device
CN114024710A (en) Data transmission method, device, system and equipment
CN104243439B (en) Document transmission processing method, system and terminal
CN108989325A (en) Encryption communication method, apparatus and system
CN103974255B (en) A kind of vehicle access system and method
CN108768963A (en) The communication means and system of trusted application and safety element
CN103914913A (en) Intelligent card application scene recognition method and system
CN113382002B (en) Data request method, request response method, data communication system, and storage medium
CN109005184A (en) File encrypting method and device, storage medium, terminal
CN108200014A (en) The method, apparatus and system of server are accessed using intelligent key apparatus
CN108416224B (en) A kind of data encryption/decryption method and device
CN110708162A (en) Resource acquisition method and device, computer readable medium and electronic equipment
CN106549757B (en) Data authenticity identification method of WEB service, server and client
CN106789963B (en) Asymmetric white-box password encryption method, device and equipment
CN106453430A (en) Method and device for verifying encrypted data transmission paths
CN106204034B (en) Using the mutual authentication method and system of interior payment
CN109889344A (en) The transmission method and computer readable storage medium of terminal, data
CN116707958A (en) Data processing method and processor

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant