TWI845063B - System and method for providing server to sign calculation data generated from article to be sign - Google Patents

Abstract

A system for providing a server to sign calculation data generated from an article to be sign and a method thereof are provided. By transmitting calculation data generated from an article from a signing client of a client device to a signing server through a security tunnel, and signing the calculation data by the signing server, the system and the method can achieve the effect of reducing time of signing and improving privacy and security of article to be sign.

Description

System and method for generating calculation data from a document to be signed for server signature

A signature system and method thereof, in particular, a system and method for generating calculation data from a document to be signed for server signature.

Digital signatures are used to verify digital data, usually generated by mathematical algorithms or other methods. A digital signature algorithm usually includes two complementary operations, one for generating a digital signature and the other for verifying the digital signature.

Currently, when generating a digital signature, the client that needs a digital signature usually sends the document to be signed to the signature server. The signature server calculates the document to be signed and generates a digital signature corresponding to the document to be signed, and then sends the generated digital signature back to the client for use.

In the early days, documents to be signed were mostly just text messages. The client would not use too much bandwidth to send text messages to the signature server, nor would it take too long to send the text messages. However, with the advancement of technology, the amount of data in the documents to be signed may be very large. For example, the document to be signed may be a binary file that can be executed, such as an executable file or an image file. In this case, the client needs to spend a certain amount of time to send the document to be signed to the signature server, and the signature server also needs to spend a certain amount of time to complete the calculation of the document to be signed and generate a digital signature corresponding to the document to be signed.

In addition, the document to be signed may contain sensitive information. If the document to be signed is sent to an external signature server for signature, it may be obtained by someone with ulterior motives during the transmission process, which will reduce the confidentiality and security of the sensitive information.

In summary, it can be seen that the prior art has long had the problem that it may take a long time to send data to the server for signature and there may be privacy and security issues. Therefore, it is necessary to propose improved technical means to solve this problem.

In view of the fact that the prior art may require a long waiting time to send data to a server for signature and may have privacy and security issues, the present invention discloses a system and method for generating calculation data from a document to be signed for server signature, wherein:

The system disclosed in the present invention generates calculation data from a document to be signed for server signature, and at least includes: a signature client, which is used to obtain a client certificate and to obtain the calculation data of the document to be signed, and the calculation data is generated by the document to be signed through specific calculations; a signature server, which is used to obtain a client certificate and store the client certificate to register the signature client, and to receive the client certificate sent by the signature client, and use the client certificate to confirm the identity of the signature client, and after the identity of the signature client is confirmed, establish a secure channel with the signature client to receive the calculation data sent by the signature client using the secure channel, and generate signature data based on the calculation data, and use the secure channel to send the signature data to the signature client.

The method disclosed in the present invention generates calculation data from a document to be signed for server signature, and its steps at least include: the signature client obtains a client certificate; the signature server obtains the client certificate to register the signature client; the signature client obtains the calculation data of the document to be signed, and the calculation data is generated by the document to be signed after specific calculation; the signature client transmits the client certificate to the signature server to provide the signature server with the client certificate to confirm the identity of the signature client, and the signature server establishes a secure channel with the signature client after the identity of the signature client is confirmed; the signature client uses the secure channel to transmit the calculation data to the signature server after the secure channel is established; the signature server generates signature data based on the calculation data, and uses the secure channel to transmit the signature data to the signature client.

The system and method disclosed in the present invention are as described above. The difference between the system and method and the prior art is that the present invention uses a secure channel to transmit the calculation data of the document to be signed to the signature server for signature through a signature client installed on the client device, thereby solving the problems existing in the prior art and achieving the technical effect of reducing the signing time for documents to be signed with large amounts of data and improving the privacy and security of the documents to be signed.

The following will be used in conjunction with drawings and embodiments to explain in detail the features and implementation methods of the present invention. The content is sufficient to enable anyone familiar with the relevant technology to easily and fully understand the technical means used by the present invention to solve the technical problems and implement them accordingly, thereby achieving the effects that can be achieved by the present invention.

The present invention can complete the signing of the document to be signed by the signing client extending from the signing server to the client device, so as to sign the document to be signed without transmitting the document to be signed out of the client device. There is no special restriction on the format of the document to be signed, for example, the document to be signed can be text data or binary file.

The signature server and client device mentioned in the present invention can be a computing device. The computing device mentioned in the present invention includes but is not limited to one or more processing modules, one or more memory modules, and hardware components such as a bus connecting different hardware components (including memory modules and processing modules). Through the multiple hardware components included, the computing device can load and execute the operating system so that the operating system runs on the computing device, and can also execute software or programs. In addition, the computing device also includes a housing, and the above-mentioned hardware components are arranged in the housing.

The bus of the computing device mentioned in the present invention may include one or more types, such as a data bus, an address bus, a control bus, an expansion bus, and/or a local bus. The buses of computing devices include but are not limited to the Industry Standard Architecture (ISA) bus, the Peripheral Component Interconnect (PCI) bus, the Video Electronics Standards Association (VESA) local bus, the Universal Serial Bus (USB) bus, the PCI Express (PCI-E/PCIe) bus, etc.

The processing module of the computing device of the present invention is coupled to a bus. The processing module includes a register group or a register space, which can be completely set on the processing chip of the processing module, or completely or partially set outside the processing chip and coupled to the processing chip via a dedicated electrical connection and/or via a bus. The processing module can be a central processing unit, a microprocessor, or any suitable processing element. If the computing device is a multi-processor device, that is, the computing device includes multiple processing modules, the processing modules included in the computing device are the same or similar, and are coupled and communicated through a bus. The processing module can interpret a computer instruction or a series of multiple computer instructions to perform specific calculations or operations, such as mathematical operations, logical operations, data comparison, copying/moving data, etc., to drive other hardware components in the computing device or run the operating system or execute various programs and/or modules.

Computing devices usually also include one or more chipsets. The processing module of the computing device can be coupled to the chipset or electrically connected to the chipset through a bus. The chipset is composed of one or more integrated circuits (ICs), including a memory controller and a peripheral input/output (I/O) controller, etc. That is, the memory controller and the peripheral input/output (I/O) controller can be included in one IC, or can be implemented using two or more ICs. The chipset usually provides input/output and memory management functions, as well as multiple general and/or dedicated registers, timers, etc., wherein the above-mentioned general and/or dedicated registers and timers can be accessed or used by one or more processing modules coupled or electrically connected to the chipset.

The processing module of the computing device can also access the data in the memory module and the mass storage area installed on the computing device through the memory controller. The above-mentioned memory module includes any type of volatile memory and/or non-volatile memory (NVRAM) memory, such as static random access memory (SRAM), dynamic random access memory (DRAM), read-only memory (ROM), flash memory, etc. The mass storage area mentioned above may include any type of storage device or storage media, such as a hard drive, optical disc, flash drive, memory card, solid state disk (SSD), or any other storage device. In other words, the memory controller can access data in static random access memory, dynamic random access memory, flash memory, hard drive, and solid state disk.

The processing module of the computing device can also be connected and communicated with peripheral devices or interfaces such as peripheral output devices, peripheral input devices, communication interfaces, and GPS receivers through the peripheral input/output controller via the peripheral input/output bus. The peripheral input device can be any type of input device, such as a keyboard, a mouse, a trackball, a touchpad, a joystick, etc. The peripheral output device can be any type of output device, such as a display, a printer, etc. The peripheral input device and the peripheral output device can also be the same device, such as a touch screen, etc. The communication interface may include a wireless communication interface and/or a wired communication interface. The wireless communication interface may include an interface supporting a wireless local area network (such as Wi-Fi, Zigbee, etc.), Bluetooth, infrared, near-field communication (NFC), 3G/4G/5G and other mobile communication networks (cellular networks) or other wireless data transmission protocols. The wired communication interface may be an Ethernet device, a DSL modem, a cable modem, an asynchronous transfer mode (ATM) device, or an optical fiber communication interface and/or component. The processing module can periodically poll various peripheral devices and interfaces, so that the computing device can input and output data through various peripheral devices and interfaces, and can also communicate with another computing device having the hardware components described above.

The following first uses "Figure 1" as a system architecture diagram of the present invention for generating calculation data from the document to be signed for server signature to illustrate the system operation of the present invention. As shown in "Figure 1", the system of the present invention includes a client device 110 and a signature server 120. In some embodiments, the client device 110 may include a client calculation terminal 111, a signature client 113, and an attachable data burning terminal 115; the signature server 120 may also include a signature server 123, and an attachable signature management terminal 121.

The client device 110 is responsible for generating the document 400 to be signed, and for transmitting the calculation data of the document 400 to be signed to the signature server 120 for signature. The document 400 to be signed can be data or files generated by the client device 110 providing input, such as text messages, image files, etc. The document 400 to be signed can also be generated by the client device 110 performing specific processing, such as executable files or binary files such as firmware images generated by compiled code, but the present invention is not limited to this. The following will further explain the various modules and components in the client device 110.

The client computing end 111 can perform specific calculations on the document to be signed 400 generated by the client device 110 to generate calculation data of the document to be signed 400. The above-mentioned specific calculations are, for example, hash operations such as SHA and MD5, but the present invention is not limited thereto. The client computing end 111 can also use a custom calculation rule to calculate the document to be signed 400 to generate calculation data, for example, taking out a plurality of specific bits from the document to be signed 400 to form calculation data, etc.

The signature client 113 is responsible for connecting to the signature server 123 of the signature server 120 through a wired or wireless network to transmit data or signals to and from the signature server 123 .

The signing client 113 is also responsible for obtaining the client certificate. In more detail, the signing client 113 can read the client certificate according to the file storage path specified by the user of the client device 110, or can generate a key pair including a private key and a public key and use the generated public key to apply for a client certificate corresponding to the generated private key.

The signing client 113 is also responsible for obtaining the calculation data of the document to be signed 400. Generally speaking, the signing client 113 can obtain the calculation data generated by the client calculation terminal 111. In some embodiments, the signing client 113 can also read the calculation data that is pre-generated and stored in a specified location.

The signature client 113 is also responsible for transmitting the obtained client certificate to the signature server 123. In more detail, the signature client 113 can transmit the client certificate to the signature server 123 through an authentication request before transmitting the calculation data of the document 400 to be signed to the signature server 123, so that the signature server 123 can identify the identity of the signature client 113 based on the client certificate. In some embodiments, the signature client 113 can also receive the server certificate transmitted by the signature server 123 and confirm the identity of the signature server 123 based on the server certificate.

The signature client 113 is also responsible for transmitting the calculation data of the document 400 to be signed to the signature server 123. Generally speaking, the signature client 113 can use the secure channel to transmit the calculation data to the signature server 123 only when the signature server 123 identifies the identity of the signature client 113 through the client certificate of the signature client 113 and establishes a secure channel with the signature client 113. The signature client 113 is also responsible for receiving the signature data generated by the signature server 123 through the secure channel between the signature server 123 and the signature server 123. In addition, the signature client 113 can also provide the received signature data to the data burning terminal 115.

The data burning terminal 115 can obtain the document to be signed 400 generated by the client device 110, the signature data received by the signature client 113, and the server certificate of the signature server 120, and can burn the obtained document to be signed 400, signature data, and server certificate to the hardware device 140. If the document to be signed 400 is a firmware image file, the hardware device 140 can use the server certificate and signature data to verify the document to be signed 400 during secure startup, and can load and execute the document to be signed 400 to start the hardware device 140 after the document to be signed 400 passes the verification.

The signature server 120 is responsible for signing the calculation data obtained by the signature client 113 installed in the client device 110 to provide the signature data to the client device 110 .

The signature management terminal 121 can manage the keys that can be used by the signature server 123, and can provide the corresponding keys to the signature server 123 according to the usage requirements of the signature server 123. Generally speaking, when the signature server 123 can use multiple keys, the signature management terminal 121 will be set in the signature server 120, but the present invention is not limited to this. In some embodiments, the signature management terminal 121 can also include a hardware security module (HSM), and the included hardware security module can be used to store keys, but the present invention is not limited to this.

The signature server 123 is responsible for storing the client certificate obtained by the signature client 113 to register the signature client 113. It should be noted that the client certificates stored in the signature server 123 are usually not received from the signature client 113. For example, the signature server 123 may provide a user interface or application program interface for importing certificates, so that the administrator of the signature server 120 may import the client certificates into the signature server 123 through the user interface or application program interface. The signature server 123 may store the imported client certificates to register the signature client 113 that obtains the imported client certificates, for example, adding the signature client 113 that obtains the imported client certificates to the whitelist, etc.

The signature server 123 is responsible for receiving the client certificate sent by the signature client 113, and is responsible for using the received client certificate to confirm the identity of the signature client 113. For example, the signature server 123 can receive the authentication data sent by the signature client 113, and can use the client certificate (including the public key) pre-registered by the signature client 113 to verify the authentication data to confirm the identity of the signature client 113. In some embodiments, the signature server 123 also transmits the server certificate to the signature client 113, so that the signature client 113 can verify the identity of the signature server 123 in a manner similar to the above.

The signature server 123 is also responsible for establishing a secure channel with the signature client 113 after the identity of the signature client 113 that sent the client certificate is confirmed, so that the signature client 113 can serve as an extension of the signature server 123 on the client device 110.

The signature server 123 is also responsible for receiving the calculation data sent by the signature client 113 through the secure channel established with the signature client 113, generating signature data based on the received calculation data, and returning the generated signature data to the signature client 113 using the secure channel established with the signature client 113. The signature server 123 can directly sign the calculation data to generate the signature data, or first calculate the digest data of the calculation data and then sign the generated digest data to generate the signature data. The digest data is usually a digital fingerprint of the calculation data, such as a hash value of the calculation data, but the present invention is not limited thereto.

Next, an embodiment is used to explain the operating system and method of the present invention, and please refer to "Figure 2A" for a flow chart of the method of generating calculation data from the document to be signed for the server to sign. In this embodiment, it is assumed that the client device 110 is a program development machine, but the present invention is not limited to this.

When the user of the client device 110 wishes to use the present invention to sign the binary file generated by compiling the product code of the client device 110 , the user can operate the client device 110 to install the signing client 113 .

After the signing client 113 is installed and executed on the client device 110, the signing client 113 can obtain the client certificate (step 210). In this embodiment, it is assumed that the signing client 113 can generate a key pair including a corresponding private key and a public key as shown in the process of "Figure 2B" (step 211), and use the generated public key to apply for a client certificate corresponding to the generated private key through a certificate registration authority (RA) or directly from a certificate issuing center (CA) (step 215). In addition, if the client device 110 has applied for a client certificate in advance, the signing client 113 can also read the client certificate according to the storage path set by the user of the client device 110.

After the signing client 113 of the client device 110 obtains the client certificate (step 210), the signing server 123 of the signing server 120 may store the client certificate obtained by the signing client 113 to register the signing client 113 (step 220). In this embodiment, it is assumed that the signature server 123 can provide a user interface to the administrator of the signature server 120. After obtaining the client identification data and client certificate of the signature client 113 provided by the user of the client device 110, the administrator of the signature server 120 can import the client identification data and client certificate of the signature client 113 into the signature server 123 through the user interface provided by the signature server 123. The signature server 123 can store the imported client identification data and client certificate as a piece of data, so that the signature client 113 can be registered in the signature server 123.

After the signature client 123 of the signature server 120 completes the registration of the signature client 113 of the client device 110, when the document 400 to be signed is generated by the client device 110, the signature client 113 can obtain the calculation data of the document 400 to be signed generated by the client device 110 (step 240). In this embodiment, assuming that the document 400 to be signed is a firmware image file generated by the user of the client device 110 completing program development and compiling the developed program, the signature client 123 can obtain the calculation data generated by the client computing terminal 111 after performing specific calculations such as hash calculations on the firmware image file (document 400 to be signed) on the client computing terminal 111 to generate calculation data (step 230).

After the signature client 113 of the client device 110 obtains the calculation data of the document to be signed 400 generated by the client device 110 (step 240), a secure channel can be established with the signature server 123 of the signature server 120 to transmit the document to be signed 400 to the signature server 123. More specifically, the signature client 113 can first transmit the client certificate to the signature server 123 (step 251), and the signature server 120 of the signature server 120 can then send the client certificate to the signature server 123 (step 252). After receiving the client certificate sent by the signing client 113 of the client device 110, 123 can use the received client certificate to determine the identity of the signing client 113, that is, to determine whether the signing client 113 that sent the client certificate has been registered. The signing server 123 can also establish a secure channel with the signing client 113 that sent the client certificate after determining that the signing client 113 that sent the client certificate has been successfully registered (step 255). In this embodiment, it is assumed that a secure channel can be established between the signature client 113 and the signature server 123 using the Transport Layer Security (TLS) protocol. For example, the signature server 123 can transmit its own server certificate to the signature client 113, so that the signature client 113 can verify the identity of the signature server 123 based on the received server certificate, and the signature server 123 can verify the identity of the signature client 113 based on the received client certificate. When the signature server 123 successfully verifies the identity of the signature client 113 and the signature client 113 successfully verifies the identity of the signature server 123, the signature server 123 and the signature client 113 can establish a TLS secure channel.

In practice, the signature client 113 of the client device 110 may also transmit the client certificate to the signature server 123 of the signature server 120 and establish a secure channel with the signature server 123 (steps 251, 255) before obtaining the binary file generated by the client device 110 or obtaining the calculation data waiting for the signature document 400 (step 240).

After establishing a secure channel with the signature server 123 of the signature server 120 , the signature client 113 of the client device 110 may use the established secure channel between the signature client 113 and the signature server 123 to transmit the obtained calculation data of the document to be signed 400 to the signature server 123 (step 260 ).

After receiving the calculation data sent by the signature client 113 of the client device 110, the signature server 123 of the signature server 120 can generate signature data according to the received calculation data, and can return the generated signature data to the signature client 113 through the established secure channel between the signature client 113 and the signature server 123 (step 270). In this embodiment, it is assumed that the signature server 123 can use the calculation data as the data to be signed, and according to the known signing process, perform a hashing operation on the calculation data to generate summary data and use the private key of the signature server 123 to sign the generated summary data to generate signature data. Afterwards, the signature server 123 can transmit the signature data to the signature client 113 through a secure channel between the signature server 123 and the signature client 113.

Thus, through the present invention, the document to be signed 400 can be signed by the signature server 120 provided by a third-party notary public institution using the calculation data generated by the document to be signed 400 without leaving the client device 110, thereby satisfying the privacy and security of the document to be signed 400 and reducing the time for transmitting the document to be signed 400 and generating the signature data.

In the above embodiment, if the client device 110 further includes a data burning terminal 115, then as shown in the process of "FIG. 2C", after the signature client 113 of the client device 110 receives the signature data returned by the signature server 120 (step 270), the data burning terminal 115 can obtain the firmware image file (document to be signed 400) generated by the client device 110, the signature data received by the signature client 113, and the signature The server 120 obtains the server certificate (step 280), and the obtained signature data and the server certificate can be burned together with the document to be signed 400 into the hardware device 140, so that when the hardware device 140 is securely started, the signature data and the server certificate can be used to verify the firmware image file (the document to be signed 400), and the firmware image file can be loaded to start the hardware device 140 after the document to be signed 400 passes the verification (step 290).

In summary, the difference between the present invention and the prior art lies in the technical means by which the signature client installed on the client device transmits the calculation data of the document to be signed to the signature server for signature using a secure channel. This technical means can solve the problem of the prior art that it may take a long time to send data to the server for signature and may have privacy and security issues, thereby achieving the technical effect of reducing the signing time of documents to be signed with large amounts of data and improving the privacy and security of the documents to be signed.

Furthermore, the method of the present invention for generating calculation data from the document to be signed for server signature can be implemented in hardware, software or a combination of hardware and software, and can also be implemented in a centralized manner in a computer system or in a distributed manner with different components distributed in several interconnected computer systems.

Although the implementation methods disclosed in the present invention are as above, the contents described are not intended to directly limit the scope of patent protection of the present invention. Any person with common knowledge in the technical field to which the present invention belongs, without departing from the spirit and scope disclosed by the present invention, makes slight changes and modifications to the implementation of the present invention in form and details, which are all within the scope of patent protection of the present invention. The scope of patent protection of the present invention shall still be based on the scope defined in the attached patent application.

110: Client device 111: Client calculation terminal 113: Signature client 115: Data burning terminal 120: Signature server 121: Signature management terminal 123: Signature server 140: Hardware device 400: Document to be signed Step 210: The signature client obtains the client certificate Step 211: The signature client generates a key pair including a private key Step 215: The signature client applies for a client certificate corresponding to the private key Step 220: The signature server obtains the client certificate to register the signature client Step 230: The document to be signed generates calculation data after specific calculations Step 240: The signature client obtains the calculation data of the document to be signed Step 251: The signature client transmits the client certificate to the signature server to provide the signature server with the client certificate to confirm the identity of the signature client Step 255: The signature server uses the client certificate to confirm the identity of the signature client and establishes a secure channel between the signature client and the signature server Step 260: The signature client transmits the calculation data to the signature server using the secure channel Step 270: The signature server generates signature data based on the calculation data and transmits the signature data to the signature client using the secure channel Step 280: The data burning terminal obtains the document to be signed, the signature data and the server certificate of the signature server Step 290: The data burning end burns the document to be signed, the signature data and the server certificate to the hardware device, so that the hardware device uses the server certificate and signature data to verify the document to be signed during security startup, and loads and executes the document to be signed after the document to be signed passes the verification.

Figure 1 is a system architecture diagram of the invention for generating calculation data from the document to be signed for server signature. Figure 2A is a flow chart of the method for generating calculation data from the document to be signed for server signature. Figure 2B is a flow chart of the method for the signature client to apply for a client certificate. Figure 2C is a flow chart of the method for burning a verifiable boot image file to a hardware device.

Step 210: The signing client obtains the client certificate

Step 220: The signature server obtains the client certificate to register the signature client

Step 230: The document to be signed undergoes specific calculations to generate calculation data

Step 240: The signature client obtains the calculation data of the document to be signed

Step 251: The signing client sends the client certificate to the signing server, so that the signing server can use the client certificate to confirm the identity of the signing client.

Step 255: After the signature server uses the client certificate to confirm the identity of the signature client, it establishes a secure channel between the signature client and the signature server.

Step 260: The signature client uses a secure channel to transmit the calculation data to the signature server

Step 270: The signature server generates signature data based on the calculation data and transmits the signature data to the signature client using a secure channel

Claims (10)

A system for generating calculation data from a document to be signed for server signature, the system at least comprising: a signature client, used to obtain a client certificate, and used to obtain a calculation data of a document to be signed, the calculation data is generated by a specific calculation of the document to be signed; a signature server, used to obtain the client certificate and store the client certificate to register the signature client, and used to receive the client certificate sent by the signature client, and use the client certificate to confirm the identity of the signature client, and after the identity of the signature client is confirmed, establish a secure communication with the signature client. A channel is used to receive the calculation data transmitted by the signature client using the secure channel, generate a signature data according to the calculation data, and transmit the signature data to the signature client using the secure channel; and a data burning terminal is used to obtain the document to be signed, the signature data, and a server certificate of the signature server, and burn the document to be signed, the signature data, and the server certificate into a hardware device, so that the hardware device uses the server certificate and the signature data to verify the document to be signed during secure startup, and loads and executes the document to be signed after the document to be signed passes the verification. A system for generating computational data from a document to be signed for server signing as described in claim 1, wherein the signing client generates a private key and applies for the client certificate corresponding to the private key to obtain the client certificate. A system for generating calculation data from a document to be signed for server signature as described in claim 1, wherein the signature server signs the calculation data to generate the signature data, or the signature server calculates a summary data of the calculation data and signs the summary data to generate the signature data. A system for generating calculation data from a document to be signed for server signature as described in claim 1, wherein the system further comprises a client computing end for performing a hash operation on the document to be signed to generate the calculation data. A system for generating calculation data from a document to be signed for server signature as described in claim 1, wherein the system further comprises a signature management terminal for using a hardware security module to store the key used by the signature server, and for providing the key to the signature server so that the signature server generates the signature data based on the calculation data. A method for generating calculation data from a document to be signed for server signing, the method comprising at least the following steps: a signing client obtains a client certificate; the signing server obtains and stores the client certificate to register the signing client; the signing client obtains a calculation data of a document to be signed, the calculation data is generated by the document to be signed through specific calculation; the signing client transmits the client certificate to the signing server to provide the signing server with the client certificate to confirm the identity of the signing client, and the signing server establishes a secure channel with the signing client after the identity of the signing client is confirmed; After the secure channel is established, the signature client uses the secure channel to transmit the calculation data to the signature server; the signature server generates a signature data based on the calculation data, and transmits the signature data to the signature client using the secure channel; and a data burning end obtains the document to be signed, the signature data, and a server certificate of the signature server, and burns the document to be signed, the signature data, and the server certificate into a hardware device, so that the hardware device uses the server certificate and the signature data to verify the document to be signed during secure startup, and loads and executes the document to be signed after the document to be signed passes the verification. The method of generating computational data from the document to be signed for server signing as described in claim 6, wherein the step of the signing client obtaining the client certificate further includes the step of the signing client generating a private key and applying for the client certificate corresponding to the private key. The method of generating calculation data from the document to be signed for server signature as described in claim 6, wherein the step of the signature server generating the signature data based on the calculation data is that the signature server signs the calculation data, or the signature server calculates a summary data of the calculation data and signs the summary data. The method of generating calculation data from the document to be signed for server signature as described in claim 6, wherein the step of generating the calculation data by performing a specific calculation on the document to be signed is that a client computing end performs a hashing operation on the document to be signed to generate the calculation data. The method of generating computational data from the document to be signed for server signature as described in claim 6, wherein the signature server obtains and stores the client certificate to register the signature client, and further includes the signature server providing a user interface or application program interface for importing the client certificate to obtain the client certificate.

Images