At present, there are two main aspects that affect the security of e-commerce: computer network security and business transaction information security. Computer network security refers to the security of computer network as an e-commerce trading platform, which includes computer network equipment security, computer network system security, database security and so on. Business transaction information security includes preventing information eavesdropping, tampering, camouflage, etc., ensuring the integrity and availability of e-commerce data, the certainty of the identities of both parties to the transaction, and the non-repudiation of the transaction behavior.
due to the virtuality and anonymity of e-commerce trading platform on the internet, the problems of computer network security and business transaction information security have become more and more prominent, and the application of electronic signature technology and its legislation provide an important guarantee for the safe operation of e-commerce.
I. Meaning of electronic signature
Electronic signature is a general term for modern authentication technology. According to the Uniform Electronic Transactions Act of the United States, "electronic signature" refers to "an electronic sound, conformity or procedure that is associated with or logically associated with an electronic record, and that electronic sound, conformity or procedure is signed or adopted by someone for the purpose of signing an electronic record"; According to the United Nations Model Law on Electronic Commerce, an electronic signature is data in electronic form that is contained in, attached to or logically associated with a data message, and it can be used to confirm the identity of the signatory related to the data message and show that the signatory approves the information contained in the data message; The European Union's Electronic Signature Directive stipulates that "electronic signature" generally refers to "data in electronic form connected with other electronic records or logically connected and used as authentication method."
from the above definition, any electronic technical means that can prove the identity of the parties and the approval of the contents of the documents in electronic communication can be called electronic signature. Electronic signature is the general concept of modern authentication technology, and it is an important guarantee for the security of e-commerce.
in short, the so-called electronic signature refers to the data contained in the data message in electronic form and attached to identify the identity of the signer and show that the signer approves the contents. Generally speaking, electronic signature is the electronic signature of electronic documents through cryptographic technology, not the digital visualization of written signatures, but similar to handwritten signatures or seals, which can also be said to be electronic seals.
At present, electronic signature can be realized by various technical means. After confirming the exact identity of the signer, electronic signature admits that people can sign an electronic record in many different ways. The methods include: digital signature based on PKI public key cryptography; Identification mark based on biometric statistics; Identification of handprints, voice prints or retinal scans; A password code, password or personal identification PIN； that enables the recipient to identify the sender; Computers based on quantum mechanics and so on.
ii. legislation of electronic signature
from the legal point of view, giving electronic signature the same legal status as traditional signature and seal is the premise for the wide application and effectiveness of electronic signature, and it is also the core content of international e-commerce legislation in the past decade.
On April 1st, 25, China officially promulgated and implemented the Electronic Signature Law of the People's Republic of China (hereinafter referred to as the Electronic Signature Law). Its promulgation provides a basic legal guarantee for the development of e-commerce in China, which solves the basic problem of the legal effect of electronic signatures, and makes clear provisions on a series of issues such as e-commerce certification bodies, the security of electronic signatures, the code of conduct of signers, and the determination of disputes in electronic transactions.
with the relevant provisions of the electronic signature law, many problems in the development of e-commerce will be solved, real online transactions will gradually develop, and some problems that restrict the development of e-commerce will be gradually solved in the development, and China's e-commerce will soon get out of the state of no legal basis and blind disorder. However, the Electronic Signature Law cannot solve the security problem of e-commerce once and for all. The law can only provide a basic guarantee, and the Electronic Signature Law can improve the integrity to a certain extent. However, in order to better promote the development of e-commerce, the most important thing is to establish an honest environment with high credibility, which requires e-commerce websites and e-commerce transaction subjects to make greater efforts in the future.
iii. the relationship between electronic signature and electronic signature, electronic seal and digital signature
electronic signature means that it exists in electronic form, is attached to an electronic document and is logically related to it, and can be used to identify the identity of the signer of the electronic document and indicate that the signer agrees with the contents of the electronic document. The electronic signature must be made by a security procedure that meets specific requirements, so as to ensure the security of the signature. The electronic signature made according to a specific security procedure is defined as a secure electronic signature, which is different from the general electronic signature and gives it the effect of being legally regarded as a signature or seal. Therefore, the electronic signature system mainly solves the problem of signature and seal of electronic documents, which is used to identify the identity of the signer of electronic documents, ensure the integrity of documents, and ensure the authenticity, reliability and non-repudiation of documents; Electronic signature should be one of the important components of electronic signature.
an electronic seal is divided into an electronic official seal and an electronic name seal. It is an electronic seal that encrypts the official seal or name seal through PKI technology and uses it as a digital authentication storage medium. Seals and management systems must be authorized by the government before they can be made. Electronic seals are expected to replace traditional seals in many fields, and become an effective measure to promote the development of e-commerce and e-government after the implementation of the Electronic Signature Law, such as online tax declaration, electronic invoices, online settlement and annual inspection of enterprises.
PKI-based electronic signature is called "digital signature". It is wrong for some people to call "electronic signature" as "digital signature". Digital signature is only a specific form of electronic signature. Although electronic signature has gained technical neutrality, it also brings inconvenience to use, and the law has further stipulated electronic signature, such as "reliable electronic signature" and "advanced electronic signature" in the Electronic Signature Law. In fact, the function of digital signature is stipulated, which makes digital signature obtain better application security and operability. At present, the only practical electronic signature is public key cryptography. Therefore, the digital signature technology based on PKI is widely used, mature and practical at home and abroad. As a public key infrastructure, PKI can provide a variety of online security services, such as authentication, data confidentiality, data integrity and non-repudiation, in which digital signature technology is used.
the core executing agency of PKI is the electronic certification service provider, which is commonly known as the certification authority CA, and the core element of PKI signature is the digital certificate issued by CA. The PKI services it provides are authentication, data integrity, data confidentiality and non-repudiation. Its practice is to use the certificate public key and its corresponding private key to encrypt/decrypt, and generate the signature and verification signature of the digital message. Digital signature is to use public key cryptography and other cryptographic algorithms to generate a series of symbols and codes to form an electronic password for signature, instead of writing signatures and seals; This electronic signature can also be technically verified, and its verification accuracy is incomparable to that of manual signature and stamp. This signature method can be used for authentication in a large crowd of trusted PKI domains or cross-authentication in multiple trusted PKI domains, and it is especially suitable for security authentication and transmission on the Internet and WAN.
iv. application of electronic signature in e-commerce
the application fields of electronic signature include e-commerce, enterprise information system, online government procurement, finance, accounting, insurance industry, food, medicine, education, scientific research and document management. But the most important thing is in e-commerce, which integrates the information exchange and transaction between buyers, sellers and middlemen (such as financial institutions) on the Internet, such as signing contracts, ordering and paying. At present, electronic signature plays a very important role in e-commerce in major developed countries and many other countries, including third world countries.
due to the "electronic signature law" which has been implemented in China, the application of electronic signature in e-commerce is mainly manifested in the following aspects:
firstly, it has a great role in promoting and developing e-commerce in China. The purpose of electronic signature law is to ensure the safety of electronic commerce, safeguard the legitimate interests of all parties concerned and promote the development of electronic commerce, and this law is formulated. With the Electronic Signature Law, the non-repudiation of participants in e-commerce can be solved and the security of e-commerce transactions can be improved. It can realize online automatic payment and solve the bottleneck problem of e-commerce in China at present.
Secondly, it is applied to the financial sector, which is the most active and extensive field of electronic signature application. When banks verify the authenticity of online banking users' identities, the users' identities must be true and reliable, and the signature has practical significance, which is the basis of using digital signatures. Transactions with large transaction volume and high security requirements must use digital signatures. Because digital signature is a relatively complex calculation method, the process of signing consumes certain system resources, and it is generally used in online banking business with large transaction amount and high security requirements. As a unified third-party security certification institution in the financial industry, it has played an important role in ensuring the security of online transactions and providing fair and credible certification services. The above is the application characteristics of electronic signature in online banking; In terms of the scope and breadth of application, digital signature technology is basically used in online banking in China at present.
the third is the reform of the bill law. with the electronic signature law as the mother law, China's bill law should be based on the electronic signature law to formulate and improve a whole set of new banking regulations. In this way, banks can save a lot of paper printing, reduce costs and improve efficiency. There are also online securities trading, online taxation, etc. On the one hand, there is no good secure payment agreement, and more importantly, there is no legal guarantee for digital signature; Technology is the foundation, and law is the guarantee. These are all areas where "electronic signature" is more widely used.
Finally, it is the revision of the Contract Law, and contracts can also appear in the form of electronic documents. With electronic signature as a guarantee, online bidding and online procurement can be based on electronic contracts. In order to meet the needs of traditional business operation, electronic signature and traditional manual signature or seal can be made into "electronic signature" visualization, that is, while verifying the authenticity of electronic signature, graphical handwritten signature or seal can be printed, which can adapt to the traditional customary authentication method and push the signature to the field of advanced electronic technology.
there is no doubt that with the further refinement of the implementation of the electronic signature law and its application and popularization in practice, electronic signature will bring about a profound revolution in online transactions and processing in finance, commerce and taxation, which will greatly promote the development of e-commerce and e-government in China.