How is the data security of the third party electronic contract platform guaranteed?

A legal and effective electronic contract platform has five major security technologies.

Data encryption and decryption technology.

The most basic network security implementation technology is mainly divided into four types: data transmission, data storage, data integrity identification and key management technology. It is used to solve the encryption processing in the transmission and storage process of electronic contracts. The user can only decrypt the key if he holds the key.

The sender encrypts the message, transmits it to the receiver, who decrypts the message with its own and the other party's keys, and finally receives the complete message.

Digital signature technology.

It refers to the data contained in electronic form in the data message, attached to the data used to identify the identity of the signatory and indicate that the signatory recognizes the content therein, used to solve the identity problem of the electronic contract, focusing on solving the authentication problem of the user, and the scientific basis is the non-repeatability of the file hash value generated by the hash algorithm, and the use of asymmetric encryption algorithm.

Timestamp technology.

Through certain technical means, the time of data generation is authenticated, so as to verify whether this data has been tampered with after it is generated, and is used to solve the problem of fixing the time and signed content of the electronic contract, so that any change in its content can be verified and discovered, which is helpful to form non-repudiatory evidence, which is used to affix in the header of the electronic contract, determine the writing time of the contract, and also make the electronic contract have the nature of time series.

Digital certificate security authentication.

Even if the ID card of an individual or unit on the network, the digital certificate is currently the most mature and widely used information security technology in the world, which solves a series of problems such as the identity of network actors and information security through authoritative technology, and establishes an effective trust mechanism on the Internet based on cryptography and the use of digital signatures, digital envelopes, timestamp services and other technologies.

Electronic management of archives.

The original text and feature information of the electronic contract shall be preserved, and an effective legal report shall be issued in the event of a dispute, and the identity information, behavior information, and hash summary of the original content shall be uploaded to the blockchain of the third-party evidence preservation agency.

In short, with these five security technologies, enterprises can rest assured that they can sign electronic contracts on third-party electronic contract platforms, and now electronic contracts are not limited to the Internet industry, but have entered many application scenarios in various fields, which is a powerful tool for reducing costs and increasing efficiency in various industries.

For many enterprises, contracts are an important resource for the survival of enterprises, and after the transformation into electronic contracts, third-party electronic signature services need to be used, and electronic contracts will also be backed up and stored by third parties, which is very worrying.

There's virtually no need to worry about the security of your contract data!

The signed data packets of the electronic contract, the vouchers to be signed, and the synthetic vouchers after signing are all encrypted files, and the business-related data files are stored in the server, so there is no need to worry about leakage. Moreover, the three types of electronic data are encrypted with national secrets and will not be tampered with.

After the realization of paperless business, the transaction data and voucher data generated by Aoxiong will not be stored, and it is responsible for transmission under the system required by the other party, while the signed data packets are stored in a separate server of the other party, and Aoxiong has an encryption process.

If third-party evidence solidification is involved, only the hash information of the last encrypted data packet is stored in the third party, which is desensitized information and will not bring any risk to the customer, and the third-party evidence solidification and storage meets security-related requirements, it has relevant qualifications.

The conditions for a valid electronic contract are as follows:

1. According to Article 13 of the Electronic Signature Law of the People's Republic of China, an electronic signature shall be deemed to be a reliable electronic signature if it meets the following conditions at the same time:

1) When the data for the creation of electronic signatures is used for electronic signatures, it is the exclusive property of the electronic signatory;

2) At the time of signing, the electronic signature creation data is controlled only by the electronic signer;

3) any alteration of the electronic signature after signing can be detected;

iv)that any changes to the content and form of the data message after signature can be detected.

5) The parties may also choose to use electronic signatures that meet the reliable conditions agreed upon by them.

2. According to Article 14 of the Electronic Signature Law of the People's Republic of China, a reliable electronic signature has the same legal effect as a handwritten signature or seal.

3. According to Article 22 of the Electronic Signature Law of the People's Republic of China, the electronic certification service provider shall ensure that the content of the electronic signature authentication certificate is complete and accurate within the validity period, and ensure that the relying party of the electronic signature can confirm or understand the content contained in the electronic signature authentication certificate and other relevant matters.

Extension: If the electronic signer knows that the electronic signature production data has been or may have been confidential, fails to notify the relevant parties in a timely manner, terminates the use of the electronic signature production data, fails to provide true, complete and accurate information to the electronic certification service provider, or has other faults, causing losses to the electronic signature relying party or the electronic certification service provider, it shall be liable for compensation.

Where the electronic signer or the party relying on the electronic signature suffers losses as a result of engaging in civil activities based on the electronic signature authentication services provided by the electronic certification service provider, and the electronic certification service provider cannot prove that it is not at fault, it shall be liable for compensation.

If electronic authentication services are provided without permission, the competent department of the information industry shall order the illegal acts to be stopped; where there are unlawful gains, the unlawful gains shall be confiscated; where unlawful gains are more than 300,000 RMB, a fine of between 1 and 3 times the unlawful gains is to be given; where there are no unlawful gains or the unlawful gains are less than 300,000 RMB, a fine of between 100,000 and 300,000 RMB is to be given.

FYI.

How to ensure the legal validity of electronic contracts.

According to the laws of our country, only electronic contracts signed with reliable electronic signatures have legal effect. Article 13 of the Electronic Signature Law stipulates that an electronic signature shall be deemed to be a reliable electronic signature if it meets the following conditions at the same time:

1.When the electronic signature creation data is used for electronic signatures, it is the exclusive property of the electronic signer;

2.At the time of signing, the electronic signature creation data is controlled only by the electronic signer;

3.Any alteration to the electronic signature after signing can be detected;

From a legal point of view, it is necessary to ensure that the identities of the parties to the contract are true and reliable, and there is corresponding evidence to prove it, and if so, can we talk about the issue of legal effect.

Hello, 1. The parties to the contract have undergone real-name authentication, and 2. Use reliable electronic signatures that meet the requirements of the Electronic Signature Law. That is, before signing the contract, determine the true identity of the contracting entity and the signing process, effectively prevent the tampering of document data, and after the signing of the contract, the electronic contract that accurately records the signing time is recognized by law.

The validity of the electronic contract is mainly by proving that the identity of the signatory of the electronic contract is valid, the willingness to sign the electronic contract is valid, and the content of the electronic contract has not been tampered with after signing.

Therefore, the signing of electronic contracts is often not the validity of a certain technology, but a set of evidence chains stored in the process, which can ensure that each link is effective.

An electronic contract is in the form of an electronic digital signature (encryption) to prove the establishment of the contract, and it is not enough for the signature to be valid, the contract also needs to prove that it has not been tampered with.

As long as the national electronic commercial cryptography qualification certification, the certification of the Electronic Data Interchange (EDI) Service Center, and the technical processing of the firewall are carried out, and the authenticity is distinguished, the computer record of the electronic contract, that is, the electronic evidence, can be used as legal evidence to determine the facts and qualitatively process.

The information security in the process of signing an electronic contract mainly relies on third-party services, and if Party A and Party B sign an electronic contract, and the electronic data used by Party A is provided by Party B, it must not be able to guarantee whether Party B will leak, tamper with, or abuse our information. Only a third-party service provider that specializes in providing electronic contracts can ensure that the information is not used for other purposes.

Take the pencil box electronic contract platform as an example:

Real-name authentication:Before signing the contract, the user needs to carry out real-name identity authentication on the electronic contract platform of the pen box, and the platform will issue a CA certificate to you in conjunction with the CA organization.

Transmission encryption:The electronic signature guaranteed by the digital signature technology mechanism ensures that data and documents are not tampered with and lost in the process of electronic contract transmission.

Third Party Pick-up:In the process of signing the electronic contract, the pen box has the function of IP evidence storage, a unique time source evidence chain, and a credible timestamp to effectively prevent the contract from being signed by different people in different places and prevent illegal tampering of the contract.

PDF Tamper Proof:The electronic contract of the pencil box electronic contract platform adopts the encrypted format of PDF file, which plays a certain role in tamper-proofing.

Cloud Storage:Regarding the storage of contracts, in fact, electronic contracts are stored locally, and the evidentiary effect is low, because it is difficult for you to prove your innocence; If it is stored in a network service provider, it will be very troublesome to collect evidence; Therefore, the third-party electronic contract platform should be the best choice: the signed contract is encrypted and stored in secure cloud storage, which ensures the original output of the contract, simple evidence collection, and high legal effect.

To protect the data of electronic contracts, it is necessary to build a full-link and full-cycle protection system. The reliable third-party platform will ensure the security of user data from multiple perspectives such as data link, structured data storage, file storage, key management, user data permissions, user account management, data auditing, and operation and maintenance management.

1. Data link:Reliable third-party platforms: All file data transfer processes use SSL security protocol full-link encryption (back-to-origin links are also encrypted) to ensure that files will not be stolen during transmission.

2. Structured data and file encryptionThe structured data is encrypted with AES256 symmetry, and the encryption key is randomly generated in memory, which is not directly stored in any storage medium, but is encapsulated in the user's digital envelope by RSA asymmetric encryption algorithm, and two parts of the key are required to open this digital envelope, one part is obtained through the user's password, and the other part is stored in a third-party system, so as to ensure that the key will not be leaked. After encrypting the file data, it is broken up and stored in blocks through a cutting algorithm.

3. Key management:The user data encryption key is encapsulated in a digital envelope using the RSA algorithm. The digital envelope opening key is jointly obtained through the user password and an independent key subsystem.

User data, encryption keys, and digital envelope opening keys are stored in different subsystems, and finally extracted and used through user login authorization actions.

4. User data permissions:For contract data in an enterprise, the administrator needs to set and assign the corresponding access permissions, and the internal employee accounts have the corresponding data access permissions.

5. Account Management:Strict rules for real-name and information modification of personal accounts, decentralization and restriction of enterprise administrator authority, and auditability.

6. Data audit:All user behaviors and administrator management behaviors can be audited, and system administration and data management roles are decentralized.

7. Operation and maintenance managementThe internal subsystem of the electronic contract platform adopts a decentralized operation and maintenance strategy, and it is impossible for a single operation and maintenance personnel to obtain the encrypted data complete from any contract, let alone skip the user's self-decryption.

The electronic platform can provide customers with security and utility guarantee from the aspects of standardization and reliability

As a service-oriented platform for electronic contract signing, its main users are contracted users and notary publics. The contracted user refers to the parties to the contract who complete the upload and signing of the electronic contract through the transmission interface. Notaries mainly provide electronic contract verification and notarization services through the data information of the electronic contract signing process stored in the notary service subsystem.

Among them, the contracted user needs to perform identity authentication when logging in to the platform to verify that the user account is used by himself, effectively preventing the risk of fraudulent use of the identity of the contracted user. Electronic contracts are encrypted through digital signature technology to ensure the security of electronic contract transmission. The notary service subsystem only records the process information of electronic contract signing, and does not involve the content of electronic contracts, so as to realize the confidentiality of electronic contracts.

In addition, the platform also includes system administrators, who mainly carry out daily monitoring and operation and maintenance of the system.

Our products comply with the Electronic Signature Law, and when users sign contracts on the Chengda Sign electronic signing platform, they have verified the authenticity of the user's identity and passed the digital certificate issued by a formal licensed CA institution.

With the development of the Internet in recent years, the many benefits brought by electronic contracts have been recognized by enterprise users, which is not only convenient to manage and saves a large part of the cost, but also has legal protection.

Electronic Contracts. So what are the features that a good electronic contract platform should have:

1.Real-name authentication:

Real-name authentication is a verification of the authenticity of user information, which helps to clarify the identity of the signing entity. Secure signing electronic contracts support real-name authentication methods such as face recognition verification, ID number verification, mobile phone number verification, bank card number verification, and ELD verification of the Ministry of Public Security, quickly confirming the real identity of all parties signing and effectively avoiding fraud.

Through real-name authentication, the system will generate an electronic signature, and at the same time, it also guarantees the first condition for the validity of the electronic contract, the real identity.

3.Send the contract

After the contract is signed, add the "recipient" information, click "Next" to send the contract to other signatories, and use digital signature technology and digital certificate issued by CA to encrypt the original text of the electronic contract during the sending process to ensure that the contract is not tampered with during transmission, that is, "the original text has not been changed".

4.The other party signs

The other party will receive a text message, click on the link in the text message to enter, also complete the real-name verification, click on the contract to be signed, confirm that there is no problem with the content, add an electronic signature to complete the contract signing, and generate a "timestamp" to ensure that the signing time has not been changed, that is, "the signature has not been changed".

5.Contract depository

The preservation of electronic contracts is also crucial, and the contract is encrypted and stored in the cloud, and at the same time provides services such as contract signing tracking, classification and archiving, batch query, and multi-folder, so that users can quickly and accurately search for the target contract from a large number of contracts, which is convenient for later contract call, greatly improves work efficiency, and reduces all kinds of warehousing, manpower, and time costs.

Rest assured to sign the platformIdentity real-name verification is adopted, which includes the two elements of the Ministry of Public Security, the three elements of mobile phone numbers, the three or four elements of bank cards, face recognition, the two elements of enterprises, and the three elements of legal persons, which cover the effective identity information of units and individuals. And combined with mobile phone text messages, email and other ways to comprehensively ensure the true identity and true will of both parties.