TWI897686B - Signature certification authorization system, method and computer readable medium - Google Patents

Abstract

The invention discloses a signature certification authorization system, method and computer readable medium. A signature web service module receives a signature request from a user terminal, a behavior analysis module retrieves the user terminal's previous user behavior data from a user behavior log based on the signature request to further analyze the user terminal's multiple behavior indicators, and then a behavior scoring module calculates the user terminal's behavior score based on the multiple behavior indicators. Furthermore, a JSON Web Token control module embeds the user terminal's behavior score into a payload of a JSON Web Token. During authentication or verification, the JSON Web Token control module authenticates or verifies validity of the JSON Web Token, and then provides a processing method for distinguishing different permissions based on the user terminal's behavior score, so as to efficiently control the user terminal's permission.

Description

Signature authentication authorization system, method and computer-readable medium

The present invention relates to a signature authentication and authorization technology, and more particularly to a signature authentication and authorization system, method, and computer-readable medium.

In the rapidly evolving world of web development, strong and secure authentication mechanisms are needed. JSON Web Token (JWT) has become a popular solution and has revolutionized the way applications handle client authentication.

However, in traditional approaches, authorization is typically assigned directly to individual clients. However, if a client's role or behavior changes, the client's permissions need to be manually adjusted, which can lead to security risks.

Currently, the signature web service frontend directly connects to the signature service application programming interface (API) through the member management module. However, this design cannot detect suspicious client activity or adjust authentication priority based on client behavior patterns.

Furthermore, existing technologies are unable to analyze multiple behavioral indicators based on the client's user behavior log, nor are they able to calculate the client's behavior score based on multiple behavioral indicators. Furthermore, they are unable to embed the client's behavior score into the payload of a JSON network token to serve as a basis for dynamic adjustment or control of permissions.

Therefore, providing an innovative signature authentication and authorization technology to resolve any of the aforementioned issues, or providing related systems and methods, has become a major research topic for technical personnel in this field.

The signature authentication and authorization system of the present invention includes: a signature web service module, a behavior analysis module and a behavior scoring module. The signature web service module is used to receive the signature request of the client, so that the behavior analysis module extracts the client's previous multiple user behavior data from the user behavior log according to the signature request of the client received by the signature web service module, and then the behavior analysis module analyzes the client's multiple behavior indicators based on the client's previous multiple user behavior data, so that the behavior scoring module calculates the client's behavior score based on the client's multiple behavior indicators analyzed by the behavior analysis module; and a JSON network token management module, which is used to The JSON Network Token Control Module embeds the client's behavior score calculated by the Behavior Scoring Module into the payload of the client's JSON Network Token. When authenticating or validating the client's JSON Network Token, the JSON Network Token Control Module authenticates or verifies the validity of the client's JSON Network Token. If the client's JSON Network Token is authenticated or verified as valid, the JSON Network Token Control Module provides a method for differentiating permissions for the client based on the client's behavior score in the JSON Network Token's payload, thereby controlling the client's permissions.

The signature authentication and authorization method of the present invention includes: a signature web service module receives a signature request from a client, a behavior analysis module extracts a plurality of previous user behavior data of the client from a user behavior log according to the signature request received by the signature web service module, and then the behavior analysis module analyzes a plurality of behavior indicators of the client according to the plurality of previous user behavior data of the client, so that a behavior scoring module calculates a behavior score of the client according to the plurality of behavior indicators of the client analyzed by the behavior analysis module; and a JSON network token control module converts the signature request received by the signature web service module into a signature request. The client's behavior score calculated by the behavior scoring module is embedded in the payload of the client's JSON network token. When the client's JSON network token is authenticated or verified, the JSON network token control module authenticates or verifies the validity of the client's JSON network token. If the client's JSON network token is authenticated or verified as valid, the JSON network token control module provides a method for differentiating permissions for the client based on the client's behavior score in the JSON network token payload, thereby managing the client's permissions.

The computer-readable medium of the present invention is used in a computing device or computer to store instructions. The computer-readable medium is executed by a processor and memory to perform the aforementioned signature authentication and authorization method.

Therefore, the present invention provides an innovative signature authentication and authorization system, method, and computer-readable medium. This system enables a behavior analysis module to automatically analyze multiple behavioral indicators based on a client's behavior log. A behavior scoring module can also rapidly calculate a client's behavior score based on these multiple behavioral indicators. Furthermore, a JSON network token management module can automatically embed the client's behavior score into the payload of a JSON network token, effectively serving as a basis for dynamic adjustment or control of permissions.

In other words, the signature web service module of the present invention can automatically receive signature requests from clients, enabling the behavior analysis module to instantly retrieve the client's previous multiple user behavior data from the user behavior log based on the signature request. It can also quickly analyze the multiple useful behavioral indicators of the client from this multiple user behavior data, allowing the behavior scoring module to accurately calculate the client's behavior score based on these multiple behavioral indicators.

Furthermore, the JSON network token management module of the present invention can automatically embed the behavior score into the payload of the client's JSON network token, instantly authenticate or verify the validity of the client's JSON network token, and provide different permission-based processing methods based on the client's behavior score, thereby facilitating efficient control of client permissions.

To make the above-mentioned features and advantages of the present invention more readily apparent, the following examples are provided with accompanying drawings for detailed description. Additional features and advantages of the present invention will be partially explained in the following description, and some of these features and advantages will be apparent from the description or may be learned through practice of the present invention. It should be understood that both the foregoing general description and the following detailed description are illustrative and explanatory only and are not intended to limit the scope of the present invention.

1: Signature Authentication and Authorization System

10: Signature web service module

11: Signature Request

20: User Management Module

21: User behavior log

30: Behavior Analysis Module

31: User behavior data

32: Behavioral indicators

40: Behavior Scoring Module

41: Behavior score

42: Priority

43: Prediction Model

50:JSON network token management module

51:JSON Network Token

52: Header

53: Payload

54:Signature

60: Signature Service Interface Application Programming Interface

61: Application Programming Interface

A: Client

B: Identity information

S1 to S5: Steps

Figure 1 is a schematic diagram of the signature authentication and authorization system of the present invention.

Figure 2 is a schematic diagram of the signature authentication and authorization process of the present invention.

The following describes the implementation of the present invention using specific embodiments. Those skilled in the art will understand the other advantages and benefits of the present invention from the disclosure herein and will be able to implement or utilize the present invention through other equivalent embodiments.

Figure 1 is a schematic diagram of the signature authentication and authorization system 1 of the present invention. As shown in Figure 1, the signature authentication and authorization system 1 may include a signature web service module 10, a user management module 20, a behavior analysis module 30, a behavior scoring module 40, a JSON network token management module 50, and a signature service interface application programming interface (API) 60, all of which are interconnected.

In one embodiment, the signature web service module 10 can communicate with client A, the user management module 20, and the behavior analysis module 30. The user management module 20 can further communicate with the behavior analysis module 30, the behavior scoring module 40, the JSON network token management module 50, and the signature service interface application programming interface (API) 60. The behavior scoring module 40 can further communicate with the behavior analysis module 30 and the JSON network token management module 50. The JSON network token management module 50 can further communicate with the signature service interface application programming interface (API) 60.

In one embodiment, client A can be a user, client, member, and/or electronic device used. The electronic device can be a smartphone, smartwatch, tablet, personal computer, desktop computer, laptop, etc. The signature web service module 10 can be a signature web service frontend, a signature web service server, signature web service software, web login service software, web login service interface, etc. The user management module 20 can be a user management device, a user management server, a user management system, user management software, a member management module, a member management system, etc. The behavior analysis module 30 can be a behavior analyzer (chip/circuit), behavior analysis software (program), etc. The behavior scoring module 40 can be a behavior scorer (chip/circuit), behavior scoring software (program), behavior score predictor (chip/circuit), behavior score prediction software (program), etc. The JSON network token management module 50 can be a JSON network token controller (chip/circuit), JSON network token management software (program), etc.

In one embodiment, the multiple behavioral indicators 32 of client A analyzed by the behavioral analysis module 30 may include one or more (e.g., at least two) of client A's activity frequency, transaction count, average API execution time, request frequency, login frequency, number of logins, access history, accessed resources (pages), and operation sensitivity. For example, activity frequency may be the number of requests per hour, transaction count may be the number of operations per day, and average API execution time may be the average time spent on each API (application programming interface) execution.

In one embodiment, the JSON Web Token (JWT) 51 managed (managed/controlled) by the JSON Web Token Management Module 50 may be composed of the following three parts: [1] Header 52, [2] Payload 53, and [3] Signature 54. Meanwhile, the token may also be referred to as a pass, a token, etc. and has a temporary meaning, while the payload may also be referred to as a load, etc. and may record the identity information B of the client A, the behavior score 41, etc.

In one embodiment, the application programming interface (API) 61 may be a signing API, a query API, an authorization API, a member function modification API, etc. Identity information, user log information, and signature request may also be referred to as identity information, user log information, and signature request, respectively.

As used herein, "at least one" means more than one (e.g., one, two, or three or more), "plurality" means more than two (e.g., two, three, four, or ten or more), and "communication link" means communicating or connecting with each other via various means, such as data, signals, electrical properties, wired means (e.g., wired network), or wireless means (e.g., wireless network). However, the present invention is not limited to the embodiments described herein.

The signature web service module 10 can receive a signature request 11 from at least one (e.g., multiple) client A. Based on the signature request 11 received by the signature web service module 10, the behavior analysis module 30 extracts client A's previous (e.g., historical or past) multiple user behavior data 31 (e.g., access frequency, access time, total API execution time, API execution results, execution time range, and/or API execution function, etc.) from the user behavior log 21 collected (managed) by the user management module 20. The behavior analysis module 30 then analyzes (calculates) client A's previous multiple user behavior data 31 to generate multiple useful behavioral indicators 32 (e.g., activity frequency, number of transactions, average API execution time, etc.) for client A.

When client A logs in, the behavior scoring module 40 dynamically adjusts the authentication priority 42 based on client A's behavior pattern (e.g., normal behavior/abnormal behavior). Furthermore, the behavior scoring module 40 determines client A's credibility and priority 42 based on multiple behavioral indicators 32 (e.g., login frequency, request frequency, resources accessed, etc.) analyzed by the behavior analysis module 30 to calculate client A's behavior score 41. Furthermore, the behavior scoring module 40 utilizes client A's user behavior log 21 (e.g., past behavior or past records) to dynamically adjust client A's behavior score 41 and the issuance policy for JSON Web Tokens (JWTs) 51.

For example, the behavior scoring module 40 can issue a JSON Web Token (JWT) 51 with a longer validity period to a client A whose trustworthiness exceeds a threshold (high trustworthiness). Alternatively, it can issue a JSON Web Token (JWT) 51 with a shorter validity period to a client A whose trustworthiness falls below a threshold (low trustworthiness), or restrict the access permissions of client A. If client A exhibits unusual activity (e.g., suspicious activity), the behavior scoring module 40 can lower the priority 42 of client A's permissions to ensure system security. Conversely, if client A is a regular and legitimate user, the behavior scoring module 40 can increase the priority 42 of client A's permissions. Therefore, the behavior scoring module 40 of the present invention can dynamically adjust the priority 42 of the permissions of client A to make the signing, authentication, and authorization mechanism of the JSON Web Token (JWT) 51 more intelligent and flexible.

This invention proposes an application method for managing authorization by dynamically adjusting the behavior score 41 in the payload 53 of a JSON Web Token (JWT) 51 based on multiple behavioral indicators 32 of client A. Each time client A logs in, the JSON Web Token control module 50 generates a JSON Web Token (JWT) 51 for client A. The JSON Web Token control module 50 then automatically embeds client A's identity information B and the behavior score 41 into the payload 53 of the JSON Web Token (JWT) 51 associated with client A.

Client A's behavior score 41 can be calculated from the user behavior log 21 (e.g., user behavior records or user log information) collected by the user management module 20. The user behavior log 21 may include various sensitive information such as login times, pages visited, and application program interfaces 61 connected. The application program interfaces 61 may include, for example, the Signature Application Program Interface, the Query Application Program Interface, the Authorization Application Program Interface, and the Member Function Modification Application Program Interface.

The behavior scoring module 40 utilizes client A's user behavior log 21 (e.g., user behavior records or user log information) and calculates client A's behavior score 41 based on client A's multiple behavioral indicators 32. Specifically, the behavior scoring module 40 accurately calculates client A's behavior score 41 based on client A's multiple behavioral indicators 32 (e.g., activity frequency, number of transactions, average API execution time, etc.). The JSON web token management module 50 then automatically embeds client A's identity information B and the behavior score 41 into the payload 53 of the JSON web token (JWT) 51.

When authenticating or validating Client A's JSON Web Token (JWT) 51, the JSON Web Token Management Module 50 authenticates or verifies the validity of Client A's JSON Web Token (JWT) 51. If Client A's JSON Web Token (JWT) 51 is authenticated or verified as valid, the JSON Web Token Management Module 51 provides a method for differentiating permissions for Client A based on the behavior score 41 of Client A in the payload 53 of the JSON Web Token (JWT) 51, thereby efficiently managing the permissions of Client A.

In one embodiment, the JSON Web Token Management Module 50 can utilize the behavior score 41 in the payload 53 of the JSON Web Token (JWT) 51 to provide higher permissions or unrestricted permissions to clients A with a behavior score 41 above a threshold (e.g., a high score or high trustworthiness), and to provide lower permissions or restricted permissions to clients A with a behavior score 41 below a threshold (e.g., a low score or low trustworthiness).

In another embodiment, the JSON web token control module 50 may utilize the behavior score 41 in the payload 53 of the JSON web token (JWT) 51 to provide higher permissions or unrestricted permissions to a client A having a behavior score 41 higher than a first score threshold (e.g., high score or highly trusted), and to provide higher permissions or unrestricted permissions to a client A having a behavior score 41 lower than a second score threshold (e.g., For client A with a behavior score 41 between a first threshold and a second threshold (e.g., between a high score and a low score, or between high trust and low trust), lower permissions or restricted permissions are provided. Furthermore, for client A with a behavior score 41 between a first threshold and a second threshold (e.g., between a high score and a low score, or between high trust and low trust), medium permissions or slightly restricted permissions are provided. The permissions may be determined based on the ratio of the behavior score 41 between the first threshold and the second threshold.

The user management module 20 can continuously monitor the user behavior of client A. Each time client A logs in, the behavior scoring module 40 re-evaluates client A's behavior score 41 based on client A's new user behavior log 21 (such as user behavior records or user log information). The JSON network token control module 50 then issues a new JSON network token (JWT) 51 based on client A's behavior score 41. The JSON network token control module 50 then dynamically adjusts client A's permissions based on the new JSON network token (JWT) 51.

The JSON web token control module 50 can authenticate or verify the validity of the JSON web tokens (JWT) 51 of multiple clients A. If the JSON web tokens (JWT) 51 of multiple clients A are authenticated or verified to be valid, the JSON web token control module 50 can classify the multiple clients A into different user groups (e.g., first, second, and/or third user groups) based on the behavior scores 41 of the multiple clients A.

At the same time, the JSON network token management module 50 can set different permissions for client A in different user groups. For example, client A in a user group with a risk higher than a threshold (high risk) can only access restricted pages or services of the application programming interface (API) 61, while client A in a user group with a risk lower than a threshold (low risk) can access all pages or services of the application programming interface (API) 61 without restrictions.

When client A attempts to access an API 61 (such as the Sign API, Query API, Authorize API, or Member Function Modification API), the JSON Web Token Control Module 50 authenticates or verifies the signature 54 and behavior score 41 in the JSON Web Token (JWT) 51. If the JSON Web Token (JWT) 51 is invalid or the behavior score 41 is below the threshold (too low) and does not meet the requirements, the JSON Web Token Control Module 50 may deny client A access to the specific API 61.

Figure 2 is a flowchart illustrating the signature authentication and authorization method of the present invention, and is described together with the signature authentication and authorization system 1 shown in Figure 1. The signature authentication and authorization method may include, for example, the technical contents described in the following steps S1 to S5.

Step S1: The user management module 20 can continuously collect the user behavior log 21 of client A (such as user behavior records or user log information).

Step S2: Each time client A requests a signature (e.g., signature/stamp)-related service or document from the signing service API 60, the behavior analysis module 30 extracts and analyzes multiple user behavior data 31 from client A's user behavior log 21, including specific fields (e.g., the fields to be analyzed) and specific time periods (e.g., the time period from login time to logout time to be analyzed), to obtain multiple behavioral indicators 32 of client A (e.g., activity frequency, number of transactions, average API execution time, etc.).

Step S3: The behavior scoring module 40 can use the multiple behavior indicators 32 obtained by the behavior analysis module 30 to calculate (estimate) the behavior score 41 of client A.

Step S4: The JSON Web Token Management Module 50 can automatically embed the identity information B and behavior score 41 of client A into the payload 53 of the JSON Web Token (JWT) 51.

Step S5: The JSON Web Token control module 50 may authenticate or verify the JSON Web Token (JWT) 51. If the JSON Web Token (JWT) 51 is invalid or the behavior score 41 in the payload 53 is below a threshold (e.g., the behavior score 41 is too low), the JSON Web Token control module 50 may refuse to connect client A to the specified application programming interface (API) 61.

For example, in the signature authentication and authorization system 1 and method of the present invention, the behavior scoring module 40 can dynamically adjust the priority 42 of authorized signatures based on the user behavior log 21 of client A (e.g., past actions or records), thereby improving system performance and security. For example, client A has already obtained membership status before executing a signing service or document, and client A can log in to the signing web service module 10 (e.g., a signing web service front desk or web login service software).

When the signature web service module 10 receives a signature request 11 from client A, the behavior analysis module 30 can extract client A's previous multiple user behavior data 31 (such as access frequency, access time, total API execution time, API execution results, execution time range, and/or API execution function, etc.) from the user behavior log 21 collected (managed) by the user management module 20. Based on client A's previous multiple user behavior data 31, the behavior analysis module 30 analyzes (calculates) client A's useful multiple behavior indicators 32 (such as activity frequency, number of transactions, average API execution time, etc.). Next, the behavior scoring module 40 can use Logistic Regression (LR) or artificial intelligence (AI) technology to generate a score based on the multiple behavioral indicators 32 of client A or predict the behavior score 41 of client A.

In one embodiment, the artificial intelligence (AI) technology may be various neural networks or AI algorithms, such as convolutional neural networks (CNN), recurrent neural networks (RNN), long short-term memory (LSTM), machine learning (ML), and deep learning (DL), but is not limited thereto.

Specifically, when client A initiates a signature request 11, the behavior analysis module 30 can retrieve multiple user behavior data 31 from the user behavior log 21 at a specific time through the user management module 20. Based on this multiple user behavior data 31, the behavior analysis module 30 can analyze and organize multiple behavior indicators 32 of client A (such as activity frequency, number of transactions, average API execution time, etc.). The behavior scoring module 40 can then use logical regression (LR) or artificial intelligence (AI) technology to predict a behavior score 41 for client A based on these multiple behavior indicators 32. For example, the behavior scoring module 40 may treat the multiple behavior indicators 32 of client A as multiple features and the behavior score 41 of client A (e.g., the final behavior score) as the target variable. It then uses logical regression (LR) or artificial intelligence (AI) technology to predict the behavior score 41 of client A based on the multiple behavior indicators 32 of client A.

In other words, the signature authentication authorization system 1 and its method of the present invention may include the technical contents described in the following procedures [1] to [7].

[1] Data collection: The user management module 20 can collect the user behavior log 21 of the client A to organize the user behavior log 21 into at least one data set, and each data in the data set can include a behavior indicator 32 and a corresponding behavior score 41.

[2] Data pre-processing: The behavior scoring module 40 can clean, fill in missing values and/or standardize the data of the user behavior log 21 organized or centrally managed by the user management module 20.

[3] Feature selection: The behavior scoring module 40 can select multiple features to be used for prediction from the multiple behavior indicators 32 of client A. For example, the behavior scoring module 40 can select multiple behavior indicators 32 of client A, such as activity frequency, number of transactions, and average API execution time, as multiple features.

[4] Establishing a prediction model 43: The behavior scoring module 40 may utilize a logical regression (LR) method or artificial intelligence technology (such as an AI algorithm) to automatically establish a logical regression (LR) model or an artificial intelligence (AI) model that can predict the behavior score 41 of the client A as the prediction model 43.

[5] Training the prediction model 43: The behavior scoring module 40 may use the training data set to train a logical regression (LR) model or an artificial intelligence (AI) model as a prediction model 43, so that the prediction model 43 such as the logical regression (LR) model or the artificial intelligence (AI) model learns the relationship between the values of the multiple behavior indicators 32 (multiple features) of the client A and the behavior score 41. At the same time, the input of the prediction model 43 such as the logical regression (LR) model or the artificial intelligence model is the multiple behavior indicators 32 (multiple features) of the client A, and the multiple behavior indicators 32 (multiple features) will be analyzed or processed by the prediction model 43 such as the logical regression (LR) model or the artificial intelligence model to obtain the output of the prediction model 43 such as the logical regression (LR) model or the artificial intelligence model as the behavior score 41 of the client A, as described in the following procedure [6].

[6] Predicting behavior score 41: After the behavior analysis module 30 analyzes the multiple behavior indicators 32 of client A from the multiple user behavior data 31 in the user behavior log 21 to be predicted, the behavior scoring module 40 can input the multiple behavior indicators 32 of client A into the prediction model 43 such as the trained logical regression (LR) model or artificial intelligence (AI) model to further predict the behavior score 41 of client A. Then, after calculating the behavior score 41 of client A (such as the total behavior score), the behavior scoring module 40 can dynamically adjust the issuance strategy of the JSON web token (JWT) 51 according to the behavior score 41 of client A. The behavior scoring module 40 can then add a custom priority 42 field to the payload 53 of the JSON Web Token (JWT) 51, using the value of client A's behavior score 41 as the value of the priority 42 field.

[7] Granting or restricting permissions: The JSON network token control module 50 can grant higher permissions, lower permissions, or restrict permissions based on the different behavior scores 41 of client A. When the behavior score 41 of client A is lower than the score threshold (low score), the JSON network token control module 50 can restrict client A to only allow access to specific resources, pages, or services, and can also restrict or deny client A from connecting to a specific application programming interface (API) 61. For example, when signing a service interface API 60 to make an API request, the JSON Web Token Control Module 50 first authenticates or verifies the JSON Web Token (JWT) 51 of Client A. The JSON Web Token Control Module 50 then uses the authentication or verification mechanism to deny Client A access to the specified API 61 if the behavior score 41 is below the score threshold.

Furthermore, in the signature authentication authorization system 1 and its method of the present invention, the "application authorization method" may include the technical contents described in the following procedures [1] to [6].

[1] The signature web service module 10 (such as the signature web service front end) receives the signature request 11 from the client A.

[2] The behavior analysis module 30 captures the user behavior log 21 of client A through the user management module 20 to perform behavior analysis on client A. That is, the behavior analysis module 30 can perform behavior analysis on the records retained by client A's previous one or several logins according to the behavior analysis strategy, so that the behavior analysis module 30 converts the client A's previous multiple user behavior data 31 (such as access frequency, access time, total API execution time, API execution results, execution time range and/or API execution function, etc.) into multiple behavior indicators 32.

[3] The behavior scoring module 40 scores the multiple behavior indicators 32 according to a custom or preset prediction method. That is, the behavior scoring module 40 can regard the multiple behavior indicators 32 of client A as multiple features and the final behavior score 41 as a target variable. The behavior scoring module 40 uses various selected methods such as logical regression (LR) method or artificial intelligence (AI) technology to convert the multiple behavior indicators 32 into the behavior score 41 of client A.

[4] The behavior scoring module 40 establishes policies and dynamically adjusts the permissions of client A based on the behavior score 41. That is, the behavior scoring module 40 can use the behavior score 41 of client A as a basis for dynamic adjustment (such as increase or decrease) of permissions. For example, the behavior scoring module 40 can dynamically adjust the validity period of the JSON Web Token (JWT) 51, and can also approve or reject the signature request 11 (such as an authorization request) applied for by client A.

[5] The JSON Web Token Management Module 50 automatically embeds the identity information B and behavior score 41 of client A into the payload 53 of the JSON Web Token (JWT) 51.

[6] The user management module 20 continuously updates the user behavior log 21 of client A so that the behavior scoring module 40 can dynamically adjust the permissions of client A based on the new behavior score 41. That is, each time the signature web service module 10 receives a signature request 11 from client A, the behavior scoring module 40 will recalculate the behavior score 41 of client A so that the behavior score 41 is embedded in the payload 53 of the JSON web token (JWT) 51 through the JSON web token control module 50, so that the JSON web token control module 50 can continuously dynamically adjust or update the JSON web token (JWT) 51 based on the recalculated behavior score 41.

In addition, in the signature authentication authorization system 1 and its method of the present invention, the "Authentication or Verification Method of JSON Web Token (JWT) 51" may include the technical contents described in the following procedures [1] to [3].

[1] The JSON Web Token Management Module 50 authenticates or verifies the validity of the JSON Web Token (JWT) 51 of Client A.

[2] Control is performed based on the policy established by the JSON Web Token Control Module 50. That is, the JSON Web Token Control Module 50 can use the behavior score 41 embedded in the payload 53 of the JSON Web Token (JWT) 51 as the basis for dynamic adjustment or control of permissions.

[3] When the JSON Web Token Control Module 50 authenticates or verifies the validity of the JSON Web Token (JWT) 51, the JSON Web Token Control Module 50 determines whether to allow or deny Client A to execute the signing service interface application programming interface (API) 60 or access the application programming interface (API) 61 based on the behavior score 41 in the payload 53 of the JSON Web Token (JWT) 51.

The present invention also provides a computer-readable medium for a signature authentication and authorization method, which is applied to a computing device or computer having a processor and memory. The computer-readable medium stores instructions, and the computing device or computer can execute the computer-readable medium through the processor and memory. When the computer-readable medium is executed, the aforementioned contents are executed. In another embodiment, the computer-readable medium is a non-transitory computer-readable storage medium.

In one embodiment, the processor may be a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MPU), a microcontroller (MCU), an artificial intelligence (AI) processor, etc.; the memory may be random access memory (RAM), read-only memory (ROM), flash memory, a memory card, a hard drive (such as a cloud/network/external hard drive), an optical disk, a flash drive, a database, etc.; and the computing device or computer may be a computer, a smartphone, a tablet, a personal computer, a laptop, a desktop computer, a server (such as a cloud/remote/network/AI server), etc.

In summary, the signature authentication and authorization system 1, method, and computer-readable medium of the present invention have at least the following features, advantages, or technical effects.

1. The signature web service module 10 of the present invention can automatically receive signature requests from client A, enabling the behavior analysis module 30 to automatically analyze multiple behavior indicators 32 based on client A's user behavior log 21. This also enables the behavior scoring module 40 to utilize these multiple behavior indicators 32 to determine client A's credibility and priority 42, and accurately calculate client A's behavior score 41 based on these multiple behavior indicators 32.

2. The behavior scoring module 40 of the present invention can dynamically adjust the priority 42 of signing authorization or authentication based on the user behavior log 21 or behavior pattern of client A, thereby improving the performance and security of the system.

3. The behavior scoring module 40 of the present invention can leverage client A's user behavior log 21 to dynamically adjust client A's behavior score 41 and the issuance policy for the JSON Web Token (JWT) 51. It can also dynamically adjust client A's permission priority 42 to make the signing, authentication, and authorization mechanism for the JSON Web Token (JWT) 51 more intelligent and flexible.

4. The behavior scoring module 40 of the present invention can automatically calculate a behavior score 41 for client A based on multiple behavior indicators 32, enabling the JSON web token management module 50 to automatically embed identity information B and the behavior score 41 into the payload 53 of the JSON web token (JWT) 51, effectively serving as a basis for dynamic adjustment or control of permissions.

5. The JSON Web Token Management Module 50 of the present invention can use a JSON Web Token (JWT) 51 as the basis for the identity authentication or verification mechanism of Client A. It can also automatically embed parameters related to the priority 42 of permission, such as Client A's identity information B and behavior score 41, into the payload 53 of the JSON Web Token (JWT) 51, thereby effectively ensuring secure access by Client A and facilitating the establishment of a signed authentication and authorization system 1 that simultaneously considers the priority 42 and supports authentication and authorization.

6. The behavior scoring module 40 of the present invention can make use of logical regression (LR) or artificial intelligence (AI) technology to quickly generate a score or accurately calculate the behavior score 41 of client A based on the multiple behavioral indicators 32 of client A.

7. The behavior scoring module 40 of the present invention can utilize logical regression (LR) methods or artificial intelligence technology (such as AI algorithms) to automatically establish a logical regression (LR) model or artificial intelligence (AI) model that can predict the behavior score 41 as a prediction model 43, thereby facilitating the rapid prediction of the behavior score 41 of client A through the prediction model 43.

8. The JSON Web Token Management Module 50 of the present invention can effectively grant various permissions (such as unrestricted permissions, restricted permissions, etc.) to Client A based on its different behavior scores 41. It can also effectively determine whether to allow or deny Client A to execute the signing service API 60 or access the API 61 based on the behavior score 41 in the payload 53 of the JSON Web Token (JWT) 51.

9. The JSON network token control module 50 of the present invention can support clients A from different (plural) user groups, and clients A from different user groups can have different permissions. This effectively restricts clients A from high-risk user groups to only access restricted pages or services of the application programming interface (API) 61, while also ensuring that clients A from low-risk user groups are not restricted and can access all pages or services of the application programming interface (API) 61 in real time.

The above embodiments are merely illustrative of the principles, features, and effects of the present invention and are not intended to limit the scope of its implementation. Anyone skilled in the art may modify and alter the above embodiments without departing from the spirit and scope of the present invention. Any equivalent changes and modifications achieved using the disclosure of this invention should still be covered by the scope of the patent application. Therefore, the scope of protection of this invention should be as set forth in the patent application.

1: Signature Authentication and Authorization System

10: Signature web service module

11: Signature Request

20: User Management Module

21: User behavior log

30: Behavior Analysis Module

31: User behavior data

32: Behavioral indicators

40: Behavior Scoring Module

41: Behavior score

42: Priority

43: Prediction Model

50:JSON network token management module

51:JSON Network Token

52: Header

53: Payload

54:Signature

60: Signature Service Interface Application Programming Interface

61: Application Programming Interface

A: Client

B: Identity information

Claims (13)

A signature authentication and authorization system, comprising: A signature web service module, a behavior analysis module, and a behavior scoring module. The signature web service module is used to receive a signature request from a client, so that the behavior analysis module extracts the client's previous multiple user behavior data from the user behavior log based on the signature request received by the signature web service module. The behavior analysis module then analyzes the client's previous multiple user behavior data to obtain multiple behavior indicators, so that the behavior scoring module calculates the client's behavior score based on the multiple behavior indicators of the client analyzed by the behavior analysis module; and A JSON network token control module is communicatively linked to the behavior scoring module, so that the JSON network token control module embeds the client's behavior score calculated by the behavior scoring module into the payload of the client's JSON network token. When the client's JSON network token is authenticated or verified, the JSON network token control module authenticates or verifies the validity of the client's JSON network token. If the client's JSON network token is authenticated or verified as valid, the JSON network token control module provides a method for differentiating permissions for the client based on the client's behavior score in the payload of the JSON network token, thereby controlling the client's permissions. The signature authentication and authorization system as described in claim 1, wherein the behavior scoring module further assigns the JSON network token with priority based on the user behavior of the client, and dynamically adjusts the client's behavior score and the issuance policy of the JSON network token using the client's user behavior log. The signing authentication and authorization system as described in claim 1, wherein the JSON network token control module further utilizes the behavior score in the payload of the JSON network token to provide higher permissions or unrestricted permissions to clients with a behavior score higher than a score threshold, and to provide lower permissions or restricted permissions to clients with a behavior score lower than the score threshold. The signing authentication and authorization system as described in claim 1, wherein the JSON network token control module further authenticates or verifies the validity of the JSON network tokens of multiple clients. If the JSON network tokens of the multiple clients are all valid after authentication or verification, the JSON network token control module categorizes the multiple clients into different user groups based on their behavior scores, and then the JSON network token control module sets different permissions for the clients in the different user groups. The signature authentication and authorization system as described in claim 1 further includes a user management module, wherein when the signature web service module receives a signature request from the client, the behavior analysis module extracts multiple user behavior data of the client from the user behavior log collected by the user management module, analyzes the multiple user behavior data of the client to generate multiple behavior indicators of the client, and then the behavior scoring module uses logical regression or artificial intelligence technology to predict the behavior score of the client based on the multiple behavior indicators of the client. The signing authentication and authorization system described in claim 1 further includes a user management module that continuously monitors the user behavior of the client. Each time the client logs in, the behavior scoring module re-evaluates the client's behavior score based on the client's new user behavior log. The JSON network token management module then issues a new JSON network token based on the client's behavior score, allowing the JSON network token management module to dynamically adjust the client's permissions based on the new JSON network token. A signature authentication authorization method, comprising: A signature web service module receives a signature request from a client, and a behavior analysis module extracts the client's previous multiple user behavior data from the user behavior log based on the signature request received by the signature web service module. The behavior analysis module then analyzes the client's previous multiple user behavior data to obtain multiple behavior indicators, and a behavior scoring module calculates the client's behavior score based on the multiple behavior indicators of the client analyzed by the behavior analysis module; and A JSON network token control module embeds the client's behavior score calculated by the behavior scoring module into the payload of the client's JSON network token. When the client's JSON network token is authenticated or verified, the JSON network token control module authenticates or verifies the validity of the client's JSON network token. If the client's JSON network token is authenticated or verified as valid, the JSON network token control module provides a method for differentiating permissions for the client based on the client's behavior score in the payload of the JSON network token, thereby managing the client's permissions. The signature authentication authorization method as described in claim 7 further includes the behavior scoring module assigning the JSON network token with priority based on the user behavior of the client, and dynamically adjusting the client's behavior score and the issuance policy of the JSON network token using the client's user behavior log. The signing authentication authorization method as described in claim 7 further includes the JSON network token control module utilizing the behavior score in the payload of the JSON network token to provide higher permissions or unrestricted permissions to clients with a behavior score higher than a score threshold, and to provide lower permissions or restricted permissions to clients with a behavior score lower than the score threshold. The signature authentication and authorization method described in claim 7 further includes the JSON network token control module authenticating or verifying the validity of the JSON network tokens of multiple clients. If the JSON network tokens of the multiple clients are all valid after authentication or verification, the JSON network token control module categorizes the multiple clients into different user groups based on their behavior scores, and then the JSON network token control module sets different permissions for the clients in the different user groups. The signature authentication and authorization method as described in claim 7 further includes: when the signature web service module receives the signature request from the client, the behavior analysis module extracts the client's multiple user behavior data from the user behavior log collected by a user management module, analyzes the client's multiple user behavior data by the behavior analysis module to generate multiple behavior indicators of the client, and then uses logical regression or artificial intelligence technology to predict the client's behavior score based on the multiple behavior indicators of the client. The signature authentication and authorization method described in claim 7 further includes a user management module continuously monitoring the user behavior of the client. Each time the client logs in, the behavior scoring module re-evaluates the client's behavior score based on the client's new user behavior log. The JSON network token control module then issues a new JSON network token based on the client's behavior score, allowing the JSON network token control module to dynamically adjust the client's permissions based on the new JSON network token. A computer-readable medium, used in a computing device or computer, stores instructions, and is executed by a processor and memory. When the computer-readable medium is executed, the signature authentication and authorization method described in any one of claims 7 to 12 is executed.