Method and apparatus for trusted access of an agent to an agent internet

Abstract

The application provides a method and device for trusted access of an intelligent agent to an intelligent agent internet, the method comprising: receiving an intelligent agent identity certificate application request from an intelligent agent provider, the request carrying an intelligent agent identity code and intelligent agent provider information; obtaining corresponding intelligent agent detailed information from an intelligent agent registration server according to the intelligent agent identity code, the intelligent agent detailed information comprising intelligent agent provider information, a challenge verification endpoint website and the corresponding intelligent agent identity code; checking the intelligent agent provider information and the intelligent agent identity code in the intelligent agent detailed information based on the information carried by the certificate application request; after the checking is passed, challenging and verifying the challenge verification endpoint website in the intelligent agent detailed information by initiating a challenge verification request to the intelligent agent provider; and after the verification is passed, generating a corresponding intelligent agent identity certificate based on the intelligent agent detailed information, and issuing the corresponding certificate to the intelligent agent provider, so that the intelligent agent can be trusted to access the intelligent agent internet based on the corresponding certificate.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method and apparatus for a trusted intelligent agent to access the intelligent agent Internet. Background Technology

[0002] An agent, a key concept in artificial intelligence, refers to a system capable of autonomously perceiving its environment, making decisions, and executing actions. With the development of AI and cloud computing technologies, agents for a wide variety of tasks have emerged. However, many practical needs are more complex, requiring the breakdown of complex tasks into multiple simpler sub-tasks and the acquisition of the final result through task flows. This necessitates collaboration among multiple agents with different functionalities. The Internet of Agents (IoA) has emerged to address this need, aiming to achieve seamless connectivity and efficient collaboration between agents through standardized communication protocols and interfaces. The importance of the IoA lies in its ability to break down silos between agents, enabling them to work collaboratively within a broader network. The key capability of the IoA lies in its powerful communication and collaboration mechanisms; however, how to reliably connect agents to the IoA remains a problem requiring further research. Summary of the Invention

[0003] In view of this, embodiments of the present invention provide a method and apparatus for trusted access of intelligent agents to the intelligent agent Internet, so as to eliminate or improve one or more defects existing in the prior art.

[0004] One aspect of the present invention provides a method for a smart agent to trusted access the smart agent Internet, the method being executed by a certificate authorization server and including the following steps: The system receives an agent identity certificate application request from an agent provider. The certificate application request carries an agent identity code and agent provider information. The identity code is obtained by receiving an agent registration request submitted by the agent provider through an agent registration server. After verifying the agent capability description information carried in the agent registration request, the server sends an agent identity code to the agent provider. The agent capability description information includes the agent name, agent function description, service access endpoint, agent provider information, challenge verification endpoint URL, and agent capability set. Based on the agent identity code, query the agent registration server to obtain the corresponding agent details, which include agent supplier information, challenge verification endpoint URL and corresponding agent identity code; Based on the information carried in the certificate application request, the intelligent agent supplier information and intelligent agent identity code in the intelligent agent details are verified. After the verification is successful, a challenge verification request is initiated to the intelligent agent supplier to perform challenge verification on the challenge verification endpoint URL in the intelligent agent details. After successful verification, a corresponding intelligent agent identity certificate is generated based on the intelligent agent's detailed information. By receiving an intelligent agent identity certificate download request from the intelligent agent supplier, the corresponding intelligent agent identity certificate is issued to the intelligent agent supplier so that the intelligent agent can be trusted to access the intelligent agent Internet based on the corresponding intelligent agent identity certificate.

[0005] In some embodiments of the present invention, challenge verification is performed on the challenge verification endpoint URL in the intelligent agent's detailed information by initiating a challenge verification request to the intelligent agent supplier, including: Randomly generate a string corresponding to the agent, and place the generated string at the location pointed to by the corresponding authorized URL based on the correspondence between the string and the URL; The authorized URL is returned to the agent provider so that the agent provider can obtain the corresponding challenge type and placed string by sending a challenge information retrieval request to the authorized URL. Based on the string and the key, challenge response content is generated and stored in the path location constructed by the certificate authorization server based on the challenge verification endpoint URL to obtain a token file. The certificate authorization server is then notified that it is ready to accept challenge verification. The key is obtained in advance by the certificate authorization server after receiving an account registration request from the agent provider and returning the corresponding key to the agent provider. By initiating a challenge verification request to the intelligent agent supplier, receiving the challenge response content stored in the token file of the intelligent agent supplier, and performing challenge verification on the received challenge response content based on the generated string and the result calculated by the key.

[0006] In some embodiments of the present invention, the path constructed by the certificate authorization server based on the challenge verification endpoint URL includes the challenge verification endpoint URL, the agent identity code, and a randomly generated string.

[0007] In some embodiments of the present invention, the key includes a JWK fingerprint.

[0008] In some embodiments of the present invention, issuing a corresponding agent identity certificate to the agent supplier enables the agent to be trusted to access the agent internet based on the corresponding agent identity certificate, including: The system issues a corresponding agent identity certificate to the agent provider, enabling the agent to authenticate itself via two-way TLS based on the agent identity certificate, thereby allowing the agent to be trusted to access the agent internet.

[0009] In some embodiments of the present invention, a corresponding agent identity certificate is issued to the agent provider so that the agent can perform identity authentication based on the corresponding agent identity certificate through two-way TLS, thereby enabling the agent to be trusted to access the agent Internet, including: The system issues a corresponding agent identity certificate to the agent provider, enabling the agent to exchange agent identity certificates with another agent possessing a corresponding agent identity certificate via bidirectional TLS using the TLS 1.3 protocol. The agent verifies the other agent's agent identity certificate, and upon successful verification, the identities of both parties are authenticated. Afterward, the agent and the other agent communicate and begin transmitting encrypted data, enabling the agent and the other agent to be trusted to access the agent internet.

[0010] In some embodiments of the present invention, the agent identity code includes multiple fields, including: the latest protocol standard version number supported by the agent, the agent registration service provider, the entity that submitted the agent registration, the year of the agent registration, the agent entity serial number submitted for registration, the agent entity serial number submitted for registration, and the verification code.

[0011] Another aspect of the present invention provides an apparatus for trusted access of an intelligent agent to the intelligent agent Internet. The apparatus includes a computer device, the computer device including a processor and a memory, the memory storing computer instructions, the processor executing the computer instructions stored in the memory, and when the computer instructions are executed by the processor, the apparatus implements the steps of the aforementioned method.

[0012] Another aspect of the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the aforementioned method.

[0013] Another aspect of the present invention provides a computer program product including computer instructions that, when executed by a processor, implement the steps of the aforementioned method.

[0014] The method and apparatus for trusted access of intelligent agents to the intelligent agent Internet of Things of the present invention can first register the intelligent agent to obtain a unique intelligent agent identity code, and then apply for an intelligent agent identity certificate based on the intelligent agent identity code to realize the identity authentication of the intelligent agent, thereby enabling the intelligent agent to be trusted to access the intelligent agent Internet of Things, which can effectively prevent illegitimate intelligent agents from accessing the intelligent agent Internet of Things.

[0015] Additional advantages, objects, and features of the invention will be set forth in part in the description which follows, and will also become apparent in part to those skilled in the art upon studying the description, or may be learned by practice of the invention. The objects and other advantages of the invention can be realized and obtained by means of the structures specifically pointed out in the description and drawings.

[0016] Those skilled in the art will understand that the objectives and advantages achievable with the present invention are not limited to those specifically described above, and that the above and other objectives achievable with the present invention will become clearer from the following detailed description. Attached Figure Description

[0017] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this application, are not intended to limit the scope of the invention. The components in the drawings are not drawn to scale but are merely illustrative of the principles of the invention. For ease of illustration and description of certain parts of the invention, corresponding portions in the drawings may be enlarged, i.e., may appear larger relative to other components in an exemplary device actually manufactured according to the invention. In the drawings: Figure 1 This is a flowchart illustrating a method for trusted access to the intelligent agent Internet in one embodiment of the present invention. Figure 2 This is a schematic diagram of the process of intelligent agent registration and obtaining identity certificate in one embodiment of the present invention; Figure 3 This is a schematic diagram of the agent identity authentication process in one embodiment of the present invention; Figure 4 This is a schematic diagram of the user authentication process in one embodiment of the present invention. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the embodiments and accompanying drawings. Here, the illustrative embodiments and descriptions of this invention are used to explain the invention, but are not intended to limit the invention.

[0019] It should also be noted that, in order to avoid obscuring the invention with unnecessary details, only the structures and / or processing steps closely related to the solution according to the invention are shown in the accompanying drawings, while other details that are not closely related to the invention are omitted.

[0020] It should be emphasized that the term "including / comprises" as used herein refers to the presence of a feature, element, step, or component, but does not exclude the presence or addition of one or more other features, elements, steps, or components.

[0021] It should also be noted that, unless otherwise specified, the term "connection" in this article can refer not only to a direct connection, but also to an indirect connection involving an intermediary.

[0022] In the following description, embodiments of the invention will be illustrated with reference to the accompanying drawings. In the drawings, the same reference numerals represent the same or similar parts, or the same or similar steps.

[0023] To enable trusted access of intelligent agents to the intelligent agent Internet, this invention discloses a method and apparatus for trusted access of intelligent agents to the intelligent agent Internet. First, the intelligent agent is registered to obtain a unique intelligent agent identity code. Then, an intelligent agent identity certificate is applied for based on the intelligent agent identity code, and the identity authentication of the intelligent agent is achieved based on the certificate, thereby enabling trusted access of the intelligent agent to the intelligent agent Internet.

[0024] Figure 1 This is a flowchart illustrating a method for trusted access to the intelligent agent internet according to an embodiment of the present invention. See also... Figure 1 The method for trusted access to the intelligent agent internet is executed by the server side of the Certificate Authority Service Provider (CASP) in the intelligent agent internet, i.e., the certificate authorization server, and includes the following steps: Step S110: Receive an agent identity certificate application request from the agent supplier. The certificate application request carries an agent identity code and agent supplier information. The identity code is obtained by receiving an agent registration request submitted by the agent supplier through an agent registration server, verifying the agent capability description information carried in the registration request, and then sending an agent identity code assigned to the agent supplier. The agent capability description information includes the agent name, agent function description, service access endpoint, agent supplier information, challenge verification endpoint URL, and agent capability set.

[0025] In the Internet of Intelligent Agents, the Agent Identity Code (AIC) is the unique identifier of an intelligent agent. Certificate Authorization Service Providers (CASPs) are authoritative bodies responsible for issuing, managing, and verifying digital certificates; common CASPs include Sectigo, Digicert, and CFCA. In the Internet of Intelligent Agents, this invention will create a completely new CASP. Unlike existing CASPs that issue certificates for domain names—certificates that protect domain names—the CASP in the Internet of Intelligent Agents will issue certificates based on the intelligent agent's AIC. The certificate issued to the intelligent agent protects the intelligent agent's AIC. When an entity discovers and accesses an intelligent agent based on its AIC, the intelligent agent needs to provide a certificate for identity verification and encrypted communication.

[0026] The agent capability description information includes agent vendor information such as the vendor's name, domain name, and registration information, which can be used to verify the vendor's identity. The service access endpoint informs others which endpoint to send a request to in order to use the agent's services; the challenge verification endpoint URL is the challenge verification endpoint URL (ca-challenge-url). The agent capability set can be a collection of skills or unique abilities that the agent can perform. The agent capability set and agent function description indicate what the agent's functions are, how they can be invoked, and the allowed input / output formats. ACS information may also include other fields.

[0027] In this method, all agents seeking to access the Agent Internet must register with the Agent Registration Server within the network. During this process, for each agent, the Agent Registration Server reviews the Agent Capability Description (ACS) submitted during registration. This includes ensuring the agent's service access endpoints are authentic, usable, and legitimate; that the skills in the agent's capability description are legal and compliant; that the agent can successfully complete the service; and that the agent's supplier information is authentic and valid. Upon successful review, a globally unique Agent Identity Card (AIC) is issued to the agent, which then applies for an Agent Identity Certificate from the Certificate Authority Server within the Agent Internet. Thus, only agents with an AIC can obtain an Agent Identity Certificate and be discovered and used by other entities, thereby enabling trusted access to the Agent Internet. Agents failing the review are not provided with an AIC; therefore, agents without an AIC cannot apply for or obtain a certificate and cannot access the Agent Internet, effectively preventing unauthorized agents from accessing the Agent Internet.

[0028] The agent identification code (AIC) consists of 32 characters, with each identifier being either an Arabic numeral or an uppercase English letter. Arabic numerals range from 0 to 9, and uppercase letters range from A to Z. A specific example of an AIC could be 1 0001 00001 1K9 12345E789 ABCDEF23 53, where the first digit represents the latest protocol standard version number supported by the intelligent agent, for example, 1 indicates support for intelligent agent identity code standard version number 1; the 2nd-5th digits represent the intelligent agent registration service provider, for example, 0001 represents the China Electronics Technology Standardization Institute; the 6th-10th digits represent the entity submitting the intelligent agent registration, which may be an institution or an individual, and each entity's code is assigned by the intelligent agent registration service provider, for example, 00001 represents Beijing University of Posts and Telecommunications; the 11th-13th digits represent the year of the intelligent agent's registration, for example, 1K9 converted to decimal is 2025, indicating that the intelligent agent was registered in 2025; the 14th-22nd digits represent the submission... The first part of the registration process involves submitting the agent entity serial number, a unique serial number assigned by the agent registration service provider to distinguish agent entities, such as 12345E789. A single agent registration service provider can register up to 101 trillion agent entities. The second part, digits 23-30, represents the agent entity serial number submitted for registration. This serial number is a unique serial number assigned by the agent registration service provider to an agent entity created based on a specific agent entity, such as ABCDEF23. A single agent registration service provider can provide registration capabilities for up to 3 trillion agent entities per agent entity. The third part, digits 31-32, represents the checksum.

[0029] Step S120: Query the agent registration server based on the agent identity code and obtain the corresponding agent details. The agent details include agent supplier information, challenge verification endpoint URL and corresponding agent identity code.

[0030] Depending on the specific requirements, the agent details may also include information such as the agent name from the agent capability description information. Correspondingly, the certificate application request will also carry information such as the agent name, so that the information carried in the certificate application request can be used to verify other information in the agent details except for the challenge verification endpoint URL.

[0031] Step S130: Based on the information carried in the certificate application request, the intelligent agent supplier information and intelligent agent identity code in the intelligent agent details are verified. After the verification is successful, a challenge verification request is initiated to the intelligent agent supplier to perform challenge verification on the challenge verification endpoint URL in the intelligent agent details.

[0032] In some embodiments, challenge verification is performed on the challenge verification endpoint URL in the agent details by initiating a challenge verification request to the agent supplier, including the following steps: Randomly generate a string corresponding to the agent, and place the generated string at the location pointed to by the corresponding authorized URL based on the correspondence between the string and the URL; The authorized URL is returned to the agent provider so that the agent provider can obtain the corresponding challenge type and placed string by sending a challenge information retrieval request to the authorized URL. Based on the string and the key, challenge response content is generated and stored in the path location constructed by the certificate authorization server based on the challenge verification endpoint URL to obtain a token file. The certificate authorization server is then notified that it is ready to accept challenge verification. The key is obtained in advance by the certificate authorization server after receiving an account registration request from the agent provider and returning the corresponding key to the agent provider. By initiating a challenge verification request to the intelligent agent supplier, receiving the challenge response content stored in the token file of the intelligent agent supplier, and performing challenge verification on the received challenge response content based on the generated string and the result calculated by the key.

[0033] If the intelligent agent supplier is applying for a certificate from the certificate authorization server for the first time, it needs to register an account on the CA server first. After successful registration, it will obtain a key, which can be a JWK fingerprint (JWK is a standard used to represent keys, which stores the key), etc.

[0034] Step S140: After successful verification, a corresponding intelligent agent identity certificate is generated based on the intelligent agent's detailed information. By receiving an intelligent agent identity certificate download request from the intelligent agent supplier, the corresponding intelligent agent identity certificate is issued to the intelligent agent supplier so that the intelligent agent can be trusted to access the intelligent agent Internet based on the corresponding intelligent agent identity certificate.

[0035] Specifically, the certificate generation process includes: the certificate authority server generating corresponding plaintext based on the agent's detailed information, and mapping the plaintext to a hash value using a hash algorithm; encrypting the hash value using the private key from the public-private key pair generated by the certificate authority for the agent requesting the certificate, resulting in a signature; and obtaining the certificate based on the plaintext and the signature. Therefore, the generated certificate consists of two parts: plaintext and a signature. The plaintext contains the public key, domain name, AIC, and other information from the public-private key pair generated for the certificate applicant, as well as the certificate authority's information, certificate validity period, and certificate serial number. The certificate authority server also sends the private key to the agent provider based on the certificate download request.

[0036] Figure 2 For an example of the process of registering an agent and obtaining an identity certificate, see [link to documentation]. Figure 2 The process of obtaining an identity certificate or having a certificate issued by a Certificate Authority (CA) server includes: ④ The agent supplier applies for an agent identity certificate from the CA server. In the specific implementation process, the agent supplier sends a certificate application request to the CA server through the deployed CA client tool. The request must include the AIC and agent supplier information. ⑤ The CA server requests detailed information about the agent from the agent registration server based on the AIC. Specifically, it matches the AIC with the AIC in the agent registration server and queries and obtains the detailed information of the agent corresponding to the matched AIC. ⑥ The agent details returned to the CA server must include AIC, agent provider information, and ca-challenge-url. The ca-challenge-url is used to store the identity verification file of the agent provider (domain name holder) required by the CA server. ⑦ The CA server verifies the AIC and agent vendor information in the agent details using the AIC and agent vendor information carried in the certificate application request; ⑧ After the information verification is successful, the CA server randomly generates a string token. Based on the correspondence between the token and the URL, the token is placed in the location pointed to by the authorized URL, and the authorized URL is returned to the agent supplier. Then, the agent supplier sends a request to the authorized URL to obtain specific challenge information, which includes the challenge type and the token. The challenge type can be HTTP-01. 9. The agent provider uses the obtained token and its own JWK fingerprint to calculate the key_authorization value as the challenge response. The CA server requires the agent provider to store the corresponding token file in a specified file path, as follows: <ca-challenge-url> / <aic> / <token>To enable the CA server to perform challenge verification, during implementation, the agent vendor will also deploy and use a challenge server with the URL ca-challenge-url. The challenge response content will be sent to the challenge server and stored as a token file according to the specified file path. ⑩ Once the challenge server response settings are complete, a notification is sent to the CA server indicating that you are ready to accept the challenge verification; The CA server sends a challenge verification request to the challenge server, which returns the challenge response content stored in the token file. The CA server calculates the token file based on the randomly generated token and the JWK fingerprint of the pre-held intelligent agent supplier, and uses the token file to verify the challenge response content. If the two match, the verification is successful. After successfully verifying the challenge response, the CA server constructs a certificate based on the agent details obtained from the agent registration server. Finally, the agent vendor sends a certificate download request to the CA server to obtain the certificate.

[0037] Since the domain name corresponding to the ca-challenge-url provided by the agent provider may not be real, nor may it be their own, a challenge verification is required to prove that the domain name is indeed accessible. Specifically, the CA server instructs the agent provider to place a token file specified by the CA server at a designated location. The CA server then retrieves the token file from that location. After verification, if the token file was indeed placed by the agent provider at the instigation of the CA server, then the agent provider's ownership of the domain name can be proven.

[0038] In practice, the CA client tools and challenge servers deployed by the intelligent agent vendor can run on the same server or on different servers separately.

[0039] To achieve trusted access for intelligent agents, this invention also provides a secure intelligent agent identity authentication mechanism for the intelligent agent Internet, which can prevent unauthorized access and data leakage, thereby ensuring data privacy and security.

[0040] In some embodiments, issuing a corresponding agent identity certificate to the agent provider to enable the agent to be trusted to access the agent internet based on the corresponding agent identity certificate includes the following steps: The system issues a corresponding agent identity certificate to the agent provider, enabling the agent to authenticate itself via two-way TLS based on the agent identity certificate, thereby allowing the agent to be trusted to access the agent internet.

[0041] In an intelligent agent internet, intelligent agents need to authenticate each other's identities before communicating. In this invention, all communication between intelligent agents requires the exchange of certificates to verify the legitimacy of the AIC, thereby verifying the identities of both parties and encrypting communication. Since TLS 1.3 supports the use of mutual TLS (mTLS) to verify the identities of both parties, the authentication of intelligent agent identities adopts the mTLS method of the TLS 1.3 protocol.

[0042] In some embodiments, a corresponding agent identity certificate is issued to the agent provider so that the agent can authenticate its identity via two-way TLS based on the agent identity certificate, thereby enabling the agent to be trusted to access the agent internet, including: The system issues a corresponding agent identity certificate to the agent provider, enabling the agent to exchange agent identity certificates with another agent possessing a corresponding agent identity certificate via bidirectional TLS using the TLS 1.3 protocol. The agent verifies the other agent's agent identity certificate, and upon successful verification, the identities of both parties are authenticated. Afterward, the agent and the other agent communicate and begin transmitting encrypted data, enabling the agent and the other agent to be trusted to access the agent internet.

[0043] In existing technologies, directly using the domain certificate of the service provider's domain for TLS authentication only ensures the domain's legitimacy, but not the legitimacy of the agent's functionality. However, in the solution provided by this invention, when applying for agent registration, corresponding ACS information must be provided for review to verify the agent's functional legitimacy. Only after the review is passed will the agent possess a unique identity code, thereby obtaining the corresponding agent identity certificate based on the identity code to achieve agent authentication and prevent unauthorized agents from accessing the network. Furthermore, the mTLS method of this approach can more conveniently and efficiently verify the identities of both parties compared to the existing one-way TLS.

[0044] Figure 3 As an example of an agent authentication process, the agent that initiates the authentication request acts as the mTLS client (e.g., agent 1), and the agent that accepts the request acts as the mTLS server (e.g., agent 2). See also Figure 3 The process includes: 1. The client sends a ClientHello message to initiate a secure connection negotiation. This message includes: a random number for key derivation, a list of supported TLS protocol versions, a cipher suite (a set of symmetric encryption algorithms / HKDF hash algorithm pairs), a specified supported CASP (which the server needs to return its certificate later), digital signature algorithms (signature_algorithms, used to provide hash algorithms that the client can use to sign certificates, ensuring that the client can verify the certificate, such as ECDSA, RSA-PSS, etc.), supported_groups (provides the conic sections of ECDHE algorithms supported by the client, such as x25519, secp256r1, etc.), key_share (contains the elliptic curve or finite field parameter group used, and the temporary public key generated by the client), psk_key_exchange_modes (used to specify the PSK key exchange modes supported by the client, such as PSK-only or PSK with (EC) DHE), pre_shared_key (used to provide support for PSK mode during the TLS handshake process), and other extended fields; 2. The server responds to the client with a ServerHello message, which includes: a random number used for key derivation, the selected TLS protocol version, the selected cipher suite, key_share (containing the elliptic curve or finite field parameter set used, and the temporary public key generated by the server), pre_shared_key (if the client uses the pre-shared key (PSK) mode, the server will confirm the PSK used here), and other extended fields. 3. The server and client use the temporary public key in each other's key_share and their own temporary private key to negotiate a shared symmetric key using the ECDHE algorithm. Then, they use the HKDF algorithm to derive multiple keys for encrypted communication. All messages sent in subsequent communications are encrypted messages. At this point, the key exchange is complete. 4. The server sends a CertificateRequest message (indicating that the client needs to send its client identity certificate) and an Encrypted Extensions message (used to carry a response that is not a ClientHello extension used to determine encryption parameters) to the client. 5. The server sends CAI (server certificate), CertificateVerify (digital signature, used to prove that it has the corresponding private key, selects a signature algorithm provided by signature_algorithms in ClientHello, and then uses the private key corresponding to the public key in the server certificate to sign the hash value of all previous handshake messages), and Finished (handshake ends) to the client. 6. The client sends CAI (Client Certificate), CertificateVerify, and Finished (handshake ends) to the server. 7. The client and server verify each other's CAI and CertificateVerify. The verification steps are as follows: First, separate the plaintext and signature of CAI, and then use the same hash algorithm as CASP to map the plaintext to obtain the first hash value; The signature in the CAI is decrypted using the pre-configured CASP public key to obtain the second hash value; The first and second hash values ​​are compared to see if they are the same. If they are the same, it indicates that the CAI has not been tampered with and all the plaintext information in it is trustworthy. Then, in order to effectively prevent the misuse of other people's certificates, the plaintext information in the CAI is verified, mainly by comparing the other party's AIC with the AIC in the CAI. If they are the same, the verification is successful.

[0045] CertificateVerify verification: The signature is decrypted using the signature algorithm specified by signature_algorithms and the public key in the other party's certificate to obtain the third hash value. Then, the fourth hash value of all handshake messages is calculated, and the third hash value and the fourth hash value are compared. If they are the same, the CertificateVerify verification is successful. This signature refers to the result obtained after encrypting all handshake messages such as ClientHello and ServerHello.

[0046] 8. Once verification is successful, encrypted data transmission between the two parties can begin. It should be noted that before initiating the authentication request, the agent has already obtained the other party's AIC, queries the ACS based on the other party's AIC to obtain the other party's endpoint, and initiates the authentication process by requesting the other party's endpoint service. Once authentication is successful, encrypted communication begins.

[0047] This invention can also perform secure verification of user identity through a personal assistant intelligent agent, enabling trusted user access to the intelligent agent Internet, and proposes a user identity authentication process in the intelligent agent Internet. Figure 4 For an example of a user authentication process, see [link to example]. Figure 4 The system verifies user identity based on the OIDC protocol, where the authentication server can represent third-party authentication and authorization servers such as WeChat and QQ. This process includes: 1. When a user requests a service from a personal assistant, the personal assistant redirects the user to an authentication server to log in. 2. After a user successfully logs in, the authentication service provider generates an ID Token (containing three parts: header, payload, and signature. The signature is obtained by encrypting the payload according to the encryption algorithm defined in the header, which can effectively prevent information from being tampered with), an Access Token, etc., and returns them to the personal assistant intelligent agent. 3. The personal assistant agent uses the authentication server's public key to decode the received ID token, verifying the validity of the signature and the fields such as iss, sub, and aud as specified in the OIDC protocol. Upon successful verification, the user's legitimate identity is authenticated, enabling secure access to the agent's internet connection.

[0048] Corresponding to the above method, the present invention also provides an apparatus for trusted access of intelligent agents to the intelligent agent Internet. The apparatus includes a computer device, which includes a processor and a memory. The memory stores computer instructions, and the processor is used to execute the computer instructions stored in the memory. When the computer instructions are executed by the processor, the apparatus implements the steps of the aforementioned method.

[0049] This invention also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the steps of the aforementioned method. The computer-readable storage medium may be a tangible storage medium, such as random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, register, floppy disk, hard disk, removable storage disk, CD-ROM, or any other form of storage medium known in the art.

[0050] This invention also provides a computer program product, including computer instructions that, when executed by a processor, implement the steps of the aforementioned method.

[0051] Those skilled in the art will understand that the exemplary components, systems, and methods described in conjunction with the embodiments disclosed herein can be implemented in hardware, software, or a combination of both. Whether implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this invention. When implemented in hardware, it can be, for example, electronic circuits, application-specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this invention are programs or code segments used to perform the desired tasks. The programs or code segments can be stored in a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried in a carrier wave.

[0052] It should be clarified that the present invention is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present invention is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of the present invention.

[0053] In this invention, features described and / or illustrated for one embodiment may be used in the same or similar manner in one or more other embodiments, and / or combined with or in place of features of other embodiments.

[0054] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, various modifications and variations of the embodiments of the present invention are possible. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.< / token> < / aic> < / ca-challenge-url>

Claims

1. A method for trusted access of an intelligent agent to the intelligent agent Internet, characterized in that, The method is executed by a certificate authorization server and includes: The system receives an agent identity certificate application request from an agent provider. The certificate application request carries an agent identity code and agent provider information. The identity code is obtained by receiving an agent registration request submitted by the agent provider through an agent registration server. After verifying the agent capability description information carried in the agent registration request, the server sends an agent identity code to the agent provider. The agent capability description information includes the agent name, agent function description, service access endpoint, agent provider information, challenge verification endpoint URL, and agent capability set. Based on the agent identity code, query the agent registration server to obtain the corresponding agent details, which include agent supplier information, challenge verification endpoint URL and corresponding agent identity code; Based on the information carried in the certificate application request, the intelligent agent supplier information and intelligent agent identity code in the intelligent agent details are verified. After the verification is successful, a challenge verification request is initiated to the intelligent agent supplier to perform challenge verification on the challenge verification endpoint URL in the intelligent agent details. After successful verification, a corresponding intelligent agent identity certificate is generated based on the intelligent agent details obtained from the intelligent agent registration server. By receiving an intelligent agent identity certificate download request from the intelligent agent supplier, the corresponding intelligent agent identity certificate is issued to the intelligent agent supplier so that the intelligent agent can be trusted to access the intelligent agent Internet based on the corresponding intelligent agent identity certificate. By initiating a challenge verification request to the agent provider, the challenge verification endpoint URL in the agent's detailed information is verified, including: Randomly generate a string corresponding to the agent, and place the generated string at the location pointed to by the corresponding authorized URL based on the correspondence between the string and the URL; The authorized URL is returned to the agent provider so that the agent provider can obtain the corresponding challenge type and placed string by sending a challenge information retrieval request to the authorized URL. Based on the string and the key, challenge response content is generated and stored in the path location constructed by the certificate authorization server based on the challenge verification endpoint URL to obtain a token file. The certificate authorization server is then notified that it is ready to accept challenge verification. The key is obtained in advance by the certificate authorization server after receiving an account registration request from the agent provider and returning the corresponding key to the agent provider. By initiating a challenge verification request to the intelligent agent supplier, receiving the challenge response content stored in the token file of the intelligent agent supplier, and performing challenge verification on the received challenge response content based on the generated string and the result calculated by the key.

2. The method according to claim 1, characterized in that, The path constructed by the certificate authorization server based on the challenge verification endpoint URL includes the challenge verification endpoint URL, the agent's identity code, and a randomly generated string.

3. The method according to claim 1, characterized in that, The key includes a JWK fingerprint.

4. The method according to claim 1, characterized in that, Issuing corresponding agent identity certificates to the agent provider to enable agents to be trusted to access the agent internet based on the corresponding agent identity certificates includes: The system issues a corresponding agent identity certificate to the agent provider, enabling the agent to authenticate itself via two-way TLS based on the agent identity certificate, thereby allowing the agent to be trusted to access the agent internet.

5. The method according to claim 4, characterized in that, Issuing a corresponding agent identity certificate to the agent provider enables the agent to authenticate itself via two-way TLS based on the agent identity certificate, thereby allowing the agent to be trusted to access the agent internet, including: The system issues a corresponding agent identity certificate to the agent provider, enabling the agent to exchange agent identity certificates with another agent possessing a corresponding agent identity certificate via bidirectional TLS using the TLS 1.3 protocol. The agent verifies the other agent's agent identity certificate, and upon successful verification, the identities of both parties are authenticated. Afterward, the agent and the other agent communicate and begin transmitting encrypted data, enabling the agent and the other agent to be trusted to access the agent internet.

6. The method according to any one of claims 1 to 5, characterized in that, The agent identity code includes multiple fields, including: the latest protocol standard version number supported by the agent, the agent registration service provider, the entity that submitted the agent registration, the year of the agent registration, the agent entity serial number submitted for registration, the agent entity serial number submitted for registration, and the verification code.

7. A device for trusted access of intelligent agents to the intelligent agent Internet, comprising a processor, a memory, and computer instructions stored in the memory, characterized in that, The processor is configured to execute the computer instructions, and when the computer instructions are executed, the device implements the steps of the method as described in any one of claims 1 to 6.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the computer program implements the steps of the method as described in any one of claims 1 to 6.

9. A computer program product comprising computer instructions, characterized in that, When executed by a processor, the computer instructions implement the steps of the method according to any one of claims 1 to 6.

Images