Domain name system-based agent identity authentication method, domain name system-based agent identity registration method, and related devices

Abstract

The application discloses an agent identity authentication method based on a domain name system, an agent identity registration method based on the domain name system and related equipment. The authentication method comprises the following steps: a first agent receives a service request message sent by a second agent, the service request message comprising a request signature, a first resolution domain and a first hash value; a query is initiated to a domain name system based on the first hash value and the first resolution domain, an extended resource record AIR corresponding to the second agent is obtained, and the extended resource record AIR comprises a public key of the second agent; a second hash value is obtained according to the public key, the consistency of the second hash value and the first hash value is verified, the legality of the request signature is verified according to the public key; and in the case that the second hash value is the same as the first hash value and the verification of the request signature is passed, it is determined that the identity authentication is successful. The method combines the distributed resolution capability of the domain name system with the self-authentication mechanism, and improves the efficiency of the agent identity authentication.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to a method for intelligent agent identity authentication based on the domain name system, a method for intelligent agent identity registration based on the domain name system, a first intelligent agent, a second intelligent agent, a computing device, a computer-readable storage medium, and a computer program product. Background Technology

[0002] With the rapid development of artificial intelligence (AI) technology and distributed systems, AI agents, possessing autonomous decision-making capabilities, are becoming core participants in the internet. AI agents can represent users, devices, or services, performing complex tasks on the network, such as automated collaborative computing, data exchange, and service invocation. In these application scenarios, trusted connections need to be established between AI agents, which places higher demands on the identity system.

[0003] Existing identity authentication technologies mainly include certificate systems based on public key infrastructure (PKI) and decentralized identity (DID) systems. However, these identity authentication technologies are generally inefficient and cannot meet the massive identity authentication needs of intelligent agents. Summary of the Invention

[0004] In view of this, this application provides a smart agent identity authentication method and related equipment based on the Domain Name System, so as to improve the efficiency of smart agent identity authentication by combining the high resolution efficiency of the Domain Name System and the cryptographic mechanism.

[0005] Firstly, this application provides a smart agent identity authentication method based on the Domain Name System, which is applied to a first smart agent and includes: Receive a service request message sent by a second intelligent agent, the service request message including the agent identity identifier (AID) of the second intelligent agent and a request signature; wherein, the agent identity identifier (AID) includes a first parsing field and a first hash value; Based on the first hash value and the first resolution domain, a query is initiated to the domain name system to obtain the extended resource record AIR corresponding to the second agent. The extended resource record AIR includes the public key of the second agent. The second hash value is obtained based on the public key, and the consistency between the second hash value and the first hash value is verified. The legality of the request signature is verified based on the public key. If the second hash value is the same as the first hash value, and the verification of the request signature is successful, the identity authentication of the second intelligent agent is determined to be successful.

[0006] In some possible implementations, the agent identity identifier (AID) is a structured string, and the agent identity identifier (AID) also includes a hash algorithm identifier. The first hash value is calculated by using the hash algorithm indicated by the hash algorithm identifier on the public key of the second agent.

[0007] In some possible implementations, the agent identity identifier (AID) further includes a namespace and a version identifier. The namespace is used to indicate the type of the second agent, and the version identifier is used to indicate the evolution cycle of the agent identity identifier (AID) to control the effective status of the public key under different versions.

[0008] In some possible implementations, initiating a query to the Domain Name System based on the first hash value and the first resolution domain includes: The preset naming prefix, the first hash value, and the first parsing domain are concatenated to generate the query path of the extended resource record AIR with a hierarchical structure, wherein the first hash value is a subdomain of the first parsing domain; Initiate a query to the domain name system according to the query path.

[0009] In some possible implementations, the Extended Resource Record (AIR) further includes an identity binding signature, which is obtained by signing the data combining the agent's identity identifier (AID) and the public key. The method further includes: Verify the validity of the identity binding signature based on the public key; The step of determining that the identity authentication of the second intelligent agent is successful when the second hash value is the same as the first hash value and the verification of the request signature is passed includes: If the second hash value is the same as the first hash value, and the verification of the request signature and the identity binding signature is successful, the identity authentication of the second intelligent agent is determined to be successful.

[0010] In some possible implementations, when the second agent undergoes a cross-domain migration, the agent identity identifier (AID) includes a second parsing domain and the first hash value.

[0011] Secondly, this application provides a method for registering the identity of an intelligent agent based on a domain name system. This method is applied to a second intelligent agent and includes: The first hash value is calculated based on the public key of the second agent; Based on the first hash value and the first parsing domain, generate the agent identity identifier (AID) of the second agent; Based on the first hash value and the first resolution domain, a registration request is initiated to the domain name system to register an extended resource record (AIR) corresponding to the second agent in the domain name system, wherein the extended resource record (AIR) includes the public key.

[0012] In some possible implementations, the method further includes: A service request message is sent to the first intelligent agent. The service request message includes the agent identity identifier (AID) of the second intelligent agent and a request signature, so that the first intelligent agent can obtain the public key from the domain name system based on the first resolution domain and the first hash value, and verify the legality of the first hash value and the request signature.

[0013] Thirdly, this application provides a first intelligent agent, which includes modules for executing the method in the first aspect or any possible implementation of the first aspect, specifically including: The transceiver module is used to receive a service request message sent by a second intelligent agent. The service request message includes the agent identity identifier (AID) of the second intelligent agent and a request signature. The agent identity identifier (AID) includes a first parsing field and a first hash value. The query module is used to initiate a query to the domain name system based on the first hash value and the first resolution domain to obtain the extended resource record AIR corresponding to the second agent, wherein the extended resource record AIR includes the public key of the second agent; The verification module is used to obtain a second hash value based on the public key and verify the consistency between the second hash value and the first hash value, and to verify the legality of the request signature based on the public key; The verification module is further configured to determine that the identity authentication of the second intelligent agent is successful if the second hash value is the same as the first hash value and the verification of the request signature is passed.

[0014] Fourthly, this application provides a first intelligent agent, which includes modules for executing the method in the first aspect or any possible implementation of the first aspect, specifically including: The calculation module is used to calculate the first hash value based on the public key of the second intelligent agent; The identifier generation module is used to generate the agent identity identifier (AID) of the second agent based on the first hash value and the first parsing domain; The transceiver module is used to initiate a registration request to the domain name system based on the first hash value and the first resolution domain, so as to register an extended resource record AIR corresponding to the second intelligent agent in the domain name system, wherein the extended resource record AIR includes the public key.

[0015] Fifthly, this application provides a computing device. The computing device includes a processor and a memory. The memory stores computer instructions; the processor executes the method described in any possible implementation of the first or second aspect of this application according to the computer instructions.

[0016] Sixthly, this application provides a computer-readable medium storing instructions that, when executed on a computer device, cause the computer device to perform the method described in any possible implementation of the first or second aspect of this application.

[0017] In a seventh aspect, this application provides a computer program product containing instructions that, when run on a computer, cause the computer to perform the method described in any possible implementation of the first or second aspect of this application.

[0018] Based on the implementation methods provided in the above aspects, this application can be further combined to provide more implementation methods.

[0019] As can be seen from the above technical solutions, the embodiments of this application have the following advantages: This application provides a method for intelligent agent identity authentication based on the Domain Name System (DNS). In this method, a first intelligent agent can verify the integrity of a service request message and the authenticity of the service request message source by querying the DNS and hash values. This method combines the distributed resolution capability of the DNS with a self-authentication mechanism, thereby improving the efficiency of intelligent agent identity authentication. Attached Figure Description

[0020] Figure 1 This is a flowchart of an intelligent agent identity authentication method based on the domain name system disclosed in an embodiment of this application; Figure 2 This is a flowchart of an intelligent agent identity registration method based on the domain name system disclosed in an embodiment of this application; Figure 3 This is a schematic diagram illustrating a scenario of an intelligent agent identity authentication method based on a domain name system disclosed in an embodiment of this application; Figure 4 This is a schematic diagram of the structure of a first intelligent agent disclosed in an embodiment of this application; Figure 5 This is a schematic diagram of the structure of a second intelligent agent disclosed in an embodiment of this application. Detailed Implementation

[0021] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, the embodiments of this application will be further described in detail below with reference to the accompanying drawings and specific implementation methods.

[0022] The terminology used in the following embodiments is for the purpose of describing specific embodiments only and is not intended to be a limitation of this application. The terms "first" and "second" in the embodiments of this application are for descriptive purposes only and should not be construed as indicating or implying relative importance, chronological order of operations, or implicitly specifying the number of indicated technical features. Therefore, a feature defined with "first" and "second" may explicitly or implicitly include one or more of that feature.

[0023] First, a brief introduction to the background technology involved in this application will be given.

[0024] With the rapid development of artificial intelligence (AI) technology and distributed systems, AI agents, possessing autonomous decision-making capabilities, are becoming core participants in the internet. AI agents can represent users, devices, or services, performing complex tasks on the network, such as automated collaborative computing, data exchange, and service invocation. In these application scenarios, trusted connections need to be established between AI agents, which places higher demands on the identity system, including globally unique identities, resolvable identities capable of location tracking, verifiable identities capable of trusted authentication, and transferable identities capable of cross-domain migration.

[0025] Currently, existing identity authentication technologies mainly include certificate systems based on Public Key Infrastructure (PKI) and decentralized identity (DID) systems. However, these authentication technologies still have significant shortcomings. Public Key Infrastructure systems rely too heavily on centralized trust anchors, resulting in single-point-of-trust problems, and their certificate issuance and management costs are high, leading to overall low efficiency. While DID systems possess decentralized characteristics, their parsing efficiency is insufficient, making it difficult to handle the massive authentication requests in complex networks.

[0026] The Domain Name System (DNS), as a crucial infrastructure of the Internet, possesses globally distributed resolution capabilities and plays a vital role in resolving domain names into Internet Protocol (IP) addresses. However, the current DNS system lacks semantic extension capabilities for agent identity, preventing it from directly supporting identity authentication and trust verification.

[0027] In view of this, embodiments of this application provide an intelligent agent identity authentication method based on the Domain Name System (DNS) to improve the efficiency of intelligent agent identity authentication by combining the high resolution efficiency of the DNS with cryptographic mechanisms.

[0028] The method includes: a first intelligent agent receiving a service request message sent by a second intelligent agent, the service request message including the second intelligent agent's agent identity identifier (AID) and a request signature; wherein the agent identity identifier (AID) includes a first resolution field and a first hash value. Then, the first intelligent agent initiates a query to the Domain Name System (DNS) based on the first hash value and the first resolution field to obtain an Extended Resource Record (AIR) corresponding to the second intelligent agent, the AIR including the second intelligent agent's public key. Next, the first intelligent agent obtains a second hash value based on the public key and verifies the consistency between the second hash value and the first hash value, and verifies the legality of the request signature based on the public key. If the second hash value is the same as the first hash value, and the request signature verification passes, the first intelligent agent determines that the second intelligent agent's identity authentication is successful.

[0029] In this method, the second agent is the one that requests the AI ​​services of the first agent. To ensure security, the first agent needs to verify the service request messages it sends. This method allows the first agent to verify the integrity of the service request message and the authenticity of its source by querying the Domain Name System (DNS) and hash values. By combining the DNS's distributed resolution capabilities with a self-authentication mechanism, the efficiency of agent authentication is improved.

[0030] To make the solution provided in this application clearer, the method provided in this application will be described below with reference to specific embodiments.

[0031] Figure 1 This is a flowchart of an intelligent agent identity authentication method based on the Domain Name System disclosed in an embodiment of this application. The method is applied to a first intelligent agent and includes: S101: The first intelligent agent receives the service request message sent by the second intelligent agent.

[0032] In some possible implementations, the first and second intelligent agents are two peer entities or server-client entities in a distributed network environment. Specifically, the second intelligent agent is the agent that requests the first intelligent agent's AI service (also known as the requesting agent), and the first intelligent agent is the server entity that provides the corresponding AI service and verifies the request (also known as the service-providing agent). When the second intelligent agent needs to obtain the network service provided by the first intelligent agent, it initiates a request to the first intelligent agent. To ensure communication security and achieve trusted identity authentication, the second intelligent agent sends a service request message to the first intelligent agent, and correspondingly, the first intelligent agent performs the operation of receiving the service request message sent by the second intelligent agent.

[0033] The service request message includes the agent identity identifier (AID) of the second agent and a request signature. The request signature is obtained by the second agent using its private key to perform cryptographic signature calculations on some or all of the key content in the service request message, and is used by the first agent to subsequently verify the integrity of the message and the authenticity of the sending source.

[0034] An Agent Identity (AID) is a digital credential used to represent the autonomous identity of an agent in a decentralized or distributed network environment. An Agent Identity (AID) can also be called a decentralized self-certifying identity. The AID primarily provides an identity statement for the agent and serves as a trusted foundation for subsequent identity resolution, Domain Name System (DNS) queries, and signature authentication. In a service request message, the Agent Identity (AID) carried by the second agent specifically includes a first resolution field and a first hash value.

[0035] The first resolution domain refers to the domain name, subdomain, or domain suffix used to indicate the corresponding resolution entry point in the domain name system (DNS). It is mainly used to determine the distributed resolution node or target query path to which subsequent queries are sent to the domain name system.

[0036] The first hash value refers to the fixed value obtained by hashing the identity credential (such as the public key) of the second agent based on a specific cryptographic hash algorithm. It has global uniqueness and cryptographic anti-tampering characteristics. It is used to establish a cryptographic binding relationship with the public key of the second agent, so that the verifier can confirm the true correspondence between the identity identifier and the public key by hash calculation alone, and realize self-authentication of identity.

[0037] In some possible implementations, the agent identity identifier (AID) is a structured string. In addition to the first parsing field and the first hash value, the agent identity identifier (AID) may also include a hash algorithm identifier.

[0038] The first hash value is obtained by cryptographically calculating the public key of the second agent using the cryptographic hash algorithm indicated by the hash algorithm identifier. In other words, by explicitly including the hash algorithm identifier in the agent's identity identifier (AID), algorithmic ambiguity can be effectively eliminated, and smooth upgrades and agile switching to higher-level cryptographic hash algorithms in the future can be supported.

[0039] Furthermore, the agent identity identifier (AID) can also include a namespace and a version identifier.

[0040] Namespaces are used to indicate the type of the second intelligent agent (e.g., general artificial intelligence agent, Internet of Things agent, or specific business service entity) so that upper-layer network or application policies can perform access control, namespace isolation, and fine-grained identification.

[0041] Version identifiers are used to indicate the epoch of the agent identity identifier (AID). The epoch can control the effective status of the public key of the second agent under different versions, thereby supporting the periodic updating, rotation, abandonment and asynchronous management of the public key. While maintaining the continuity of the agent identity, it greatly improves the system's ability to resist security risks such as key leakage.

[0042] Based on the above description, this application also provides an exemplary representation of an AID. An AID can be a segmented structured string composed of multiple text fields connected by a preset delimiter (such as a colon). The specific structure can be: AID = aid: <ns> : <domain> : <hash-alg> : <hash-value> : <epoch>; in, <ns>For namespaces; <domain>It is the first parse domain; <hash-alg>Identifier for hash algorithm; <hash-value>The first hash value; <epoch>This is a version identifier. Please refer to the above description for a detailed definition.

[0043] S102: The first agent initiates a query to the domain name system based on the first hash value and the first resolution domain, and obtains the extended resource record AIR corresponding to the second agent.

[0044] After the first agent parses and extracts the first resolution domain and the first hash value corresponding to the second agent from the service request message, it initiates a distributed resolution query to the domain name system to efficiently and securely obtain the second agent's trusted public key and other identity credentials in a decentralized network architecture.

[0045] An Extended Resource Record (AIR) is a structured identity data carrier specifically defined for network agents within the Domain Name System (DNS). Also known as an agent identity record, AIR primarily carries trusted identity information of agents directly within a distributed DNS infrastructure, providing a globally resolvable and tamper-proof identity data source for any verifier. The AIR includes the public key of the second agent, serving as the cryptographic basis for subsequent self-authentication and signature verification by the first agent against the second agent, and also as the foundational credential for secure communication encryption between subsequent agents.

[0046] Furthermore, to ensure compatibility with the existing Domain Name System (DNS) architecture, when the first agent initiates a query to the DNS based on the first hash value and the first resolution domain, it can specifically: concatenate the preset naming prefix, the first hash value, and the first resolution domain sequentially to obtain the second resolution domain (i.e., the target query domain); then, using this second resolution domain as the query target, it initiates a resolution request to the DNS for the Extended Resource Record (AIR). The preset naming prefix can be a predefined specific text prefix (e.g., _aid) used to identify the agent's identity query service. By concatenating the first hash value (which typically has global uniqueness) as a subdomain with the preset naming prefix and the first resolution domain, not only can the query path be globally uniquely locatable and indexable within the DNS, but it can also effectively prevent attackers from implementing identity spoofing by replacing, hijacking, or tampering with the resolution path, thereby ensuring the security of the query process.

[0047] Based on the above introduction, this application also provides an exemplary mapping mechanism from AID to DNS name: _agent. <hash-value> . <domain>That is, the first hash value is a subdomain of the first resolution domain. This design has the following advantages: compatibility with the existing DNS naming system, support for distributed deployment, and avoidance of naming conflicts.

[0048] In some possible implementations, the Extended Resource Record (AIR) also includes an identity binding signature, also known as a record signature. The identity binding signature is a cryptographic signature used by the domain owner of the first resolved domain (i.e., the authorized domain administrator to which the second agent's identity is registered and belongs) to endorse the agent's identity data.

[0049] Specifically, the identity binding signature is generated by concatenating and performing cryptographic signature calculations on multi-dimensional key identity data, including the first resolution domain, the agent's identity identifier (AID), the second agent's public key, and version identifiers (such as evolution cycles), using the domain owner's private key. By introducing the domain owner's record signature for key identity fields into the Extended Resource Record (AIR), not only can a trust inheritance relationship be established between the agent's identity and its domain owner, but it can also effectively prevent malicious attackers from arbitrarily publishing or forging the second agent's fake public key under malicious domains or subdomains under their control, thus improving the security of identity authentication.

[0050] Based on the above introduction, this application also provides an exemplary logical structure for an AIR record, as shown in Table 1: Table 1

[0051] As shown in Table 1, in addition to the aforementioned content, AIR can also record the service address and capability description information of the second intelligent agent, thereby recording the characteristics of the second intelligent agent more comprehensively and accurately, which is conducive to the second intelligent agent determining whether the service message request is reasonable; AIR can also include extended fields to reserve other possible information inputs.

[0052] Based on the description in Table 1, the embodiments of this application also exemplarily provide the AIR binary encoding format: +--------------------------+ | Version (8 bits) | +--------------------------+ | HashAlg (8 bits) | +--------------------------+ | PubKeyAlg (16 bits) | +------------------------------+ | Epoch (16 bits)| +------------------------------+ | AID Length (16 bits)| +------------------------------+ | AID| +------------------------------+ | PubKey Length (16 bits) | +------------------------------+ | Public Key| +------------------------------+ | Locator Length (16 bits) | +------------------------------+ | Locator| +------------------------------+ | Capability Length (16 bits) | +------------------------------+ | Capability| +------------------------------+ | Signature Length (16 bits) | +------------------------------+ | Signature| +------------------------------+ | Extension Length (16 bits) | +------------------------------+ | Extension Data| +--------------------------+ Each field corresponds to the description in Table 1.

[0053] S103: The first agent obtains the second hash value based on the public key and verifies the consistency between the second hash value and the first hash value, and verifies the legality of the request signature based on the public key.

[0054] S104: If the second hash value is the same as the first hash value, and the signature verification is successful, the first agent determines that the second agent's identity authentication is successful.

[0055] After obtaining the Extended Resource Record (AIR) corresponding to the second agent through distributed DNS resolution, the first agent extracts the second agent's public key contained within it. Subsequently, the first agent uses this public key to perform hash consistency verification for self-authentication and validity verification of the request signature, ensuring the authenticity of the communication peer's identity and the integrity of the request message. The verification process and results will be described in detail below.

[0056] First, let's introduce the process of hash consistency verification: The first agent first obtains the public key of the second agent carried in the extended resource record (AIR) and determines the cryptographic hash algorithm required to generate the hash value. For example, if the agent identity AID explicitly contains a hash algorithm identifier, the first agent performs cryptographic calculations on the extracted public key of the second agent according to the specific hash algorithm indicated by the hash algorithm identifier, thereby obtaining a fixed value, namely the second hash value; if the AID does not contain an algorithm identifier, the system's default cryptographic hash algorithm can be used for calculation. After obtaining the second hash value, the first agent compares the second hash value with the first hash value parsed and extracted from the agent identity AID in the service request message to verify whether the two are completely consistent. If they are consistent, the hash consistency check passes.

[0057] Because there is a definitive cryptographic binding between the first hash value and the public key of the second agent, any verifier only needs to perform local hash calculations to confirm the identity of the public key. Therefore, by verifying the consistency between the second hash value and the first hash value, the first agent can directly confirm that the public key obtained from the DNS does indeed belong to the legitimate holder declared by the agent's identity ID (AID), fundamentally eliminating the possibility of attackers attempting to commit identity fraud or hijacking by stealing someone else's AID or replacing or tampering with the public key in the DNS.

[0058] The following describes the process of verifying the validity of the signature request: The first agent uses the public key of the second agent to perform cryptographic signature verification on the request signature carried in the service request message. Specifically, the request signature is generated by the second agent before sending the request, using its locally securely stored private key to concatenate key business data (such as request headers, timestamps, random numbers, and core payloads) in the service request message and calling an asymmetric encryption algorithm. The first agent then verifies the legitimacy of the request signature by decrypting it or aligning the signature matrix using the public key obtained from the DNS Extended Resource Record (AIR).

[0059] This verification process is primarily used to ensure message source authentication and tamper-proofing during communication. Due to the unique correspondence of asymmetric key pairs, only the entity holding the private key matching the public key can generate a valid request signature. By verifying the validity of the request signature, the first agent can not only ultimately confirm that the active entity currently initiating the service request is indeed the true legitimate owner of the public key and AID (achieving "proof of ownership"), but also ensure that the service request message has not been maliciously tampered with by a third party during network transmission.

[0060] It should be noted that the embodiments of this application do not impose specific restrictions on the order of the two verification processes.

[0061] If the second hash value is the same as the first hash value, and the request signature verification passes, the first agent can determine that the service request message has passed the hash consistency check and the legality check of the request signature, thereby confirming that the second agent's identity authentication is successful and subsequent service calls and other operations can be performed.

[0062] Furthermore, the Extended Resource Record (AIR) can also include an identity-bound signature. An identity-bound signature is a digital credential obtained by cryptographically signing the data combining the agent's identity identifier (AID) and public key. Optionally, the data involved in the signature combination may also include a first parsing field and a version identifier, etc.

[0063] After acquiring the Extended Resource Record (AIR), the first intelligent agent can also verify the legitimacy of the identity binding signature based on the public key contained within it. Specifically, the first intelligent agent uses the public key to perform a signature verification calculation on the identity binding signature to confirm whether the identity binding signature was generated after a legitimate identity registrant endorsed the aforementioned key identity data.

[0064] Therefore, the criteria for determining the successful authentication of the second agent will be more stringent. Specifically, if the second hash value is the same as the first hash value, and both the request signature and the identity binding signature verifications pass, the first agent determines that the second agent's authentication has been successful.

[0065] Understandably, by introducing identity-bound signatures into the Extended Resource Record (AIR) and verifying their legitimacy, the first agent can further confirm the authenticity and validity of the strong binding relationship between the domain name, the agent's identity identifier (AID), and the public key. This multi-factor authentication mechanism enables the authorized domain to confirm the agent's identity, effectively preventing attackers from publishing or tampering with forged agent identity information under malicious domains under their control, thus improving the reliability of identity authentication.

[0066] In some possible implementations, when the second agent migrates across domains, its home domain name or authorized registration DNS resolution entry changes. That is, the agent identity identifier (AID) of the second agent includes a second DNS resolution domain and a first hash value. The second DNS resolution domain corresponds to the new domain name or new DNS resolution entry after the migration, while the first hash value remains unchanged.

[0067] This is because the underlying asymmetric key pair (i.e., public key assets) of the second agent remains unchanged, thus the first hash value, which serves as the core credential for identity self-authentication, can be fully preserved. When the first agent subsequently receives a service request from the migrated second agent, it can initiate a distributed DNS lookup query for the new domain name based on the new second resolution domain carried in the AID, to obtain the migrated Extended Resource Record (AIR), and combine this with the unchanged first hash value to complete subsequent hash consistency verification and request signature verification. In this way, the continuity and unforgeability of the agent's identity can be ensured when migrating across institutions, regions, or service domains.

[0068] Based on the above description, this application provides an intelligent agent identity authentication method based on the Domain Name System. In this method, the first intelligent agent can verify the integrity of the service request message and the authenticity of the service request message sending source by querying the Domain Name System and hash value. This method combines the distributed resolution capability of the Domain Name System with the self-authentication mechanism, thereby improving the efficiency of intelligent agent identity authentication.

[0069] Figure 1 The corresponding embodiment describes the process by which a first intelligent agent verifies the identity of a second intelligent agent based on DNS. It is understood that the second intelligent agent needs to register its AIR in the network beforehand for querying during the verification process. Based on this, embodiments of this application also provide an intelligent agent identity registration method based on the Domain Name System. See [link to documentation]. Figure 2 A flowchart of an intelligent agent identity registration method based on the domain name system provided in this application embodiment.

[0070] like Figure 2 As shown, this method is applied to the second agent, which is the agent that subsequently sends the service request message. The method specifically includes the following steps: S201: The second agent calculates the first hash value based on the public key of the second agent.

[0071] Before accessing the network or requesting a service, the second agent needs to generate an asymmetric key pair locally, consisting of a public key and a private key. Next, the second agent uses a specific cryptographic hash algorithm to calculate the public key, thereby obtaining a first hash value. For the specific concepts and definitions of the public key and the first hash value, please refer to the above text. Figure 1 Description of corresponding method embodiments.

[0072] In this way, by calculating the hash value of the public key as the core component of subsequent identity identification, the second intelligent agent can autonomously complete the construction of the underlying cryptographic trust root without the intervention of a third-party authoritative institution, thereby laying the data foundation for realizing decentralized self-authentication identity.

[0073] S202: The second agent generates an agent identity identifier (AID) based on the first hash value and the first parsing domain.

[0074] After obtaining the first hash value, the second agent acquires the first resolution domain, which indicates the entry point for subsequent domain name system (DNS) resolution. Then, the second agent combines the first hash value with the first resolution domain to generate its agent identity identifier (AID). In addition to the first hash value and the first resolution domain, the agent identity identifier (AID) may also include fields such as a hash algorithm identifier, namespace, and version identifier. For specific concepts and definitions of the first resolution domain, the agent identity identifier (AID), and their respective fields, please refer to the above text. Figure 1 Description of corresponding method embodiments.

[0075] In this way, the generated agent identity identifier AID serves as the second agent's unique digital credential in the decentralized network, realizing the cryptographic binding between identity and public key, and providing a basis for subsequent identity registration, parsing and querying.

[0076] S203: The second agent initiates a registration request to the domain name system based on the first hash value and the first resolution domain, in order to register the extended resource record AIR corresponding to the second agent in the domain name system.

[0077] After generating its agent identity identifier (AID), the second agent needs to publish its identity credentials to the globally distributed DNS infrastructure. Specifically, the second agent constructs the corresponding registration and query paths based on the first hash value and the first DNS domain, and initiates a registration request to the Domain Name System (DNS) for the Extended Resource Record (AIR). This AIR contains at least the second agent's public key and, optionally, may also include an identity binding signature for attribution authentication. For specific concepts and definitions of the DNS and AIR, please refer to the above text. Figure 1 Description of corresponding method embodiments.

[0078] Thus, by successfully registering the Extended Resource Record (AIR) in the Domain Name System, the second agent completes the on-chaining and distribution of its identity record within the network. This registration process enables any other agent in the network to retrieve the AIR based on the first hash value and the first resolution domain, thereby obtaining the second agent's public key and completing subsequent security verification procedures.

[0079] To make the above method embodiments more specific and intuitive, this application also provides a scenario example of an intelligent agent identity authentication method based on the Domain Name System. It should be noted that this example is merely an illustrative illustration of the method provided in this application and does not represent all implementations of the method provided in this application.

[0080] See Figure 3 This is a schematic diagram illustrating a scenario for an intelligent agent identity authentication method based on a domain name system, provided in an embodiment of this application. It should be understood that... Figure 3 The specific implementation methods described in the above method embodiments are all consistent with those described in the present invention and will not be repeated here. The method includes the following steps: S301: The second agent (agent A) performs AIR registration.

[0081] The second agent (agent A) can first generate an AID, for example, as described in the method embodiment above: Based on the public key PublicKey_A = Ed25519(...); Hash calculation: Hash = SHA-256(PublicKey_A); The AID obtained is: aid:ai:client.ai.com:sha256:9f3a8c2e:01.

[0082] Then, the second agent (Agent A) can register an AIR record in DNS: _agent.9f3a8c2e.client.ai.com

[0083] The specific content of AIR includes the meaning of the specific fields, which can be found in the description of the method embodiment above: AID = aid:ai:client.ai.com:sha256:9f3a8c2e:01; PubKeyAlg = Ed25519; PublicKey = ... ...; Locator = https: / / client.ai.com / api; Signature = Sign(domain || AID || PublicKey || Epoch).

[0084] S302: The second agent sends a service request message to the first agent (agent B).

[0085] The service request message may include the following content, and the meaning of the specific fields can be found in the description in the method embodiment above: POST / api / chat; Agent-AID: aid:ai:client.ai.com:sha256:9f3a8c2e:01; Agent-Timestamp: 1710000000; Agent-Signature: SIG_A.

[0086] S303: The first agent (agent B) performs parsing and query operations.

[0087] The first intelligent agent (Agent B) can query _agent.9f3a8c2e.client.ai.com to obtain the specific content of AIR.

[0088] S304: The first agent (agent B) performs the verification.

[0089] The first intelligent agent can perform one or more verifications based on the acquired AIR content and service request message, for example: (1) DNS verification, such as DNSSEC verification: used to ensure data trustworthiness.

[0090] (2) Hash consistency verification: SHA256(PublicKey_A) equals 9f3a8c2e.

[0091] (3) Identity binding verification: Verify AIR signature (Verify(Signature, domain || AID ||PublicKey || Epoch)).

[0092] (4) Request signature verification: Verify(SIG_A, AID || timestamp||payload).

[0093] If the verification passes, trust can be established, for example, by determining that Trust(A) equals TRUE, thereby proceeding with subsequent service calls.

[0094] Based on the above description, this application provides a possible implementation of a domain name system-based intelligent agent authentication method in an experimental scenario, which more intuitively demonstrates how this method combines DNS and cryptographic principles to achieve efficient intelligent agent authentication.

[0095] This application also provides a first intelligent agent. A detailed description is provided below with reference to the accompanying drawings.

[0096] See Figure 4 The diagram shown illustrates the structure of a first intelligent agent. The first intelligent agent 400 may include: The transceiver module 401 is used to receive a service request message sent by the second intelligent agent. The service request message includes the agent identity identifier (AID) of the second intelligent agent and a request signature. The agent identity identifier (AID) includes a first parsing field and a first hash value. The query module 402 is used to initiate a query to the domain name system based on the first hash value and the first resolution domain to obtain the extended resource record AIR corresponding to the second agent. The extended resource record AIR includes the public key of the second agent. The verification module 403 is used to obtain the second hash value based on the public key and verify the consistency between the second hash value and the first hash value, and to verify the legality of the request signature based on the public key; The verification module 403 is also used to determine that the identity authentication of the second agent is successful if the second hash value is the same as the first hash value and the verification of the request signature is passed.

[0097] In some possible implementations, the agent identity identifier (AID) is a structured string. The agent identity identifier (AID) also includes a hash algorithm identifier. The first hash value is calculated by using the hash algorithm indicated by the hash algorithm identifier on the public key of the second agent.

[0098] In some possible implementations, the agent identity (AID) also includes a namespace and a version identifier. The namespace is used to indicate the type of the second agent, and the version identifier is used to indicate the evolution cycle of the agent identity (AID) to control the effective status of the public key under different versions.

[0099] In some possible implementations, when query module 402 initiates a query to the domain name system based on the first hash value and the first resolution domain, it is specifically used for: The preset naming prefix, the first hash value, and the first resolution domain are concatenated to generate the query path of the extended resource record AIR with a hierarchical structure, wherein the first hash value is a subdomain of the first resolution domain; Initiate a query to the Domain Name System based on the query path.

[0100] In some possible implementations, the Extended Resource Record (AIR) also includes an identity binding signature, which is obtained by signing the data composed of the agent's identity identifier (AID) and public key. Module 403 is also used for: Verify the legitimacy of the identity-bound signature based on the public key; If the second hash value is the same as the first hash value, and the verification of the request signature and the identity binding signature is successful, the identity authentication of the second agent is determined to be successful.

[0101] In some possible implementations, when a second agent migrates across domains, the agent's identity identifier (AID) includes a second parsing domain and a first hash value.

[0102] This application also provides a second intelligent agent. A detailed description is provided below with reference to the accompanying drawings.

[0103] See Figure 5 The diagram shown illustrates the structure of a second intelligent agent. The second intelligent agent 500 may include: Calculation module 501 is used to calculate the first hash value based on the public key of the second agent; The identifier generation module 502 is used to generate the agent identity identifier AID of the second agent based on the first hash value and the first parsing domain; The transceiver module 503 is used to initiate a registration request to the domain name system based on the first hash value and the first resolution domain, so as to register the extended resource record AIR corresponding to the second intelligent agent in the domain name system, wherein the extended resource record AIR includes a public key.

[0104] In some possible implementations, the transceiver module 503 is also used for: A service request message is sent to the first intelligent agent. The service request message includes the agent identity identifier (AID) of the second intelligent agent and a request signature, so that the first intelligent agent can obtain the public key from the domain name system based on the first resolution domain and the first hash value, and verify the legality of the first hash value and the request signature.

[0105] Based on the aforementioned method and intelligent agent, this application also provides a computing device. The computing device includes a processor and a memory. The memory stores computer-readable instructions, and the processor executes these instructions to perform the aforementioned method. In some examples, the computing device is used to implement the functions of the aforementioned apparatus.

[0106] This application provides a computer-readable storage medium storing instructions that, when executed on a computer device, cause the computer device to perform the above-described method.

[0107] This application provides a computer program product containing instructions that, when run on a computer device, cause the computer device to perform the above-described method.

[0108] It should also be noted that the device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. In addition, in the device embodiment drawings provided in this application, the connection relationship between modules indicates that they have a communication connection, which can be implemented as one or more communication buses or signal lines.

[0109] Through the above description of the embodiments, those skilled in the art can clearly understand that this application can be implemented by means of software plus necessary general-purpose hardware, or it can be implemented by special-purpose hardware including application-specific integrated circuits, special-purpose CPUs, special-purpose memory, special-purpose components, etc. Generally, any function performed by a computer program can be easily implemented by corresponding hardware, and the specific hardware structure used to implement the same function can also be diverse, such as analog circuits, digital circuits, or special-purpose circuits. However, for this application, software program implementation is more often a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a readable storage medium, such as a computer floppy disk, USB flash drive, mobile hard disk, ROM, RAM, magnetic disk, or optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, training equipment, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0110] In the above embodiments, the implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, in the form of a computer program product.

[0111] The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions may be transmitted from one website, computer, training device, or data center to another website, computer, training device, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that a computer can store or a data storage device such as a training device or data center that integrates one or more available media. The available media may be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media (e.g., solid-state drives (SSDs)).

[0112] The above description of the disclosed embodiments enables those skilled in the art to make or use this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.< / domain> < / hash-value> < / epoch> < / domain> < / ns> < / epoch> < / hash-value> < / hash-alg> < / domain> < / ns>

Claims

1. A smart agent identity authentication method based on a domain name system, characterized in that, Applied to a first intelligent agent, the method includes: Receive a service request message sent by a second intelligent agent, the service request message including the agent identity identifier (AID) of the second intelligent agent and a request signature; wherein, the agent identity identifier (AID) includes a first parsing field and a first hash value; Based on the first hash value and the first resolution domain, a query is initiated to the domain name system to obtain the extended resource record AIR corresponding to the second agent. The extended resource record AIR includes the public key of the second agent. The second hash value is obtained based on the public key, and the consistency between the second hash value and the first hash value is verified. The legality of the request signature is verified based on the public key. If the second hash value is the same as the first hash value, and the verification of the request signature is successful, the identity authentication of the second intelligent agent is determined to be successful.

2. The method according to claim 1, characterized in that, The agent identity identifier AID is a structured string, and the agent identity identifier AID also includes a hash algorithm identifier. The first hash value is calculated by using the hash algorithm indicated by the hash algorithm identifier on the public key of the second agent.

3. The method according to claim 2, characterized in that, The agent identity identifier (AID) also includes a namespace and a version identifier. The namespace is used to indicate the type of the second agent, and the version identifier is used to indicate the evolution cycle of the agent identity identifier (AID) to control the effective status of the public key under different versions.

4. The method according to any one of claims 1 to 3, characterized in that, The step of initiating a query to the Domain Name System based on the first hash value and the first resolution domain includes: The preset naming prefix, the first hash value, and the first parsing domain are concatenated to generate the query path of the extended resource record AIR with a hierarchical structure, wherein the first hash value is a subdomain of the first parsing domain; Initiate a query to the domain name system according to the query path.

5. The method according to any one of claims 1 to 3, characterized in that, The extended resource record AIR also includes an identity binding signature, which is obtained by signing the data combining the agent's identity identifier AID and the public key; The method further includes: Verify the validity of the identity binding signature based on the public key; The step of determining that the identity authentication of the second intelligent agent is successful when the second hash value is the same as the first hash value and the verification of the request signature is passed includes: If the second hash value is the same as the first hash value, and the verification of the request signature and the identity binding signature is successful, the identity authentication of the second intelligent agent is determined to be successful.

6. The method according to any one of claims 1 to 3, characterized in that, When the second agent undergoes cross-domain migration, the agent identity identifier AID includes the second parsing domain and the first hash value.

7. A method for registering intelligent agent identities based on a domain name system, characterized in that, Applied to a second intelligent agent, the method includes: The first hash value is calculated based on the public key of the second agent; Based on the first hash value and the first parsing domain, generate the agent identity identifier (AID) of the second agent; Based on the first hash value and the first resolution domain, a registration request is initiated to the domain name system to register an extended resource record (AIR) corresponding to the second agent in the domain name system, wherein the extended resource record (AIR) includes the public key.

8. The method according to claim 7, characterized in that, The method further includes: A service request message is sent to the first intelligent agent. The service request message includes the agent identity identifier (AID) of the second intelligent agent and a request signature, so that the first intelligent agent can obtain the public key from the domain name system based on the first resolution domain and the first hash value, and verify the legality of the first hash value and the request signature.

9. A first intelligent agent, characterized in that, The first intelligent agent includes: The transceiver module is used to receive a service request message sent by a second intelligent agent. The service request message includes the agent identity identifier (AID) of the second intelligent agent and a request signature. The agent identity identifier (AID) includes a first parsing field and a first hash value. The query module is used to initiate a query to the domain name system based on the first hash value and the first resolution domain to obtain the extended resource record AIR corresponding to the second agent, wherein the extended resource record AIR includes the public key of the second agent; The verification module is used to obtain a second hash value based on the public key and verify the consistency between the second hash value and the first hash value, and to verify the legality of the request signature based on the public key; The verification module is further configured to determine that the identity authentication of the second intelligent agent is successful if the second hash value is the same as the first hash value and the verification of the request signature is passed.

10. A second intelligent agent, characterized in that, The second intelligent agent includes: The calculation module is used to calculate the first hash value based on the public key of the second intelligent agent; The identifier generation module is used to generate the agent identity identifier (AID) of the second agent based on the first hash value and the first parsing domain; The transceiver module is used to initiate a registration request to the domain name system based on the first hash value and the first resolution domain, so as to register an extended resource record AIR corresponding to the second intelligent agent in the domain name system, wherein the extended resource record AIR includes the public key.

11. The second intelligent agent according to claim 10, characterized in that, The transceiver module is also used for: A service request message is sent to the first intelligent agent. The service request message includes the agent identity identifier (AID) of the second intelligent agent and a request signature, so that the first intelligent agent can obtain the public key from the domain name system based on the first resolution domain and the first hash value, and verify the legality of the first hash value and the request signature.

12. A computer program product, characterized in that, When the computer program product is run on a computer, it causes the computer to perform the method as described in any one of claims 1 to 8.

Images