Strongly isolated private domain intelligent agent data processing method, server and computer program product

Abstract

The application discloses a strong-isolated private-domain intelligent agent data processing method and a server, relates to the field of data security, and comprises the following steps: receiving a data processing request sent by a user through a user terminal and obtaining a department identifier; routing the data processing request to a corresponding internal data interface module according to the department identifier, wherein the internal data interface module is used for analyzing the data processing request, obtaining a processing task, and calling an intelligent agent engine, the intelligent agent engine is used for obtaining a temporary access credential according to the department identifier and accessing a department internal data storage area based on the temporary access credential to obtain to-be-processed data; and the intelligent agent engine is used for executing the processing task, analyzing and processing the to-be-processed data, obtaining a processing result, and transmitting the processing result to the user terminal through an output interface module. The application can effectively reduce the risk of data leakage and the risk of unauthorized access and information leakage between different departments.

Description

Technical Field

[0001] This application relates to the field of data security, and in particular to a method and server for processing private domain intelligent agent data with strong isolation. Background Technology

[0002] With the rapid development of artificial intelligence technology, intelligent analysis and decision-making systems have been widely applied in various fields. However, most current mainstream intelligent analysis and decision-making systems rely on cloud engines for data processing.

[0003] For specific sectors such as government agencies, financial institutions, and medical institutions, the data they process (such as official documents, policy documents, and personal privacy information) is highly confidential and sensitive. Due to the confidentiality of this data, strict isolation is required between different departments within these sectors. Uploading this data to a public cloud or external server for processing via a cloud engine not only increases the risk of data breaches but also raises the risk of unauthorized access and information leaks between different departments.

[0004] Therefore, a solution is urgently needed to address the aforementioned data security issues. Summary of the Invention

[0005] This application provides a method and server for processing private domain intelligent agent data with strong isolation, which can reduce the risk of data leakage and the risk of unauthorized access and information leakage between different departments.

[0006] To achieve the above objectives, the embodiments of this application adopt the following technical solutions:

[0007] Firstly, a strongly isolated private domain intelligent agent data processing method is provided, applied to a server. The server deploys a private domain intelligent agent, which includes a data storage layer, an engine layer, and a data service interface layer. The data storage layer includes multiple internal data storage areas, the engine layer includes an intelligent agent engine, and the data service interface layer includes an output interface module and multiple internal data interface modules. The method includes:

[0008] Receive data processing requests sent by users through user terminals and obtain department identifiers;

[0009] Based on the department identifier, the data processing request is routed to the corresponding internal data interface module. This module parses the request, obtains the processing task, and invokes the intelligent agent engine. The intelligent agent engine then retrieves a temporary access credential based on the department identifier and uses this credential to access the department's internal data storage area to obtain the data to be processed.

[0010] The intelligent agent engine is used to perform processing tasks, analyze and process the data to be processed, obtain the processing results, and transmit the processing results to the user terminal through the output interface module.

[0011] In one possible implementation of the first aspect, receiving a data processing request sent by a user through a user terminal and obtaining a department identifier includes:

[0012] Receive official document data uploaded by users through user terminals and assign a unique identifier to the official document data;

[0013] Receive data processing requests for official document data sent by users. The data processing requests include a unique identifier and a department identifier.

[0014] In another possible implementation of the first aspect, the internal data storage area is isolated by physical isolation and / or strong logical isolation.

[0015] Another possible implementation of the first aspect includes:

[0016] When the internal data storage area adopts physical isolation, the internal data storage area includes multiple storage array partitions. Each storage array partition corresponds one-to-one with a department identifier, and the data between each storage array partition and other storage array partitions cannot be accessed by each other through physical isolation. The physical isolation method is physical network isolation.

[0017] When the internal data storage area adopts a strong logical isolation method, the internal data storage area includes multiple independent logical volumes that correspond one-to-one with department identifiers. Data between each independent logical volume and other independent logical volumes cannot be accessed through the strong logical isolation method.

[0018] In another possible implementation of the first aspect, strong logical isolation methods include:

[0019] VLAN technology is used to divide the internal data storage area into independent network areas, and the access paths of the internal data interface modules and corresponding internal data storage areas of each department are restricted to the corresponding VLANs.

[0020] Firewall policies are employed to block unauthorized access across VLANs and to prevent direct or indirect communication between data storage areas within different departments.

[0021] Create a separate logical volume for each department and assign different database user permissions to each logical volume;

[0022] Use a separate directory for file storage and configure operating system-level access control permissions.

[0023] In another possible implementation of the first aspect, the data service interface layer further includes an external data gateway module, the data storage layer further includes an external data cache, and the intelligent agent engine executes processing tasks, analyzes and processes the data to be processed, and obtains processing results, including:

[0024] The intelligent agent engine analyzes the data to be processed to determine whether external data support is needed.

[0025] When external data support is required, the intelligent agent engine sends an external data request to the external data gateway module. The external data gateway module is used to obtain external data from the external network according to preset rules and store the external data in the external data cache.

[0026] The intelligent agent engine accesses the external data cache, obtains external data, and performs processing tasks to analyze and process the data to be processed and the external data, and obtains processing results. The processing tasks include at least one of data analysis, pattern recognition, text classification, information extraction, or decision support.

[0027] In another possible implementation of the first aspect, the private domain agent also includes a security management layer, which includes a unified authentication and authorization center. The agent engine obtains temporary access credentials based on the department identifier and accesses the department's internal data storage area based on the temporary access credentials to obtain the data to be processed, including:

[0028] The intelligent agent engine sends a permission request to the unified authentication and authorization center. The permission request includes a department identifier. The unified authentication and authorization center generates a temporary access credential based on the department identifier and returns the temporary access credential to the intelligent agent engine. The temporary access credential has only permission to access the corresponding department's internal data storage area.

[0029] The intelligent agent engine uses temporary access credentials to access the corresponding department's internal data storage area and obtain the data to be processed.

[0030] In another possible implementation of the first aspect, the data storage layer further includes a public external data area, and the method further includes:

[0031] Before executing a processing task, the intelligent agent engine obtains the user terminal's access permissions to the data to be processed, and determines the scope of data access for the user terminal based on the access permissions.

[0032] During the execution of processing tasks, the intelligent agent engine accesses the internal data storage area within the data access scope;

[0033] After executing a processing task, the intelligent agent engine clears the temporary data generated during the process and releases the temporary access credentials.

[0034] Secondly, this application provides a server deployed with a private domain intelligent agent. The private domain intelligent agent includes a data storage layer, an engine layer, and a data service interface layer. The data storage layer includes multiple internal data storage areas, the engine layer includes an intelligent agent engine, and the data service interface layer includes an output interface module and multiple internal data interface modules, including:

[0035] The memory is configured to store instructions; and

[0036] The processor is configured to retrieve the instructions from the memory and, when executing the instructions, to implement the strongly isolated private domain agent data processing method described above.

[0037] Thirdly, this application provides a computer program product, including a computer program or instructions that, when executed by a processing device, implement the above-described method.

[0038] By deploying a private domain intelligent agent architecture on the server, comprising a data storage layer, an engine layer, and a data service interface layer, the above technical solution achieves localized processing and strict isolation of sensitive data, effectively solving data security issues inherent in traditional cloud-based processing models. Precise routing based on departmental identifiers ensures that data processing requests are directed only to authorized internal data interface modules, and a temporary access credential mechanism strictly controls access permissions to internal data storage areas, fundamentally preventing unauthorized cross-departmental data access. Simultaneously, the intelligent agent engine executes data analysis and processing tasks in a local environment, avoiding the risk of sensitive data leakage. Processing results are only transmitted to the requesting user terminal via the output interface module, guaranteeing the security and isolation of the entire data processing process. This architecture not only meets the stringent data privacy requirements of specific sectors such as government, finance, and healthcare but also retains the high efficiency of intelligent analysis and decision-making, providing a secure, reliable, and fully functional technical solution for scenarios involving highly sensitive information.

[0039] Other features and advantages of the embodiments of this application will be described in detail in the following detailed description section. Attached Figure Description

[0040] Figure 1 A schematic diagram of the overall process of a strongly isolated private domain intelligent agent data processing method provided in an embodiment of this application;

[0041] Figure 2 A flowchart illustrating a strongly isolated private domain intelligent agent data processing method provided in an embodiment of this application;

[0042] Figure 3 This is a diagram of a strongly isolated private domain intelligent agent architecture provided in an embodiment of this application. Detailed Implementation

[0043] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are only for illustration and explanation of the embodiments of this application and are not intended to limit the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0044] It should be noted that if the embodiments of this application involve directional indicators (such as up, down, left, right, front, back, etc.), the directional indicators are only used to explain the relative positional relationship and movement of the components in a certain specific posture (as shown in the figure). If the specific posture changes, the directional indicators will also change accordingly.

[0045] Furthermore, if the embodiments of this application involve descriptions such as "first" or "second," these descriptions are for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of technical features indicated. Therefore, features defined with "first" or "second" may explicitly or implicitly include at least one of those features. Additionally, the technical solutions of various embodiments can be combined with each other, but this must be based on the ability of those skilled in the art to implement them. If the combination of technical solutions is contradictory or impossible to implement, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection claimed in this application.

[0046] like Figure 1 and Figure 2 As shown in the figure, this application provides a strongly isolated private domain intelligent agent data processing method, applied to a server. The server deploys a private domain intelligent agent, which includes an infrastructure layer, a data storage layer, an engine layer, a data service interface layer, and a security management layer. The data storage layer includes multiple internal data storage areas and an external data cache area. The engine layer includes an intelligent agent engine. The data service interface layer includes multiple internal data interface modules, an external data gateway module, and an output interface module. The security management layer includes a unified authentication and authorization center, a security audit module, and a monitoring and management platform. The method may include the following steps.

[0047] S110. Receive data processing requests sent by users through user terminals and obtain department identifiers;

[0048] S120. Based on the department identifier, the data processing request is routed to the corresponding internal data interface module. The internal data interface module parses the data processing request, obtains the processing task, and calls the intelligent agent engine. The intelligent agent engine obtains a temporary access credential based on the department identifier and accesses the department's internal data storage area based on the temporary access credential to obtain the data to be processed.

[0049] The S130, or intelligent agent engine, is used to perform processing tasks, analyze and process the data to be processed, obtain processing results, and transmit the processing results to the user terminal through the output interface module.

[0050] Figure 3 This diagram illustrates a strongly isolated private domain intelligent agent architecture provided in an embodiment of this application. (Refer to...) Figure 3 The private domain intelligent agent is deployed on the server and includes an infrastructure layer, a data storage layer, an engine layer, a data service interface layer, and a security management layer. The data storage layer includes multiple internal data storage areas and external data cache areas. The engine layer includes the intelligent agent engine. The data service interface layer includes multiple internal data interface modules, an external data gateway module, and an output interface module. The security management layer includes a unified authentication and authorization center, a security audit module, and a monitoring and management platform.

[0051] The private domain agent receives data processing requests from user terminals through the data service interface layer. These requests can be sent in various ways, including but not limited to HTTP / HTTPS requests, WebSocket connections, dedicated API calls, or secure file transfer protocols. In practice, when a user needs to process data from a specific department, they first need to initiate a request to the server through their terminal (such as a computer, tablet, or mobile device). The request may be for tasks such as text analysis, data mining, information retrieval, or decision support. The request must include a department identifier to indicate the data source and the scope of processing authority.

[0052] Department identifiers can be explicit department codes (e.g., "DEPT-001" for the finance department and "DEPT-002" for the human resources department) or department association information implicit in user authentication information. In one implementation, the user first uploads document data to the server, which assigns a unique identifier to the document. Subsequent data processing requests from the user include this unique identifier and the corresponding department identifier. For example, after a user uploads a financial report, the server assigns the identifier "DOC-20250430-001," and the user then sends an analysis request containing this identifier and "DEPT-001" (finance department). The server verifies the user's access rights to the department's data, ensuring that only authorized personnel can process the data from that department. This implements data isolation and access control from the request reception stage, laying the foundation for subsequent secure processing.

[0053] By routing data processing requests to the corresponding internal data interface modules based on department identifiers, departmental data isolation can be effectively achieved. The private domain agent precisely routes requests to the corresponding internal data interface modules based on the department identifiers contained within the request. The routing process employs a rule-based mapping mechanism, establishing a one-to-one correspondence between department identifiers and corresponding internal data interface modules through a pre-configured routing table. For example, when the department identifier "DEPT-001" is identified, the request will be routed to the finance department's internal data interface module. Upon receiving the request, the internal data interface module first parses the request, breaking it down into structured processing tasks. The parsing process includes parameter extraction, format validation, and semantic analysis to ensure the completeness and validity of the processing tasks. For example, for a text analysis request, the interface module will extract parameters such as the analysis type (e.g., sentiment analysis, key information extraction), processing scope, and output format. After parsing, the internal data interface module calls the agent engine and passes the processing task parameters. The agent engine then sends a permission request to the unified authentication and authorization center, containing the department identifier. The unified authentication and authorization center generates temporary access credentials based on departmental identifiers and preset security policies. These credentials have strict time limits and scope restrictions, allowing access only to the internal data storage area of ​​the designated department. After obtaining the temporary access credentials, the intelligent agent engine uses them to access the corresponding department's internal data storage area and retrieve the data to be processed. This access mechanism based on temporary credentials ensures that even within the server, the principle of least privilege must be followed, effectively preventing unauthorized cross-departmental data access.

[0054] In the process of the intelligent agent engine executing processing tasks, analyzing and processing the data to be processed, obtaining processing results, and transmitting the processing results to the user terminal through the output interface module, the intelligent agent engine first calls the corresponding algorithm and model according to the type and parameters of the processing task. Processing tasks can include various types such as data analysis, pattern recognition, text classification, information extraction, or decision support. For example, for a text classification task, the intelligent agent engine can use a pre-trained machine learning model, such as a deep learning model, to classify text. During processing, the intelligent agent engine analyzes whether external data support is needed. If so, the engine sends a request to the external data gateway module, which retrieves data from the external network according to preset rules and stores it in an external data cache. External data may include publicly available regulations, policy documents, industry standards, or other non-sensitive reference materials. The intelligent agent engine then accesses the external data cache, obtains the aforementioned auxiliary data, and combines it with internal data for comprehensive analysis. After processing, the intelligent agent engine generates structured processing results, which may include analysis reports, decision recommendations, data visualizations, or extracted key information. These results are transmitted to the user terminal through the output interface module. The output interface module performs format conversion and security processing on the results according to the user terminal type and the output format specified in the request. It should be noted that throughout the entire process, the intelligent agent engine strictly adheres to the permission scope of the temporary access credentials, will not access data from other departments beyond their authorized limits, and will record all operation logs for subsequent compliance checks by the security audit module.

[0055] In this embodiment, the infrastructure layer includes a local server cluster and network devices. The local server cluster provides computing, storage, and network resources, and the network devices include switches, routers, and firewalls. To ensure security, the following steps are also included: deploying a virtualization platform or containerization platform on the local server cluster for resource pooling, rapid deployment, and application environment isolation; deploying independent virtual machines or container instances for the internal data interface modules of each department on the virtualization platform or containerization platform; and configuring firewalls to allow only the internal data interface modules of each department to access the corresponding internal data storage area.

[0056] In this embodiment, the infrastructure layer includes a local server cluster and network devices, wherein the local server cluster is responsible for providing computing, storage and network resources, and the network devices include switches, routers and firewalls.

[0057] To ensure security, a virtualization platform or containerization platform is deployed on the local server cluster for resource pooling, rapid deployment, and application environment isolation. Specifically, open-source platforms like KVM or containerization platforms such as Kubernetes can be chosen. Virtualization platforms create a virtual layer on top of physical hardware, abstracting physical resources into resource pools, enabling unified management and dynamic allocation of computing, storage, and network resources. This resource pooling mechanism allows servers to flexibly adjust resource allocation according to the actual needs of different departments, improving resource utilization. Simultaneously, virtualization technology supports rapid deployment; using pre-configured templates or images, new virtual machines or container instances can be created and started in a short time, significantly shortening the deployment cycle. More importantly, virtualization platforms provide robust isolation mechanisms. Through hardware-assisted virtualization technology and memory page table isolation, resources and data are strictly separated between different virtual environments, ensuring that even if one virtual environment is compromised, the security of other environments will not be affected.

[0058] Secondly, on virtualization or containerization platforms, deploy independent virtual machines or container instances for each department's internal data interface modules. Each department's internal data interface module runs in its own dedicated virtual environment, completely isolated from interface modules of other departments. In the virtual machine implementation, each virtual machine has an independent operating system kernel, file system, and network stack, providing strong isolation. In the containerization implementation, although the host kernel is shared, effective isolation is achieved through mechanisms such as namespace isolation, control group restrictions, and security context configuration. This independent deployment method ensures that even if a department's interface module has a security vulnerability or is maliciously attacked, it will not directly affect the interface modules of other departments. Furthermore, allocating the minimum necessary resources and permissions to each virtual machine or container instance, following the principle of least privilege, further reduces the potential attack surface.

[0059] The firewall is configured to allow only internal data interface modules of each department to access their corresponding internal data storage areas. As a core component of network security, the firewall in this embodiment is configured to implement strict access control policies. Specifically, a multi-layered firewall architecture is adopted, including a network boundary firewall and internal partition firewalls. The boundary firewall is responsible for controlling communication between the entire system and the external network, blocking unauthorized external access; the internal partition firewall is responsible for controlling access isolation between different departments. The firewall rules are designed based on the "default deny" principle, meaning that all cross-departmental communication requests will be denied unless explicitly permitted. For each department's internal data interface module, the firewall is configured with precise access control lists, allowing only access to the corresponding internal data storage areas and prohibiting direct cross-departmental data access. These rules are not only based on IP addresses and ports but also incorporate advanced functions such as application layer protocol inspection, stateful inspection, and deep packet inspection, enabling the identification and blocking of disguised illegal access attempts. Furthermore, the firewall is configured with detailed logging capabilities to record all access attempts, providing a basis for security auditing and incident response.

[0060] The aforementioned security configuration achieves resource pooling and application environment isolation through virtualization or containerization technologies. This not only improves infrastructure resource utilization and deployment efficiency but also establishes a solid security isolation foundation at the technical architecture level, preventing cross-departmental data leakage risks. Furthermore, deploying independent virtual machines or container instances for each department further strengthens application-level isolation, ensuring that even if an application in one department is attacked or has vulnerabilities, it will not affect the systems and data of other departments. Fine-grained firewall configuration implements strict access control at the network layer, ensuring that data access strictly follows authorized paths and effectively preventing unauthorized cross-departmental data access. These three protection mechanisms work together to form a defense-in-depth system, significantly improving the overall security of the private domain intelligent agent. Simultaneously, the virtualization-based architecture also possesses good scalability and flexibility, enabling rapid adjustment and expansion as business needs change, maintaining the continuous secure operation of the system. In summary, the security configuration in this embodiment provides a secure, reliable, efficient, and flexible operating environment for the private domain intelligent agent, making it particularly suitable for application scenarios such as government agencies, financial institutions, and medical institutions that handle highly sensitive data.

[0061] In this embodiment, the security audit module records all critical operations and data access logs, including user identity, access time, accessed resources, operation type, and operation result; the monitoring and management platform monitors server status, service operation, resource utilization, and security events in real time; when abnormal access patterns or unauthorized access attempts are detected, the monitoring and management platform triggers a security alarm and executes automatic protection measures according to preset policies.

[0062] The internal data interface module is used to parse data processing requests and obtain processing tasks, which may include the following steps:

[0063] S1. The internal data interface module parses the data processing request and extracts the data identifier and processing type.

[0064] S2. Locate the data to be processed in the corresponding department's internal data storage area based on the data identifier;

[0065] S3. Based on the processing type, determine the processing task to be performed. The processing task includes at least one of data analysis, pattern recognition, text classification, information extraction, or decision support.

[0066] This embodiment employs a multi-layered isolation mechanism, including physical and strong logical isolation, to ensure strict separation of data across different departments, effectively preventing unauthorized cross-departmental data access. A temporary access credential mechanism further enhances data access security, enabling granular access control. Simultaneously, the local deployment of the private domain intelligent agent avoids the risk of sensitive data being uploaded to public clouds or external servers, fundamentally resolving the potential for data leakage. Furthermore, the design of the external data gateway module allows the server to leverage external knowledge resources while ensuring internal data security, improving the comprehensiveness and accuracy of data processing. The overall architecture design balances security and functionality, making it particularly suitable for scenarios involving highly sensitive data, such as those in government agencies, financial institutions, and medical institutions. It significantly reduces data security risks while providing high-quality intelligent analysis services, offering secure and reliable technical support for data-driven decision-making within organizations.

[0067] Reference Figure 1 In one embodiment of this invention, receiving a data processing request sent by a user through a user terminal and obtaining a department identifier includes the following steps:

[0068] S210. Receive official document data uploaded by the user through the user terminal, and assign a unique identifier to the official document data;

[0069] S220: Receive a data processing request for official document data sent by the user. The data processing request includes a unique identifier and a department identifier.

[0070] In this embodiment, the private domain agent provides a secure file upload channel through the data service interface layer, supporting multiple upload methods to adapt to different user scenarios. These upload methods include, but are not limited to, HTTPS-based web form uploads, secure FTP transfers, dedicated client software uploads, or encrypted API calls.

[0071] To ensure the security of the transmission process, all upload channels in this embodiment employ the TLS 1.3 encryption protocol for end-to-end encryption, preventing data from being stolen or tampered with during transmission. When a user uploads official document data via a terminal (such as a computer, tablet, or mobile device), the server first performs an integrity check on the uploaded file, calculating the file's hash value and comparing it with the checksum provided by the user's terminal to ensure that the file has not been damaged or tampered with during transmission. Subsequently, the server scans the file for viruses and malicious code, using the latest virus signature database and heuristic detection algorithms to ensure that the uploaded file does not contain malicious code that could compromise server security.

[0072] After the file security check is passed, the server extracts the file's metadata information, including basic attributes such as filename, format, size, and creation time, as well as content attributes such as author, title, and keywords. For structured documents (such as Word and PDF), the server also attempts to extract structural information, such as chapter divisions and table structures, to provide a foundation for subsequent intelligent processing. After completing the above basic processing, the server generates a globally unique identifier for each uploaded document. The identifier format can be "DOC-{timestamp}-{department code}-{random string}". The generated unique identifier is stored in a temporary cache along with the document data, awaiting subsequent processing requests from the user. Simultaneously, the server returns a confirmation message to the user indicating successful upload, including the generated unique identifier, for the user to reference in subsequent processing requests. Throughout the upload process, the server records detailed operation logs, including upload time, user information, file information, and generated identifiers. This log information is securely stored and backed up periodically to ensure that each document can be accurately tracked and managed.

[0073] The private domain intelligent agent receives user processing requests through the data service interface layer. These requests are typically initiated after the user uploads a document, and their purpose is to perform specific types of intelligent analysis or processing on the uploaded document. Data processing requests can be sent through various secure channels, including but not limited to encrypted HTTP / HTTPS requests, secure WebSocket connections, dedicated API calls, or asynchronous requests based on message queues.

[0074] Data processing requests sent by users must contain two key elements: a unique identifier and a department identifier. The unique identifier is a globally unique ID assigned during the document upload stage, used to accurately locate the document data to be processed; the department identifier indicates the department or business unit to which the document belongs, and is the basis for implementing data isolation and access control.

[0075] Upon receiving a processing request, the server first verifies the validity of the request format and parameters, ensuring the request structure is complete, the parameter types are correct, and the values ​​are within the valid range. Next, the server verifies the validity of the unique identifier, checking if the identifier exists on the server and if the corresponding document data is accessible. If the identifier is invalid or the corresponding document does not exist, the server returns an appropriate error message and logs the abnormal request.

[0076] For valid identifiers, the server further verifies the user's access rights to the document, checking whether the user belongs to or has the authority to access the department specified in the request. Upon successful verification, the server parses the processing parameters in the request. These parameters may include the processing type (e.g., text analysis, information extraction, document classification), processing priority, and result format requirements. The server constructs a structured processing task description based on these parameters, preparing for subsequent intelligent processing. Simultaneously, the server records detailed information about the received request, including the request time, user information, request parameters, and verification results. In summary, the server establishes multi-layered security protection before processing begins, ensuring the security and compliance of data processing and effectively preventing the risks of unauthorized access and cross-departmental data leakage.

[0077] This implementation method achieves precise tracking and management of sensitive documents by assigning globally unique identifiers to uploaded official document data, avoiding the risks of document confusion and misprocessing. During the request reception phase, the server implements strict access control by verifying the combination of the unique identifier and department identifier, ensuring that users can only process data from departments they are authorized to access. This not only enhances the security and traceability of data processing but also improves the server's user-friendliness, enabling users to easily reference and process uploaded official documents. It effectively guarantees the security of sensitive official document data during the uploading and processing process, making it particularly suitable for institutions such as government, finance, and healthcare that handle highly sensitive information.

[0078] In one embodiment of this invention, the internal data storage area is isolated using physical isolation and / or strong logical isolation.

[0079] In the data storage layer of the private domain agent, the internal data storage area is isolated using physical isolation and / or strong logical isolation. Specifically, physical isolation refers to using hardware-level separation to ensure that data from different departments is stored in physically independent devices or network areas, fundamentally preventing cross-departmental data access. In actual deployments, physical isolation can be achieved in various ways.

[0080] First, separate storage devices can be configured for different departments, such as dedicated storage servers, storage arrays, or network-attached storage (NAS) devices, which do not share any physical connections or storage media. Second, network-level physical isolation can be adopted by deploying completely independent network infrastructure, including independent switches, routers, and network lines, to ensure that the data networks of different departments are physically completely separated. For example, the finance department's data can be stored in a completely independent network segment, which has no physical connection points with the human resources department's network segment.

[0081] The advantage of physical isolation lies in its security, which is almost independent of the correctness of software configuration and policy execution. Even if the server software has vulnerabilities or configuration errors, physically disconnected servers still cannot access each other, thus providing the strongest protection barrier for sensitive data. However, physical isolation also brings higher hardware costs, management complexity, and operational challenges. Therefore, in practical applications, physical isolation is usually selectively implemented for the most critical departmental data, while strong logical isolation is used for other departments, based on data sensitivity and security requirements.

[0082] Strong logical isolation achieves effective data isolation through strict software-level control mechanisms while sharing physical infrastructure. Compared to physical isolation, strong logical isolation offers greater flexibility and cost-effectiveness.

[0083] Strong logical isolation is typically achieved through a multi-layered approach. First, at the network level, Virtual Local Area Network (VLAN) technology can be used to divide the same physical network into multiple logically isolated network segments. Each department's data storage and access paths are restricted to a specific VLAN. For example, the finance department's servers and storage devices might be assigned to VLAN 10, while the human resources department's devices might be assigned to VLAN 20. Through VLAN configuration on switches and routers, the network traffic of these two departments is logically completely separated. Second, advanced firewalls and Access Control Lists (ACLs) can be deployed to strictly control communication between different VLANs. Firewall policies can be configured to deny all cross-VLAN communication by default, allowing only explicitly authorized necessary communication. For example, rules can be set to allow all departments to access the central authentication server, but prohibit any direct inter-departmental data access. At the storage level, Logical Unit Number (LUN) isolation in Storage Area Networks (SANs) or shared isolation technology in Network Attached Storage (NAS) can be used to create independent logical storage volumes for different departments. Although these logical volumes may physically reside in the same storage array, strict access control policies ensure that each department can only access the storage space allocated to it. For example, on a large storage array, multiple independent RAID volume groups can be created, and LUN masking technology can be used to ensure that servers in each department can only see and access the LUNs assigned to that department. At the database level, techniques such as schema isolation, row-level security, or column-level encryption can be used to achieve logical isolation of data from different departments within the same database instance. For example, independent database users and schemas can be created for each department, and database access control mechanisms can ensure that users in each department can only access their own data schemas.

[0084] In this implementation, physical isolation, through hardware-level separation, fundamentally cuts off access channels between data from different departments, providing the highest level of protection for the most sensitive data. Meanwhile, strong logical isolation, through strict software-level control, achieves effective data isolation while maintaining server flexibility and cost-effectiveness. This dual isolation strategy allows the server to flexibly select appropriate isolation methods based on the sensitivity and security requirements of different departmental data, meeting the highest security standards while avoiding unnecessary hardware investment and management complexity. In this way, the private domain agent can securely process sensitive data from multiple departments on a single server, effectively preventing data leakage and unauthorized access. It is particularly suitable for sectors with stringent data security requirements, such as government, finance, and healthcare, providing these institutions with a secure and efficient intelligent data processing solution.

[0085] In one embodiment of this invention, it further includes:

[0086] When the internal data storage area adopts physical isolation, the internal data storage area includes multiple storage array partitions. Each storage array partition corresponds one-to-one with a department identifier, and the data between each storage array partition and other storage array partitions cannot be accessed by each other through physical isolation. The physical isolation method is physical network isolation.

[0087] When the internal data storage area adopts a strong logical isolation method, the internal data storage area includes multiple independent logical volumes or database instances that correspond one-to-one with department identifiers. Data between each independent logical volume and other independent logical volumes cannot be accessed by each other through the strong logical isolation method.

[0088] When physical isolation is used for internal data storage, the internal data storage area employs an architecture of multiple storage array partitions. Each storage array partition corresponds to a specific department identifier, forming a one-to-one relationship. This storage array partitioning can be implemented using various physical devices, including dedicated storage servers, dedicated storage array devices, or Network Attached Storage (NAS) servers. Each storage array partition is physically independent, possessing its own storage controller, cache server, and disk array, ensuring complete physical isolation of data. For example, the finance department's data is stored in a separate RAID 10 configured storage array, while the human resources department's data is stored in another separate RAID 5 configured storage array. There are no shared components or cross-access paths between these two storage arrays.

[0089] Physical network isolation is a key technology for achieving complete isolation between storage array partitions. It involves configuring independent network infrastructure for each storage array partition, including dedicated network interface cards (NICs), switches, and routers, to create completely independent data transmission channels. These independent network components have no physical connection points, completely severing access paths between data from different departments from the network topology perspective. In practical deployments, various network isolation technologies can be employed, such as deploying independent physical networks, using dedicated VLANs in conjunction with physical port isolation, and implementing strict network segmentation. Through this physical network isolation mechanism, even if server software has vulnerabilities or configuration errors, data from different departments cannot be accessed across physical network boundaries, fundamentally eliminating the risk of cross-departmental data leakage.

[0090] When strong logical isolation is used in the internal data storage area, data isolation is achieved by creating multiple independent logical volumes or database instances, each corresponding to a specific department identifier. An independent logical volume is a logical storage unit partitioned using storage virtualization technology on a shared physical storage infrastructure. Each logical volume has independent storage space and access control policies. In practice, these logical volumes can be created and managed using Storage Area Network (SAN) Logical Unit Number (LUN) technology or Software-Defined Storage (SDS) technology. For example, on a large storage array, multiple independent RAID volume groups can be created, and dedicated logical volumes can be assigned to each department.

[0091] For database storage, independent database instances can be created for different departments. Each instance has its own data files, log files, and configuration parameters, logically completely separated. Strong logical isolation ensures that data between different logical volumes or database instances cannot access each other through multi-layered access control mechanisms. These mechanisms include, but are not limited to: LUN masks and LUN mapping techniques, ensuring that each server can only see and access the logical volumes assigned to it; storage-level access control lists (ACLs), defining which hosts can access specific storage resources; multi-factor authentication and encrypted communication, ensuring that only authorized users and servers can access storage resources; and fine-grained permission control, restricting users to performing only specific operations (such as read-only access or full control). Through these strong logical isolation measures, even in the case of shared physical infrastructure, effective isolation of data between different departments can be achieved, preventing unauthorized cross-departmental data access.

[0092] This implementation combines physical isolation and strong logical isolation to construct a comprehensive and in-depth data security protection system. Physical isolation, through completely independent storage array partitions and physical network isolation, severs access channels between data from different departments at the hardware level, providing the highest level of security for the most sensitive data. Strong logical isolation, through independent logical volumes or database instances combined with multi-layered access control mechanisms, achieves effective data isolation even with shared physical infrastructure. This dual isolation strategy allows the server to select the most suitable isolation method based on the sensitivity and security requirements of different departments' data, satisfying stringent security standards while also considering server flexibility and cost-effectiveness. In this way, the private domain agent can securely process sensitive data from multiple departments on a single server, effectively preventing data leakage and unauthorized access, making it particularly suitable for fields with stringent data security requirements, such as government, finance, and healthcare.

[0093] In one embodiment of this invention, the strong logical isolation method includes the following steps:

[0094] S510: Use VLAN technology to divide the internal data storage area into independent network areas, and restrict the access paths of each department's internal data interface module and corresponding internal data storage area to the corresponding VLAN.

[0095] The S520 employs firewall policies to block unauthorized access across VLANs and to prevent direct or indirect communication between data storage areas within different departments.

[0096] S530. Create a corresponding independent logical volume or database instance for each department, and assign different database user permissions to each independent logical volume.

[0097] S540 uses a separate directory for file storage and configures operating system-level access control permissions.

[0098] In the process of using VLAN technology to divide the internal data storage area into independent network areas and restricting the access paths of each department's internal data interface module and corresponding internal data storage area to the corresponding VLAN, Virtual Local Area Network (VLAN) technology is used to achieve logical isolation at the network layer. VLAN is a technology that divides a single physical network into multiple logical networks. By adding VLAN tags (IEEE 802.1Q standard) to data frames, even if devices are connected to the same physical switch, they can be assigned to different broadcast domains, as if they were connected to different physical networks.

[0099] In actual deployment, the first step is to configure VLANs on the network switches, assigning a unique VLAN ID to each department. After configuration, the ports of each department's servers, storage devices, and network devices are assigned to their corresponding VLANs. Simultaneously, the internal data interface modules are configured so that they can only access the corresponding department's internal data storage area through specific VLANs. This configuration can be achieved through switch port VLAN membership settings, 802.1Q trunk link configuration, and VLAN Access Control Lists (VACLs). Through this VLAN isolation mechanism, even if devices from different departments are physically connected to the same network infrastructure, their network traffic is restricted to their respective VLANs, preventing direct access to devices and resources in other VLANs, thus achieving strong departmental data isolation at the network layer.

[0100] In implementing firewall policies to prevent unauthorized access across VLANs and to block direct or indirect communication between data storage areas within different departments, multi-layered firewalls and access control mechanisms were deployed as a supplement and enhancement to VLAN isolation. The core of the firewall policy is the implementation of a strict default deny principle, meaning that all cross-VLAN communication is blocked unless explicitly permitted.

[0101] In terms of network architecture, various firewall deployment modes can be adopted, including deploying traditional firewalls at inter-VLAN routing points, enabling distributed firewall functionality on core switches, or deploying next-generation firewalls to provide higher levels of protection. Firewall rule configuration follows the principle of least privilege, allowing only necessary and explicitly authorized communication traffic. For example, rules can be configured to allow all VLANs to access the central authentication server (located in VLAN 999), but prohibit any direct communication between VLAN 100 (finance department) and VLAN 200 (human resources department). To prevent indirect communication and data leakage, the firewall also implements deep packet inspection (DPI) and application-layer filtering to identify and block advanced techniques that may be used to circumvent isolation, such as tunneling protocols, proxy services, or data smuggling. Furthermore, the firewall logs all cross-VLAN access attempts, especially blocked access. These logs are sent in real-time to the security information and event management server for analysis to promptly identify potential security threats. Through these strict firewall policies, not only can unauthorized access across VLANs be effectively prevented, but indirect communication through intermediate servers or services can also be prevented, thus building a robust security barrier at the network layer.

[0102] The steps of creating a corresponding independent logical volume or database instance for each department and assigning different database user permissions to each independent logical volume implement storage-level and database-level isolation measures to ensure effective data isolation between different departments, even when sharing physical storage infrastructure. At the storage level, storage virtualization technology is used to create independent logical volumes for each department. These logical volumes can be implemented based on logical unit number technology of storage area networks, software-defined storage technology, or virtualized storage array technology. Each logical volume has independent storage space, performance configuration, and security settings, and is logically completely separated. For example, on an enterprise-grade storage array, multiple RAID volume groups can be created, and dedicated logical volumes can be assigned to different departments based on these volume groups. At the database level, several isolation strategies can be adopted: one is to deploy a completely independent database instance for each department, with each instance having its own processes, memory space, and configuration parameters; another is to create independent database schemas within a shared database instance, achieving isolation through database access control mechanisms; and a third is to use multi-tenant database technology to create logically isolated tenant spaces for different departments within the same database. Regardless of the strategy adopted, strict database user permissions must be configured. This includes creating department-specific database user accounts, implementing role-based access control to restrict each user to accessing only the data of their own department, and further refining permissions based on user responsibilities (such as read-only, read-write, or administrator permissions). In this way, effective isolation of data from different departments can be achieved even at the database level, preventing unauthorized cross-departmental data access.

[0103] By using separate directories for file storage and configuring operating system-level access control permissions, file system-level isolation measures are implemented, providing additional protection for unstructured data (such as documents, images, and videos). In the file storage architecture design, a separate top-level directory structure is first created for each department on the file system or network-attached storage device. These directories can be physically independent file systems or logically isolated folders. For example, top-level directories such as " / finance", " / hr", and " / legal" can be created to store file data for the finance, human resources, and legal departments, respectively. Based on these separate directories, strict operating system-level access control permissions are configured, restricting users to access only the directories of their respective departments. This access control can be implemented through various mechanisms, including: traditional permission models and access control lists in UNIX / Linux systems; NTFS permissions and shared permissions in Windows systems; and more advanced mandatory access control or attribute-based access control.

[0104] In specific configurations, ownership of department directories can be assigned to a dedicated system user group for that department, with appropriate permission masks set to ensure that only members of that user group can access the corresponding directories. For example, the finance department's directory might be configured to allow access only to members of the "finance_group" group, prohibiting direct access from other users and even system administrators. Furthermore, file system encryption can be implemented, using department-specific encryption keys to encrypt file data, protecting data security even at the physical access level. These file system-level isolation measures ensure the secure storage and access of unstructured data, preventing unauthorized cross-departmental file data access.

[0105] This implementation constructs a defense-in-depth data security architecture, forming a complete security protection chain. VLAN technology creates logically isolated boundaries at the network layer, firewall policies strengthen these boundaries and prevent any unauthorized cross-boundary access, independent logical volumes and database isolation ensure the secure storage and access of structured data, while file server-level access control protects the security of unstructured data. This comprehensive, strong logical isolation mechanism achieves near-physical isolation level security in the context of shared physical infrastructure, while maintaining server flexibility and cost-effectiveness. In this way, private domain agents can securely process sensitive data from multiple departments on a single server, effectively preventing data leakage and unauthorized access, and is particularly suitable for application scenarios that require a balance between data security and server flexibility.

[0106] In one embodiment of this invention, the data service interface layer further includes an external data gateway module, the data storage layer further includes an external data cache, and the intelligent agent engine executes processing tasks to analyze and process the data to be processed and obtain processing results, including the following steps:

[0107] The S610 intelligent agent engine analyzes the data to be processed to determine whether external data support is needed.

[0108] S620. When external data support is required, the intelligent agent engine sends an external data request to the external data gateway module. The external data gateway module is used to obtain external data from the external network according to preset rules and store the external data in the external data cache area.

[0109] S630, the intelligent agent engine accesses the external data cache, obtains external data, and performs processing tasks to analyze and process the data to be processed and the external data, and obtains processing results. The processing tasks include at least one of data analysis, pattern recognition, text classification, information extraction, or decision support.

[0110] In this embodiment, the intelligent agent engine first performs preliminary analysis and evaluation on the data to be processed obtained from the internal data storage area to determine whether additional external data is needed to supplement, verify or enrich the existing data, thereby improving the accuracy and completeness of the processing results.

[0111] In practice, the intelligent agent engine first performs structured parsing of the data to be processed, extracting key entities, attributes, and relationships to construct a preliminary knowledge graph or semantic network. Subsequently, the engine evaluates the completeness and sufficiency of the existing data based on a predefined domain knowledge model. For example, when processing a policy analysis task, if the document mentions a regulation but lacks specific clauses, the engine will mark this information gap. The evaluation process considers multiple factors, including the timeliness of the data (whether the latest external data updates are needed), completeness (whether key information is missing), accuracy (whether external data verification is needed), and contextual relevance (whether supplementary background information is needed). If the existing data exhibits at least one of these issues, it is determined that external data support is required.

[0112] The intelligent agent engine sends an external data request to the external data gateway module. The external data gateway module retrieves external data from the external network according to preset rules and stores the external data in the external data cache, thus implementing a secure and controllable external data acquisition mechanism. When the intelligent agent engine determines that external data support is needed, it constructs a structured external data request, which includes the type, scope, timeliness requirements, and purpose of the required data.

[0113] These requests are sent to the external data gateway module via an internal secure channel. The external data gateway module is responsible for all external data interactions. Upon receiving a request, the external data gateway module first evaluates it according to preset security rules. These rules define various constraints, including permitted external data types, accessible external data sources, access frequency limits, and data sensitivity checks. For example, the rules allow access to official regulatory databases and public academic databases, but prohibit access to unverified data sources.

[0114] Once the assessment is successful, the gateway module will select an appropriate external data source for querying based on the request content. These data sources include publicly available government databases, regulatory databases, academic resource databases, industry standard databases, or other authorized reference libraries. The data acquisition process uses secure communication protocols (such as HTTPS, SFTP, etc.) and may require authentication and access authorization. The acquired external data will then undergo security processing, including format standardization, integrity verification, malware scanning, and sensitive information filtering, to ensure data security and availability.

[0115] Processed external data is stored in an external data cache, a dedicated storage space physically or logically isolated from the internal data storage area, used for temporarily storing data acquired from external sources. The cache employs strict access control and data lifecycle management to ensure that external data is not mixed with sensitive internal data and is promptly deleted after use. Through this rigorously controlled external data acquisition mechanism, the private domain agent can obtain necessary external knowledge support while ensuring security.

[0116] The intelligent agent engine accesses the external data cache to obtain external data and executes processing tasks to analyze and process the data to be processed and the external data, and obtains the processing results. The intelligent agent engine can integrate and analyze internal data and external data, thereby leveraging the complementary advantages of the two data sources to improve the quality and value of the processing results.

[0117] Specifically, the intelligent agent engine reads external data stored in an external data cache through a controlled access channel. This access process is subject to strict permission control and behavior monitoring, ensuring that only authorized processing tasks can use this external data. After acquiring the external data, the engine performs data fusion processing, associating, comparing, and integrating the external data with the internal data to be processed. The techniques used in data fusion include entity alignment (identifying records referring to the same entity in different data sources), relation mapping (establishing logical connections between different datasets), and time-series alignment (processing data at different time granularities). The fused dataset provides a more comprehensive information foundation for subsequent in-depth analysis.

[0118] Subsequently, the intelligent agent engine performs corresponding analysis and processing according to the specific requirements of the task. For data analysis tasks, it may use methods such as statistical analysis, time series analysis, or association rule mining to discover hidden patterns and trends in the data; for pattern recognition tasks, it may apply machine learning algorithms such as support vector machines, random forests, or deep neural networks to identify complex data patterns; for text classification tasks, it may use natural language processing techniques such as bag-of-words models, TF-IDF, or pre-trained language models to classify text content; for information extraction tasks, it may use named entity recognition, relation extraction, or event detection techniques to extract structured information from unstructured text; for decision support tasks, it may combine methods such as rule reasoning, decision trees, or Bayesian networks to provide decision suggestions.

[0119] After processing, the engine generates structured results, clearly indicating which parts are based on internal data and which reference external data, ensuring interpretability and traceability. Finally, the engine cleans up temporary data generated during processing and updates the external data usage log, providing a basis for subsequent audits and security checks. Through this combined internal and external data analysis mechanism, the private domain intelligent agent can protect the security of sensitive internal data while fully utilizing external knowledge resources to provide more comprehensive and accurate analytical results.

[0120] This implementation constructs a secure and controllable knowledge expansion channel. Through requirements analysis by the intelligent agent engine, secure acquisition of external data via the external data gateway, and isolated storage in the external data cache, it achieves secure integration of internal sensitive data and external publicly available data. While ensuring data security, it significantly enhances the knowledge breadth and processing capabilities of the private domain intelligent agent. The introduction of external data enables the intelligent agent to access the latest regulations, policies, industry standards, and publicly available reference materials, avoiding information silos and improving the timeliness and comprehensiveness of analysis results. Simultaneously, strict external data acquisition rules and isolated storage mechanisms ensure that external data does not become a security vulnerability, effectively preventing data leakage and contamination risks. This design, balancing security and functionality, allows the private domain intelligent agent to provide intelligent services with an open perspective within a closed environment.

[0121] In one embodiment of this invention, the private domain intelligent agent further includes a security management layer, which comprises a unified authentication and authorization center, a security audit module, and a monitoring and management platform. The intelligent agent engine obtains temporary access credentials based on the department identifier and accesses the department's internal data storage area based on the temporary access credentials to obtain the data to be processed, including the following steps:

[0122] S710 and the intelligent agent engine send a permission request to the unified authentication and authorization center. The permission request includes a department identifier. The unified authentication and authorization center generates a temporary access credential based on the department identifier and returns the temporary access credential to the intelligent agent engine. The temporary access credential has only the permission to access the corresponding department's internal data storage area.

[0123] The S720 and the intelligent agent engine use temporary access credentials to access the corresponding department's internal data storage area to obtain the data to be processed.

[0124] In this embodiment, when the agent engine needs to access internal data of a specific department, it first constructs a structured permission request message. This message contains several key elements: the request initiator's identity (a unique identifier for the agent engine), the request timestamp, the department identifier (indicating the target department's data to be accessed), the request purpose (the type and description of the task to be processed), the requested data scope (the data type and scope to be accessed), and the request validity period (the expected duration of data access). This information is sent to the unified authentication and authorization center in the security management layer via a secure channel (such as a TLS encrypted connection). The unified authentication and authorization center, as the core security component of the private domain agent, is responsible for all access control decisions and maintains a complete permission policy library and access control matrix.

[0125] Upon receiving a permission request, the Unified Authentication and Authorization Center (hereinafter referred to as the Center) first verifies the authenticity and integrity of the request to ensure that it has not been tampered with and originates from a legitimate intelligent agent engine. Subsequently, the Center queries the permission policy database based on the department identifier to assess the legitimacy of the request. The assessment process considers various factors, including but not limited to: current security policy configuration, the requester's historical behavior records, data sensitivity classification, and access time window restrictions.

[0126] If the assessment results in permission, the center generates a temporary access credential. This credential uses an encrypted token (such as JWT, JSON Web Token) format and contains the following information: credential ID, authorization scope (limited to the internal data storage area of ​​a specific department), validity period (usually short, such as 15 minutes), access restrictions (such as read-only or read-write permissions), and a digital signature (signed using the center's private key to ensure the credential cannot be forged). The generated temporary access credential is returned to the agent engine through a secure channel. Simultaneously, the center records a complete authorization log, including request details, decision results, and credential information. These logs are sent to the security audit module for subsequent compliance checks and security analysis. Through this temporary credential-based authorization mechanism, the server implements the principle of least privilege and dynamic authorization control, ensuring that even internal components must undergo strict permission verification before accessing sensitive data.

[0127] After obtaining temporary access credentials, the agent engine needs to use these credentials to access the target department's internal data storage area. The access process begins with constructing a secure access request. The engine embeds the temporary access credentials into the data access request, forming a complete authentication request. This request is sent to the target department's internal data storage area via a dedicated secure data access protocol (such as a secure API call, an encrypted database connection, or a secure file transfer protocol).

[0128] The access control layer of the internal data storage area receives and processes this request. First, it verifies the validity of the temporary access credentials, including checking the digital signature of the credentials (verified using the public key of a unified authentication and authorization center), confirming that the credentials have not expired, and verifying whether the access scope specified in the credentials matches the current request. Once verification is successful, the access control layer determines the specific dataset that is allowed access based on the authorization scope in the credentials.

[0129] Once the access scope is determined, the data storage area executes the actual data retrieval operations, which may include database queries, file reading, or object storage access. The retrieved data undergoes sensitive field anonymization, data format standardization, or data integrity verification before being returned to the agent engine. Throughout the access process, the server records detailed access logs, including the access time, the credentials used, the scope of accessed data, and the type of data operation (e.g., read, write, or modify). These logs are sent to the security audit module in real time for access behavior analysis and anomaly detection. It is worth noting that temporary access credentials have strict scope limitations, ensuring that the agent engine can only access data from specific departments and cannot access data from other departments beyond their designated scope. At the same time, the temporary nature of the credentials reduces the risk window for credential leakage or misuse. Through this fine-grained access control mechanism based on temporary credentials, the server provides necessary data access capabilities while minimizing the risk of data leakage and unauthorized access.

[0130] This implementation achieves security control by separating permission requests and data access into two independent steps. In other words, the agent engine must first obtain a valid temporary access credential before it can access the target data. This ensures that even internal server components must undergo strict authentication and authorization before accessing sensitive data, further enhancing data security and effectively preventing advanced attack methods such as privilege escalation and lateral movement. Simultaneously, the unified authentication and authorization center, acting as the central permission management point, provides consistent security policy enforcement and comprehensive access auditing capabilities, enabling security administrators to have overall control over server data access behavior. This security mechanism ensures data isolation while still allowing the agent engine to efficiently process data within its authorized scope, achieving a balance between security and functionality. For institutions such as governments, financial institutions, and healthcare providers that handle highly sensitive data, this granular permission control based on temporary credentials provides a compliant data processing solution, effectively reducing the risk of data leakage.

[0131] In one embodiment of this invention, the data storage layer further includes a public external data area, and also includes the following steps:

[0132] Before executing processing tasks, the S810 and the intelligent agent engine obtain the user terminal's access permissions for the data to be processed, and determine the data access scope of the user terminal for the data to be processed based on the access permissions.

[0133] During the execution of processing tasks, the S820 and the intelligent agent engine access the internal data storage area and the public external data area within the data access scope.

[0134] After executing a processing task, the S830 and the intelligent agent engine clear temporary data generated during the process and release temporary access credentials.

[0135] In the implementation of the data storage layer, in addition to the internal data storage areas of each department, a public external data area is also set up. The public external data area is used to store non-sensitive data that can be shared and accessed by multiple departments, such as publicly available policy documents, shared reference materials, and industry standards and specifications. Although this data is not highly sensitive, it still has important reference value for the business processes of each department. The public external data area adopts centralized storage management, but still implements strict access control policies to ensure data integrity and availability. Physically, the public external data area can be deployed on a separate storage array, or logically separated from the internal data storage area and managed through different storage pools and access paths. The setting up of the public external data area reduces redundant data storage, improves server resource utilization efficiency, and simultaneously meets the access needs of different departments for shared data, maximizing the utilization of data resources while ensuring data security.

[0136] Before executing processing tasks, the intelligent agent engine first needs to obtain the user terminal's access permissions for the data to be processed, and determine the scope of data access based on these permissions. In practice, the intelligent agent engine extracts user identity information and department identifiers from the data processing requests sent by the user terminal, and then sends an access verification request to the unified authentication and authorization center at the security management layer. The unified authentication and authorization center performs permission assessment based on a pre-configured permission matrix, combined with multi-dimensional information such as user identity, department, and job level. During the permission assessment process, the precise scope of user access to the data to be processed can be dynamically calculated. For example, an ordinary staff member of a government department may only be authorized to access non-confidential documents and public reference materials of their department; while a department head may be authorized to access all documents of their department and some shared files from other specific departments.

[0137] After successful authorization verification, the unified authentication and authorization center generates an authorization token containing a detailed description of the access scope and returns it to the agent engine. The agent engine parses the authorization token to extract the specific data access scope, including restrictions such as the types of data that can be accessed, the data level, and the time range. This fine-grained authorization control mechanism ensures that users can only access and process data within their authorized scope, effectively preventing unauthorized access and data leakage risks, while also providing clear boundary constraints for subsequent data processing operations.

[0138] During task execution, the intelligent agent engine strictly adheres to the defined data access scope, accessing both internal and public external data areas. Specifically, the engine first analyzes the required data types and sources based on the task's needs. For operations requiring access to internal data storage, the engine uses the previously acquired temporary access credentials to connect to the corresponding department's internal data storage area via a secure channel. During access, the engine continuously checks each data request to ensure it remains within the authorized access range. If a request exceeds this range, it immediately rejects the request and records the abnormal access attempt. Similarly, for access to public external data, the engine verifies the user's access rights. Although this data is relatively insensitive, the principle of minimum necessity must be followed, acquiring only the data required for the task.

[0139] During data access, the intelligent agent engine maintains an operation log, recording all data access behaviors, including access time, access object, and access type, for subsequent auditing and traceability. This strictly controlled data access mechanism ensures that processing tasks receive the necessary data support while effectively preventing data overreach and misuse, achieving a balance between data security and efficiency.

[0140] After executing a processing task, the agent engine needs to clear temporary data generated during the process and release temporary access credentials. Specifically, the agent engine first identifies and collects all temporary data generated during processing, including intermediate calculation results, temporary cache files, and data objects in memory. For temporary files stored on disk, secure erasure techniques are used for complete deletion, such as multiple overwrites or the use of specialized data erasure algorithms, ensuring that the data cannot be recovered by data recovery tools. For temporary data in memory, the agent engine explicitly releases the relevant memory space and performs memory overwrites when necessary to prevent sensitive information from remaining in memory. For temporary tables or records in the database, cleanup operations are performed to ensure no processing traces are left. Simultaneously with clearing temporary data, the agent engine also sends a credential release request to the unified authentication and authorization center to cancel previously acquired temporary access credentials.

[0141] Upon receiving a request, the unified authentication and authorization center immediately revokes the validity of the credential and updates the permission status record. To prevent credential abuse, the server also implements credential lifecycle management; even if the agent engine does not actively release it, temporary access credentials will automatically expire after a preset expiration period. Furthermore, the agent engine generates an execution report for the processing task, recording the main steps of data processing, a summary of results, and resource usage, but excluding original sensitive data. This report is securely stored for subsequent auditing and analysis. This rigorous post-processing mechanism ensures that sensitive data is not leaked or left behind during task execution, further enhancing the server's data security capabilities.

[0142] This implementation achieves efficient sharing and secure use of data resources in a strongly isolated environment by adding a public external data area within the private domain intelligent agent and implementing strict access control and data lifecycle management. First, through a refined access control mechanism, the server can dynamically determine the data access scope based on user identity and business needs, ensuring that users can only operate on data within the authorized scope, effectively preventing unauthorized access. Second, during task execution, the intelligent agent engine strictly accesses data within the authorized scope and ensures compliance and security of data access through secure channels and real-time access verification. Finally, by thoroughly clearing temporary data and promptly releasing access credentials, the server eliminates potential security risks after data processing, ensuring that sensitive information is not leaked due to task processing. This comprehensive data security mechanism not only meets the stringent data privacy requirements of government agencies and financial institutions but also achieves efficient sharing of non-sensitive data through the establishment of a public external data area, improving server resource utilization and data processing efficiency. Overall, the solution provided in this embodiment maximizes data value while ensuring data security, providing reliable technical support for the application of private domain intelligent agents in highly sensitive fields.

[0143] This application embodiment also provides a server deployed with a private domain intelligent agent. The private domain intelligent agent includes a data storage layer, an engine layer, and a data service interface layer. The data storage layer includes multiple internal data storage areas, the engine layer includes an intelligent agent engine, and the data service interface layer includes an output interface module and multiple internal data interface modules, including:

[0144] The memory is configured to store instructions; and

[0145] The processor is configured to retrieve instructions from memory and, when executing instructions, to implement the aforementioned strongly isolated private domain agent data processing method.

[0146] This application also provides a computer program product, including a computer program or instructions, which, when executed by a processing device, implement the above-described method.

[0147] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0148] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, as well as combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0149] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0150] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0151] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0152] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0153] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0154] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0155] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A method for processing private domain intelligent agent data with strong isolation, characterized in that, Applied to a server, the server deploys a private domain intelligent agent. The private domain intelligent agent includes a data storage layer, an engine layer, a data service interface layer, and a security management layer. The data storage layer includes multiple internal data storage areas, the engine layer includes an intelligent agent engine, the data service interface layer includes an output interface module and multiple internal data interface modules, and the security management layer includes a unified authentication and authorization center. The method includes: Receive data processing requests sent by users through user terminals and obtain department identifiers; Based on the department identifier, the data processing request is routed to the corresponding internal data interface module. The internal data interface module is used to parse the data processing request, obtain the processing task, and call the intelligent agent engine. The intelligent agent engine sends a permission request to the unified authentication and authorization center. The permission request includes the department identifier and user identity information. The unified authentication and authorization center determines the data access scope based on the pre-configured permission matrix, combined with the user identity information and department identifier. The unified authentication and authorization center generates temporary access credentials based on the department identifier and data access scope. The temporary access credentials include the authorization scope, validity period and digital signature. The authorization scope is limited to accessing the corresponding department's internal data storage area, the validity period is a preset short duration, and the digital signature is generated using the private key of the unified authentication and authorization center. The intelligent agent engine uses temporary access credentials to access the corresponding department's internal data storage area to obtain the data to be processed. The intelligent agent engine is used to perform processing tasks, analyze and process the data to be processed, obtain the processing results, and transmit the processing results to the user terminal through the output interface module. In the case where the internal data storage area adopts physical isolation, the internal data storage area includes multiple storage array partitions. Each storage array partition corresponds to a department identifier, and the data between each storage array partition and other storage array partitions is isolated through a physical network and cannot be accessed by each other. When the internal data storage area adopts a strong logical isolation method, the internal data storage area includes multiple independent logical volumes that correspond one-to-one with the department identifier. Data between each independent logical volume and other independent logical volumes cannot be accessed through the strong logical isolation method. Strong logical isolation methods include: VLAN technology is used to divide the internal data storage area into independent network areas, and the access paths of the internal data interface modules and corresponding internal data storage areas of each department are restricted to the corresponding VLANs. Firewall policies are employed to block unauthorized access across VLANs and to prevent direct or indirect communication between data storage areas within different departments. These policies include deep packet inspection and application layer filtering to identify and block tunneling protocols, proxy services, and data smuggling. Create a separate logical volume for each department and assign different database user permissions to each logical volume; Use a separate directory for file storage and configure operating system-level access control permissions.

2. The method according to claim 1, characterized in that, Receive data processing requests sent by users through user terminals and obtain department identifiers, including: Receive official document data uploaded by users through user terminals and assign a unique identifier to the official document data; Receive data processing requests for official document data sent by users. The data processing requests include a unique identifier and a department identifier.

3. The method according to claim 1, characterized in that, The internal data storage area is isolated using physical isolation and / or strong logical isolation.

4. The method according to claim 1, characterized in that, The data service interface layer also includes an external data gateway module, and the data storage layer includes an external data cache. The intelligent agent engine executes processing tasks, analyzes and processes the data to be processed, and obtains the processing results, including: The intelligent agent engine analyzes the data to be processed to determine whether external data support is needed. When external data support is required, the intelligent agent engine sends an external data request to the external data gateway module. The external data gateway module is used to obtain external data from the external network according to preset rules and store the external data in the external data cache. The intelligent agent engine accesses the external data cache, obtains external data, and performs processing tasks to analyze and process the data to be processed and the external data, and obtains processing results. The processing tasks include at least one of data analysis, pattern recognition, text classification, information extraction, or decision support.

5. The method according to claim 1, characterized in that, The data storage layer also includes a public external data area, and the method further includes: Before executing a processing task, the intelligent agent engine obtains the user terminal's access permissions to the data to be processed, and determines the scope of data access for the user terminal based on the access permissions. During the execution of processing tasks, the intelligent agent engine accesses the internal data storage area within the data access scope; After executing a processing task, the intelligent agent engine clears the temporary data generated during the process and releases the temporary access credentials.

6. A server, characterized in that, A private domain intelligent agent is deployed, comprising a data storage layer, an engine layer, and a data service interface layer. The data storage layer includes multiple internal data storage areas, the engine layer includes an intelligent agent engine, and the data service interface layer includes an output interface module and multiple internal data interface modules, including: The memory is configured to store instructions; and A processor is configured to retrieve the instructions from the memory and, when executing the instructions, to implement the strongly isolated private domain agent data processing method according to any one of claims 1 to 5.

7. A computer program product, comprising a computer program or instructions, characterized in that, When the computer program or instructions are executed on the processing device, the method of any one of claims 1 to 5 is implemented.

Images