A knowledge base access control method and system for large-scale intelligent agent applications

Abstract

The application provides a knowledge base permission management method and system for large-scale agent applications, and relates to the technical field of knowledge base security management, which comprises the following steps: receiving a knowledge base access request data packet initiated by an agent proxy, performing protocol analysis on the request data packet, and extracting at least a global unique identifier of the agent and a unique identifier of a target knowledge unit; querying a permission policy library according to the agent identifier and current task context information to obtain a permission policy matched with the current task type. The application realizes the permission management goals of on-demand authorization, minimum permission and real-time response.

Description

Technical Field

[0001] This invention relates to the field of knowledge base security management technology, and in particular to a knowledge base access control method and system for large-scale intelligent agent applications. Background Technology

[0002] Against the backdrop of accelerating digital transformation in fields such as intelligent manufacturing and smart factories, large enterprises have generally built multi-agent collaborative platforms to achieve efficient collaboration across the entire process of R&D, production, and after-sales service. The task execution of dozens to hundreds of professional intelligent agents within the platform all rely on an enterprise-level core knowledge base divided by business domain.

[0003] However, the current one-to-one static permission binding model between intelligent agents and sub-libraries adopted by enterprises has a serious mismatch with the dynamic task requirements of intelligent agents. On the one hand, when the after-sales fault diagnosis intelligent agent needs to temporarily access the R&D sub-library to handle customized equipment faults, it needs to submit permission applications manually, which takes a long time on average, directly leading to a decrease in fault repair efficiency and forming a bottleneck of permission loss. On the other hand, when the supply chain scheduling intelligent agent completes the quarterly review task, the average delay in manually revoking its temporarily acquired cross-domain permissions is long. During the window period, the intelligent agent still retains access rights to non-business-related sub-libraries such as the production process parameter library, which poses a security risk of misoperation of critical data and forms a permission redundancy vulnerability. Summary of the Invention

[0004] The technical problem to be solved by this invention is to provide a knowledge base permission control method and system for large-scale intelligent agent applications, so as to achieve the permission control goals of on-demand authorization, least privilege, and real-time response.

[0005] To solve the above-mentioned technical problems, the technical solution of the present invention is as follows:

[0006] Firstly, a knowledge base access control method for large-scale intelligent agent applications, the method comprising:

[0007] Receive knowledge base access request data packets initiated by the agent agent, perform protocol parsing on the request data packets, and extract at least the agent's globally unique identifier and the target knowledge unit's unique identifier;

[0008] The permission policy library is queried based on the agent identifier and the current task context information to obtain the permission policy that matches the current task type.

[0009] Based on the permission policy, combined with the structured baseline framework generated by the predefined system architecture and the policy modulation factor, it is determined whether it is necessary to authorize access to knowledge units corresponding to multiple adjacent spatial regions. If so, the multiple regions are merged into a convex polygon, and a real-time permission token is generated based on the convex polygon and the operation permission. If not, a real-time permission token is obtained according to the permission policy.

[0010] Hierarchical permission verification is performed based on real-time permission tokens to verify access rights to target knowledge unit sub-libraries, logical partitions, and specific operations; if the token contains the authorization scope corresponding to the convex polygon, the verification process will simultaneously check whether the target knowledge unit is within the authorization scope.

[0011] After all permissions are verified, the agent accesses the target knowledge unit and generates an access log containing the agent identifier, the target knowledge unit identifier, the access time, and the operation type.

[0012] After detecting that the agent has completed the task, the permission revocation process is initiated according to the access log, which invalidates the corresponding real-time permission token and updates the permission status database to record the permission revocation status.

[0013] Secondly, a knowledge base access control system for large-scale intelligent agent applications includes:

[0014] The acquisition module is used to receive knowledge base access request data packets initiated by the agent agent, perform protocol parsing on the request data packets, and extract at least the agent's globally unique identifier and the unique identifier of the target knowledge unit.

[0015] The matching module is used to query the permission policy library based on the agent identifier and the current task context information to obtain the permission policy that matches the current task type.

[0016] The calculation module is used to determine whether access to knowledge units corresponding to multiple adjacent spatial regions needs to be authorized based on the permission policy, combined with the structured baseline framework generated by the predefined system architecture and the policy modulation factor. If so, the multiple regions are merged into a convex polygon, and a real-time permission token is generated based on the convex polygon and the operation permission. If not, a real-time permission token is obtained according to the permission policy. Hierarchical permission verification is performed based on the real-time permission token to verify the access rights of the target knowledge unit sub-library, logical partition and specific operation. If the token contains the authorization range corresponding to the convex polygon, the target knowledge unit is checked simultaneously during verification to see if it is within the authorization range.

[0017] The processing module is used to allow the agent to access the target knowledge unit after all permissions have been verified, and to generate an access log containing the agent identifier, the target knowledge unit identifier, the access time, and the operation type. After detecting that the agent has completed the task, the module initiates the permission revocation process based on the access log, invalidates the corresponding real-time permission token, and updates the permission status database to record the permission revocation status.

[0018] Thirdly, a computing device, comprising:

[0019] One or more processors;

[0020] A storage device for storing one or more programs that, when executed by one or more processors, cause the one or more processors to implement the method.

[0021] Fourthly, a computer-readable storage medium storing a program that, when executed by a processor, implements the method.

[0022] The above-described solution of the present invention has at least the following beneficial effects:

[0023] By parsing access requests to extract core identifiers and dynamically matching permission policies based on task context (task type, priority, etc.), this replaces the static binding of agents and sub-libraries and manual approval, shortening the permission acquisition time for temporary cross-domain access by agents, avoiding task delays caused by missing permissions, and improving the efficiency of multi-agent collaboration. On the other hand, by generating space-optimized real-time permission tokens, executing sub-libraries, logical partitioning, and three-level operation verification, it achieves precise control of least privilege, eliminating unnecessary access. At the same time, relying on the automated permission revoke process triggered by task completion, temporary permission tokens are immediately invalidated, completely eliminating the permission redundancy and misoperation risks caused by manual revoke delays. In addition, structured access logs are automatically generated throughout the process, providing a basis for permission auditing and problem tracing. The overall system is adapted to large-scale intelligent agent collaboration scenarios in large enterprises, taking into account the high efficiency of permission control. Attached Figure Description

[0024] Figure 1 This is a flowchart illustrating a knowledge base permission control method for large-scale intelligent agent applications provided by an embodiment of the present invention.

[0025] Figure 2 This is a schematic diagram of a knowledge base access control system for large-scale intelligent agent applications provided by an embodiment of the present invention. Detailed Implementation

[0026] Exemplary embodiments of the present disclosure will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.

[0027] like Figure 1 As shown, an embodiment of the present invention proposes a knowledge base access control method for large-scale intelligent agent applications, the method comprising the following steps:

[0028] Step 1: Receive the knowledge base access request data packet initiated by the agent agent, perform protocol parsing on the request data packet, and extract at least the agent's globally unique identifier and the unique identifier of the target knowledge unit;

[0029] Step 2: Query the permission policy library based on the agent identifier and the current task context information to obtain the permission policy that matches the current task type;

[0030] Step 3: Based on the permission policy, combined with the structured baseline framework generated by the predefined system architecture and the policy modulation factor, determine whether it is necessary to authorize access to knowledge units corresponding to multiple adjacent spatial regions. If so, merge the multiple regions into a convex polygon and generate a real-time permission token based on the convex polygon and the operation permission. If not, obtain the real-time permission token according to the permission policy.

[0031] Step 4: Perform hierarchical permission verification based on the real-time permission token to verify the access rights of the target knowledge unit sub-library, logical partition and specific operation; if the token contains the authorization scope corresponding to the convex polygon, check whether the target knowledge unit is within the authorization scope during verification.

[0032] Step 5: After all permissions are verified, the agent accesses the target knowledge unit and generates an access log containing the agent identifier, the target knowledge unit identifier, the access time, and the operation type.

[0033] Step 6: After detecting that the agent has completed the task, start the permission revocation process according to the access log, invalidate the corresponding real-time permission token, and update the permission status database to record the permission revocation status.

[0034] In this embodiment of the invention, core identifiers are extracted by parsing requests to clearly identify the access subject and object, laying a precise foundation for access control. Dynamic matching of access policies based on task context replaces static binding between agents and sub-libraries and manual intervention, enabling rapid response to temporary cross-domain access requests from agents and avoiding task efficiency degradation caused by manual approval delays. Real-time access tokens are generated by merging multiple regions into convex polygons, optimizing access management efficiency across multiple regions while ensuring clear and controllable authorization scope. Sub-libraries, logical partitions, and hierarchical verification of operations achieve precise control of minimum permissions, preventing agents from unauthorized access to sensitive knowledge units. Complete access logs are automatically generated, providing reliable evidence for access auditing and traceability. Automatic permission revocation is triggered upon task completion, causing real-time access tokens to expire immediately, completely eliminating permission redundancy and misoperation risks caused by manual revocation delays. The entire system forms a closed-loop control mechanism encompassing request parsing, policy matching, token generation, hierarchical verification, log recording, and permission revocation, adaptable to large-scale agent collaboration scenarios.

[0035] In a preferred embodiment of the present invention, step 1 above may include:

[0036] Step 1.1: Receive knowledge base access request data packets initiated by the agent agent via the communication network. Specifically, when various professional agents in the enterprise multi-agent collaboration platform need to access the enterprise-level core knowledge base, they will not directly establish a connection with the knowledge base access control system. Instead, they will first convert the access request into a standardized knowledge base access request data packet and initiate the access request through the agent agent. The agent agent will rely on the dedicated communication network built within the enterprise to stably transmit the access request data packet to the request receiving system of the knowledge base access control system. The request receiving system will monitor the network transmission data in real time, and when it identifies an access request data packet that conforms to the preset format, it will immediately complete the receiving operation.

[0037] Step 1.2 involves parsing the received request data packet using the communication protocol, removing the protocol header and trailer information, and obtaining the payload of the data packet. Specifically, after receiving the access request data packet, the knowledge base access control system calls the built-in communication protocol parsing system. The communication protocol parsing system first identifies the type of communication protocol followed by the data packet, such as a custom intelligent agent communication protocol within the enterprise or a standardized protocol commonly used in the industry. Then, according to the format specifications of the corresponding protocol, it parses the data packet byte by byte, removing the protocol header containing communication control information and the protocol trailer containing verification information from the data packet, retaining only the payload containing the core requirements for intelligent agent access. At the same time, it performs an integrity check on the removed payload. If the check finds that the payload is missing or damaged, it immediately sends a retransmission request to the intelligent agent agent.

[0038] Step 1.3 involves parsing the payload to extract at least the globally unique identifier of the agent and the unique identifier of the target knowledge unit. Specifically, the access control system will initiate a payload parsing program. The program will perform structured parsing of the payload according to the data interaction specifications of the enterprise-level core knowledge base, accurately identifying and extracting information for identifying the access subject and information for identifying the access object from the payload. The information for identifying the access subject is the globally unique identifier of the agent. Each agent's identifier is unique in the entire collaborative platform and can accurately distinguish different agents such as after-sales fault diagnosis agents and supply chain scheduling agents. The information for identifying the access object is the unique identifier of the target knowledge unit. The identifier corresponds one-to-one with the knowledge units in each sub-library of the enterprise-level core knowledge base, such as the R&D sub-library, the after-sales fault case library, and the production process parameter library.

[0039] In this embodiment of the invention, by receiving request data packets through an agent agent and a communication network, the standardization and traceability of request transmission in large-scale distributed collaborative scenarios of agents are ensured, avoiding the transmission chaos that may occur when directly receiving agent requests. Secondly, by parsing the communication protocol to remove redundant information from the header and tail and extract the payload, irrelevant data interference can be filtered out, reducing the computational cost of subsequent parsing, while ensuring that only core data is processed, thus improving the overall efficiency of access control. Finally, by accurately extracting the globally unique identifier of the agent and the unique identifier of the target knowledge unit, the access subject and access object can be clearly defined, avoiding misjudgment of permissions due to identifier confusion from the source.

[0040] In a preferred embodiment of the present invention, step 2 above may include:

[0041] Step 2.1: Based on the globally unique identifier of the agent and the unique identifier of the target knowledge unit, obtain the current task context information. The information includes at least the task type identifier, task priority parameters, and environment security level. Specifically, after obtaining the globally unique identifier of the agent and the unique identifier of the target knowledge unit, the knowledge base access control system will start the task context information acquisition program. The program first accesses the agent task management system based on the globally unique identifier of the agent to retrieve the basic information of the task currently being executed by the agent, and extracts the task type identifier from it. For example, the customized equipment fault investigation task type identifier for the after-sales fault diagnosis agent and the quarterly supply chain review task type identifier for the supply chain scheduling agent. At the same time, it obtains the task priority parameters set when the task is assigned, such as marking the emergency fault investigation task as high priority and the routine data statistics task as medium priority. Then, the program queries the knowledge base environment management system based on the unique identifier of the target knowledge unit to obtain the environment security level of the storage area where the target knowledge unit is located. For example, the core data storage area of ​​the R&D sub-library is marked as high security level and the public data area of ​​the after-sales fault case library is marked as medium security level.

[0042] Step 2.2 involves associating the globally unique identifier of the agent with the unique identifier of the target knowledge unit to form a primary query index. Specifically, the part of the access control system responsible for generating the index receives the globally unique identifier of the agent and the unique identifier of the target knowledge unit. According to the enterprise's preset index coding rules, the prefix field of the globally unique identifier of the agent is associated with the category field of the unique identifier of the target knowledge unit, and the suffix field of the globally unique identifier of the agent is associated with the location field of the unique identifier of the target knowledge unit, forming a continuous character sequence with unique pointing characteristics. The character sequence can simultaneously correspond to a specific agent and a specific target knowledge unit, thus serving as the primary query index.

[0043] Step 2.3 involves performing multi-dimensional matching calculations between the primary query index and the current task context information. A weighted algorithm is used to set the matching weight of the task type identifier to the highest, with the matching weights of the task priority parameter and environment security level decreasing sequentially, generating a comprehensive query index. Specifically, the part of the access control system responsible for multi-dimensional matching calculations first splits the primary query index into multiple feature fields. Then, the task type identifier, task priority parameter, and environment security level in the current task context information are also split into corresponding feature fields. Subsequently, the feature fields of the primary query index are compared and matched one by one with each feature field of the context information. During the matching process, a built-in weighted algorithm is used to set matching weights for different context information, with the matching weight of the task type identifier set to the highest to ensure that the strategy matching prioritizes and aligns with business needs. The matching weight of the task priority parameter is set to the second highest, and the matching weight of the environment security level is set to the lowest. Based on the matching results of each field and its corresponding weight, a comprehensive matching value is calculated. The primary query index is then combined with the comprehensive matching value to generate a comprehensive query index that reflects the agent's access needs, task attributes, and environmental requirements.

[0044] Step 2.4 involves traversing the policy entries in the permission policy library based on the comprehensive query index, calculating the matching score between each policy entry and the comprehensive query index, and selecting the permission policy entry with the highest matching score as the permission policy that matches the current task type. Specifically, the part of the permission control system responsible for policy matching will start a traversal process of the permission policy library based on the comprehensive query index. The permission policy library stores various permission policy entries preset by the enterprise for different business scenarios. Each entry includes the corresponding applicable intelligent agent scope, target knowledge unit scope, task type adaptation conditions, priority adaptation interval, and environmental security level requirements. During the traversal, the features in the comprehensive query index will be compared with the corresponding conditions of each policy entry. Based on the comparison results, the matching score between each policy entry and the comprehensive query index will be calculated. For example, a policy entry that fully meets all conditions will receive a full score, and entries that partially meet the conditions will have their scores reduced according to the weight of the non-compliant items. After traversing all policy entries, all scores will be sorted, and the permission policy entry with the highest matching score will be selected as the permission policy that matches the current intelligent agent task type.

[0045] In this embodiment of the invention, contextual information including task type identifier, priority, and environmental security level is obtained through the unique identifiers of the intelligent agent and the target knowledge unit. This allows for a clear understanding of the business background accessed by the intelligent agent, providing a scenario-based basis for policy matching. Associating the two types of unique identifiers forms a primary query index, ensuring that the basic query scope is locked from the access subject to the access object, avoiding interference from irrelevant policies. A comprehensive query index is generated through multi-dimensional matching calculations and weighted algorithms, ensuring deep alignment between permission policies and core business needs, taking into account both task urgency and environmental security, and avoiding one-sided policy matching. Based on the comprehensive index, the policy library is traversed, and the policy with the highest matching degree is selected, ensuring that the output permission policy is fully adapted to the intelligent agent's current task. No manual application for temporary permissions is required, and redundant permissions exceeding task requirements are not granted, supporting efficient and secure collaboration of large-scale intelligent agents in dynamic task scenarios.

[0046] In a preferred embodiment of the present invention, step 3 above may include:

[0047] Step 3.1: Receive the permission policy output from the permission policy library that matches the current task type. Based on the permission policy, extract the authorization configuration parameters for spatial area access. Specifically, the part of the knowledge base permission control system responsible for receiving permission policies will receive the permission policy transmitted from the permission policy library in real time that matches the current agent's task type. The permission policy contains various configuration information for the agent to access the knowledge base. The system will start a parameter extraction program to filter and extract the authorization configuration parameters related to spatial area access from the specified fields of the permission policy. The parameters include the identifier of the spatial area where the knowledge unit that is allowed to be accessed is located, the boundary range description of each area, and the configuration item for whether cross-area access is allowed. For example, for the permission policy for the after-sales fault diagnosis agent to temporarily access the R&D sub-library, the identifier of the non-confidential area in the R&D sub-library, the spatial range parameter of the area, and the configuration information that allows cross-after-sales sub-library and R&D sub-library access will be extracted.

[0048] Step 3.2 compares the authorization configuration parameters with the structured baseline framework generated by the predefined system architecture, and combines this with dynamically calculated policy modulation factors to determine whether the current permission policy includes access authorization for knowledge units corresponding to multiple adjacent spatial regions. Specifically, the permission control system first retrieves the structured baseline framework generated by the enterprise's pre-defined system architecture. This framework clearly defines the standard spatial division rules for each sub-base and knowledge unit of the enterprise-level core knowledge base, as well as the authorization scope baseline under different business scenarios. Subsequently, the system compares the extracted authorization configuration parameters item by item with the corresponding content in the structured baseline framework to check whether the authorization configuration parameters are valid. Whether it conforms to the spatial division specifications in the framework, the system will dynamically calculate the policy modulation factor based on the urgency of the current task, the confidentiality level of the knowledge unit, and the agent's historical access records. For example, high-urgency troubleshooting tasks will correspond to a higher modulation factor, while knowledge units with low confidentiality levels will correspond to a lower modulation factor. Finally, the system will combine the comparison results with the policy modulation factor to comprehensively determine whether the current permission policy includes access authorization for knowledge units corresponding to multiple adjacent spatial regions. For example, if the comparison finds that the authorization configuration parameters involve non-confidential areas of the after-sales fault case library and the R&D sub-library and the modulation factor meets the cross-regional access conditions, it will be determined as including multi-regional access authorization.

[0049] Step 3.3: If the judgment result is yes, then based on the spatial coordinate data of multiple adjacent regions specified in the permission policy, calculate and generate a convex polygon that can cover all specified regions. Specifically, when it is determined that the current permission policy includes access authorization for knowledge units corresponding to multiple adjacent spatial regions, the system reads and obtains the spatial coordinate data corresponding to each of the multiple adjacent spatial regions from the specified data segment of the above permission policy. The spatial coordinate data accurately records the boundary coordinates and position information of each spatial region in the physical storage or logical storage system of the knowledge base. Subsequently, the system starts the spatial geometry operation process, takes the spatial coordinate data of all adjacent regions as the operation input, connects the extreme coordinate points of the boundaries of each spatial region in sequence, and performs convexity verification and optimization on the connected graphics. Finally, it calculates and generates a closed figure that can completely cover all specified adjacent spatial regions and has the smallest area in terms of geometric shape. The closed figure is the convex polygon that can cover all specified regions.

[0050] Step 3.4: Based on the spatial range definition of the convex polygon and the operation permissions specified in the permission policy, a corresponding real-time permission token is generated. Specifically, this includes: defining the spatial range of the generated convex polygon, clarifying its specific coordinate boundaries in the knowledge base storage system, the types and quantities of knowledge units it contains, and the access priority of knowledge units within the authorized range; then, the system extracts the operation permissions of the knowledge units within the aforementioned spatial range from the permission policy matching the current task type. The operation permissions specifically include allowed operations such as querying, reading, and downloading, and prohibited operations such as modifying and deleting; subsequently, the system integrates the spatial range definition information of the convex polygon with the extracted operation permission information according to the preset permission token data format, assigns a unique token identifier and validity period to the token, and finally generates a real-time permission token corresponding to the current multi-region access requirements.

[0051] Step 3.5: If the judgment result is negative, the system directly generates a corresponding real-time permission token based on the target knowledge unit identifier and operation permissions specified in the permission policy. Specifically, when it is determined that the current permission policy does not include access authorization for multiple adjacent spatial region knowledge units, the system directly searches for and extracts the explicitly recorded target knowledge unit identifier from the permission policy that matches the current task type. The target knowledge unit identifier forms a unique correspondence with a single knowledge unit in the knowledge base or multiple knowledge units in a single spatial region. At the same time, the system extracts the operation permissions for the target knowledge unit from the above permission policy, clarifying the specific operation content that the intelligent agent can perform on the target knowledge unit. Subsequently, the system combines the extracted target knowledge unit identifier and the corresponding operation permission information in a structured manner according to the preset permission token generation rules, and adds basic information such as the token's unique identifier, generation time, and validity period, finally generating a real-time permission token that is only for a single target knowledge unit or a single spatial region knowledge unit.

[0052] In this embodiment of the invention, spatial dimension requirements for agent access are clarified by extracting spatial region authorization configuration parameters from the permission policy; multi-region access needs are judged by combining a structured benchmark framework and dynamic policy modulation factors, conforming to the enterprise's predefined system architecture specifications, adapting to dynamic task changes, and avoiding the rigidity of static authorization; multiple adjacent regions are merged into convex polygons, which simplifies the management and verification process of multi-region permissions, eliminating the need for separate authorization for each region and improving the efficiency of access to large-scale knowledge units; corresponding real-time permission tokens are generated according to different judgment results, ensuring that the authorization scope is clear and controllable when accessing multiple regions, and ensuring that the authorization process is simple and efficient when accessing a single region. The token clearly includes the spatial range and operation permissions, preventing agents from accessing unnecessary knowledge units without authorization, while meeting the dual requirements of permission flexibility and security in dynamic task scenarios.

[0053] In a preferred embodiment of the present invention, step 4 above may include:

[0054] Step 4.1: Based on the real-time permission token, extract the permission information contained therein. The permission information includes at least the authorized target knowledge unit sub-target identifier, logical partition identifier, and allowed operation type. Specifically, the system first obtains the aforementioned generated real-time permission token. The token carries the core authorization information for the agent to access the knowledge base. The system will start the token parsing program and parse the real-time permission token layer by layer according to the preset token data structure specification. Extract the complete permission information contained therein from the specified fields of the token. The permission information includes at least the authorized target knowledge unit sub-base identifier, logical partition identifier, and allowed operation type. The target knowledge unit sub-base identifier is used to clarify the scope of the knowledge base sub-base that the agent can access, the logical partition identifier is used to define the specific knowledge unit partition within the sub-base, and the allowed operation type is used to limit the operation behavior that the agent can perform.

[0055] Step 4.2 involves performing first-level permission verification. The obtained target knowledge unit sub-library identifier is matched against the target knowledge unit identifier in the access request to verify whether the agent is authorized to access the knowledge unit sub-library. Specifically, after extracting permission information, the system initiates the first-level permission verification process, which focuses on sub-library-level access permission checks. The system correlates and matches the extracted target knowledge unit sub-library identifier with the target knowledge unit identifier extracted from the access request data packet. Specifically, it parses the sub-library information to which the target knowledge unit identifier belongs, and then compares the sub-library information with the extracted target knowledge unit sub-library identifier. If they match completely, the agent is deemed authorized to access the knowledge unit sub-library, and the first-level permission verification passes. If they do not match, the agent is deemed unauthorized to access the knowledge unit sub-library, and the first-level permission verification fails. In this case, the system directly rejects the agent's access request. First-level verification can intercept unauthorized access to sub-libraries from the source, for example, preventing a production process optimization agent from attempting to access a customer privacy information database.

[0056] Step 4.3: After the first-level permission verification passes, the second-level permission verification is performed. Based on the obtained logical partition identifier, it verifies whether the specific knowledge unit requested by the agent is located within the authorized logical partition. Specifically, after the first-level permission verification passes, the system immediately initiates the second-level permission verification process. The verification process focuses on access permission verification at the logical partition level. The system first parses the extracted logical partition identifier to clarify the specific logical partition range within the corresponding sub-library. Then, it further parses the logical partition information to which the target knowledge unit belongs from the target knowledge unit identifier in the access request. Subsequently, it performs a correspondence verification between the parsed target knowledge unit logical partition information and the extracted authorized logical partition identifier to determine whether the specific knowledge unit requested by the agent is within the authorized logical partition range. If it is within the range, the second-level permission verification passes; if it is outside the range, the second-level permission verification fails, and the system terminates the subsequent access process. Through the second-level verification, the scope of permission control can be further narrowed from the sub-library to the specific logical partition.

[0057] Step 4.4: After the second-level permission verification passes, the third-level permission verification is performed. This involves comparing the allowed operation types with the intended operation types in the access request to verify authorization. Specifically, after the second-level permission verification passes, the system continues with the third-level permission verification process. This process focuses on permission checks at the operation type level. The system first categorizes the extracted allowed operation types, clarifying the types of operations the agent can perform within the current authorization scope, such as querying, reading, and downloading. Simultaneously, it parses the operation type the agent intends to perform on the target knowledge unit from the access request initiated by the agent. Then, it compares the allowed operation types with the intended operation type one by one. If the intended operation type falls within the allowed operation type range, the third-level permission verification is passed, and the agent is allowed to perform the corresponding operation. If the intended operation type exceeds the allowed operation type range, the third-level permission verification fails, and the system prohibits the agent from performing the operation. This three-level verification allows for precise control over the agent's operational behavior, preventing the risk of unauthorized operations leading to knowledge unit data tampering or leakage.

[0058] Step 4.5: If the real-time permission token contains the spatial authorization range corresponding to the convex polygon, then during the second-level permission verification, a spatial range check is performed simultaneously. The spatial coordinates of the target knowledge unit are calculated, and it is determined whether it is within the spatial range of the convex polygon. Specifically, during the second-level permission verification process, the system synchronously performs a secondary parsing of the real-time permission token to determine whether the token contains the spatial authorization range information corresponding to the convex polygon. If the parsing reveals that the token contains authorization range information, the system initiates the spatial range check process. First, it retrieves and obtains the target knowledge unit requested by the agent from the spatial coordinate management system of the knowledge base. The system obtains the spatial coordinate data corresponding to the target knowledge unit. This data precisely describes the specific location of the target knowledge unit in the knowledge base storage space. The system then processes the obtained spatial coordinate data of the target knowledge unit to determine its specific coordinate value. Subsequently, the coordinate value is compared with the spatial range boundary of the convex polygon to determine whether the spatial coordinates of the target knowledge unit are within the spatial range defined by the convex polygon. If they are within the range, the spatial range verification passes; if they are outside the range, the spatial range verification fails, and the second-level permission verification is deemed to fail. Through synchronous verification, it can be ensured that in multi-region merged authorization scenarios, the agent can only access knowledge units within the authorized spatial range.

[0059] In this embodiment of the invention, by extracting the target knowledge unit sub-library identifier, logical partition identifier, and allowed operation type from the token, a clear and explicit verification basis is provided for hierarchical verification, ensuring that the verification direction does not deviate from the core of authorization. The three-level progressive verification narrows the verification scope layer by layer from the library to the partition to the operation dimension. First, it prevents the agent from accessing unauthorized sub-libraries, then it limits access to specific logical partitions, and finally it controls the operation type, achieving layer-by-layer control of the least privilege. For tokens with authorization ranges containing convex polygon spaces, the spatial coordinates of knowledge units are verified simultaneously during partition verification, ensuring that in multi-region merged authorization scenarios, the agent can only access knowledge units within the convex polygon, avoiding the risk of cross-regional unauthorized access. The overall verification process covers the conventional scenario of single-region access, adapts to the complex scenario of multi-region merging, intercepts various unauthorized access behaviors, and improves verification efficiency through hierarchical verification.

[0060] In a preferred embodiment of the present invention, step 5 above may include:

[0061] Step 5.1: After all permission verifications pass, the system grants the agent access rights to the target knowledge unit based on the verification results. Specifically, after all the aforementioned permission verifications, including sub-library level, logical partition level, and operation level verifications (and spatial range verification if it involves spatial authorization scope), have passed, the system will generate a permission granting confirmation instruction based on the passing results of each level of verification. The instruction clearly records the scope of the target knowledge unit that the agent can access and the allowed operations. The system sends the permission granting confirmation instruction to the agent, thereby formally granting the agent access rights to the target knowledge unit.

[0062] Step 5.2: Receive the operation request for the target knowledge unit initiated by the intelligent agent agent based on the granted access permissions, execute the operation request, and complete the corresponding operation on the target knowledge unit. Specifically, after the intelligent agent agent receives the access permissions granted by the system, it initiates an operation request for the target knowledge unit based on the permissions. The system will monitor and receive the operation request in real time. First, it performs a compliance check on the format of the operation request to confirm whether the request contains the unique identifier of the target knowledge unit and the specific operation instructions. After the format check is passed, the system will retrieve the aforementioned granted access permission information and re-verify whether the target knowledge unit in the operation request is within the authorized scope and whether the requested operation type is an allowed type. After verification, the system starts the corresponding operation execution program and performs the corresponding operation on the target knowledge unit according to the instructions in the operation request. For example, when performing a data reading operation, it retrieves the content of the target knowledge unit from the knowledge base and feeds it back to the intelligent agent agent; when performing a data query operation, it filters the relevant information of the target knowledge unit and organizes and outputs it until the entire operation process is completed.

[0063] Step 5.3: While performing the operation, obtain key access information, including the agent's globally unique identifier, the target knowledge unit's unique identifier, the access timestamp, and the operation type. Specifically, this includes: while the system starts the operation execution program to perform the corresponding operation on the target knowledge unit, it will simultaneously start the access information collection program. The program will retrieve key information during the access process from designated storage areas within the system that store different key information. Specifically, it will retrieve and obtain the globally unique identifier of the agent that initiated the access from the area storing agent identity information, obtain the unique identifier of the target knowledge unit being accessed from the area storing knowledge unit location information, obtain the precise access timestamp when the operation is executed from the area storing system time information, and obtain the operation type that the agent intends to execute and that the system has confirmed is executed from the area storing the operation instruction parsing results.

[0064] Step 5.4: Organize the acquired key information according to a predefined log format to generate a complete access log entry. Specifically, the system will pre-configure a standardized access log format, which clearly specifies the order, field length, and data format requirements of key information such as the agent's globally unique identifier, the target knowledge unit's unique identifier, the access timestamp, and the operation type. After the key information is collected, the system will start the log generation program to organize the key information in the temporary storage area in a structured manner according to the predefined access log format. For example, the agent's globally unique identifier will be placed at the beginning of the log entry, followed by the target knowledge unit's unique identifier, the access timestamp, and the operation type field. The data format of each field will be standardized to ensure compliance with preset requirements, ultimately forming an access log entry containing complete key information and a standardized format.

[0065] In this embodiment of the invention, access permissions are precisely granted only after all verifications are passed, ensuring that the agent can only obtain permissions based on compliance verification, avoiding unauthorized access without verification. At the same time, authorization is executed by agent proxy, adapting to the distributed architecture of large-scale agent collaboration. The agent receives and executes compliant operation requests, ensuring that the agent efficiently completes knowledge unit access within the authorized scope, such as the after-sales agent retrieving data from the R&D sub-library and the production agent querying process parameters, ensuring the smooth progress of business tasks. Key information, including agent ID, knowledge unit ID, timestamp, and operation type, is collected synchronously during operation execution, comprehensively recording the access and ensuring the compliance and smoothness of agent access.

[0066] In a preferred embodiment of the present invention, step 6 above may include:

[0067] Step 6.1: The task status monitoring mechanism detects that the agent has completed its current task. In response to the task completion detection result, the system queries the access log database based on the agent's globally unique identifier to retrieve all access log entries related to the agent's current task. Specifically, the system has a pre-deployed, continuously running task status monitoring mechanism that receives task progress data from each agent in real time. By comparing the task progress data with the preset task completion judgment criteria, the system determines whether the agent has completed its current task. When the task progress data of an agent meets the task completion judgment criteria, it is determined that the agent has completed its current task. After detecting the task completion result, the system immediately responds to the result by using the agent's globally unique identifier as the search keyword to initiate a query operation on the access log database. The access log database stores all historical log entries of all agents accessing the knowledge base. The system filters out log entries related to the agent based on the globally unique identifier and further refines the filtering by combining the execution time range of the current task, ultimately retrieving all access log entries directly related to the agent's current task.

[0068] Step 6.2: Based on the retrieved access log entries, extract the unique identifiers of all real-time permission tokens issued in the task. Specifically, after obtaining all access log entries related to the agent's current task, the system will start a log parsing program to parse each access log entry layer by layer according to the preset log structure. Since each access log entry records the real-time permission token information used for the corresponding access behavior when it is generated, the unique identifier of the real-time permission token corresponding to the access can be extracted from each log entry through parsing. The system will deduplicate all the parsed unique identifiers of the real-time permission tokens, remove duplicate identifiers, and finally obtain the set of unique identifiers of all real-time permission tokens issued to the agent during the task execution.

[0069] Step 6.3: Initiate the permission revoke process by sending an instruction to the permission token management service to immediately invalidate all tokens corresponding to the extracted real-time permission token identifiers. Specifically, after determining the set of unique identifiers of the real-time permission tokens to be revoked, the system will formally initiate the permission revoke process. First, a permission revoke instruction will be generated, containing the unique identifiers of all real-time permission tokens to be revoked and the operation instruction for immediate invalidation. Subsequently, the system will send the permission revoke instruction to the permission token management service. Upon receiving the instruction, the permission token management service will immediately search all valid real-time permission tokens in its internal storage, match the unique identifiers of the tokens contained in the instruction with the token identifiers in its internal storage, find the corresponding real-time permission tokens, and execute the token invalidation operation.

[0070] Step 6.4: In the permission status database, update the permission status of the expired real-time permission tokens to "reclaimed" and record the precise timestamp of permission reclamation completion. Specifically, after the permission token management service completes the real-time permission token expiration operation, it will send a token expiration confirmation signal to this system. Upon receiving the confirmation signal, the system will immediately access the permission status database, which stores the current status information of all real-time permission tokens, including valid, expired, and reclaimed statuses. The system will locate the corresponding token status record in the permission status database based on the extracted unique identifier of the real-time permission token, update the permission status in these records from expired to reclaimed, and simultaneously obtain the current precise time from the system time synchronization source as the timestamp of permission reclamation completion, recording it in the corresponding token status record to form a complete permission lifecycle record.

[0071] In this embodiment of the invention, a task status monitoring mechanism captures the task completion signal of the intelligent agent in real time, and accurately retrieves the access logs related to the current task based on the globally unique identifier of the intelligent agent, ensuring that only the permissions of the current task are revoked, avoiding the accidental revocation of permissions for other tasks; all real-time permission token identifiers corresponding to the current task are extracted from the logs to clearly identify the revocation targets and prevent permission residue caused by missing a token; the tokens are immediately invalidated by an instruction, replacing manual operation, shortening the permission revocation response time from the traditional several hours to seconds, completely eliminating the window period during which after-sales intelligent agents, supply chain scheduling intelligent agents, etc., retain cross-domain permissions after completing tasks, and avoiding the security risks of accidental operation of critical data; the permission status database is updated synchronously and timestamps are recorded to achieve a complete record of the permission lifecycle, providing a clear basis for permission auditing and compliance checks, ensuring that the entire revocation process is traceable and verifiable, and adapting to the security management requirements of revoking permissions upon task completion in large-scale intelligent agent dynamic task scenarios.

[0072] like Figure 2 As shown, embodiments of the present invention also provide a knowledge base access control system for large-scale intelligent agent applications, comprising:

[0073] The acquisition module is used to receive knowledge base access request data packets initiated by the agent agent, perform protocol parsing on the request data packets, and extract at least the agent's globally unique identifier and the unique identifier of the target knowledge unit.

[0074] The matching module is used to query the permission policy library based on the agent identifier and the current task context information to obtain the permission policy that matches the current task type.

[0075] The calculation module is used to determine whether access to knowledge units corresponding to multiple adjacent spatial regions needs to be authorized based on the permission policy, combined with the structured baseline framework generated by the predefined system architecture and the policy modulation factor. If so, the multiple regions are merged into a convex polygon, and a real-time permission token is generated based on the convex polygon and the operation permission. If not, a real-time permission token is obtained according to the permission policy. Hierarchical permission verification is performed based on the real-time permission token to verify the access rights of the target knowledge unit sub-library, logical partition and specific operation. If the token contains the authorization range corresponding to the convex polygon, the target knowledge unit is checked simultaneously during verification to see if it is within the authorization range.

[0076] The processing module is used to allow the agent to access the target knowledge unit after all permissions have been verified, and to generate an access log containing the agent identifier, the target knowledge unit identifier, the access time, and the operation type. After detecting that the agent has completed the task, the module initiates the permission revocation process based on the access log, invalidates the corresponding real-time permission token, and updates the permission status database to record the permission revocation status.

[0077] The methods and systems involved in this patent are merely illustrative of technical solutions, aiming to solve the technical problems of knowledge base access control in large-scale intelligent agent scenarios. They do not involve the collection, storage, use, or disclosure of actual business data or privacy information of any specific enterprise, organization, or individual, nor do they contain any technical details or implementation cases that can be directly related to user privacy.

[0078] The actual application of the technologies related to this patent requires the application party to strictly comply with relevant laws and regulations, establish a sound privacy protection and data security mechanism, and ensure compliant protection of user privacy and sensitive data throughout the entire process of access control. This patent's technical solution does not assume responsibility for the application party's compliant operations. The technical elements described in this patent, such as the "globally unique identifier for intelligent agents," "target knowledge unit identifier," and "access log," are only technical identification and recording designs. Their actual implementation requires desensitization, encryption, and other privacy protection processing based on the application scenario. Any privacy leakage caused by the failure to take compliant protection measures in any application based on this patent's technology is unrelated to this patent's technical solution itself.

[0079] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A knowledge base access control method for large-scale intelligent agent applications, characterized in that, The method comprises: Receiving a knowledge base access request data packet initiated by an agent, performing protocol analysis on the request data packet, and extracting at least a global unique identifier of the agent and a unique identifier of a target knowledge unit; Querying a permission policy library according to the agent identifier and current task context information to obtain a permission policy matched with the current task type; According to the permission policy, combining a structured reference framework generated based on a predefined system architecture and a policy modulation factor, determining whether to authorize access to knowledge units corresponding to multiple adjacent spatial regions, if yes, merging the multiple regions into a convex polygon, and generating a real-time permission token based on the convex polygon and the operation permission; if no, obtaining a real-time permission token according to the permission policy; According to the real-time permission token, performing hierarchical permission verification to verify the access right of the target knowledge unit sub-library, logical partition and specific operation; if the token contains the authorized range corresponding to the convex polygon, the target knowledge unit is checked whether it is within the authorized range during the verification; After all the permission verifications are passed, the agent accesses the target knowledge unit, and generates an access log containing the agent identifier, the target knowledge unit identifier, the access time and the operation type; After detecting that the agent completes the task, starting a permission recovery process according to the access log, invalidating the corresponding real-time permission token, and updating a permission state library to record the permission recovery state. 2.The knowledge base permission management method for large-scale agent application of claim 1, wherein, Receiving a knowledge base access request data packet initiated by an agent, performing protocol analysis on the request data packet, and extracting at least a global unique identifier of the agent and a unique identifier of a target knowledge unit, comprising: Receiving a knowledge base access request data packet initiated by an agent via a communication network; Performing communication protocol analysis on the received request data packet, stripping the protocol header and tail information, and obtaining the payload of the data packet; Performing analysis on the payload, and extracting at least the global unique identifier of the agent and the unique identifier of the target knowledge unit.

3. The knowledge base permission management method for large-scale agent application of claim 2, wherein, Querying a permission policy library according to the agent identifier and current task context information to obtain a permission policy matched with the current task type, comprising: According to the global unique identifier of the agent and the unique identifier of the target knowledge unit, obtaining the current task context information, which at least includes a task type identifier, a task priority parameter and an environment security level; Combining the global unique identifier of the agent and the unique identifier of the target knowledge unit to form a primary query index; Performing multi-dimensional matching calculation on the primary query index and the current task context information, setting the matching degree weight of the task type identifier as the highest through a weighting algorithm, and setting the matching degree weights of the task priority parameter and the environment security level in turn decreasing, to generate a comprehensive query index; Based on the comprehensive query index, traversing the policy entries in the permission policy library, calculating the matching degree score of each policy entry and the comprehensive query index, and selecting the permission policy entry with the highest matching degree score as the permission policy matched with the current task type.

4. The knowledge base permission management method for large-scale agent application of claim 3, wherein, According to the permission policy, a structured benchmark framework generated based on a predefined system architecture, and a policy modulation factor, it is judged whether access to knowledge units corresponding to multiple adjacent spatial regions needs to be authorized. If yes, the multiple regions are merged into a convex polygon, and a real-time permission token is generated based on the convex polygon and operation permissions; If no, a real-time permission token is obtained according to the permission policy, including: Receiving a permission policy matched with a current task type from a permission policy library, and extracting authorization configuration parameters about spatial region access according to the permission policy; Comparing the authorization configuration parameters with a structured benchmark framework generated based on a predefined system architecture, and combining a dynamically calculated policy modulation factor to judge whether the current permission policy contains authorization of access to knowledge units corresponding to multiple adjacent spatial regions; If the judgment result is yes, a convex polygon covering all the specified regions is calculated and generated according to the spatial coordinate data of the multiple adjacent regions specified in the permission policy; Based on the spatial range definition of the convex polygon and the operation permissions specified in the permission policy, a corresponding real-time permission token is generated; If the judgment result is no, a corresponding real-time permission token is generated according to the target knowledge unit identifier and operation permissions specified in the permission policy.

5. The knowledge base permission management method for large-scale agent application according to claim 4, characterized in that, According to the real-time permission token, hierarchical permission verification is performed on the access rights of the target knowledge unit sub-library, logical partition, and specific operation; If the token contains the authorization range corresponding to the convex polygon, it is checked whether the target knowledge unit is within the authorized range during verification, including: According to the real-time permission token, the permission information contained therein is extracted, including at least the authorized target knowledge unit sub-library identifier, logical partition identifier, and allowed operation type; First-level permission verification is performed, and the obtained target knowledge unit sub-library identifier is matched with the target knowledge unit identifier in the access request to verify whether the agent is authorized to access the knowledge unit sub-library; After the first-level permission verification passes, second-level permission verification is performed, and according to the obtained logical partition identifier, it is verified whether the specific knowledge unit requested to be accessed by the agent is located within the authorized logical partition; After the second-level permission verification passes, third-level permission verification is performed, and the obtained allowed operation type is matched with the operation type intended to be performed in the access request to verify whether the operation is authorized; If the spatial authorization range corresponding to the convex polygon is parsed from the real-time permission token, spatial range verification is performed synchronously during the second-level permission verification, the spatial coordinates of the target knowledge unit are calculated, and it is judged whether it is located within the spatial range of the convex polygon.

6. The knowledge base permission management method for large-scale agent application of claim 5, wherein, After all the permission verifications pass, the agent accesses the target knowledge unit, and an access log containing the agent identifier, target knowledge unit identifier, access time, and operation type is generated, including: After all the permission verifications pass, the agent is granted access to the target knowledge unit according to the verification result; Receiving an operation request for the target knowledge unit initiated by the agent based on the granted access permission, executing the operation request, and completing the corresponding operation on the target knowledge unit; While performing the operation, key information of the access is acquired, including the agent global unique identifier, the target knowledge unit unique identifier, the access timestamp, and the operation type; The acquired key information is organized according to a predefined log format to generate a complete access log entry.

7. The knowledge base permission management method for large-scale agent application of claim 6, wherein, After detecting that the agent has completed the task, the permission recovery process is started according to the access log, the corresponding real-time permission token is invalidated, and the permission state library is updated to record the permission recovery state, including: The agent has completed its current task is detected through the task state monitoring mechanism, in response to the detection result of the task completion, the access log library is queried according to the global unique identifier of the agent, and all access log entries related to the current task of the agent are retrieved; Based on the retrieved access log entries, the unique identifiers of all real-time permission tokens issued in the task are extracted; The permission recovery process is started, and instructions are sent to the permission token management service to invalidate all real-time permission token identifiers extracted immediately; In the permission state library, the permission state corresponding to the invalidated real-time permission token is updated to be recovered, and the precise timestamp of the completion of the permission recovery is recorded.

8. A knowledge base permission management system for large-scale agent application, the system implements the method of any one of claims 1 to 7, characterized in that, Comprise: The acquisition module is used for receiving the knowledge base access request data packet initiated by the agent proxy, performing protocol analysis on the request data packet, and extracting at least the global unique identifier of the agent and the unique identifier of the target knowledge unit; The matching module is used for querying the permission policy library according to the agent identifier and the current task context information to obtain the permission policy matched with the current task type; The calculation module is used for judging whether the access to the knowledge units corresponding to multiple adjacent spatial regions needs to be authorized according to the permission policy, the structured reference framework generated by the pre-defined system architecture and the policy modulation factor, if yes, merging the multiple regions into a convex polygon, generating a real-time permission token based on the convex polygon and the operation permission; If not, the real-time permission token is obtained according to the permission policy; The hierarchical permission verification is performed according to the real-time permission token, and the access right of the target knowledge unit sub-library, the logical partition and the specific operation is verified; if the token contains the authorized range corresponding to the convex polygon, whether the target knowledge unit is within the authorized range is checked synchronously during the verification; The processing module is used for the agent to access the target knowledge unit after all the permission verification is passed, generating an access log containing the agent identifier, the target knowledge unit identifier, the access time and the operation type; after detecting that the agent has completed the task, the permission recovery process is started according to the access log, the corresponding real-time permission token is invalidated, and the permission state library is updated to record the permission recovery state.

9. A computing device, comprising: Comprise: One or more processors; Storage device, for storing one or more programs, when the one or more programs are executed by the one or more processors, so that the one or more processors implement the method of any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a program, which is executed by the processor to implement the method of any one of claims 1 to 7.

Images