A large model gateway security protection system and a security protection method

Abstract

The application discloses a large model gateway security protection system and a security protection method, relates to the field of large model information security protection, and comprises the following: a gateway input and output module that performs compliance verification on a user request, sends non-compliant requests to a blocking and isolating module, and inputs compliant requests to a called large model; a filtering and cleaning module that is used for real-time screening of original response content generated by the large model; a classification and grading module that identifies and marks the cleaned response content and determines a classification and grading result; a permission control module that is used for verifying access permissions of a requesting user; a data desensitization module that is used for desensitizing sensitive fields according to the classification and grading result of the classification and grading module and the user permissions; desensitized data is output to a target application system through the gateway input and output module; and the blocking and isolating module is used for blocking and isolating non-compliant requests, high-proportion non-compliant responses and requests corresponding to high-risk behaviors, and has multi-dimensional security protection capability.

Description

Technical Field

[0001] This application relates to the field of large-scale information security protection, and in particular to a large-scale gateway security protection system and security protection method. Background Technology

[0002] With the continuous development of large language model technology, it has been widely applied in key areas such as government services, financial consulting, medical diagnosis, industrial control, and education and training. Large models possess powerful natural language understanding and generation capabilities, demonstrating significant advantages in driving the automation and intelligence of business processes, and are gradually becoming an important support for the next generation of intelligent systems.

[0003] However, as large models become deeply integrated into real-world business systems, the security risks they pose are becoming increasingly prominent. Due to their strong generalization capabilities and open interactive features, large models often make it difficult for systems to effectively restrict user input or fully constrain output during the integration process. This "black box" input / output mechanism makes large models highly susceptible to becoming a potential source of sensitive information leakage, access control bypass, and erroneous responses.

[0004] The aforementioned security issues are particularly prominent in several typical scenarios. For example, in government service systems, users may use large models to query personal social security, housing provident fund, and other information. Without an effective authorization verification mechanism, this can easily lead to the leakage of personal privacy or unauthorized access. In the financial industry, when robo-advisory systems call large models to provide services, they may generate unapproved financial advice or accidentally expose sensitive transaction data, posing compliance risks. In enterprise internal knowledge base systems, employees may access confidential information by querying document content through models if they bypass the access control mechanism, leading to data security incidents. Furthermore, in industrial intelligent control systems, if large models are used for equipment scheduling and control tasks, attackers can disrupt normal system operation or even damage critical production processes by constructing malicious inputs or inducing abnormal responses.

[0005] Therefore, in order to address the security issues such as uncontrollable output response content, insufficient data sensitivity protection, and ambiguous permission boundaries that exist during the large model access process, it is urgent to build a large model gateway security protection system with multi-dimensional security protection capabilities. Summary of the Invention

[0006] The purpose of this application is to provide a security protection system and method for large model gateways, which solves the security problems existing in the process of large model access, such as uncontrollable output response content, insufficient protection of data sensitivity, and ambiguity of permission boundaries.

[0007] To achieve the above objectives, this application provides the following solution:

[0008] Firstly, this application provides a large-scale gateway security protection system, including:

[0009] The gateway input / output module is used to receive requests sent by users through the application system, perform compliance verification on the requests, send non-compliant requests to the blocking and isolation module, input compliant requests to the large model being called, and output the original response content of the processed large model.

[0010] The filtering and cleaning module is used to screen the original response content generated by the large model in real time. If the proportion of non-compliant content exceeds the set threshold, the original response content is sent to the blocking and isolation module. If the proportion of non-compliant content does not exceed the set threshold, the original response content is cleaned to obtain the cleaned response content.

[0011] The classification and grading module is used to identify and label the cleaned response content, and determine the classification and grading results of the cleaned response content. The classification and grading results include sensitivity level and type.

[0012] The access control module is used to control user access permissions;

[0013] The data desensitization module is used to desensitize sensitive fields based on the classification and grading results of the classification and grading module and user permissions, and generate desensitized data; the desensitized data is output to the target application system through the gateway input / output module;

[0014] The blocking and isolation module is used to block and isolate non-compliant requests, requests where the proportion of non-compliant content exceeds a set threshold, and requests where users exceed their access rights, and to provide security responses or prompts to users.

[0015] Optionally, the large model gateway security protection system further includes: a monitoring and management module for real-time monitoring of the operation status of the filtering and cleaning module, the classification and grading module, the access control module, and the data desensitization module, and for recording the operation behavior logs of each module.

[0016] Optionally, the filtration and cleaning module includes a sub-module for intercepting and purifying sensitive information and a sub-module for a cleaning engine driven by dynamic and static strategies.

[0017] The output sensitive information interception and purification function submodule uses a rule engine and sensitive word library matching method, combined with regular expressions and Aho-Corasick algorithm to detect the original response content, performs content interception or cleaning on the detected high-risk information, and sets a sensitive content detection threshold. When the proportion of sensitive, harmful or illegal information exceeds the sensitive content detection threshold, the blocking and isolation module is triggered.

[0018] The cleaning engine functional submodule driven by the coordinated dynamic and static strategies includes a cleaning unit driven by static strategies and a cleaning unit driven by dynamic strategies.

[0019] The statically driven cleaning unit intercepts and filters content based on a preset structured rule template;

[0020] The dynamic policy-driven cleaning unit allows administrators to define and manage refined cleaning rules based on business scenarios and compliance requirements, and supports dynamic updates and optimizations of the rule base.

[0021] Optionally, the classification and grading module includes a content depth scanning and feature extraction function submodule, a dynamic content classification and tagging function submodule, and an intelligent sensitivity grading and rating function submodule;

[0022] The content deep scanning and feature extraction function submodule is used to perform fine-grained automated scanning and feature extraction on the response content of the large model using natural language processing technology to obtain feature information; the feature information includes keywords, technical terms, legal terms, and sensitive entities;

[0023] The dynamic content classification and tagging function submodule is used to automatically classify and tag the feature information into domain categories based on a pre-built multi-dimensional domain category knowledge base using a classification algorithm.

[0024] The intelligent sensitivity grading and classification function submodule is used to perform risk weighted scoring based on the frequency, density, contextual relevance, and sensitive information category weight of sensitive entities in the cleaned response content. Combined with the built-in risk rule engine, the risk score is mapped to the preset sensitivity grading standard to determine the data security level.

[0025] Optionally, the access control module includes a multi-factor authentication and trusted verification function submodule, an operation permission and resource quota management submodule, and a full-link access audit and traceability function submodule;

[0026] The multi-factor authentication and trusted verification function submodule is used to authenticate the identity of the requesting subject using a multi-factor authentication mechanism, and to link the blocking and isolation module for requests that fail the verification.

[0027] The operation permission and resource quota control submodule is used to refine the control of the types of operations that users or applications can perform, and to implement call frequency limits, concurrency control and resource usage quota management.

[0028] The full-link permission audit and traceability function submodule is used to record all authentication events, permission decision results, resource operation details and quota consumption, and generate a complete audit log.

[0029] Optionally, the data desensitization module includes a sensitive data intelligent identification and location function submodule, a reversible / irreversible desensitization mechanism management function submodule, and a desensitization degree adaptive change function submodule;

[0030] The sensitive data intelligent identification and positioning function submodule is used to perform in-depth analysis of text data using multi-level scanning technology, based on the information output by the classification and grading module and a predefined sensitive data pattern library, to locate and label high-risk fields; the text data includes user request content, model interaction context, and log data to be stored;

[0031] The reversible / irreversible desensitization mechanism management function submodule is used to support a flexible data processing mode based on policy configuration. Reversible desensitization is used for internal analysis scenarios, while irreversible desensitization is used for external sharing or public scenarios.

[0032] The adaptive change function submodule for the degree of data anonymization is used to adaptively control the degree of data anonymization based on the classification and grading results, data sensitivity, and user permissions, and to adopt a local anonymization strategy for highly sensitive information.

[0033] Optionally, the monitoring and management module includes a full-link data acquisition and log aggregation function submodule, a real-time operation monitoring and situational awareness submodule, and an intelligent alarm and event response linkage function submodule;

[0034] The full-link data acquisition and log aggregation function submodule is used to collect and aggregate the operation logs, system performance indicators and security audit information of each module in real time to build a data warehouse;

[0035] The real-time operation monitoring and situational awareness submodule is used to monitor the operation status of the gateway and each submodule in real time and display it in a multi-dimensional way, and dynamically detect operational anomalies.

[0036] The intelligent alarm and event response linkage function submodule is used to intelligently monitor and alarm real-time monitoring data.

[0037] Optionally, in terms of intelligent monitoring and alarming of real-time monitoring data, the intelligent alarm and event response linkage function submodule is used for:

[0038] When real-time monitoring data exceeds the fixed threshold of key monitoring indicators, an anomaly alarm is triggered to identify typical known risks.

[0039] Cluster analysis of user access behavior and traffic patterns reveals abnormal requests that deviate from normal behavior clusters;

[0040] A trained machine learning model is used to identify abnormal fluctuations in real-time monitoring data, resulting in potential risk identification.

[0041] Optionally, the blocking and isolation module includes a data flow forced interception execution function submodule and an emergency response and one-click circuit breaker function submodule;

[0042] The data stream forced interception execution function submodule is used to drop data packets or terminate sessions for high-risk user request inflow channels or large model response outflow channels based on the instructions of the blocking decision engine, and return a security response to the user.

[0043] The emergency response and one-click circuit breaker function submodule is used to provide a one-click emergency circuit breaker capability that can be preset or manually triggered, supporting the instantaneous blocking of specific model services, user groups, source IP ranges or all traffic.

[0044] Secondly, this application provides a large-model gateway security protection method, applied to the large-model gateway security protection system described in the first aspect, comprising:

[0045] Users send requests through the application system. The gateway input / output module receives the requests and performs compliance checks. If the request is non-compliant, it is sent to the blocking and isolation module, which provides the user with a security response or prompt. If the request is compliant, it is input into the large model being invoked.

[0046] The large model responds to compliance requests and generates original response content. The filtering and cleaning module screens the original response content in real time. If the proportion of non-compliant content exceeds the set threshold, the original response content is sent to the blocking and isolation module. If the proportion of non-compliant content does not exceed the set threshold, the original response content is cleaned to obtain cleaned response content.

[0047] The classification and grading module identifies and marks the cleaned response content, and determines the classification and grading results of the cleaned response content. The classification and grading results include sensitivity level and type.

[0048] Control user access permissions; if the permission verification is successful, proceed to the next step.

[0049] The data desensitization module desensitizes sensitive fields based on classification and grading results and user permissions, generating desensitized data.

[0050] The gateway input / output module outputs the de-identified data to the target application system.

[0051] According to the specific embodiments provided in this application, the following technical effects are disclosed:

[0052] This application provides a large-scale model gateway security protection system and method. Users send requests through the application system. The gateway input / output module receives the requests and performs compliance verification. If the request is non-compliant, it is sent to the blocking and isolation module, which provides a security response or prompt to the user. If the request is compliant, it is input to the invoked large-scale model. The large-scale model responds to compliant requests, generating original response content. A filtering and cleaning module performs real-time screening of the original response content. If the proportion of non-compliant content exceeds a set threshold, the original response content is sent to the blocking and isolation module. If the proportion of non-compliant content does not exceed the set threshold, the original response content is cleaned to obtain cleaned response content. A classification and grading module identifies and marks the cleaned response content, determining the classification and grading results, including sensitivity level and type. User access permissions are controlled; if permission verification passes, the process proceeds to the next step. A data desensitization module desensitizes sensitive fields based on the classification and grading results and user permissions, generating desensitized data. The gateway input / output module outputs the desensitized data to the target application system, solving security problems such as uncontrollable output response content, insufficient data sensitivity protection, and ambiguous permission boundaries during large-scale model access. Attached Figure Description

[0053] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0054] Figure 1 This is a schematic diagram of the structure of a large-scale gateway security protection system provided in Embodiment 1 of this application.

[0055] Figure 2 This is an architecture diagram of a large-scale gateway security protection system provided in Embodiment 1 of this application. Detailed Implementation

[0056] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0057] Currently, large-scale models generally lack robust security control mechanisms during actual integration into application systems, primarily exhibiting the following problems:

[0058] The input side lacks effective compliance verification: user requests are directly entered into the model without verification, which may lead to jailbreak attacks such as prompt word injection;

[0059] The output lacks filtering and desensitization mechanisms: The response content generated by the large model may contain sensitive information, inappropriate remarks or statements that violate regulatory requirements. Without an effective cleaning, review and desensitization process, it is difficult to ensure the legality and security of its output.

[0060] Lack of classification and grading mechanism: The classification and grading mechanism is generally lacking in existing large model application systems, making it difficult to accurately identify, classify and grade the model response content, and limit the establishment and implementation of overall security protection capabilities.

[0061] Weak access control: In most current systems, user identity and access permissions are not tightly bound to the large model calling process, which can easily lead to problems such as unauthorized access and information leakage, and cannot achieve fine-grained access control based on user permissions;

[0062] Lack of end-to-end monitoring and auditing loop: The model invocation and security protection processes lack monitoring and log recording, making it difficult to conduct source tracing analysis and accountability after a security incident occurs.

[0063] To address the aforementioned issues, this application proposes a large-scale model gateway security protection system and method. This system performs compliance checks on user requests and implements content review and cleaning, classification and hierarchical management, permission verification, and data anonymization throughout the entire process of large-scale model response content. This ensures that the final response content delivered to the user is legal and compliant, contains no sensitive information, and strictly adheres to the user's authorized scope. For detected unauthorized user requests or abnormal model responses, the system has timely blocking and isolation mechanisms and provides clear security response feedback. This achieves trusted access and security assurance throughout the entire large-scale model call process, ensuring its reliable and controllable operation in various business scenarios.

[0064] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0065] Example 1

[0066] like Figure 1 As shown, this embodiment provides a large-scale gateway security protection system, including a classification and grading module, a filtering and cleaning module, an access control module, a data anonymization module, a monitoring and management module, a blocking and isolation module, and a gateway input / output module.

[0067] like Figure 2As shown, users submit questions or requests through the application system. These questions or requests enter the large-scale gateway security protection system through the gateway input / output module. The gateway input / output module first performs compliance checks on the user's questions or requests. Non-compliant requests are sent to the blocking and isolation module, which then provides a preset security response or prompt to the user. The gateway input / output module only inputs compliant user requests into the invoked large-scale model, which then responds to the questions or requests. After the large-scale model responds to compliant user questions or requests, the original response content is first screened in real-time by the filtering and cleaning module. If the proportion of non-compliant content in the original response content generated by the large-scale model is too high, the blocking and isolation module directly provides a security response or feedback to the user. If the proportion of non-compliant content in the content generated by the large-scale model is low or there are no violations, the filtering and cleaning module removes invalid, malicious, or non-compliant data to ensure the legality and compliance of the original response content of the large-scale model. After cleaning, the response content is identified and marked by the classification and grading module to determine the sensitivity level and type of the data. Subsequently, the access control module verifies the requesting user's access permissions to ensure the legality of the operation. If high-risk behavior (such as unauthorized access) is detected, the blocking and isolation module immediately terminates the request and isolates the threat, enabling rapid feedback for security response. Before data output, the data anonymization module anonymizes sensitive fields (such as personal information) based on classification and grading results and user permissions (anonymization involves masking or replacement), generating secure anonymized data. Finally, legitimate requests and their anonymized data are delivered to the target application system through the gateway input / output module. Throughout the process, the monitoring and management module monitors the filtering and cleaning module, classification and grading module, access control module, and data anonymization module in real time, checking whether the modules are operating correctly and logging the operation behavior of different modules for subsequent security auditing. The entire process forms a closed loop, completing the entire process of blocking unauthorized requests, dynamic classification and grading control, and secure output. The modules work together to achieve full-cycle protection from request access to secure delivery.

[0068] When the gateway input / output module detects non-compliant requests, it activates the blocking and isolation module to block and isolate these requests. When the filtering and cleaning module detects that the proportion of non-compliant content in the original response generated by the large model exceeds a set threshold, it activates the blocking and isolation module to block and isolate user requests corresponding to this threshold. When the access control module verifies that a user's access permissions are exceeded or unauthorized, it activates the blocking and isolation module to block and isolate requests corresponding to these unauthorized access permissions. The gateway input / output module, filtering and cleaning module, and access control module work together with the blocking and isolation module to block and isolate non-compliant requests, requests where the proportion of non-compliant content exceeds the set threshold, and requests corresponding to unauthorized user access permissions, ensuring the overall security performance of the system data.

[0069] When there are no non-compliant requests, the proportion of non-compliant content exceeds the set threshold, or the user's access permissions are exceeded, the cleaned response content output by the filtering and cleaning module will sequentially enter the classification and grading module and the data anonymization module for classification, grading, and data anonymization. The monitoring and management module also monitors the operating status of the filtering and cleaning module, classification and grading module, access control module, and data anonymization module throughout the entire process. The entire process forms a closed loop, completing the entire process of blocking illegal requests, dynamic classification and grading control, and secure output. The modules work together to achieve full-cycle protection from request access to secure delivery.

[0070] (i) Gateway input / output module, used to receive requests sent by users through the application system, perform compliance verification on the requests, send non-compliant requests to the blocking and isolation module, input compliant requests to the large model being called, and output the original response content of the processed large model.

[0071] The gateway input / output module is the traffic hub and protocol conversion center of the large-model gateway security protection system. It undertakes the key task of uniformly receiving all external user requests flowing into the gateway and large-model response data flowing out of the gateway, providing a standardized, high-performance, and scalable access and output channel for data interaction of the entire system.

[0072] This gateway's input / output module provides input compliance review and attack protection. It performs real-time deep inspection of incoming user requests, accurately identifying and blocking illegal, non-compliant, discriminatory content and statements that violate company policies. It also focuses on preventing carefully crafted prompt injection attacks, effectively blocking any jailbreaking attempts to bypass model security restrictions, induce the disclosure of sensitive information, or perform malicious operations, ensuring the security, legality, and controllability of commands input to the gateway. When a suspected illegal or malicious command is detected, the system automatically triggers a linkage blocking and isolation module, quickly cutting off the abnormal request channel and initiating a security response mechanism to minimize the spread of security risks and prevent damage.

[0073] To achieve the above functions, the gateway input / output module adopts a multi-layered detection mechanism based on rule engine, semantic analysis and threat detection model. The gateway input / output module includes a rule engine and sensitive word matching function submodule, a semantic understanding and context analysis function submodule, and a prompt injection and jailbreak detection function submodule.

[0074] (1.1) Rule Engine and Sensitive Word Matching Function Sub-module: Construct a sensitive word library covering illegal terms, discriminatory content, illegal terms and enterprise-defined strategy words. Combine regular expressions and efficient Aho-Corasick multi-pattern matching algorithm to quickly and accurately intercept request instructions that directly contain sensitive words or formatted illegal expressions.

[0075] (1.2) Semantic understanding and context analysis function submodule: For hidden expressions that bypass simple rules, the similarity between the request and the illegal intent template is calculated by using semantic embedding models such as BERT, so as to accurately discover variant expressions that may discriminate, induce or circumvent enterprise security strategies.

[0076] (1.3) Prompt word injection and jailbreak detection function sub-module: Deploy a dedicated detection module, and use a classifier trained with positive and negative examples, combined with blacklist and whitelist rules, to identify typical prompt word injection attack behaviors such as "command hijacking", "system prompt rewriting" and "character escape", and promptly block jailbreak commands that attempt to bypass security restrictions, induce the model to leak sensitive information or perform malicious operations.

[0077] By combining multiple technologies, the gateway input / output module can accurately guarantee the security and compliance of input requests, prevent various complex attacks, and ensure the security, legality, and controllability of large model input channels. Through specific data exchange and transmission protocols, the gateway input / output module ensures that complex and heterogeneous data streams between internal and external systems can be securely, reliably, and efficiently accessed through the gateway processing pipeline, and ultimately delivers the processed and compliant results accurately, ensuring the availability, compatibility, and security of the gateway service.

[0078] Gateway input / output module: It not only performs a series of security processing and protection on model output, but also performs deep detection on user request commands, accurately intercepts illegal, irregular, and discriminatory content and statements that violate policies, and focuses on preventing jailbreak attacks such as prompt word injection, preventing behaviors that bypass model security restrictions, induce leakage, or execute malicious operations.

[0079] (ii) The filtering and cleaning module is used to screen the raw response content generated by the large model in real time. If the proportion of non-compliant content exceeds a set threshold, the raw response content is sent to the blocking and isolation module. If the proportion of non-compliant content does not exceed the set threshold, the raw response content is cleaned to obtain cleaned response content. The set threshold can be set according to the user's specific needs and can be dynamically modified.

[0080] The filtering and cleaning module is the purification and filtering part of the large model gateway security protection system. It undertakes the critical task of real-time risk interception and content purification of large model responses flowing out of the gateway, providing a secure and compliant data flow for subsequent processing stages. This module accurately identifies and processes potential malicious commands, illegal and non-compliant content, sensitive information leaks, and abnormal formats, building a security defense line for model interaction.

[0081] The filtration and cleaning module includes a sub-module for intercepting and purifying sensitive output information and a cleaning engine sub-module driven by dynamic and static strategies.

[0082] (2.1) The output sensitive information interception and purification function submodule adopts the method of matching the rule engine and the sensitive word library, combined with regular expressions and Aho-Corasick algorithm to detect the original response content, performs content interception or cleaning on the detected high-risk information, and sets a sensitive content detection threshold. When the proportion of sensitive, harmful or illegal information exceeds the sensitive content detection threshold, the blocking and isolation module is triggered.

[0083] Sensitive information typically falls into four categories. The first is ideological content or content that violates public morals and good order, such as ethical violations. The second is content prohibited by Chinese laws and regulations, such as violence, murder, pornography, and personal information. The third is data requiring special protection. The fourth is data that is not suitable for public disclosure given the current state of national and social development.

[0084] The third type of data is classified into core data, important data, and general data according to the classification and grading protection system. Core data refers to data related to national security, the lifeline of the national economy, important people's livelihood, and major public interests. Important data involves public safety data, industrial control data, and technological security data such as design drawings and process parameters.

[0085] Based on a rule engine and sensitive word database matching approach, a multi-dimensional sensitive dictionary containing core technical terms, sensitive information, and inappropriate content is constructed. This dictionary, combined with regular expressions and the Aho-Corasick algorithm for multi-pattern matching, is used to detect the original response content of large-scale models. Once high-risk information such as core national data, important data like core technical details and undisclosed technical parameters, legally sensitive data (violence, pornography, etc.), or inappropriate content (content violating public morals and good order) is detected, content interception or a cleaning mechanism (such as key field masking, replacement, or partial deletion) is decisively executed according to preset strategies. This rigorous scanning and filtering of the original response content flowing from the large-scale model fundamentally blocks the risk of sensitive data leakage through model responses, ensuring the compliance and security of the output information.

[0086] Regular expression matching:

[0087] Regular expressions are string matching tools based on finite state automata, suitable for detecting complex text patterns. Through predefined syntax rules, they can identify sensitive information conforming to specific structures (such as ID card numbers, mobile phone numbers, IP addresses, specific keyword combinations, etc.).

[0088] Regular expression matching for sensitive content detection can be applied to scenarios such as ID card number detection, email address detection, URL detection, mobile phone number detection, and sentences containing sensitive keywords (such as "core technology" or "illegal instructions").

[0089] The streamlined process of using Aho-Corasick for sensitive word matching:

[0090] Step 1: Prepare a list of sensitive words as a set of multi-pattern keywords to be matched.

[0091] Step 2: Construct a Trie tree for all sensitive words. During the construction process, each word is broken down into character paths and inserted into the Trie structure.

[0092] Step 3: After constructing the Trie tree, construct a failure pointer for each node. This pointer is used to point to the longest suffix position that can continue matching when a match fails, thereby achieving automatic jump.

[0093] Step 4: After the fail pointer is constructed, the entire AC automaton is completed. At this point, a traversal matching operation can be performed on the target text.

[0094] Step 5: During the matching process, starting from the first character of the text, the state transitions are performed along the Trie tree. If the current character fails to match, the system jumps to the next possible state based on the fail pointer.

[0095] Step 6: When a node in the matching path is marked as terminated (i.e., representing a complete sensitive word), record the matching position and the corresponding word to achieve sensitive word identification.

[0096] Step 7: Continue traversing the text until the scan is complete, and finally output all the identified sensitive words and their positions, thereby achieving fast and accurate matching of sensitive content in the text.

[0097] In addition, by setting a sensitive content detection threshold, when the proportion of sensitive, harmful or illegal information in the original response content of the large model exceeds the preset threshold, the blocking and isolation module will be immediately activated to implement security response measures such as forced blocking and session termination, thereby effectively preventing high-risk content from flowing out and ensuring the compliance and security of the output results.

[0098] (2.2) The cleaning engine functional sub-module driven by dynamic and static strategies includes a cleaning unit driven by static strategies and a cleaning unit driven by dynamic strategies.

[0099] The static strategy-driven cleaning unit intercepts and filters content based on preset structured rule templates. The preset structured rule templates include keyword blocking templates, format rule verification templates, expression form restriction templates, illegal transaction identification templates, pornographic and vulgar content identification templates, violent and bloody content templates, ethnic discrimination and hate speech templates, etc.

[0100] The content interception and filtering mechanism, based on preset structured rule templates and fixed rules, features a structured strategy expression. This mechanism primarily targets known, frequently occurring sensitive information types, illegal or non-compliant expressions, or content with abnormal formats, implementing standardized and routine cleaning to ensure basic risk prevention capabilities.

[0101] In a statically strategy-driven text cleaning process, here is an example of the system's preset structured rule template:

[0102] 1) Keyword blocking template:

[0103] Intercept text containing specific sensitive keywords, such as words related to national security;

[0104] Combinations containing the names of well-known figures and negative verbs;

[0105] Keywords involving illegal activities, etc.

[0106] 2) Format rule validation template:

[0107] Validate whether the field or text format is compliant, for example:

[0108] Is the ID number a 18-digit number, and does it start with "0" or contain non-numeric characters?

[0109] Is the mobile phone number 11 digits long? Does it comply with the operator's number segment rules?

[0110] Does the email address conform to a standard format (e.g., it contains "@" and ".", and has no illegal characters)?

[0111] Does the length and beginning of the bank card number match the identification code of a legitimate bank?

[0112] 3) Expression format restriction template:

[0113] Restricting specific presentation formats to avoid circumventing review or redirection risks, for example:

[0114] Detect whether the text uses the "pinyin avoidance" method;

[0115] Detects intentional insertion of special symbols to interrupt sensitive words;

[0116] Intercept text containing QR code links or short URLs (such as "t.cn", "bit.ly", etc.).

[0117] 4) Illegal Transaction Identification Template:

[0118] Intercept text content that suggests illegal transactions, such as:

[0119] Contains the letter "A" or similar;

[0120] It also includes combined fields such as "B+C".

[0121] 5) Pornographic and vulgar content identification template:

[0122] Identify and block pornographic and violent content, such as:

[0123] High-risk combinations such as "D+E" and "F+G" appear;

[0124] Identify the presence of pornographic slang;

[0125] Intercepting repetitive and densely appearing marketing-inducing phrases.

[0126] 6) Template for violent and bloody content:

[0127] Identify text containing violent threats or extreme content;

[0128] Descriptive violent scenes appear.

[0129] 7) Template for ethnic discrimination and hate speech:

[0130] Detect offensive, inappropriate comments, and racially hateful content, such as:

[0131] Stereotypical words appear;

[0132] It contains strong xenophobic phrases such as "drive them out".

[0133] The dynamic policy-driven cleaning unit allows administrators to define and manage refined cleaning rules based on business scenarios and compliance requirements, and supports dynamic updates and optimizations of the rule base.

[0134] It allows administrators to define and manage refined cleaning rules (such as keyword blacklists, semantic pattern matching rules, and context-related interception strategies) based on business scenarios and compliance requirements, and supports dynamic updates and optimizations of the rule base to ensure the accuracy, timeliness, and scenario adaptability of the cleaning strategies. It serves as the cleaning center for the module to achieve intelligent risk handling.

[0135] (iii) Classification and grading module, used to identify and mark the cleaned response content, and determine the classification and grading results of the cleaned response content. The classification and grading results include sensitivity level and type.

[0136] The classification and grading module is the core sensing organ and decision-making foundation of the large-scale model gateway security protection system. It undertakes the crucial tasks of deeply understanding, identifying attributes, and assessing the value of all data content flowing out of the gateway from the large-scale model response, providing a basis for determining the data source for subsequent modules. This module scans and analyzes to determine whether information involves sensitive data details, core technical parameters, legal status, customer information, etc., and assigns corresponding category labels and security levels based on preset or learned strategy systems.

[0137] The classification and grading module includes a content depth scanning and feature extraction sub-module, a dynamic content classification and tagging sub-module, and an intelligent sensitivity grading and rating sub-module.

[0138] (3.1) Content deep scanning and feature extraction function submodule, which is used to perform fine-grained automated scanning and feature extraction on the response content of large model using natural language processing technology to obtain feature information; the feature information includes keywords, technical terms, legal terms and sensitive entities.

[0139] Natural language processing technology is used to perform fine-grained automated scanning and feature extraction on the response content of large models to obtain feature information. Specifically, this includes: performing word segmentation on the response content of large models to obtain word segmentation results; performing named entity recognition (NER) on the word segmentation results to obtain technical terms, legal terms, and sensitive entities; and extracting keywords from the word segmentation results to obtain keywords.

[0140] Natural language processing (NLP) techniques are employed, including word segmentation, named entity recognition (NER), and keyword extraction. Word segmentation divides the text into the smallest meaningful units, facilitating subsequent feature analysis. NER, based on the segmentation results, identifies key entities in the cleaned response text, such as technical terms, legal clauses, core parameters, and sensitive information. Keyword extraction extracts keywords that reflect the core content of the text. Through the synergistic application of these technologies, fine-grained automated scanning and feature extraction are achieved on the cleaned response content, accurately identifying keywords, technical terms, legal terms, and sensitive entities, providing solid data support for subsequent content classification and security grading.

[0141] (3.2) Dynamic content classification and tagging function submodule, which is used to automatically classify and tag the feature information into domain categories based on a pre-built multi-dimensional domain category knowledge base using classification algorithms.

[0142] Based on the feature information such as keywords, technical terms, legal terms and sensitive entities extracted in the above steps, combined with the pre-built multi-dimensional domain category knowledge base (such as technical solution description library, legal status query library, internal project management library, user entity information library and general public knowledge base), the content is automatically classified and tagged by domain category through a classification algorithm that combines rule matching and word vector-based K-nearest neighbor (KNN).

[0143] The specific process includes: first, using rule-based static matching (such as keyword mapping and entity category correspondence) to quickly classify the feature information; second, introducing KNN based on word vectors to supplement the judgment of complex or ambiguous content, improving the accuracy and generalization ability of the classification. After the feature information is classified, corresponding labels are automatically assigned, such as "technical solution description", "legal status query" or "user entity information", completing the fine classification and labeling of the response content of the large model.

[0144] "Complex or ambiguous content" refers to the remaining feature information that rule-based static matching fails to classify clearly, such as lack of significant keywords, semantic ambiguity, multiple possible classifications, or novel expressions not yet covered by the rule base.

[0145] (3.3) Intelligent sensitivity classification and rating function submodule, which is used to perform risk weighted scoring based on the frequency of occurrence, density of occurrence, degree of contextual association and weight of sensitive information category of sensitive entities in the cleaned response content. Combined with the built-in risk rule engine, the risk score is mapped with the preset sensitivity classification standard to determine the data security level.

[0146] After completing in-depth content scanning and feature extraction, the dynamic content classification and tagging submodule has extracted core feature information such as keywords, technical terms, legal terms, and sensitive entities from the cleaned response content. Based on this feature information, the sensitivity of the data content is further intelligently graded and classified.

[0147] First, the content is weighted by risk based on the frequency and density of various sensitive entities in the original response content of the large model, as well as their contextual relevance to other sensitive elements.

[0148] Occurrence density measures the concentration of sensitive entities in text, and is defined as the ratio of the number of times a sensitive entity appears to the length of the text.

[0149] (1);

[0150] in, Indicates the presence of density. This represents the total number of times the sensitive entity appears. This indicates the text length, which can be either the number of characters or the number of words.

[0151] Contextual relevance calculation:

[0152] 1) Spatial distance correlation: Define the set of sensitive elements as The location of each sensitive entity in the text is (No. The first class of sensitive entities (Second occurrence position), sensitive elements are equivalent to the type of sensitive entities; one sensitive element can correspond to multiple sensitive entities. Two types of sensitive elements. and The degree of spatial distance correlation between them is defined as:

[0153] (2);

[0154] in, Sensitive elements and The degree of spatial distance correlation between them; Sensitive elements The The next occurrence position.

[0155] 2) Semantic relevance: Extracting word vector representations for sensitive entities. Cosine similarity is used to measure semantic relevance:

[0156] (3);

[0157] in, Extracting word vectors for sensitive entities The semantic relevance between elements. For example, sensitive elements may include sensitive entities such as hypersonic vehicles and Dongfeng missiles. The degree of contextual relevance here reflects the degree of association between sensitive elements in a text. It should be noted that unrelated sensitive elements may not pose a problem when placed together, but related sensitive elements are more likely to form a complete chain of sensitive information.

[0158] 3) Contextual relevance is defined as:

[0159] (4);

[0160] in, Sensitive elements and Contextual relevance; These are weighting coefficients used to adjust spatial and semantic effects.

[0161] Finally, the summation or weighted average of all sensitive element pairs in the text is performed to obtain the overall contextual relevance. :

[0162] (5);

[0163] in, Each of the sensitive elements and Weights (such as category importance); This refers to the number of pairs of sensitive elements in the cleaned response content.

[0164] Furthermore, different categories of sensitive information are assigned different weights. For example, high-risk entities such as core national data and important data, including "process and technical parameters," "keys," and "internal project codes," have higher sensitivity weights, while general public information has lower weights. Through this multi-dimensional weighted calculation, the system can quantify the sensitivity risk score of each piece of data.

[0165] Subsequently, based on the built-in risk rule engine, the sensitive risk score is mapped to the enterprise's preset sensitivity grading standards to automatically determine the data's security level. For example, when the sensitive risk score is higher than the first risk value, the data security level is determined to be "Sensitive Level I"; when the sensitive risk score is within the first risk range, the data security level is "Sensitive Level II"; when the sensitive risk score is within the second risk range, the data security level is "Sensitive Level III"; and when the sensitive risk score is lower than the second risk value, the data security level is "Sensitive Level IV". This sensitivity grading mapping rule system supports flexible configuration and can be customized according to the enterprise's security strategy, regulatory requirements, and industry standards. The first risk value is 90, the first risk range is [70, 89], the second risk range is [40, 69], and the second risk value is 40.

[0166] In actual operation, a dynamic feedback and strategy optimization mechanism is also provided. By continuously collecting user operation logs, audit results, and false positives and false negatives, the sensitive word library, risk weights, and rule parameters are flexibly adjusted to ensure that the hierarchical strategy can be continuously optimized with business changes, maintaining high accuracy and adaptability.

[0167] (iv) Access Control Module: This module controls user access permissions. If unauthorized or unauthorized access is detected, the user will be isolated and banned. High-risk behavior refers to unauthorized or unauthorized access requests.

[0168] The access control module is the secure access arbitration part of the large model gateway security protection system. It undertakes the critical task of performing trusted identity verification and accurate permission rulings for all user and system requests to access the large model service, providing strict access security guarantees for the model interaction process. Based on sensitive tags and risk levels provided by the classification and grading module, and combined with predefined policy rules, this module dynamically implements identity authentication, permission determination, operation authorization, and resource quota management, ensuring that data assets and model capabilities are only securely used by legitimate entities within authorized scopes.

[0169] The access control module includes a multi-factor authentication and trusted verification function sub-module, an operation permission and resource quota management sub-module, and a full-link permission audit and traceability function sub-module.

[0170] (4.1) Multi-factor authentication and trusted verification function submodule, used to authenticate the identity of the request subject using a multi-factor authentication mechanism, and to link the blocking and isolation module for requests that fail the verification.

[0171] In the access control module, the system first implements strict identity authentication for the requesting entity, employing multi-factor authentication mechanisms such as API Key, OAuth 2.0, SAML, or LDAP to ensure the authenticity and legitimacy of the user's identity. The authentication process includes several key steps. First, credential verification checks whether the submitted API Key, Token, or identity assertion is formatted correctly and matches it with legitimate credentials registered in the system to prevent forgery or tampering. Next, validity verification checks the credential's expiration date, confirming it is within the valid time window and has not been revoked or expired, thus preventing the misuse of expired credentials. Finally, a rigorous check is performed on the request source and access frequency, including verifying IP address, device fingerprint, request path, and access frequency to determine whether the request originates from an authorized network, trusted device, or preset security domain, preventing unauthorized access from abnormal sources or malicious terminals. Through these multi-layered verifications, the system ensures that the requesting entity possesses a legitimate identity and is in a trusted environment. For requests that fail authentication, have abnormal credentials, have suspicious origins, or pose an unauthorized access risk, the blocking and isolation module will be activated immediately to execute defensive measures such as request dropping and session termination, and return a security response prompt (such as "Authentication failed" or "Illegal request has been blocked"), effectively preventing unauthorized access and potential attacks, and ensuring the access security of large-scale application models.

[0172] (4.2) Operation permission and resource quota control submodule, which is used to refine the control of the types of operations that users or applications can perform, and to implement call frequency limits, concurrency control and resource usage quota management.

[0173] Building upon authorized access, further refine the control over the specific types of operations that users or applications can perform (such as query only, analysis requests, configuration modifications, etc.), and implement strict call frequency limits, concurrency control, and resource usage quota management (such as daily call limits) to effectively prevent service abuse, resource overload, and potential systemic risks.

[0174] (4.3) The end-to-end permission auditing and traceability function submodule is used to record all authentication events, permission decision results, resource operation details and quota consumption, and generate complete audit logs to achieve transparency and accountability in permission use. It supports efficient querying and traceability analysis of historical access behavior, meets the strict requirements of compliance checks and security incident investigations, and strengthens the closed-loop supervision of permission management.

[0175] (v) Data desensitization module, used to desensitize sensitive fields based on the classification and grading results of the classification and grading module and user permissions, and generate desensitized data; the desensitized data is output to the target application system through the gateway input / output module.

[0176] Sensitive fields are anonymized based on user permissions. For example, when the data is financial data, users with financial permissions can view the unanonymized data, while ordinary employees (i.e., users without financial permissions) can only view the anonymized data.

[0177] The data anonymization module is the privacy protection processing part of the large model gateway security system. It undertakes the crucial task of real-time identification and transformation of sensitive data before it flows out of the security boundary, providing essential privacy protection for the data flow process. This module precisely masks, replaces, or generalizes high-value data such as core parameters, technical details, legally sensitive information, and personal identification identifiers in the generated content of the large model, ensuring that the original sensitive information is not obtained by unauthorized parties, strictly adhering to the principles of data minimization and privacy protection.

[0178] The data desensitization module includes a sub-module for intelligent identification and location of sensitive data, a sub-module for management of reversible / irreversible desensitization mechanisms, and a sub-module for adaptive changes in the degree of desensitization.

[0179] (5.1) Sensitive data intelligent identification and positioning function submodule, which is used to perform in-depth analysis of text data based on the information output by the classification and grading module and the predefined sensitive data pattern library using multi-level scanning technology, locate and label high-risk fields; text data includes user request content, model interaction context and log data to be stored.

[0180] This intelligent sensitive data identification and location submodule serves as the foundation for de-identification processing. Based on the data category labels and security level information output by the classification and grading module, and combined with a predefined sensitive data pattern library (including highly sensitive information, technical parameter features, legal keywords, etc.), it employs multi-level scanning technology to conduct in-depth analysis of user request content, model interaction context, and log data to be stored. The specific process includes: first, preliminary screening of text data using a rule engine and keyword matching to quickly identify potentially sensitive segments; then, using Named Entity Recognition (NER) technology to accurately extract key entities involving core data information, undisclosed technical parameters, legally sensitive conclusions, and personal identification information; simultaneously, combining contextual semantic analysis to assess the implicit sensitive attributes and associated risks in the text, ultimately locating and labeling all high-risk fields, providing a clear and accurate target basis for subsequent precise de-identification and security control.

[0181] (5.2) Reversible / Irreversible desensitization mechanism management function submodule, which is used to support flexible data processing mode based on policy configuration. Reversible desensitization is used for internal analysis scenarios, and irreversible desensitization is used for external sharing or public scenarios.

[0182] This reversible / irreversible data masking mechanism management submodule supports a flexible data processing mode based on policy configuration. Administrators can pre-set masking rules in the policy configuration interface according to different business scenarios (such as internal audit backtracking, log storage, or external sharing). For internal analysis scenarios, reversible masking (tokenization) based on a security mapping table is adopted; while in the process of data flow involving external sharing or public access, irreversible masking (such as permanent masking or generalization) is enforced, thereby ensuring data availability while effectively meeting strict confidentiality requirements and comprehensively strengthening the security control of the entire data lifecycle.

[0183] (5.3) Adaptive change function submodule for desensitization degree, which is used to adaptively control the degree of data desensitization according to the classification and grading results, data sensitivity and user permissions, and to adopt a local desensitization strategy for highly sensitive information.

[0184] This adaptive desensitization submodule adjusts the degree of data desensitization based on classification and grading results, the sensitivity of the corresponding information, user permissions, etc. It adopts a local desensitization strategy for highly sensitive information, adjusts the proportion of desensitized information according to the degree of security risk, and distinguishes it from regular data to ensure the overall security performance of the system data.

[0185] (vi) The monitoring and management module is used to monitor the operation status of the filtering and cleaning module, the classification and grading module, the access control module and the data desensitization module in real time, and to record the operation behavior logs of each module.

[0186] The monitoring and management module serves as the central hub and centralized control platform for the entire operational chain of the large-scale gateway security protection system. It undertakes the critical tasks of real-time monitoring, in-depth analysis, unified management, and intelligent response to the system's overall operational status, security posture, operational behaviors, and policy execution. This provides a panoramic view and decision support for the gateway's continuous, stable, secure, compliant, efficient, and controllable operation. This module aggregates operational logs, alarm events, performance metrics, and audit data from various functional modules, enabling comprehensive visibility and proactive governance throughout the gateway's entire lifecycle through visualization, intelligent analysis, and centralized configuration.

[0187] The monitoring and management module includes a sub-module for full-link data acquisition and log aggregation, a sub-module for real-time operation monitoring and situational awareness, and a sub-module for intelligent alarm and event response linkage.

[0188] (6.1) The full-link data collection and log aggregation function submodule is used to collect and aggregate the operation logs, system performance indicators and security audit information of each module in real time to build a data warehouse.

[0189] The monitoring and management module collects and aggregates detailed operation logs (such as request / response content summaries, user identities, permission decisions, desensitization operations, and blocking events), system performance indicators (such as throughput, latency, and error rate), and security audit information (such as policy hit records and abnormal access trajectories) from various modules such as filtering and cleaning, classification and grading, access control, and data desensitization in real time. This builds a complete and traceable data warehouse, providing the original basis for panoramic monitoring and in-depth analysis.

[0190] (6.2) Real-time operation monitoring and situation awareness submodule, used to monitor the operation status of the gateway and each submodule in real time and display it in a multi-dimensional way, and dynamically detect operation abnormalities.

[0191] Based on the massive amount of aggregated operational data, this real-time operation monitoring and situational awareness submodule provides second-level real-time monitoring and multi-dimensional visualization of the health status, service performance, resource load, and security risks of the gateway as a whole and each submodule, such as dashboards and topology diagrams. It dynamically senses traffic fluctuations, performance bottlenecks, and errors and anomalies, forming a global, immediate, and clear understanding of the system's operational status, laying the foundation for proactive operation and maintenance and risk warning.

[0192] (6.3) Intelligent alarm and event response linkage function submodule, used for intelligent monitoring and alarm of real-time monitoring data.

[0193] Regarding intelligent monitoring and alarming of real-time monitoring data, the intelligent alarm and event response linkage function submodule is used for:

[0194] When real-time monitoring data exceeds the fixed threshold of key monitoring indicators, an anomaly alarm is triggered to identify typical known risks.

[0195] Cluster analysis of user access behavior and traffic patterns reveals abnormal requests that deviate from normal behavior clusters;

[0196] A trained machine learning model is used to identify abnormal fluctuations in real-time monitoring data, resulting in potential risk identification.

[0197] This intelligent alarm and event response linkage function submodule achieves intelligent monitoring and alarm through a dual mechanism based on preset thresholds and intelligent learning baselines.

[0198] On the one hand, based on a static rule engine, an administrator can set fixed thresholds for key monitoring metrics (such as API request frequency, abnormal traffic, CPU / memory usage, number of sensitive operation triggers, call failure rate, etc.) in the policy configuration. When the real-time monitoring data exceeds the set threshold, the system immediately triggers an abnormal alarm to quickly identify typical known risks. The static rule engine includes a program for implementing the function of "when the real-time monitoring data exceeds the set threshold, the system immediately triggers an abnormal alarm to quickly identify typical known risks".

[0199] On the other hand, relying on behavior analysis and machine learning modeling, the system models the historical normal operating state to form a dynamic multi-dimensional baseline, including access behavior patterns, resource usage curves, user operation sequences, etc. The specific algorithms used include:

[0200] (1) Cluster analysis (such as K-Means) to cluster user access behaviors, traffic patterns, etc., and quickly discover abnormal requests that deviate from the normal behavior cluster.

[0201] (2) Time series anomaly detection (based on LSTM prediction residual analysis) to perform trend modeling on time series data such as resource usage rates (CPU, memory, bandwidth), API call frequencies, etc. When the real-time data shows abnormal fluctuations that significantly deviate from the predicted trend, the system determines it as a potential risk.

[0202] When it is detected that the behavior metrics exceed the static threshold or deviate dynamically from the baseline (such as abnormal instruction combinations, sudden changes in tool call frequencies, access from abnormal IP segments, etc.), the system will automatically identify and trigger an alarm.

[0203] The alarm mechanism supports multi-level linkage responses. It can not only push alarms through emails, text messages, work order systems or SOC platforms, but also automatically execute defense measures according to preset policies, such as dynamically adjusting API gateway traffic limiting, forcibly terminating abnormal sessions, automatically blocking abnormal IPs, or联动隔离模块阻断高风险调用 (this part seems to have some incorrect or unclear expression, but translated as is), so as to achieve closed-loop control of risks.

[0204] By combining rule-driven rapid detection with deep anomaly perception of machine learning, this intelligent alarm and event response linkage functional sub-module significantly improves the detection ability for known threats and unknown anomalies, ensuring the safe, stable and reliable operation of the large model in industrial scenarios.

[0205] (7) Blocking and isolation module, used to execute blocking and isolation on non-compliant requests, requests corresponding to the proportion of non-compliant content exceeding the set proportion threshold, and user access permission overstepping, and feedback security responses or prompts to users.

[0206] The blocking and isolation module serves as the ultimate security defense and emergency stop for large-scale model gateway systems or devices. It is crucial for millisecond-level real-time interception, connection termination, and risk source isolation of data requests and model responses deemed high-risk or seriously non-compliant, providing the entire system with decisive handling capabilities in the face of high-risk threats. Based on the comprehensive analysis conclusions and predefined circuit breaker strategies of the gateway input detection, filtering, and access control modules, this module forcibly enforces access blocking and connection isolation before security risks breach the defenses or cause substantial damage, ensuring that core patent assets and system security are protected from irreversible harm.

[0207] The blocking and isolation module includes a data flow forced interception execution function submodule and an emergency response and one-click circuit breaker function submodule.

[0208] (7.1) Data Flow Forced Interception Execution Function Submodule, which is used to drop data packets or terminate sessions on high-risk user request inflow channels or large model response outflow channels based on the instructions of the blocking decision engine, and return a security response to the user.

[0209] Based on the instructions of the blocking decision engine, the data flow forced interception execution function submodule implements immediate and forced packet dropping or session termination for user request inflow channels or large model response outflow channels that are judged to be high-risk, thereby completely blocking malicious instructions from entering the large model or preventing sensitive response content from being leaked to unauthorized users.

[0210] The determination of high-risk status is derived from multiple upstream security modules:

[0211] First, the gateway input / output module detects and verifies the compliance of user requests entering the system. If illegal requests, malicious commands, or other behaviors are detected, the request will be deemed high-risk, and a blocking and security response command will be sent to the blocking and isolation module.

[0212] Secondly, the filtering and cleaning module performs real-time sensitive information detection on the response content of the large model. When the output content contains core national data, important data such as core process parameters, technical details, and legally sensitive information, and exceeds the preset risk threshold, it is determined that the current response has a high risk of leakage, triggering the blocking and isolation module to prevent the illegal information from being transmitted to the user.

[0213] In addition, the access control module is responsible for real-time verification of user identity and permissions. If unauthorized access, unauthorized calls, or abnormal permissions are detected, and the system is deemed high-risk, the blocking and isolation module will be activated to prevent unauthorized requests from continuing to flow into the model or unauthorized data from being obtained.

[0214] Upon receiving the blocking command from the aforementioned security module, this module immediately executes defensive measures according to preset policies, including dropping data packets, forcibly terminating the session, disconnecting the API connection, or closing the conversation session. Simultaneously, it returns a predefined security response to the user, such as "Request denied," "Illegal access detected," or "Output content contains prohibited information and has been blocked," ensuring the system can quickly handle security incidents in their initial stages.

[0215] (7.2) Emergency response and one-click circuit breaker function submodule, which provides one-click emergency circuit breaker capability that can be preset or manually triggered, and supports instantaneous blocking of specific model services, user groups, source IP ranges or all traffic.

[0216] This emergency response and one-click circuit breaker function submodule serves as a "red button" for dealing with sudden major security incidents (such as zero-day vulnerability exploitation, large-scale attacks, and core model anomalies). It provides a one-click emergency circuit breaker capability that can be preset or manually triggered, and supports instantaneous blocking of specific model services, user groups, source IP ranges, or all traffic as needed, minimizing incident response time and providing the highest priority mandatory means for emergency response and threat containment.

[0217] Example 2

[0218] This embodiment provides a large-model gateway security protection method, which is applied to the large-model gateway security protection system described in Embodiment 1. The solution provided by this large-model gateway security protection method is similar to the solution described in the above system. Therefore, the specific limitations of one or more large-model gateway security protection method embodiments provided below can be found in the limitations of the large-model gateway security protection system above, and will not be repeated here.

[0219] This embodiment provides a large model gateway security protection method, applied to the large model gateway security protection system described in Embodiment 1, including the following steps:

[0220] S1: The user sends a request through the application system. The gateway input / output module receives the request and performs compliance verification. If the request is non-compliant, it is sent to the blocking and isolation module, which provides the user with a security response or prompt. If the request is compliant, it is input into the large model to be invoked.

[0221] S2: The large model responds to compliance requests and generates original response content. The filtering and cleaning module screens the original response content in real time. If the proportion of non-compliant content exceeds the set threshold, the original response content is sent to the blocking and isolation module. If the proportion of non-compliant content does not exceed the set threshold, the original response content is cleaned to obtain the cleaned response content.

[0222] S3: The classification and grading module identifies and marks the cleaned response content, and determines the classification and grading results of the cleaned response content. The classification and grading results include sensitivity level and type.

[0223] S4: Control user access permissions. If the permission verification is successful, proceed to the next step.

[0224] S5: The data desensitization module desensitizes sensitive fields based on classification and grading results and user permissions, generating desensitized data;

[0225] S6: The gateway input / output module outputs the de-identified data to the target application system.

[0226] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0227] This document uses specific examples to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. Furthermore, those skilled in the art will recognize that, based on the ideas of this application, there will be changes in the specific implementation methods and application scope. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A large-scale gateway security protection system, characterized in that, The large-scale gateway security protection system includes: The gateway input / output module is used to receive requests sent by users through the application system, perform compliance verification on the requests, send non-compliant requests to the blocking and isolation module, input compliant requests to the large model being called, and output the original response content of the processed large model. The filtering and cleaning module is used to screen the original response content generated by the large model in real time. If the proportion of non-compliant content exceeds the set threshold, the original response content is sent to the blocking and isolation module. If the proportion of non-compliant content does not exceed the set threshold, the original response content is cleaned to obtain the cleaned response content. The classification and grading module is used to identify and label the cleaned response content, and determine the classification and grading results of the cleaned response content. The classification and grading results include sensitivity level and type. The access control module is used to control user access permissions; The data desensitization module is used to desensitize sensitive fields based on the classification and grading results of the classification and grading module and user permissions, and generate desensitized data; the desensitized data is output to the target application system through the gateway input / output module; The blocking and isolation module is used to block and isolate non-compliant requests, requests where the proportion of non-compliant content exceeds a set threshold, and requests where users exceed their access rights, and to provide security responses or prompts to users. The monitoring and management module is used to monitor the operation status of the filtration and cleaning module, classification and grading module, access control module and data desensitization module in real time, and record the operation behavior logs of each module; The gateway input / output module includes a jailbreak detection function submodule. The prompt word injection and jailbreak detection function submodule is used to: deploy a dedicated detection module, identify typical prompt word injection attack behaviors through a classifier trained with positive and negative examples, combined with blacklist and whitelist rules, and promptly block jailbreak commands that attempt to bypass security restrictions, induce the model to leak sensitive information, or perform malicious operations. The filtering and cleaning module includes a sub-module for outputting sensitive information interception and purification, and a cleaning engine sub-module driven by dynamic and static strategies. The output sensitive information interception and purification function submodule uses a rule engine and sensitive word library matching method, combined with regular expressions and Aho-Corasick algorithm to detect the original response content, performs content interception or cleaning on the detected high-risk information, and sets a sensitive content detection threshold. When the proportion of sensitive, harmful or illegal information exceeds the sensitive content detection threshold, the blocking and isolation module is triggered. The cleaning engine functional submodule driven by the coordinated dynamic and static strategies includes a cleaning unit driven by static strategies and a cleaning unit driven by dynamic strategies. The statically driven cleaning unit intercepts and filters content based on a preset structured rule template; The dynamic strategy-driven cleaning unit allows administrators to define and manage refined cleaning rules based on business scenarios and compliance requirements, and supports dynamic updates and optimizations of the rule base. The classification and grading module includes a content deep scanning and feature extraction function sub-module, a dynamic content classification and tagging function sub-module, and an intelligent sensitivity grading and classification function sub-module. The content deep scanning and feature extraction function submodule is used to perform fine-grained automated scanning and feature extraction on the response content of the large model using natural language processing technology to obtain feature information; the feature information includes keywords, technical terms, legal terms, and sensitive entities; The dynamic content classification and tagging function submodule is used to automatically classify and tag the feature information into domain categories based on a pre-built multi-dimensional domain category knowledge base using a classification algorithm. The intelligent sensitivity grading and classification function submodule is used to perform risk weighted scoring based on the frequency, density, contextual relevance, and sensitive information category weight of sensitive entities in the cleaned response content. Combined with the built-in risk rule engine, the risk score is mapped to the preset sensitivity grading standard to determine the data security level.

2. The large-scale gateway security protection system according to claim 1, characterized in that, The access control module includes a multi-factor authentication and trusted verification function sub-module, an operation permission and resource quota management sub-module, and a full-link permission audit and traceability function sub-module. The multi-factor authentication and trusted verification function submodule is used to authenticate the identity of the requesting subject using a multi-factor authentication mechanism, and to link the blocking and isolation module for requests that fail the verification. The operation permission and resource quota control submodule is used to refine the control of the types of operations that users or applications can perform, and to implement call frequency limits, concurrency control and resource usage quota management. The full-link permission audit and traceability function submodule is used to record all authentication events, permission decision results, resource operation details and quota consumption, and generate a complete audit log.

3. The large-scale gateway security protection system according to claim 1, characterized in that, The data desensitization module includes a sensitive data intelligent identification and positioning function submodule, a reversible / irreversible desensitization mechanism management function submodule, and a desensitization degree adaptive change function submodule. The sensitive data intelligent identification and positioning function submodule is used to perform in-depth analysis of text data using multi-level scanning technology, based on the information output by the classification and grading module and a predefined sensitive data pattern library, to locate and label high-risk fields; the text data includes user request content, model interaction context, and log data to be stored; The reversible / irreversible desensitization mechanism management function submodule is used to support a flexible data processing mode based on policy configuration. Reversible desensitization is used for internal analysis scenarios, while irreversible desensitization is used for external sharing or public scenarios. The adaptive change function submodule for the degree of data anonymization is used to adaptively control the degree of data anonymization based on the classification and grading results, data sensitivity, and user permissions, and to adopt a local anonymization strategy for highly sensitive information.

4. The large-scale gateway security protection system according to claim 1, characterized in that, The monitoring and management module includes a full-link data acquisition and log aggregation function submodule, a real-time operation monitoring and situational awareness submodule, and an intelligent alarm and event response linkage function submodule. The full-link data acquisition and log aggregation function submodule is used to collect and aggregate the operation logs, system performance indicators and security audit information of each module in real time to build a data warehouse; The real-time operation monitoring and situational awareness submodule is used to monitor the operation status of the gateway and each submodule in real time and display it in a multi-dimensional way, and dynamically detect operational anomalies. The intelligent alarm and event response linkage function submodule is used to intelligently monitor and alarm real-time monitoring data.

5. The large-scale gateway security protection system according to claim 4, characterized in that, Regarding intelligent monitoring and alarming of real-time monitoring data, the intelligent alarm and event response linkage function submodule is used for: When real-time monitoring data exceeds the fixed threshold of key monitoring indicators, an anomaly alarm is triggered to identify typical known risks. Cluster analysis of user access behavior and traffic patterns reveals abnormal requests that deviate from normal behavior clusters; A trained machine learning model is used to identify abnormal fluctuations in real-time monitoring data, resulting in potential risk identification.

6. The large-scale gateway security protection system according to claim 1, characterized in that, The blocking and isolation module includes a data flow forced interception execution function submodule and an emergency response and one-click circuit breaker function submodule; The data stream forced interception execution function submodule is used to drop data packets or terminate sessions for high-risk user request inflow channels or large model response outflow channels based on the instructions of the blocking decision engine, and return a security response to the user. The emergency response and one-click circuit breaker function submodule is used to provide a one-click emergency circuit breaker capability that can be preset or manually triggered, supporting the instantaneous blocking of specific model services, user groups, source IP ranges or all traffic.

7. A security protection method for large-scale gateways, characterized in that, The large-model gateway security protection method, applied to the large-model gateway security protection system according to any one of claims 1-6, comprises: Users send requests through the application system. The gateway input / output module receives the requests and performs compliance checks. If the request is non-compliant, it is sent to the blocking and isolation module, which provides the user with a security response or prompt. If the request is compliant, it is input into the large model being invoked. The large model responds to compliance requests and generates original response content. The filtering and cleaning module screens the original response content in real time. If the proportion of non-compliant content exceeds the set threshold, the original response content is sent to the blocking and isolation module. If the proportion of non-compliant content does not exceed the set threshold, the original response content is cleaned to obtain cleaned response content. The classification and grading module identifies and marks the cleaned response content, and determines the classification and grading results of the cleaned response content. The classification and grading results include sensitivity level and type. Control user access permissions; if the permission verification is successful, proceed to the next step. The data desensitization module desensitizes sensitive fields based on classification and grading results and user permissions, generating desensitized data. The gateway input / output module outputs the de-identified data to the target application system.

Images