Task request response method and device, electronic equipment, storage medium and program

Abstract

The invention provides a task request response method and device, electronic equipment, a storage medium and a program. A specific embodiment of the method comprises the following steps: in response to a received task request, determining at least one subtask corresponding to the task request; searching a target service correspondingly matched with each sub-task from the plurality of services; verifying whether the task request has a security authority corresponding to execution of each sub-task; and in response to determining that the security authority for executing any subtask exists, calling and executing a corresponding matched target service to respond to the task request. According to the embodiment, the received task can be intelligently processed.

Description

Technical Field

[0001] Embodiments of this application relate to the technical field of artificial intelligence, and in particular to a task request response method, apparatus, electronic device, storage medium, and program. Background Technology

[0002] With the rapid development of artificial intelligence technology, AI agents can understand users' task intentions through interaction and complete corresponding tasks, such as starting and stopping services, configuring networks, and retrieving documents.

[0003] However, in practice, when faced with more complex task intentions, AI agents often struggle to accurately understand and execute the corresponding tasks. At the same time, current AI agents lack the ability to closely integrate task execution with overall security control during the execution process. Therefore, current AI agents have significant limitations in managing tasks and are unable to autonomously and effectively control tasks from multiple perspectives. Summary of the Invention

[0004] In view of this, embodiments of the present disclosure provide a task request response method, apparatus, electronic device, storage medium, and program.

[0005] In a first aspect, embodiments of this disclosure provide a task request response method, the method comprising:

[0006] In response to receiving a task request, at least one subtask corresponding to the task request is determined;

[0007] Find the target service that matches each subtask from multiple services;

[0008] Verify whether the task request has the security permissions to execute each subtask;

[0009] In response to determining that the user has the security permission to execute any subtask, the user invokes and executes the corresponding matching target service in response to the task request.

[0010] In some alternative implementations, the task request includes natural language instructions; accordingly, in response to receiving the task request, at least one subtask corresponding to the task request is determined, including:

[0011] In response to receiving the natural language instruction, the natural language instruction is identified to obtain a structured representation of the task description information;

[0012] The task description information is decomposed into at least one structured subtask.

[0013] In some optional implementations, the target service corresponding to each subtask is searched from multiple services, including:

[0014] According to the pre-set logical order of each subtask, the target task category corresponding to each subtask is determined sequentially from multiple pre-set task categories;

[0015] Find the target service category that matches each target task category from multiple service categories;

[0016] For each subtask, select the service instance with the highest matching degree from the service instances of the corresponding target service category, and use it as the corresponding target service.

[0017] In some optional implementations, each subtask refers to at least one operation action and one operation object; security permissions include access permissions, operation permissions, and data permissions; correspondingly, verifying whether the task request has the security permissions corresponding to each subtask includes:

[0018] For each subtask, verify whether the task request has access permissions to the corresponding operation object;

[0019] In response to having the corresponding access permissions, verify whether the task request has the operation permission to perform the corresponding operation action;

[0020] In response to having the corresponding operation permissions, determine whether the subtask points to preset sensitive data;

[0021] In response to a subtask pointing to the sensitive data, and the task request having data permissions to access the sensitive data, it is determined that the task request has the corresponding security permissions.

[0022] In some optional implementations, after verifying whether the task request has the security permissions to execute each subtask, the following steps may be further performed:

[0023] In response to the determination that the task request does not have the security permission to execute any subtask, the corresponding matching target service is refused to be invoked.

[0024] In some optional implementations, the corresponding matching target service is invoked and executed, including:

[0025] In response to the execution of the target service, a complete snapshot is created and saved, wherein the complete snapshot represents the complete data of the corresponding subtask at the time of creation;

[0026] Create and save complete snapshots at each preset first time point during the execution of the target service;

[0027] During the execution of the target service, at each preset second time node, an incremental snapshot is created and saved. The incremental snapshot represents the change data of the corresponding subtask relative to the previous complete snapshot at the time of creation.

[0028] The number of the first time nodes is less than the number of the second time nodes.

[0029] In some alternative implementations, after creating and saving a full snapshot in response to the execution of starting the target service, the following steps may be further performed:

[0030] Monitor the execution of each target service for any anomalies;

[0031] In response to the determination that any target service has encountered an execution exception and has a complete snapshot and / or incremental snapshot, data recovery is performed on the corresponding subtask based on the data represented by the previous complete snapshot or the data represented by the previous incremental snapshot.

[0032] Secondly, embodiments of this disclosure provide a task request response apparatus, the apparatus comprising:

[0033] The task determination module is configured to determine at least one subtask corresponding to the task request in response to receiving a task request.

[0034] The service determination module is configured to search for the target service that matches each subtask from multiple services.

[0035] The permission verification module is configured to verify whether the task request has the security permissions to execute each subtask.

[0036] The service invocation module is configured to invoke and execute the corresponding target service in response to determining that it has the security permission to execute any subtask, in response to the task request.

[0037] In some optional implementations, the task request includes natural language instructions; accordingly, the task determination module is further configured to:

[0038] In response to receiving the natural language instruction, the natural language instruction is identified to obtain a structured representation of the task description information;

[0039] The task description information is decomposed into at least one structured subtask.

[0040] In some optional implementations, the service determination module is further configured to:

[0041] According to the pre-set logical order of each subtask, the target task category corresponding to each subtask is determined sequentially from multiple pre-set task categories;

[0042] Find the target service category that matches each target task category from multiple service categories;

[0043] For each subtask, select the service instance with the highest matching degree from the service instances of the corresponding target service category, and use it as the corresponding target service.

[0044] In some optional implementations, each subtask refers to at least one operation action and one operation object; security permissions include access permissions, operation permissions, and data permissions; accordingly, the permission verification module is further configured as follows:

[0045] For each subtask, verify whether the task request has access permissions to the corresponding operation object;

[0046] In response to having the corresponding access permissions, verify whether the task request has the operation permission to perform the corresponding operation action;

[0047] In response to having the corresponding operation permissions, determine whether the subtask points to preset sensitive data;

[0048] In response to a subtask pointing to the sensitive data, and the task request having data permissions to access the sensitive data, it is determined that the task request has the corresponding security permissions.

[0049] In some optional implementations, the service invocation module is further configured as follows:

[0050] In response to the determination that the task request does not have the security permission to execute any subtask, the corresponding matching target service is refused to be invoked.

[0051] In some optional implementations, the service invocation module is further configured as follows:

[0052] In response to the execution of the target service, a complete snapshot is created and saved, wherein the complete snapshot represents the complete data of the corresponding subtask at the time of creation;

[0053] Create and save complete snapshots at each preset first time point during the execution of the target service;

[0054] During the execution of the target service, at each preset second time node, an incremental snapshot is created and saved. The incremental snapshot represents the change data of the corresponding subtask relative to the previous complete snapshot at the time of creation.

[0055] The number of the first time nodes is less than the number of the second time nodes.

[0056] After the service invocation module creates and saves a complete snapshot in response to the execution of starting the target service, it further performs the following operations:

[0057] Monitor the execution of each target service for any anomalies;

[0058] In response to the determination that any target service has encountered an execution exception and has a complete snapshot and / or incremental snapshot, data recovery is performed on the corresponding subtask based on the data represented by the previous complete snapshot or the data represented by the previous incremental snapshot.

[0059] Thirdly, embodiments of this disclosure provide an electronic device, including: one or more processors; and a storage device having one or more programs stored thereon, which, when executed by the one or more processors, cause the one or more processors to implement the method described in any implementation of the first aspect.

[0060] Fourthly, embodiments of this disclosure provide a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by one or more processors, implements the method as described in any implementation of the first aspect.

[0061] Fifthly, embodiments of this disclosure provide a computer program product, including a computer program / instructions that, when executed by a processor, implement the method described in any of the implementations of the first aspect.

[0062] To address the limitations of artificial intelligence agents in effectively controlling various aspects of tasks autonomously, the embodiments of this disclosure provide a task request response method, apparatus, electronic device, storage medium, and program. By having the intelligent agent decompose a received task request into one or more sub-tasks, the intelligent agent implementing this method avoids directly executing complex tasks. Instead, it addresses the difficulty in accurately understanding and executing complex tasks by executing multiple sub-tasks. Based on the identified sub-tasks, the intelligent agent can more conveniently determine the corresponding matching target service. Compared to directly matching target services to complex tasks, matching target services to sub-tasks is more efficient. This increases accuracy and reduces the probability of errors. After matching the corresponding target service, before calling the target service, the agent verifies whether the task request has the security permissions to execute each subtask, thus preventing unauthorized task requests. Since each subtask is clear and simple, verifying security permissions is more efficient than verifying complex tasks. When the task request has the security permissions to execute any subtask, calling the corresponding target service can respond to the task request. In particular, calling the target service after verifying security permissions tightly integrates the execution of the target service with overall security, enabling effective and autonomous control over each subtask. Attached Figure Description

[0063] Other features, objects, and advantages of this disclosure will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings. The drawings are for illustrative purposes only and are not intended to limit the invention. In the drawings:

[0064] Figure 1 This is an exemplary system architecture diagram to which one embodiment of this disclosure may be applied;

[0065] Figure 2 This is an architecture diagram of the task request and response framework 200 according to this disclosure;

[0066] Figure 3 A flowchart of one embodiment of the task request response method according to this disclosure;

[0067] Figure 4 This is an exploded flowchart of one embodiment of step 302 according to the present disclosure;

[0068] Figure 5A This is an exploded flowchart of one embodiment of step 303 according to the present disclosure;

[0069] Figure 5BThis is a schematic diagram of the operation of the security control layer 240 according to this disclosure;

[0070] Figure 6 This is a breakdown flowchart of an embodiment of invoking and executing the target service according to step 304 of this disclosure;

[0071] Figure 7 This is a schematic diagram of the structure of one embodiment of the task request response apparatus according to the present disclosure;

[0072] Figure 8 A schematic diagram of the structure of a computer system suitable for implementing embodiments of the present disclosure. Detailed Implementation

[0073] The present disclosure will now be described in further detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and not intended to limit it. Furthermore, it should be noted that, for ease of description, only the parts relevant to the invention are shown in the accompanying drawings.

[0074] It should be noted that, unless otherwise specified, the embodiments and features described in this disclosure can be combined with each other. This disclosure will now be described in detail with reference to the accompanying drawings and embodiments.

[0075] Figure 1 An exemplary system architecture 100 is shown, in which embodiments of the task request response method, apparatus, electronic device, storage medium, and program of this disclosure can be applied.

[0076] like Figure 1 As shown, system architecture 100 may include terminal devices 101, 102, and 103, a network 104, and a server 105. Network 104 serves as the medium for providing communication links between terminal devices 101, 102, and 103 and server 105. Network 104 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0077] Users can use terminal devices 101, 102, and 103 to interact with server 105 via network 104 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 101, 102, and 103, such as natural language processing applications, large model applications, speech recognition applications, short video social applications, audio and video conferencing applications, web browser applications, shopping applications, search applications, instant messaging tools, email clients, social platform software, etc.

[0078] Terminal devices 101, 102, and 103 can be either hardware or software. When terminal devices 101, 102, and 103 are hardware, they can be various electronic devices with sound acquisition devices (e.g., microphones), video acquisition devices (e.g., cameras), and displays, including but not limited to smartphones, tablets, e-book readers, MP3 players (Moving Picture Experts Group Audio Layer III), MP4 players (Moving Picture Experts Group Audio Layer IV), laptops, and desktop computers, etc. When terminal devices 101, 102, and 103 are software, they can be installed on the terminal devices listed above. They can be implemented as multiple software programs or software modules (e.g., services related to providing task request responses) or as a single software program or software module. No specific limitations are imposed here.

[0079] In some cases, the task request and response method provided in this disclosure can be executed by terminal devices 101, 102, and 103, and correspondingly, the task request and response device can be set in terminal devices 101, 102, and 103. In this case, system architecture 100 may not include server 105.

[0080] In some cases, the task request response method provided in this disclosure can be jointly executed by terminal devices 101, 102, and 103 and server 105. For example, the step of "determining at least one subtask corresponding to the task request in response to receiving a task request" can be executed by terminal devices 101, 102, and 103, and the step of "searching for target services that match each subtask from multiple services" can be executed by server 105. This disclosure does not limit this. Accordingly, the task request response device can also be respectively set in terminal devices 101, 102, and 103 and server 105.

[0081] In some cases, the task request and response method provided in this disclosure can be executed by server 105. Accordingly, the task request and response device can also be set in server 105. In this case, system architecture 100 may not include terminal devices 101, 102, and 103.

[0082] It should be noted that server 105 can be either hardware or software. When server 105 is hardware, it can be implemented as a distributed server cluster consisting of multiple servers, or as a single server. When server 105 is software, it can be implemented as multiple software programs or software modules (e.g., used to provide distributed services), or as a single software program or software module. No specific limitations are made here.

[0083] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0084] It should be noted that the task request and response method disclosed herein is deployed on Figure 1 This is achieved through intelligent agents in terminal devices 101, 102, 103 and / or server 105.

[0085] refer to Figure 2 The diagram illustrates an architecture of one embodiment of the task request response framework 200 of this disclosure.

[0086] The task request and response framework 200 can serve as an agent implementing this method, including an agent client framework 210, an agent routing layer 220, an MCP server cluster (Model Context Protocol Server cluster, module coding toolkit service cluster) 230, a security control layer 240, and a user interface layer 250.

[0087] like Figure 2 As shown, the intelligent agent client framework 210 includes a knowledge manager 211, a dialogue manager 212, a task manager 213, a state monitor 214, and a checkpoint manager 215; the intelligent agent routing layer 220 includes an intent recognizer 221, a routing decision maker 222, and an instruction converter 223; the MCP server cluster 230 includes a document operation server (application service) 231, a network operation server 232, a system tool server 233, and a tool registry 234; the security control layer 240 includes an access controller 241, a behavior auditor 242, an audit log 243, and a privacy filter 244.

[0088] Furthermore, during the operation of the task request and response framework 200, it can also connect to other external application services or interfaces to process the current task through other external services or programs; for example, the task request and response framework 200 can connect to its external OpenAI API (Open Artificial Intelligence Application Programming Interface) 260, as well as other LLM (Large Language Model) services 270.

[0089] The user interface layer 250 is used to interact with the user, thereby obtaining the user's task request and sending the task request to the intelligent agent Client framework 210.

[0090] The intelligent agent client framework 210 is used to understand the task request before the task request response framework 200 responds to the task request, convert it into a task intent or task instruction that the electronic device can recognize, that is, a structured representation of task description information, and send the task intent or task instruction to the intelligent agent routing layer 220. After the task request response framework 200 responds to the task request, it monitors and records the currently executed task.

[0091] The intelligent agent routing layer 220 is used to identify the received task intent or task instruction and select the corresponding service for it.

[0092] The security control layer 240 is used to perform security verification on the verification task intent or task instruction before executing the selected service.

[0093] The MCP Server cluster 230 integrates multiple services for the intelligent agent router layer 220 to call, thereby enabling responses to task intents or task instructions.

[0094] Continue to refer to Figure 3 The flowchart 200 of an embodiment of the task request and response method of this disclosure is shown. Figure 2 The task request and response framework 200 in the system executes the following steps:

[0095] Step 301: In response to receiving a task request, determine at least one subtask corresponding to the task request.

[0096] The task request is issued by the user and may be a natural language instruction in the form of voice or text, such as a natural language expression, and is received by the user interface layer 250 in the task request response framework 200.

[0097] After receiving a task request, the user interface layer 250 can send it to the intelligent agent client framework 210, which will then recognize the task request and convert the user's natural language instructions into task intents or task instructions that the electronic device running the intelligent agent client framework 210 can understand. For example, the task intents or task instructions can be task description information in a structured representation that can be recognized by the computer device.

[0098] Based on this, the intelligent agent client framework 210 can determine one or more subtasks corresponding to the task request according to the task description information.

[0099] In some alternative implementations, with Figure 2 Taking the task request and response framework 200 in the client framework as an example, the dialogue manager 212 in the client framework 210 can receive natural language instructions from the user interface layer 250. In some cases, the dialogue manager 212 can also directly receive natural language instructions issued by the user.

[0100] Furthermore, the dialogue manager 212 can send the obtained natural language commands to the task manager 213, and the task manager 213 can process the natural language commands.

[0101] Specifically, the task manager 213 can call the knowledge manager 211 in the agent client framework 210, the OpenAI API 260 outside the task management framework, and / or other LLM services 270 to process natural language.

[0102] The knowledge manager 211 stores knowledge related to various tasks and can manage and retrieve this knowledge, thereby providing data support for the task manager 213 to assist the task manager 213 in processing natural language commands.

[0103] In some cases, the knowledge manager 211 may store, for example, system knowledge bases, domain knowledge bases, and context knowledge bases.

[0104] In this embodiment, the knowledge bases in the knowledge manager 211 can be divided into different layers. By storing data in layers, the retrieval efficiency and management complexity of various knowledge can be optimized, and it helps to more clearly distinguish the stability and application scope of different types of knowledge.

[0105] The system knowledge base can be a foundational layer, including stable and general information about the underlying operating system and core tools, such as system-specific configurations, common system error codes and their meanings, and basic system information.

[0106] The domain knowledge base is another data layer, which can include knowledge related to the application scenarios or preset workflows of the intelligent agent client framework 210, such as the best solution for executing preset tasks, solutions to common problems, application configuration specifications, user-defined processes and user-defined terminology, etc. Based on this, the domain knowledge base can help the intelligent agent client framework 210 not only handle task requests, but also understand the business background of each subtask pointed to by the task request.

[0107] The context knowledge base is a dynamic layer that stores temporary information related to the current interaction session, including, for example, the current dialogue history, user preferences inferred from previous user interactions, intermediate results of the currently executing subtask, and information that needs to be temporarily obtained. Based on this, the context knowledge base ensures that the intelligent agent Client framework 210 can remember the previous dialogue content and adjust subsequent operations accordingly, making its operations coherent and personalized.

[0108] The Intelligent Agent Client Framework 210 can periodically check and update the system knowledge base and domain knowledge base, or trigger update operations as needed; for the context knowledge base, it can capture and update in real time during the interaction.

[0109] In addition, in some cases, the knowledge manager 211 can also call external knowledge sources to update the knowledge in various knowledge bases.

[0110] Based on this, when the Task Manager 213 receives a natural language instruction, if the natural language instruction is ambiguous or unclear, for example, a file deletion instruction that does not specify the specific object to be deleted but only gives a general request for deletion, the Task Manager 213 can call other LLM services 270 or its internal pre-trained LLM model to perform multiple rounds of interaction and context analysis, thereby obtaining the accurate task intent or task instruction.

[0111] Based on the aforementioned knowledge manager 211, during the process of task manager 213 processing natural language instructions, knowledge manager 211 can assist task manager 213 in better understanding the intent of natural language instructions, thereby obtaining more accurate task intent or task instructions; and during the process of task manager 213 decomposing the structured representation of task intent or task instructions, knowledge manager 211 can assist task manager 213 in planning more reasonable sub-tasks.

[0112] In addition, during the process of responding to the task request described below, the Knowledge Manager 211 can also provide the MCP Server cluster 230 with necessary parameters, such as configuration parameters and / or environment parameters.

[0113] Based on this, in cases of complex task description information, such as a task request to update a configuration file and restart a service, Task Manager 213 can break down the complex task description information into logically independent subtasks by calling the knowledge base in the Knowledge Manager, and analyze the dependencies between these subtasks. For example, the service related to the configuration file must be stopped before the configuration file can be updated, and then the service can be restarted.

[0114] Therefore, for each of the subtasks obtained from the decomposition, the task manager 213 can prioritize them, for example, according to logical relationships, and form them into a task sequence that represents the order of each subtask, so that each subtask can be processed in an orderly manner in the following steps.

[0115] In other cases, where the task description information is simple, such as when a configuration file is deleted, Task Manager 213 may not break down the task description information and treat it directly as a subtask.

[0116] Step 302: Find the target service that matches each subtask from multiple services.

[0117] Based on the subtasks determined by the task manager 213 in step 301 above, the task manager 213 can send each subtask to the agent routing layer 220, and the agent routing layer 220 can further parse each subtask to convert the structured subtasks into a programming language that the corresponding target service can recognize and understand.

[0118] Furthermore, from multiple services in the MCP Server cluster 230, a target service that can be used to execute the subtask is matched for each subtask.

[0119] Specifically, the process of matching the target service for each subtask in step 302 may include the following: Figure 4 Steps 401 to 403 are shown.

[0120] Step 303: Verify whether the task request has the security permissions to execute each subtask.

[0121] Based on the target service identified in step 302 above, it is also necessary to verify whether the current task request has the necessary security permissions before calling and executing the target service.

[0122] Specifically, since each subtask is a structured representation of a task intent or task instruction, each subtask points to an operation action that the task request response framework 200 needs to perform, as well as the operation object when performing that operation action.

[0123] Therefore, verifying security permissions can be specifically defined as: for each subtask that the task request actually needs to perform, whether the task request has the security permissions related to the specific operation action and the operation object when executing the subtask.

[0124] Specifically, security permissions may include, for example, access permissions to the corresponding operation object, operation permissions to perform the corresponding operation actions, and data permissions when the subtask involves sensitive data or privacy data.

[0125] Based on the different permissions mentioned above, a policy library can also be set up in the security control layer 240, and the configuration and rules for verifying each permission can be pre-set in the policy library to ensure the consistency and manageability of security permission verification.

[0126] Accordingly, when the security control layer 240 obtains the sub-tasks of the task request and the target service corresponding to each sub-task, it can call the policy library to verify the permissions of each sub-task.

[0127] For each subtask, once all permissions have been verified, it can be determined that the subtask has the security permission to call the corresponding target service; if the subtask fails to pass the verification of any one or more permissions, it can be considered that the subtask does not have the security permission to call the corresponding target service.

[0128] If each subtask has the necessary security permissions, it can be determined that the current task request has the necessary security permissions to execute each subtask.

[0129] Specifically, the verification of security permissions for each subtask in step 303 may include steps 501 to 504 as shown in Figure 5 below.

[0130] Furthermore, the security control layer 240 can send the verification result of the task request to the instruction converter 223 in the agent routing layer 220, so that the instruction converter 223 can call the target service corresponding to each subtask through the following step 304.

[0131] In some optional implementations, if any one or more subtasks of the task request do not have the security permission to call the corresponding target service, the security control layer 240 will also send the verification result of the task request to the instruction converter 223 in the agent routing layer 220. The instruction converter 223 will refuse to call the corresponding target service for the subtasks that do not have the security permission.

[0132] Accordingly, the security control layer 240 constructs a trustworthy operating environment through security permission verification, ensuring that all operations are carried out within an authorized and controllable scope.

[0133] Step 304: In response to determining that the user has the security permission to execute any subtask, the user invokes and executes the corresponding matching target service in response to the task request.

[0134] Based on the verification results of step 303 above, if the current task request has the security permission to execute each subtask, the instruction converter 223 can call the corresponding target service from the MCP Server cluster 230 and start the execution of the target service. After calling and executing the corresponding target service in sequence according to the task sequence, the response to the task request can be realized.

[0135] During the execution of any target service, the data of the corresponding subtasks will change as the target service is executed. If there is an exception or the target service cannot be executed, the data of the corresponding subtasks will also show corresponding errors.

[0136] Based on this, the intelligent agent Client framework 210 can be used to continuously record and monitor the relevant data of the corresponding subtasks when the target service is executed. In the event that the target service is abnormal or cannot be executed, the most recent normal state of the target service in time can be determined, and the relevant data of the subtasks recorded and monitored at that time can be determined. Then, the data of the subtasks can be restored to the data when the subtasks were in the most recent normal state.

[0137] Therefore, it is possible to avoid consuming a lot of resources to re-respond to the corresponding subtask when the target service is abnormal or unable to execute.

[0138] Specifically, the process of executing the target service in step 304 may include the following: Figure 6 Steps 601 to 604 are shown.

[0139] By breaking down received task requests into one or more subtasks using an intelligent agent, the agent can avoid directly executing complex tasks. Instead, it can solve the problem of accurately understanding and executing complex tasks by executing multiple subtasks. Based on the identified subtasks, the agent can more easily determine the corresponding target service. Compared to directly matching target services for complex tasks, matching target services for subtasks is more accurate and reduces the probability of errors. After matching the corresponding target service, before calling the target service, the agent verifies whether the task request has the security permissions to execute each subtask, thus preventing unauthorized requests. Since each subtask is clear and simple, verifying security permissions is more efficient than verifying complex tasks. Once the task request has the security permissions to execute any subtask, calling the corresponding target service enables a response to the task request. Especially after verifying security permissions, calling the target service tightly integrates the execution of the target service with overall security, achieving effective and multi-faceted autonomous control over each subtask.

[0140] Continue to refer to Figure 4 The diagram illustrates a decomposition process 400 of one embodiment of step 302 of this disclosure. This decomposition process 400 includes the following steps 401 to 403:

[0141] Step 401: According to the preset logical order of each subtask, determine the target task category corresponding to each subtask sequentially from multiple preset task categories.

[0142] The task categories can be, for example, system management operation tasks, file system operation tasks, and / or network configuration tasks.

[0143] Based on the task sequence of each subtask determined in step 301 above, the corresponding matching operation can be performed on each subtask one by one according to the order of each subtask.

[0144] In this step, the intent recognizer 221 in the intelligent agent router 220 can receive the task sequence sent by the task manager 213. Since each subtask in the task sequence is a structured representation of an intent instruction or task instruction, the intelligent agent router 220 can identify whether the intent of the subtask is still ambiguous or unclear.

[0145] If the intent of each subtask remains ambiguous or unclear, the intent recognizer 221 can report this to the dialogue manager 212, and the dialogue manager 212 and task manager 213 can conduct multiple rounds of interaction and context analysis with the user to obtain the accurate task intent or task instruction.

[0146] For subtasks whose intent is unambiguous or unclear, based on the predefined intent category, i.e., the subtask category, the intent recognizer 221 can sequentially determine the task category corresponding to each subtask in the logical order of the subtasks in the task sequence, and take it as the target task category corresponding to the subtask, and send the determined target task category to the routing decision-maker 222.

[0147] Step 402: Find the target service category that matches each target task category from multiple service categories.

[0148] Based on the target task category determined in step 401 above, the routing decision maker 222 can search for target service categories with the ability to perform such tasks from the pre-set tool registry 234.

[0149] The tool registry 234 contains records of multiple different service paths and service categories.

[0150] Step 403: For each subtask, select the service instance with the highest matching degree from the service instances of the corresponding target service category, and use it as the corresponding target service.

[0151] Based on the target service category found in step 402 above, the routing decision maker 222 can evaluate all currently available instances belonging to that target service category, that is, each server in the MCP Server cluster 230.

[0152] Specifically, the routing decision maker 222 can comprehensively evaluate the health status, historical performance, cost factors, preset routing policies and user preferences of each server, and comprehensively match the most suitable server at the moment, and use it as the target service for the corresponding subtask.

[0153] As can be seen, in this embodiment, the intelligent agent router 220 can intelligently identify each sub-task through the intent recognizer 221. While avoiding misunderstanding of task requests, the routing decision-maker 222 can automatically match the appropriate target service, which greatly improves the efficiency of task request response.

[0154] Continue to refer to Figure 5AThe diagram illustrates a decomposition process 500 of one embodiment of step 303 of this disclosure. This decomposition process 500 includes the following steps 501 to 504:

[0155] Step 501: For each subtask, verify whether the task request has the access permission to access the corresponding operation object.

[0156] Based on the sub-tasks identified in the preceding steps, for each sub-task, its access permissions, operation permissions, and data permissions can be verified sequentially.

[0157] refer to Figure 5B It shows a schematic diagram of the operation of the security control layer 240 of this disclosure.

[0158] like Figure 5B As shown, after the security control layer 240 receives each subtask of the task request, it first processes each subtask of the task request through the access controller 241.

[0159] Access permissions are verified based on the access controller 241 configured in the security control layer 240.

[0160] Specifically, as mentioned above, the policy library centrally stores configurations and rules related to verifying security permissions, including access control rules used to verify access permissions.

[0161] Accordingly, the access controller 241 can retrieve relevant access control rules from the policy library and verify access permissions based on the access control rules.

[0162] Step 502: In response to having the corresponding access permissions, verify whether the task request has the operation permission to perform the corresponding operation action.

[0163] Based on the access permission verification in step 501 above, such as Figure 5B As shown, further verification of operation permissions can only be performed if the access permission verification is passed.

[0164] Specifically, the access controller 241 can send the result of the access permission verification to the behavior auditor 242. After receiving the verification result, the behavior auditor 242 can start the verification of operation permissions.

[0165] Specifically, the policy library also includes audit rules for verifying operation permissions.

[0166] Accordingly, the behavior auditor 242 can retrieve relevant audit rules from the policy library and verify operation permissions according to the audit rules.

[0167] In this embodiment, different levels can be set for different operation actions, and different permission requirements can be set for different levels. For example, the operation of reading a file can be set to a low level and no permission requirement can be set accordingly; the operation of modifying configuration can be set to a medium level and medium permission requirement can be set accordingly; and the operation of deleting a file can be set to a high level and highest permission requirement can be set accordingly.

[0168] In some optional implementations, the audit log 243 set in the security control layer 240 can record in detail the various operation actions verified by the behavior auditor 242, and can be used to analyze and detect them when needed later.

[0169] Step 503: In response to having the corresponding operation permissions, determine whether the subtask points to preset sensitive data.

[0170] Based on the access permission verification in step 501 above, such as Figure 5B As shown, data permission verification can only be performed after the operation permission verification has been passed.

[0171] Specifically, the behavior auditor 242 can send the result of the operation permission verification to the privacy filter 244. After the privacy filter 244 receives the verification result, it can start the verification of data permissions.

[0172] During this process, the privacy filter 244 can first determine whether the target service corresponding to the subtask involves sensitive data or privacy data during the expected execution process, that is, whether the operation action and operation object pointed to by the subtask involve sensitive data or privacy data.

[0173] If it does not involve sensitive or private data, then the subtask can be considered to have the corresponding security permissions.

[0174] Step 504: In response to the subtask pointing to the sensitive data and the task request having data permission to access the sensitive data, determine that the task request has the corresponding security permission.

[0175] Based on the judgment in step 503 above, if it is determined that the operation action or operation object of the subtask involves sensitive data or privacy data, then the privacy filter 244 needs to verify its data permissions.

[0176] Specifically, the security control layer 240 also stores sensitive data rules used to verify data permissions.

[0177] Accordingly, privacy filter 244 can retrieve relevant sensitive data rules and verify data permissions based on those sensitive data rules.

[0178] If a subtask involving sensitive or private data passes data permission verification, the task request is considered to have the security permissions corresponding to that subtask. If the task request has the security permissions corresponding to all subtasks, the task request is considered to have passed security permission verification and can further call the target service in MCP Server cluster 230.

[0179] It should be noted that the policy library and sensitive data rules in Figure 5 can also be set outside the security control layer 240 to reduce the storage overhead of the security control layer 240, or set outside the task request response framework 200 to reduce the storage overhead of the task request response framework 200.

[0180] Based on the multi-layered permission verification method set in the security control layer 240 in this embodiment, it means that the verification of security permissions does not rely on a single permission, but rather completes the overall security permission verification by deploying a series of complementary and progressive permission verification mechanisms. This ensures that even if the permission verification of a certain layer is bypassed or fails, other permission verification layers can still provide effective protection, thereby greatly improving the security of the task request response framework 200.

[0181] Continue to refer to Figure 6 The diagram illustrates a decomposition process 600 of one embodiment of step 304 of this disclosure. This decomposition process 600 includes the following steps 601 to 602:

[0182] Step 601: In response to starting the execution of the target service, create and save a complete snapshot, wherein the complete snapshot represents the complete data of the corresponding subtask at the time of creation.

[0183] Based on the target service invoked and executed in step 304 above, when the target service starts... Figure 2 The checkpoint manager 215 of the Intelligent Agent Client framework 210 can create and save a complete snapshot of the data of the corresponding subtask.

[0184] Among them, the complete snapshot is the full picture of the data of the corresponding subtask based on the execution status of the target service at the time the snapshot is created.

[0185] Step 602: Create and save complete snapshots at each preset first time point during the execution of the target service.

[0186] Furthermore, the expected completion time of key stages in the execution of the target service can be used as the first time node, and a complete snapshot can be created and saved at each first time node as the target service is executed.

[0187] This allows you to add a timestamp of the snapshot's creation date and the corresponding subtask's tag to each complete snapshot, making it easy and quick to retrieve each complete snapshot.

[0188] Step 603: During the execution of the target service, at each preset second time node, create and save an incremental snapshot. The incremental snapshot represents the change data of the corresponding subtask relative to the previous complete snapshot at the time of creation.

[0189] Based on the complete snapshot created in steps 601 above, multiple second time nodes can be set between the creation times of two adjacent complete snapshots, and an incremental snapshot can be created and saved at each second time node.

[0190] Incremental snapshots do not save the complete state of the entire task, but only record the data and state information that have changed since the last complete snapshot. This allows for tracking of variable states or modified data blocks. Compared to frequently creating complete snapshots, incremental snapshots significantly reduce the time and storage space required for each save operation, enabling the task request response framework 200 to create different snapshots more frequently. This reduces the time required to backtrack when restoring data and decreases the data loss window caused by failures.

[0191] In this embodiment, the number of first time nodes is less than the number of second time nodes, thereby making the number of incremental snapshots greater than the number of complete snapshots.

[0192] Specifically, for example, 10 incremental snapshots can be created between every two adjacent full snapshots.

[0193] In some optional implementations, the status monitor 214 in the intelligent agent Client framework 210 of the task request response framework 200 can monitor the execution status of each target service in real time. When any target service experiences an abnormality or failure in execution, it is considered that the status of its corresponding subtask is abnormal.

[0194] Specifically, pre-defined components such as real-time monitors, performance analyzers, and anomaly detectors can be used to continuously track the execution progress, resource usage, and system performance metrics of the target service. These monitored system performance metrics can include, for example, CPU utilization (representing the processor resource consumption of the monitored target service), memory usage (representing the memory usage of the target service during execution), execution progress (representing the current status and completion percentage of subtasks), response time (representing the time interval between a request and a response from a subtask), and error rate (representing the number and type of errors that occur in the target service corresponding to a subtask during execution).

[0195] Furthermore, when an abnormal state of a subtask is detected, a preset automatic isolation mechanism can be triggered.

[0196] The automatic isolation mechanism is used to quickly contain threats and prevent them from spreading further or causing deeper damage to the system. For example, it can remove the target service from the optional services of the agent router 220 and / or prevent new task requests from being sent to the target service.

[0197] At the same time, when the state of a subtask is abnormal, its data is also incorrect. Therefore, it is necessary to restore or rebuild the task data of the subtask.

[0198] During the recovery or reconstruction process, based on the full snapshot and incremental snapshot created above, the closest snapshot in time is first found according to the subtask ID and timestamp of the subtask with the abnormal state. This snapshot may be a full snapshot or an incremental snapshot.

[0199] Based on this, Task Manager can load the data from the snapshot, thereby reconstructing the relevant data and context data of the subtask at the time point of the snapshot.

[0200] If the snapshot is an incremental snapshot, it can start loading from the complete snapshot that is closest to the time of the incremental snapshot, and then load each incremental snapshot after the complete snapshot in sequence, so that the data of the subtask can be restored to the data as close as possible to the time before the abnormal state.

[0201] Based on this, this embodiment combines full snapshots and incremental snapshots to effectively save data while saving storage overhead. The checkpoint manager 215 saves the relevant data of the important stage by creating a full snapshot only at the first time node after the important stage is completed, and saves storage overhead by creating an incremental snapshot at the second time node. Based on the full snapshot and incremental snapshot, the status monitor 214 can directly call the full snapshot and / or incremental snapshot that is closest in time when it detects an anomaly in the target service, thereby avoiding the resources consumed by directly re-executing the full subtask.

[0202] Further reference Figure 7 As an implementation of the methods shown in the above figures, this disclosure provides an embodiment of a task request response device, which is similar to... Figure 2 Corresponding to the method embodiments shown, this device can be specifically applied to various electronic devices.

[0203] like Figure 7 As shown, the task request response device 700 of this embodiment includes:

[0204] The task determination module 701 is configured to determine at least one subtask corresponding to the task request in response to receiving a task request.

[0205] Service determination module 702 is configured to search for the target service that matches each subtask from multiple services.

[0206] The permission verification module 703 is configured to verify whether the task request has the security permissions to execute each subtask.

[0207] Service invocation module 704 is configured to invoke and execute the corresponding matching target service in response to determining that it has the security permission to execute any subtask, in response to the task request.

[0208] In some alternative implementations, the task request includes natural language instructions; accordingly, the task determination module 701 is further configured to:

[0209] In response to receiving the natural language instruction, the natural language instruction is identified to obtain a structured representation of the task description information;

[0210] The task description information is decomposed into at least one structured subtask.

[0211] In some alternative implementations, the service determination module 702 is further configured to:

[0212] According to the pre-set logical order of each subtask, the target task category corresponding to each subtask is determined sequentially from multiple pre-set task categories;

[0213] Find the target service category that matches each target task category from multiple service categories;

[0214] For each subtask, select the service instance with the highest matching degree from the service instances of the corresponding target service category, and use it as the corresponding target service.

[0215] In some optional implementations, each subtask refers to at least one operation action and one operation object; security permissions include access permissions, operation permissions, and data permissions; accordingly, the permission verification module 703 is further configured to:

[0216] For each subtask, verify whether the task request has access permissions to the corresponding operation object;

[0217] In response to having the corresponding access permissions, verify whether the task request has the operation permission to perform the corresponding operation action;

[0218] In response to having the corresponding operation permissions, determine whether the subtask points to preset sensitive data;

[0219] In response to a subtask pointing to the sensitive data, and the task request having data permissions to access the sensitive data, it is determined that the task request has the corresponding security permissions.

[0220] In some optional implementations, the service invocation module 704 is further configured to:

[0221] In response to the determination that the task request does not have the security permission to execute any subtask, the corresponding matching target service is refused to be invoked.

[0222] In some optional implementations, the service invocation module 704 is further configured to:

[0223] In response to the execution of the target service, a complete snapshot is created and saved, wherein the complete snapshot represents the complete data of the corresponding subtask at the time of creation;

[0224] Create and save complete snapshots at each preset first time point during the execution of the target service;

[0225] During the execution of the target service, at each preset second time node, an incremental snapshot is created and saved. The incremental snapshot represents the change data of the corresponding subtask relative to the previous complete snapshot at the time of creation.

[0226] The number of the first time nodes is less than the number of the second time nodes.

[0227] And after the service invocation module 704 creates and saves a complete snapshot in response to the execution of starting the target service, it further performs the following operations:

[0228] Monitor the execution of each target service for any anomalies;

[0229] In response to the determination that any target service has encountered an execution exception and has a complete snapshot and / or incremental snapshot, data recovery is performed on the corresponding subtask based on the data represented by the previous complete snapshot or the data represented by the previous incremental snapshot.

[0230] It should be noted that the implementation details and technical effects of each unit in the task request response device provided in the embodiments of this disclosure can be referred to the descriptions of other embodiments in this disclosure, and will not be repeated here.

[0231] The following is for reference. Figure 8 It shows a schematic diagram of the structure of a computer system 800 suitable for implementing the electronic device of the present disclosure. Figure 8 The computer system 800 shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments of this disclosure.

[0232] like Figure 8As shown, the computer system 800 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 801, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 802 or a program loaded from a storage device 808 into a random access memory (RAM) 803. The RAM 803 also stores various programs and data required for the operation of the computer system 800. The processing device 801, ROM 802, and RAM 803 are interconnected via a bus 804. An input / output (I / O) interface 805 is also connected to the bus 804.

[0233] Typically, the following devices can be connected to I / O interface 805: input devices 806 including, for example, touchscreens, touchpads, keyboards, mice, cameras, microphones, etc.; output devices 807 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 808 including, for example, magnetic tapes, hard disks, etc.; and communication devices 809. Communication device 809 allows computer system 800 to communicate wirelessly or wiredly with other devices to exchange data. Although Figure 8 A computer system 800 with various electronic devices is shown; however, it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed alternatively.

[0234] In particular, according to embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device 809, or installed from a storage device 808, or installed from a ROM 802. When the computer program is executed by a processing device 801, it performs the functions defined in the methods of embodiments of this disclosure.

[0235] It should be noted that the computer-readable medium described in this disclosure can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this disclosure, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in connection with an instruction execution system, apparatus, or device. In this disclosure, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium can be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wires, optical fibers, RF (radio frequency), etc., or any suitable combination thereof.

[0236] The aforementioned computer-readable medium may be included in the aforementioned electronic device; or it may exist independently and not assembled into the electronic device.

[0237] The aforementioned computer-readable medium carries one or more programs, which, when executed by the electronic device, cause the electronic device to perform the following functions: Figure 2 The illustrated embodiments and their alternative implementations demonstrate a task request response method.

[0238] Computer program code for performing the operations of this disclosure can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0239] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0240] The units or modules described in the embodiments of this disclosure can be implemented in software or hardware. The names of the units or modules do not necessarily limit the unit itself; for example, a task determination module can also be described as "in response to receiving a task request, determining at least one subtask corresponding to the task request."

[0241] The above description is merely a preferred embodiment of this disclosure and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of this disclosure is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-described concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features disclosed in this disclosure that have similar functions.

Claims

1. A method for responding to a task request, comprising: in response to receiving a task request, determining at least one subtask corresponding to the task request; finding a target service respectively corresponding to each subtask from a plurality of services; verifying whether the task request has a security permission for executing each subtask; in response to determining that the task request has a security permission for executing any subtask, invoking and executing the corresponding target service to respond to the task request.

2. The method of claim 1, wherein, The task request comprises a natural language instruction. The response to receiving a task request, determining at least one subtask corresponding to the task request, comprises: in response to receiving the natural language instruction, identifying the natural language instruction to obtain structured task description information; decomposing the task description information into at least one structured subtask.

3. The method of claim 1, wherein, The finding a target service respectively corresponding to each subtask from a plurality of services comprises: determining a target task category corresponding to each subtask in turn from a plurality of preset task categories according to a preset logical order of each subtask; finding a target service category respectively corresponding to each target task category from a plurality of service categories; for each subtask, selecting a service instance with the highest matching degree from each service instance of the corresponding target service category as the corresponding target service.

4. The method of claim 1, wherein, Each subtask points to at least one operation action and one operation object. The security permission comprises access permission, operation permission and data permission. The verification of whether the task request has a security permission for executing each subtask comprises: for each subtask, verifying whether the task request has an access permission for accessing the corresponding operation object; in response to having the corresponding access permission, verifying whether the task request has an operation permission for executing the corresponding operation action; in response to having the corresponding operation permission, judging whether the subtask points to a preset sensitive data; in response to the subtask pointing to the sensitive data and the task request having a data permission for accessing the sensitive data, determining that the task request has the corresponding security permission.

5. The method of claim 1, wherein, After the verification of whether the task request has a security permission for executing each subtask, the method further comprises: in response to determining that the task request does not have a security permission for executing any subtask, refusing to invoke the corresponding target service.

6. The method of claim 1, wherein, The invoking and executing the corresponding target service comprises: in response to starting the execution of the target service, creating and saving a complete snapshot, the complete snapshot representing complete data of the corresponding subtask at the time of creation; at each first time node preset during the execution of the target service, creating and saving a complete snapshot; at each second time node preset during the execution of the target service, creating and saving an incremental snapshot, the incremental snapshot representing changed data of the corresponding subtask relative to the previous complete snapshot at the time of creation; wherein the number of the first time nodes is less than the number of the second time nodes.

7. The method of claim 6, wherein, After the response to starting the execution of the target service, creating and saving a complete snapshot, the method further comprises: monitoring whether the execution of each target service is abnormal. In response to determining that any target service has an execution exception and has a complete snapshot and / or an incremental snapshot, data recovery is performed on the corresponding subtask according to data indicated by the previous complete snapshot or data indicated by the previous incremental snapshot.

8. A task request response apparatus, comprising: a task determination module configured to determine at least one subtask corresponding to a task request in response to receiving the task request; a service determination module configured to find a target service respectively corresponding to each subtask from a plurality of services; a permission verification module configured to verify whether the task request has a security permission for executing each subtask; a service calling module configured to call and execute the corresponding target service in response to determining that the security permission for executing any subtask is available, so as to respond to the task request.

9. An electronic device, comprising: one or more processors; a storage device having one or more programs stored thereon, when the one or more programs are executed by the one or more processors, the one or more processors implement the task request response method of any one of claims 1-7.

10. A computer readable storage medium having stored thereon a computer program, wherein, The computer program is executed by one or more processors to implement the task request response method of any one of claims 1-7.

11. A computer program product comprising computer program instructions, wherein, The computer program instructions run on a computer to cause the computer to perform the task request response method of any one of claims 1-7.

Images