Sensitive information leakage detection method and device, storage medium and equipment

Abstract

The embodiment of the invention discloses a sensitive information leakage detection method, which comprises the following steps: deploying a section program in an MCP client in advance, a tangent point being a code used for sending a parameter of a calling tool to an MCP server in the MCP client, when the MCP client operates the code in response to a tool calling request sent by an LLM, triggering the tangent point, and calling the pre-deployed section program, and through the aspect program, intercepting a parameter which is sent to the MCP server and is used for calling a tool, and carrying out sensitive information detection on the parameter. Through the method, whether the sensitive information is leaked as the parameter of the calling tool when the MCP client calls the tool provided by the MCP server can be effectively detected, so that the safety of calling the tool provided by the MCP server by the MCP client can be improved.

Description

Technical Field

[0001] This specification relates to the field of computer technology, and in particular to a method, apparatus, storage medium and device for detecting the leakage of sensitive information. Background Technology

[0002] With the development of artificial intelligence (AI) technology, large language models (LLM) have been widely used in various fields.

[0003] Through LLM, users can obtain various information and knowledge as if communicating with real people. In particular, generative LLM can also help users generate images and computer code, greatly simplifying the tedious operations required by users in their daily life and work.

[0004] However, for some questions raised by users, relying solely on the LLM's own reasoning capabilities is insufficient. This necessitates invoking external tools to assist in resolving the user's questions. To facilitate unified invocation of various external tools, the Model Context Protocol (MCP) was developed. MCP clients can simultaneously establish an interaction channel between the user and the LLM and invoke tools provided by various external MCP servers to assist the LLM in providing services to the user.

[0005] However, in scenarios where the MCP client interacts with the LLM and calls tools provided by the MCP server, how to detect the risk of the MCP client leaking sensitive information as parameters when calling the tools is an urgent problem to be solved. Summary of the Invention

[0006] This specification provides a method, apparatus, storage medium, and electronic device for detecting the leakage of sensitive information, in order to partially solve the problems existing in the prior art.

[0007] The embodiments in this specification adopt the following technical solutions:

[0008] This specification provides a method for detecting sensitive information leakage. The method is applied to a Model Context Protocol (MCP) client, and an aspect-oriented program is pre-deployed in the MCP client. The pointcut of the aspect-oriented program is the code in the MCP client used to send parameters for invoking a tool to the MCP server. The method includes:

[0009] Obtain the user's input command and send the input command to the Large Language Model (LLM);

[0010] Receive the tool invocation request returned by the LLM after performing semantic analysis on the input instruction;

[0011] Based on the tool call request, the code is executed, and in response to the triggering of the code execution, the pre-deployed aspect program is invoked;

[0012] The segmentation procedure intercepts parameters to be sent to the MCP server and performs sensitive information detection on the parameters.

[0013] This specification provides a sensitive information leakage detection device. The device is applied to a Model Context Protocol (MCP) client. An aspect-oriented programming language is pre-deployed in the device, and the pointcut of the aspect-oriented language is the code within the device used to send parameters for invoking tools to the MCP server. The device includes:

[0014] The interaction module is used to acquire user input commands and send the input commands to the Large Language Model (LLM).

[0015] The receiving module is used to receive the tool invocation request returned by the LLM after performing semantic analysis on the input instruction;

[0016] The calling module is used to run the code according to the tool calling request, and to call the pre-deployed aspect program in response to the triggering of running the code;

[0017] The detection module is used to intercept parameters to be sent to the MCP server through the segmentation program, and to perform sensitive information detection on the parameters.

[0018] This specification provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the aforementioned method for detecting the leakage of sensitive information.

[0019] This specification provides an electronic device including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, it implements the aforementioned method for detecting the leakage of sensitive information.

[0020] The above-described at least one technical solution adopted in the embodiments of this specification can achieve the following beneficial effects:

[0021] This specification discloses a method for detecting sensitive information leakage. An aspect program is pre-deployed in the MCP client, with the pointcut being the code in the MCP client used to send parameters for calling tools to the MCP server. When the MCP client runs this code in response to a tool call request sent by the LLM, the pointcut is triggered, invoking the pre-deployed aspect program. This aspect program intercepts the parameters to be sent to the MCP server for tool call and performs sensitive information detection on these parameters. This method effectively detects whether the MCP client will leak sensitive information as parameters when calling tools provided by the MCP server, thereby improving the security of MCP client calls to tools provided by the MCP server. Attached Figure Description

[0022] The accompanying drawings, which are included to provide a further understanding of this specification and form part of this specification, illustrate exemplary embodiments and are used to explain this specification, but do not constitute an undue limitation thereof. In the drawings:

[0023] Figure 1 This specification provides a schematic diagram of a system architecture for an MCP client to call external tools, as illustrated in an embodiment.

[0024] Figure 2 This is a flowchart illustrating a method for detecting the leakage of sensitive information provided in an embodiment of this specification.

[0025] Figure 3 A schematic diagram of a sensitive information leakage detection device provided in the embodiments of this specification;

[0026] Figure 4 This is a schematic diagram of the structure of the electronic device provided in the embodiments of this specification. Detailed Implementation

[0027] To make the objectives, technical solutions, and advantages of this specification clearer, the technical solutions of this specification will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this specification, and not all of them. Based on the embodiments in this specification, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this specification.

[0028] The technical solutions provided in the various embodiments of this specification are described in detail below with reference to the accompanying drawings.

[0029] Figure 1 This is a schematic diagram of a system architecture for an MCP client to call an external tool, provided as an embodiment of this specification. The system specifically includes: an MCP client, an MCP server, and an LLM. Wherein:

[0030] The MCP client is user-facing and can be deployed on user devices (such as personal computers, mobile phones, tablets, etc.) to provide users with a channel for interaction between the user and the LLM.

[0031] Each MCP server is typically deployed in a remote backend, such as on a backend server, to provide various available tools to MCP clients. These available tools provided by the MCP server are external tools, relative to the MCP client and LLM.

[0032] An LLM can be deployed either on the user device (where it's also deployed) or on a backend server. When deployed on a backend server, it can be deployed on the same backend server as any MCP server, or it can be deployed separately on a different backend server. This LLM is pre-trained and can interact with the user through one or more of the following methods: text, voice, and visual communication.

[0033] In practical applications, the MCP client can receive input commands directly from users through one or more forms such as text, voice, and vision, such as "What's the weather like today?". The MCP client then sends this input command to the LLM, which executes it. If the LLM finds that its own reasoning ability is insufficient to execute the input command, it returns a tool invocation request to the MCP client, informing the client that executing the input command requires calling an external tool. Upon receiving this request, the MCP client obtains a list of available tools provided by each MCP server. This list includes the tool identifiers and descriptions of each available tool. The MCP client sends this list to the LLM, which, based on the descriptions of the available tools and the user's input command, determines the tool identifier of the available tool (hereinafter referred to as the target tool) to execute the input command. The LLM then returns this tool identifier to the MCP client, enabling the MCP client to invoke the target tool corresponding to the tool identifier and execute the input command through the target tool.

[0034] However, when LLM sends the tool identifier of the target tool to the MCP client to invoke the target tool, it also determines the parameters required for the MCP client to invoke the target tool based on the target tool's description information. LLM then instructs the MCP client to send these parameters to the MCP server that provided the client, so that the target tool can be invoked based on these parameters. Thus, if an attacker adds attack instructions to the description information, causing LLM to identify sensitive information that should not be used as a parameter for invoking the target tool, the MCP client will leak this sensitive information.

[0035] To detect potential sensitive information leakage, this embodiment pre-deploys an aspect program in the MCP client. The pointcut is the code in the MCP client used to send parameters for calling the tool to the MCP server. Once the MCP client executes this code to send the tool parameters to the MCP server, the aforementioned aspect program is triggered. This aspect program can temporarily intercept the parameters to be sent to the MCP server and perform sensitive information detection on these parameters to determine whether the MCP client will leak sensitive information. Figure 2 As shown.

[0036] Figure 2 A flowchart of a sensitive information leakage detection method provided in the embodiments of this specification is included, specifically comprising the following steps:

[0037] S200: Obtain the user's input command and send the input command to the Large Language Model (LLM).

[0038] In the embodiments described in this specification, such as Figure 2 The method shown can be applied to MCP clients, specifically to electronic devices where the MCP client resides, such as personal computers, mobile phones, tablets, servers, or server clusters consisting of multiple servers.

[0039] Users can directly input one or more forms of input commands, such as text, voice, and vision, into the MCP client. After receiving the input command, the MCP client can send the input command to the LLM.

[0040] S202: Receive the tool call request returned by the LLM after performing semantic analysis on the input instruction.

[0041] Generally, after receiving the input command, the LLM can perform semantic analysis on the user's input command based on its own reasoning ability, and generate response information based on the analysis results as the execution result of the input command. However, if the LLM determines, based on the above analysis results, that it cannot generate the response information corresponding to the input command using only its own reasoning ability, it determines that executing the input command requires calling an external tool. Therefore, the LLM returns a tool call request to the MCP client.

[0042] After receiving the tool invocation request, the MCP client can obtain the description information of each available tool provided by each MCP server and send the obtained description information of each available tool to the LLM. The LLM then determines the target tool to execute the user's input command based on the semantics of the user's input command and the description information of each available tool. Based on the description information of the target tool, the LLM determines the parameters required for the MCP client to invoke the target tool and returns the identifier of the target tool and the parameter information corresponding to the parameters required to invoke the target tool in an instruction message to the MCP client.

[0043] In this specification, the descriptive information of the available tools described in the embodiments is information used to describe the functions of the available tools in natural language. This descriptive information is written into the MCP server by the developers of the available tools in the form of comments or the like when developing the available tools.

[0044] S204: Based on the tool call request, run the code, and in response to the triggering of running the code, call the pre-deployed aspect program.

[0045] After receiving the above instruction message, the MCP client responds by running pre-written code to send the parameters corresponding to the above parameter information to the MCP server that provides the target tool. By running this code, the client sends the parameters required to invoke the target tool to the MCP server that provides the target tool.

[0046] Since the aspect program is pre-deployed with the above code as the point of entry in the embodiments of this specification, the MCP client will trigger the invocation of the aspect program once it runs the above code.

[0047] During initialization, the MCP client can first load the aspect base corresponding to the aspect program. The aspect base contains the aspect program and the pointcut corresponding to the aspect program. Through the aspect base, the MCP client can deploy the aspect program accordingly, so that once the above code is run, the aspect program will be triggered to run.

[0048] S206: The sectioning procedure intercepts the parameters to be sent to the MCP server and performs sensitive information detection on the parameters.

[0049] In the embodiments of this specification, since it is not yet known whether the parameters to be sent by the MCP client to the MCP server (hereinafter referred to as the target server) that provides the target tool contain sensitive information, the MCP client can first intercept the parameters to be sent to the MCP server by running the aspect program, that is, temporarily prevent the MCP from sending parameters to the target server, and perform sensitive information detection on the parameters to be sent.

[0050] When performing sensitive information detection on the parameters to be sent, MCP can use the aforementioned aspect procedure to call a pre-trained detection model, input the parameters to be sent into the detection model, and use the detection model to detect whether the parameters to be sent contain sensitive information and the type of sensitive information contained therein.

[0051] The detection model can be deployed on the same electronic device as the MCP client, or on other devices, as long as the aspect ratio program can call the detection model to detect sensitive information in the parameters to be sent.

[0052] In order for the above detection model to accurately detect whether the parameters to be sent contain sensitive information, the detection model needs to be trained in advance in the embodiments of this specification.

[0053] When training the detection model, sample parameters can be obtained. These parameters include positive and negative sample parameters. Positive sample parameters do not contain sensitive information, while negative sample parameters contain at least one type of sensitive information. After obtaining the sample parameters, they can be input into the detection model to be trained. The model detects the sensitive information contained in the sample parameters and the type of sensitive information contained therein. Based on the detection results and annotations of the sample parameters, the model parameters of the detection model are adjusted. The annotation of the sample parameters indicates whether they contain sensitive information and the type of sensitive information contained therein.

[0054] To balance detection efficiency, the aforementioned detection model can be a lightweight machine learning model, rather than a heavyweight model such as an LLM. The device used to train the detection model can be the same device as the MCP client, or other electronic devices; this specification does not impose any restrictions.

[0055] In addition to using a lightweight detection model to check for sensitive information in the parameters to be sent, the MCP client can also use this aspect-oriented programming (AOP) program to obtain pre-configured regular expressions corresponding to sensitive information types. For each type of sensitive information, the client uses the corresponding regular expression to check if the parameters to be sent contain that type of sensitive information. If so, it can be directly determined that the parameters to be sent contain sensitive information of that type. The regular expression can contain keywords corresponding to the sensitive information of each type.

[0056] The whitelist and regular expressions mentioned above can be pre-configured in the aspect base and loaded directly by the MCP client during initialization.

[0057] Regardless of the method used to detect whether the parameters to be sent contain sensitive information and the type of sensitive information contained therein, once the MCP client detects that the parameters to be sent contain sensitive information of at least one type, it determines the target tool to be invoked and the target server providing the target tool, and obtains a pre-configured whitelist. For each type of sensitive information contained in the parameters to be sent, it determines whether there is a correspondence between the target tool, the target server, and the sensitive information of that type contained in the parameters to be sent in the whitelist.

[0058] If it is included, it means that although the parameter to be sent contains sensitive information of this type, the sensitive information of this type is indeed a necessary parameter for calling the target tool; if it is not included, it means that the sensitive information of this type contained in the parameter to be sent is not a necessary parameter for calling the target tool. If the sensitive information of this type is sent as a parameter to the target server, it will cause the leakage of sensitive information.

[0059] Therefore, if all sensitive information types contained in the parameters to be sent are necessary for calling the target tool, or if the parameters to be sent do not contain any sensitive information, the aspect program can allow the MCP client to send the parameters to the target server, i.e., it will no longer intercept the MCP client from sending the parameters to the target server, allowing the MCP client to send the parameters normally to the target server to call the target tool provided by the target server based on the parameters. However, if the parameters to be sent contain sensitive information that is not necessary for calling the target tool, the aspect program can cause the MCP client to directly refuse to send the parameters to the MCP server, thereby refusing to call the target tool.

[0060] Furthermore, when the parameters to be sent contain sensitive information that is not necessary for calling the target tool, it indicates that at least one of the target tool, its description information, or the target server providing the target tool may be under attack. Therefore, the MCP client can also identify the target tool as a risky tool and perform risk control processing according to preset risk control strategies. The risk control strategies described in this specification include at least one of the following: recording risk logs based on the sensitive information contained in the detected parameters, generating alarm information based on the sensitive information contained in the detected parameters, and blocking connections with the MCP server providing the risky tool.

[0061] Furthermore, the information types of sensitive information described in the embodiments of this specification may include, but are not limited to, personally identifiable information (PII) and key information.

[0062] The sensitive information of the PII type includes one or a combination of the following:

[0063] Basic information: Name, ID card number, passport number, social security number, driver's license number;

[0064] Biometrics: fingerprints, facial recognition data, iris scans, voiceprints;

[0065] Official records include: registered address, marital status, and academic certificate number.

[0066] Contact information: mobile phone number, email address, home address, IP address;

[0067] Online behavior: social media accounts, cookie data, device IMEI / MAC address;

[0068] Other data: medical records (such as medical record number, visit time), financial information (such as bank card number, transaction records), occupational information (such as company, position, employee number), and whereabouts (such as GPS location data).

[0069] Sensitive information related to the key type refers to any data stored in the electronic device where the MCP client resides, which is classified as a key or password, such as the contents of the / etc / passwd file.

[0070] The above method can effectively detect whether the MCP client will leak sensitive information as a parameter when calling tools provided by the MCP server, thereby improving the security of the MCP client calling tools provided by the MCP server.

[0071] The above is an example of a method for detecting the leakage of sensitive information provided in this specification. Based on the same idea, this specification also provides corresponding devices, storage media and electronic devices.

[0072] Figure 3 This is a schematic diagram of a sensitive information leakage detection device provided in an embodiment of this specification. The device is applied to a Model Context Protocol (MCP) client, and an aspect program is pre-deployed in the device. The pointcut of the aspect program is the code in the device used to send parameters for calling the tool to the MCP server. The device includes:

[0073] Interaction module 301 is used to acquire user input commands and send the input commands to the Large Language Model (LLM).

[0074] The receiving module 302 is used to receive the tool invocation request returned by the LLM after performing semantic analysis on the input instruction;

[0075] The calling module 303 is used to run the code according to the tool calling request, and in response to the triggering of running the code, to call the pre-deployed aspect program;

[0076] The detection module 304 is used to intercept parameters to be sent to the MCP server through the slicing program, and to perform sensitive information detection on the parameters.

[0077] Optionally, the detection module 304 is specifically used to call a pre-trained detection model through the sectioning procedure; and to detect the sensitive information contained in the parameters and the information type of the sensitive information contained therein through the detection model.

[0078] Optionally, the detection module 304 is specifically used to obtain, through the aspect ratio program, regular expressions corresponding to sensitive information of each information type that are pre-configured; and for each type of sensitive information, using the regular expression to detect whether the parameter contains sensitive information of that type.

[0079] Optionally, the detection module 304 is further configured to, when detecting that the parameters contain sensitive information of at least one type of information, determine the target tool to be invoked and the MCP server providing the target tool; determine whether there is a correspondence between the target tool to be invoked, the MCP server providing the target tool, and all sensitive information of all types of information contained in the parameters in a pre-configured whitelist; if so, send the parameters to the MCP server to invoke the target tool provided by the MCP server according to the parameters; otherwise, refuse to send the parameters to the MCP server to refuse to invoke the target tool.

[0080] Optionally, the detection module 304 is further configured to, when at least some of the corresponding relationships do not exist in the whitelist, identify the target tool as a risk tool and perform risk control processing according to a preset risk control strategy; wherein the risk control strategy includes at least one of the following: recording risk logs based on sensitive information contained in the detected parameters, generating alarm information based on sensitive information contained in the detected parameters, and blocking the connection with the MCP server that provides the risk tool.

[0081] Optionally, the device further includes:

[0082] The training module 305 is used to acquire sample parameters, which include positive sample parameters and negative sample parameters. The positive sample parameters do not contain sensitive information, and the negative sample parameters contain sensitive information of at least one type. The sample parameters are input into a detection model to be trained, and the detection model to be trained detects the sensitive information contained in the sample parameters and the type of sensitive information contained therein. Based on the detection results of the detection model to be trained on the sample parameters and the annotation of the sample parameters, the model parameters of the detection model to be trained are adjusted.

[0083] Optionally, the information type includes personally identifiable information (PII) type and / or key type.

[0084] This specification also provides a computer-readable storage medium storing a computer program that, when executed by a processor, can be used to perform the aforementioned method for detecting the leakage of sensitive information.

[0085] based on Figure 2 The method for detecting the leakage of sensitive information shown in this specification also provides embodiments that provide... Figure 4 The diagram shows the structure of the electronic device. Figure 4 At the hardware level, the electronic device includes a processor, internal bus, network interface, memory, and non-volatile storage, and may also include other hardware required for business operations. The processor reads the corresponding computer program from the non-volatile storage into memory and then runs it to implement the aforementioned method for detecting sensitive information leakage.

[0086] The above description is merely an embodiment of this specification and is not intended to limit this specification. Various modifications and variations can be made to this specification by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this specification should be included within the scope of the claims of this specification.

Claims

1. A method for detecting sensitive information leakage, the method being applied to a Model Context Protocol (MCP) client, wherein an aspect program is pre-deployed in the MCP client, the pointcut of which is the code in the MCP client used to send parameters for invoking a tool to the MCP server; the method comprising: Obtain the user's input command and send the input command to the Large Language Model (LLM); Receive the tool invocation request returned by the LLM after performing semantic analysis on the input instruction; Based on the tool call request, the code is executed, and in response to the triggering of the code execution, the pre-deployed aspect program is invoked; The segmentation procedure intercepts parameters to be sent to the MCP server and performs sensitive information detection on the parameters.

2. The method as described in claim 1, wherein sensitive information detection is performed on the parameter, specifically including: The segmentation procedure calls a pre-trained detection model; The detection model is used to detect the sensitive information contained in the parameters and the type of information contained in the sensitive information.

3. The method as described in claim 1, wherein sensitive information detection is performed on the parameter, specifically including: The aspect ratio procedure is used to obtain the regular expressions corresponding to the sensitive information of each information type that are pre-configured. For each type of sensitive information, a regular expression is used to detect whether the parameter contains sensitive information of that type.

4. The method as described in claim 2 or 3, further comprising: When the parameters are found to contain sensitive information of at least one type, the target tool to be invoked and the MCP server providing the target tool are determined. Determine whether the target tool to be invoked, the MCP server providing the target tool, and the correspondence between all sensitive information types contained in the parameters exist in the pre-configured whitelist; If so, the parameters are sent to the MCP server to invoke the target tool provided by the MCP server according to the parameters; Otherwise, the parameters are refused to be sent to the MCP server in order to refuse to invoke the target tool.

5. The method of claim 4, wherein when at least some of the corresponding relationships do not exist in the whitelist, the method further comprises: The target tool is identified as a risk tool, and risk control measures are implemented according to a preset risk control strategy. The risk control strategy includes at least one of the following: recording risk logs based on sensitive information contained in the detected parameters, generating alarm information based on sensitive information contained in the detected parameters, and blocking connections with the MCP server that provides risk tools.

6. The method as described in claim 2, wherein pre-training the detection model specifically includes: Obtain sample parameters, which include positive sample parameters and negative sample parameters. The positive sample parameters do not contain sensitive information, while the negative sample parameters contain sensitive information of at least one type. The sample parameters are input into the detection model to be trained, and the sensitive information contained in the sample parameters and the information type of the sensitive information are detected by the detection model to be trained. Based on the detection results of the detection model to be trained on the sample parameters and the annotation of the sample parameters, the model parameters of the detection model to be trained are adjusted.

7. The method as described in claim 2 or 3, wherein the information type includes personally identifiable information (PII) type and / or key type.

8. A sensitive information leakage detection device, the device being applied to a Model Context Protocol (MCP) client, wherein an aspect program is pre-deployed in the device, the pointcut of which is code in the device used to send parameters for invoking a tool to an MCP server; the device comprises: The interaction module is used to acquire user input commands and send the input commands to the Large Language Model (LLM). The receiving module is used to receive the tool invocation request returned by the LLM after performing semantic analysis on the input instruction; The calling module is used to run the code according to the tool calling request, and to call the pre-deployed aspect program in response to the triggering of running the code; The detection module is used to intercept parameters to be sent to the MCP server through the segmentation program, and to perform sensitive information detection on the parameters.

9. A computer-readable storage medium storing a computer program that, when executed by a processor, implements the method described in any one of claims 1-7.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method described in any one of claims 1-7.

Images