AI proxy identity management system and method

Abstract

The invention provides an AI agent identity management system and method, a construction module of the system constructs a unique identifier of an AI agent according to a security configuration file set by a user and an operation code of the AI agent bound to the user, and realizes unique binding of the user and the agent, so as to clarify a responsibility subject of an agent behavior and facilitate responsibility investigation; the verification module verifies the identity of an associated operator, so that unauthorized access and control can be avoided; the authorization module stores the set authorization information into the corresponding AI agent after the identity verification is passed, so that the pretending behavior is avoided, and the authorization flexibility can be ensured; and the storage module stores account information of all users and the AI agent in a block chain, so that the binding relationship is published and cannot be tampered, and an information basis is provided for cross-system cooperation. Therefore, a verifiable, traceable and accountable digital identity chain can be constructed for the AI agent, the agent management efficiency is effectively improved, and the security of the agent is ensured.

Description

Technical Field

[0001] This application relates to the fields of data security and management technology, and in particular to an AI agent identity management system and method. Background Technology

[0002] With the rapid development of artificial intelligence technology, AI agents are increasingly being applied in various scenarios, such as autonomous driving, financial transactions, and medical diagnosis. Therefore, ensuring their safety, reliability, and accountability has become crucial. Just as individuals in the real world need ID cards to identify themselves, AI agents also require a unique digital identity (AgentID) to prove their identity, record their behavior, and clearly define their responsible party. This digital identity not only includes the AI ​​agent's basic information but also its authentication credentials, permissions, and behavioral records, facilitating the tracking of all its activities.

[0003] Currently, AI agent identity management faces numerous challenges, such as how to ensure that only authorized users can control and use specific AI agents to prevent malicious users from abusing them, and how to trace the consequences of AI agent actions back to specific individuals or organizations. These issues limit the widespread application and development of AI agent technology. Therefore, designing a secure, reliable, traceable, and accountable AI agent identity management system is crucial. Summary of the Invention

[0004] The main purpose of this application is to provide an AI agent identity management system and method, which can at least solve the problems of insufficient agent identity security and poor traceability of responsibility in related technologies.

[0005] To achieve the above objectives, the first aspect of this application provides an AI agent identity management system, which includes: an identifier construction module, used to construct a unique identifier for the AI ​​agent based on a security configuration file set by a user and the running code of the AI ​​agent bound to the user; wherein the security configuration file includes the user's identity information; an information storage module, used to store the account information of all users and the AI ​​agents to a blockchain; an identity verification module, used to verify the identity information of the operator associated with the target operation instruction when a target operation instruction is received; and an authorization module, used to store the authorization information set by the operator to the associated AI agent when the operator's identity verification is successful.

[0006] A second aspect of this application provides an AI agent identity management method, which includes: constructing a unique identifier for the AI ​​agent based on a security configuration file set by a user and the running code of the AI ​​agent bound to the user; wherein the security configuration file includes the user's identity information; storing the account information of all users and the AI ​​agent in a blockchain; verifying the identity information of the operator associated with the target operation instruction when a target operation instruction is received; and storing the authorization information set by the operator in the associated AI agent when the operator's identity verification is successful.

[0007] As can be seen from the above, according to the AI ​​agent identity management system and method provided in this application, the construction module constructs a unique identifier bound to the AI ​​agent based on the user-set security configuration file and the associated AI agent's running code, achieving a unique binding between the user and the AI ​​agent to clarify the responsible party for the AI ​​agent's behavior and facilitate accountability. The verification module verifies the identity of the operator associated with the target operation instruction upon receiving it, thereby preventing unauthorized access and control. The authorization module stores the user-set authorization information in the AI ​​agent corresponding to that user only after the operator's identity information has been verified, preventing impersonation and allowing for flexible authorization settings. The storage module stores the account information of all users and all AI agents in the system, making the binding relationship between users and their agents public and tamper-proof, and providing an information foundation for cross-system collaboration. Thus, a verifiable, traceable, and accountable digital identity chain can be built for AI agents, effectively improving agent management efficiency and ensuring agent security. Attached Figure Description

[0008] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0009] Figure 1 A schematic diagram of the structure of an AI agent identity management system provided in an embodiment of this application; Figure 2 A flowchart illustrating an information storage module provided in one embodiment of this application; Figure 3 A flowchart illustrating another AI agent identity management system provided in an embodiment of this application; Figure 4 This is a basic flowchart illustrating the AI ​​agent identity management method provided in one embodiment of this application. Detailed Implementation

[0010] To make the inventive objectives, features, and advantages of this application more apparent and understandable, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0011] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of the embodiments of this application, "multiple" means two or more, unless otherwise explicitly specified.

[0012] In related technologies, AI agent identity management faces challenges such as insufficient agent identity security and poor accountability. To address these issues, building a verifiable, traceable, and accountable AI agent identity management system is crucial. The core of this system lies in providing each AI agent with a unique and verifiable digital identity (AgentID), much like a real-world ID card or pass. This identity is used to identify and manage all online attributes and credentials of the agent, including accounts, authentication credentials, certificates, and behavioral records. By binding the Agent ID to the corresponding user ID, the responsible party for the AI ​​agent can be clearly identified, ensuring that the consequences of their actions can be accurately attributed to real-world legal entities.

[0013] One embodiment of this application provides an AI agent identity management system, such as... Figure 1 This is a schematic diagram of the structure of the AI ​​agent identity management system provided in this embodiment. The AI ​​agent identity management system includes an identifier construction module, an information storage module, an identity verification module, and an authorization module; wherein, The identifier construction module is used to construct a unique identifier for the AI ​​agent bound to the user, based on the security configuration file set by the user and the running code of the AI ​​agent bound to the user; wherein, the security configuration file includes the user's identity information; The information storage module is used to store the account information of all users and AI agents on the blockchain; The identity verification module is used to verify the identity information of the operator associated with the target operation instruction when the target operation instruction is received. The authorization module is used to store the authorization information set by the operator to the corresponding AI agent when the operator's identity verification is successful.

[0014] Specifically, in this embodiment, the construction module constructs a unique identifier for the AI ​​agent bound to the user based on the user-defined security configuration file. This security configuration file contains the user's identity information, thus achieving a unique binding between the user and the AI ​​agent, clarifying the responsible party for the AI ​​agent's actions, and facilitating accountability. When the verification module receives a target operation instruction requiring verification, it verifies the identity of the user associated with that instruction. The target operation instruction can be a user-authorized operation instruction or an instruction to determine the next action; this prevents unauthorized access and control. The authorization module stores the user-defined authorization information in the corresponding AI agent only after the user's identity information has been verified, preventing impersonation and allowing for flexible authorization settings. The storage module stores the account information of all users and all AI agents in the system, making the binding relationship between users and their agents public and tamper-proof, and providing an information foundation for cross-system collaboration. Therefore, a verifiable, traceable, and accountable digital identity chain can be built for the AI ​​agent, ensuring the agent's security.

[0015] In some embodiments of this example, the construction module includes a first hash operation unit, a second hash operation unit, and an identifier generation unit; The first hash operation unit is used to perform a hash operation on the user-set security configuration file to obtain the first hash value; The second hash operation unit is used to perform hash operations on the running code of the AI ​​agent bound to the user to obtain the second hash value; The identifier generation unit is used to generate a unique identifier for the AI ​​agent based on the first hash value, the second hash value, and the name of the AI ​​agent.

[0016] Specifically, in this embodiment, the locally binding mechanism between the AI ​​agent and the user aims to give the user complete control over the AI ​​agent while ensuring that the user fulfills their obligation to continuously supervise the AI ​​agent's behavior. Simply put, it allows the AI ​​agent to remember its owner's identity information (such as biometric information) and recognize that it only serves that owner. In subsequent services, the AI ​​agent can also verify the operator's identity; if it is not its owner, the service will be terminated.

[0017] Specifically, a security configuration file (which may also contain other configuration information) can be generated based on the user's identity information. This configuration file is then hashed to obtain a first hash value, which is a string of a certain length. Additionally, the code running on the AI ​​agent to be bound to the user is hashed to obtain a second hash value. Finally, a unique identifier for the AI ​​agent is generated based on the AI ​​agent's name, the first hash value (configuration hash), and the second hash value (code hash). That is, the unique identifier of the AI ​​agent can have the structure (name; code hash; configuration hash). When the code and configuration file change (e.g., fixing code vulnerabilities, adding new features, or the user updating the configuration file), the hash value can be updated to ensure the AI ​​agent's identity remains valid. Therefore, by using the hash value of the AI ​​agent's local code and the hash value of the security configuration file containing the user's identity information as the AI ​​agent's identifier, a unique binding between the user and the AI ​​agent can be achieved.

[0018] Furthermore, in some embodiments of this example, the identifier construction module further includes an identity information acquisition unit, which is used to: generate a biometric template associated with the user based on the biometric authentication module, and use the biometric module as a registration template; generate the user's identity information according to the registration template and the user's unique identifier; wherein the registration module and the user's unique identifier are associated.

[0019] In this embodiment, a Biometric Authentication Module (BAM) can be used to verify a user's identity. BAM identifies a user based on their inherent biometric features (such as facial images, fingerprint patterns, iris textures, etc.). During the registration phase, BAM collects the user's biometric data and generates a biometric template associated with that user using a feature extraction algorithm. The biometric template refers to the digital data extracted and stored from the user's biometric features (such as fingerprints, face, iris, etc.). The generated biometric template serves as the registration template and is bound to the user's unique identifier. This registration module and the user's unique identifier, as the user's identity information, are securely stored in a security configuration file.

[0020] In some embodiments of this example, the information storage module includes a user account generation unit, an AI agent account generation unit, and an information storage unit; The user account generation unit is used to generate a user account based on the user's public key, the user's unique identifier, and the unique identifier of the AI ​​agent bound to the user when the user is authenticated. The AI ​​agent account generation unit is used to generate an AI agent account based on the AI ​​agent's attribute information, communication information, and associated user's account information after the digital signature verification is successful. The attribute information includes the AI ​​agent's unique identifier, and the digital signature is a signature generated by signing the AI ​​agent's attribute information and communication information using the user's private key. The information storage unit is used to store user accounts and AI agent accounts on the blockchain.

[0021] Specifically, in this embodiment, to build an AI agent identity management system that supports publicly queryable user and agent binding relationship declarations and agent discovery services, this embodiment uses blockchain technology as the underlying infrastructure of the identity management system. The transparent, immutable, and decentralized nature of blockchain allows users and agents to create globally unique IDs and guarantees absolute control over those IDs, thereby supporting secure and reliable ID binding.

[0022] For example Figure 2 The flowchart of the information storage module shown illustrates how blockchain smart contracts support user and AI agent account registration and make the binding relationship between users and AI agents public. This embodiment references the ERC-4337 protocol, using the Entrypoint contract (i.e., the entry point contract) as the access point for user interaction with the blockchain system. Once a user is authenticated, this contract creates a user identity contract for that user. The user identity contract is a smart contract used to store information related to the user's identity, including the user's unique identifier, the user's public key (which can be created during registration), and the identity information of the AI ​​agent bound to the user. This user identity contract serves as the user's account in the identity management system. This embodiment uses zkKYC verification to authenticate users. zkKYC verification is a zero-knowledge proof-based authentication process used to protect user privacy during Know Your Customer (KYC) checks. In this process, users can prove their identity information (such as their status as a legal entity) without providing specific private data. After a user passes zkKYC verification, the system can confirm the legitimacy of their identity.

[0023] For the AI ​​agent's account, the system first obtains the user-defined attribute information (including agent identifier) ​​and communication information (including communication protocol and communication address URL) for the AI ​​agent. This information defines the agent's role and function. Then, the system uses the user's private key to sign this information, generating a digital signature. Next, the Entrypoint contract is invoked to transmit the generated attribute information, communication information, digital signature, and the AI ​​agent's owner's identity contract address (i.e., the associated user's account information). The Entrypoint contract verifies the digital signature to check its validity. Once the signature verification is successful, the Entrypoint contract creates an agent identity contract based on the aforementioned information (such as attribute information, communication information, and the AI ​​agent's owner's identity contract address). This contract serves as the AI ​​agent's account in the identity management system. After the user account and agent account are created, they will be stored on a blockchain, such as a distributed ledger, to make the user-agent binding relationship public and prevent tampering and impersonation.

[0024] Furthermore, in some embodiments of this example, the AI ​​agent identity management system further includes an agent discovery module, which is used to: obtain attribute information and communication information of other AI agents in the system; select a target AI agent based on the attribute information and communication information of other AI agents; and send a communication establishment request to the target AI agent.

[0025] Specifically, for example Figure 3 The flowchart of the AI ​​agent identity management system shown in this embodiment uses a local binding mechanism to uniquely bind the agent to its human subject locally. After realizing the security feature that the agent only serves the master, this binding relationship will be made public and tamper-proof through smart contracts in the blockchain, while providing an information basis for agent discovery.

[0026] It should be understood that in multi-agent systems (MAS) and agent-driven AI ecosystems, agent discovery mechanisms are fundamental capabilities for building collaborative networks, enabling task interconnection, and establishing trust relationships. Discovery mechanisms allow agents to identify, locate, and understand the existence, capabilities, and interfaces of other agents, thereby establishing collaborative channels between starting points or groups. This is a prerequisite for achieving task decomposition, capability complementarity, and behavioral coordination.

[0027] The AI ​​agent identity management system in this embodiment provides a unified and reliable agent discovery service for various agent communication protocols such as A2A, MCP, and ACP. Agents can obtain attribute information of agents already registered on the blockchain by initiating query requests to blockchain nodes, such as owner identity information (ID), agent capabilities, roles, communication protocols, and communication address URLs. After filtering these AI agents according to preset filtering rules, a request to establish communication is initiated to the target AI agent's communication address URL according to the format defined by the target AI agent's communication protocol.

[0028] In some embodiments of this example, the identity verification module includes a sending unit, a generating unit, a matching unit, and an identity confirmation unit; The invocation unit is used to invoke the target unique identifier of the operator associated with the target operation instruction when a target operation instruction is received. The generation unit is used to generate a temporary biometric template for the operator based on a preset biometric authentication module. A matching unit is used to match temporary biometric modules with registration modules associated with a target unique identifier; The identity verification unit is used to confirm that the operator's identity has been verified if a match is found.

[0029] Specifically, in this embodiment, when a user needs to log in or authorize or confirm further actions with the bound AI agent, the system identifies the user's unique identifier based on the user's instructions. This identifier is stored in the system during user registration and is bound to the user's registration template. The Biometric Authentication (BAM) module calls a local biometric acquisition device (such as a fingerprint sensor, camera, or iris scanner) to collect the user's biometric features in real time and generates a temporary biometric template. This template is then compared with the registration template stored in the local secure environment to confirm the user's identity. If the match is successful, BAM generates an authentication result and returns authentication information, including the matching status and unique identifier confirmation result, to the corresponding module in the system. If the match fails, a verification failure result is returned, and the system can refuse the user's access and prompt for re-verification. By combining BAM technology to confirm the operator's identity in real time, this embodiment effectively prevents unauthorized access and control, ensuring that the agent only serves its legitimate owner, thereby significantly improving the security of the AI ​​agent.

[0030] Furthermore, in some embodiments of this example, the authentication module further includes a random value generation unit; The random value generation unit is used to generate a random challenge value and send it to the biometric authentication module when a target operation instruction is received. The matching unit is also used to generate an expected response value based on the temporary biometric module and the random challenge value, and to generate a target response value based on the target registration template and the random challenge value, and to match the expected response value with the target response value.

[0031] Specifically, in this embodiment, upon receiving a target operation instruction, the system generates a random challenge value (e.g., a random string or number) and sends this challenge value along with a unique identifier to the local Biometric Authentication Module (BAM). This random challenge value ensures uniqueness for each authentication, preventing replay attacks. For example, a preset algorithm processes the random challenge value and the generated biometric template to obtain a response value (e.g., a hash value), which is then used to determine the operator's physical legitimacy. Based on the target unique identifier associated with the operator, the corresponding registration template can be retrieved. Performing the same operation on the registration template and the random challenge value yields the target response value. By matching the two response values, user authentication is achieved. If the match is successful, the biometric authentication module generates an authentication result and returns authentication information containing the matching status, unique identifier, and random value confirmation result to the corresponding module in the system.

[0032] In some embodiments of this example, the authorization module includes a credential generation unit and a signature unit; The credential generation unit is used to generate verifiable credentials based on the attribute information and runtime environment information of the associated AI agent; wherein, the verifiable credentials include: the unique identifier of the associated AI agent, the unique identifier of the operator, task information and permission information; The signature unit is used to sign the verifiable credential using the operator's private key and store the signed verifiable credential in the associated AI agent.

[0033] Specifically, in this embodiment, authorization is the process by which a user grants permissions to an agent, enabling the agent to access user data, invoke resources, or act on behalf of the user. If the user passes real-person authentication, the AI ​​agent can be finely authorized based on its attributes (such as role and capabilities) and the context information of the current task, avoiding over-configuration of agent permissions and protecting the user's data privacy and account security. Specifically, a verifiable credential is first generated based on the agent's role, capabilities, and the context information of the current task. This credential includes identity information, task information, and permission information. Identity information includes, for example, the agent's unique identifier and the user's unique identifier. Task information includes, for example, the task ID and task definition, which help the system understand the current AI agent's tasks and responsibilities. Permission information specifies the agent's permissions when performing tasks, including security level, scope of authorization, and the validity period of the credential, ensuring that the agent has appropriate permissions during execution. Then, the verifiable credential is signed using the credential owner's private key. This signature guarantees the authenticity and integrity of the credential, and anyone can verify the signature using the corresponding public key. The signed, verifiable credentials will then be securely stored in the associated AI agent for future use.

[0034] In some embodiments of this example, the AI ​​agent identity management system further includes an authorization verification module, which is used to: generate a zero-knowledge proof based on the AI ​​agent's running code and running environment information when receiving an authorization verification request sent by a verifier; and perform authorization verification of the AI ​​agent based on the zero-knowledge proof.

[0035] Specifically, in this embodiment, when the AI ​​agent interacts with a third party, i.e., the verifier, the verifier needs to authenticate the agent's identity and its permissions to establish a foundation of trust. Confirming the agent's identity means verifying whether it truly possesses the declared identifier. Traditional authentication methods rely on digital signature algorithms, using the private key to prove ownership. However, this method has the problem that if the private key is leaked, attackers can impersonate the agent by running other programs. As a software program, the AI ​​agent cannot be physically identified using traditional biometric technologies. Therefore, its identity can be identified by analyzing the code it runs. This embodiment utilizes zkVM (Zero-Knowledge Virtual Machine) to generate zero-knowledge proofs on the agent's locally running code and runtime environment (context information), and uses these zero-knowledge proofs as part of the agent's identity authentication, confirming the agent's true identity without disclosing local privacy data. zkVM is a virtual machine execution environment that combines zero-knowledge proof technology, capable of generating verifiable proofs about the execution process and results while executing code locally. The runtime environment may include, but is not limited to, operating system version, dependency library version, runtime configuration, and other information. With zkVM, an agent can prove that it meets specific conditions (such as running a specific version of code or having a specific software environment) without exposing specific details of its code, data, or environment, thus achieving secure and privacy-preserving verification.

[0036] Based on the technical solution of the above embodiments of this application, the construction module constructs a unique identifier for the AI ​​agent bound to the user, according to the security configuration file set by the user and the running code of the AI ​​agent bound to the user. This achieves a unique binding between the user and the AI ​​agent, clarifying the responsible party for the AI ​​agent's behavior and facilitating accountability. Upon receiving a target operation instruction, the verification module verifies the identity of the operator associated with the instruction, thereby preventing unauthorized access and control. The authorization module stores the user-set authorization information in the AI ​​agent corresponding to that user only after the operator's identity information has been verified, preventing impersonation and allowing for flexible authorization settings. The storage module stores the account information of all users and all AI agents in the system, making the binding relationship between users and their agents public and tamper-proof, and providing an information foundation for cross-system collaboration. Thus, a verifiable, traceable, and accountable digital identity chain can be built for the AI ​​agent, ensuring the agent's security.

[0037] This embodiment also provides an AI agent identity management method, such as Figure 4 The diagram shown illustrates the basic process of an AI agent identity management method. Please refer to [link / reference]. Figure 4The AI ​​agent identity management method includes the following steps: 401. Based on the user-defined security configuration file and the running code of the AI ​​agent bound to the user, construct a unique identifier for the AI ​​agent; 402. Store all user and AI agent account information on the blockchain; 403. When a target operation instruction is received, verify the identity information of the operator associated with the target operation instruction; 404. When the operator's identity is verified, the authorization information set by the operator is stored in the associated AI agent.

[0038] Specifically, in this embodiment, to enable the agent to remember the owner's identity characteristics and initiate identity verification, a unique identifier for the AI ​​agent bound to the user can be constructed based on the user-set security configuration file and the running code of the AI ​​agent bound to the user. This security configuration file contains the user's identity information, thus achieving a unique binding between the user and the AI ​​agent, clarifying the responsible party for the AI ​​agent's actions, and facilitating accountability. Upon receiving a target operation instruction requiring verification, the identity of the user associated with that instruction is verified. The target operation instruction can be an instruction for the user to authorize an operation or an instruction to determine the next action; this prevents unauthorized access and control. Only after the user's identity information is verified can the authorization information set by the user be stored in the AI ​​agent corresponding to that user, preventing risks such as impersonation and unauthorized access. Storing the account information of all users and all AI agents in a blockchain system makes the binding relationship between users and their agents public and tamper-proof, providing an information foundation for cross-system collaboration. Therefore, a verifiable, traceable, and accountable digital identity chain can be built for the AI ​​agent, ensuring the agent's security.

[0039] In the several embodiments provided in this application, it should be understood that the disclosed systems and methods can be implemented in other ways. For example, the system embodiments described above are merely illustrative; for instance, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between systems or modules may be electrical, mechanical, or other forms.

[0040] The modules described as separate components may or may not be physically separate. Similarly, the components shown as modules may or may not be physical modules; they may be located in one place or distributed across multiple network modules. Some or all of the modules can be selected to achieve the purpose of this embodiment, depending on actual needs.

[0041] Furthermore, the functional modules in the various embodiments of this application can be integrated into one processing module, or each module can exist physically separately, or two or more modules can be integrated into one module. The integrated modules described above can be implemented in hardware or as software functional modules.

[0042] If the integrated module is implemented as a software functional module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a readable storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned readable storage medium includes various media capable of storing program code, such as USB flash drives, external hard drives, ROM, RAM, magnetic disks, or optical disks.

[0043] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, as some steps may be performed in other orders or simultaneously according to this application. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to this application.

[0044] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0045] The above is a description of the AI ​​agent identity management system and method provided in this application. For those skilled in the art, based on the ideas of the embodiments of this application, there will be changes in the specific implementation methods and application scope. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. An AI agent identity management system, characterized in that, include: An identifier construction module is used to construct a unique identifier for the AI ​​agent based on a security configuration file set by the user and the running code of the AI ​​agent bound to the user; wherein, the security configuration file includes the user's identity information; An information storage module is used to store the account information of all the users and the AI ​​agent to the blockchain; The identity verification module is used to verify the identity information of the operator associated with the target operation instruction when the target operation instruction is received; The authorization module is used to store the authorization information set by the operator to the associated AI agent when the operator's identity verification is successful.

2. The AI ​​agent identity management system according to claim 1, characterized in that, The identifier construction module includes a first hash operation unit, a second hash operation unit, and an identifier generation unit; The first hash operation unit is used to perform a hash operation on the security configuration file set by the user to obtain a first hash value; The second hash operation unit is used to perform a hash operation on the running code of the AI ​​agent bound to the user to obtain a second hash value; The identifier generation unit is used to generate a unique identifier for the AI ​​agent based on the first hash value, the second hash value, and the name of the AI ​​agent.

3. The AI ​​agent identity management system according to claim 1, characterized in that, The identifier construction module further includes an identity information acquisition unit, which is used for: Based on the biometric authentication module, a biometric template associated with the user is generated, and the biometric module is used as a registration template; The user's identity information is generated based on the registration template and the user's unique identifier; wherein, the registration module is associated with the user's unique identifier.

4. The AI ​​agent identity management system according to claim 1, characterized in that, The information storage module includes a user account generation unit, an AI agent account generation unit, and an information storage unit. The user account generation unit is used to generate a user account based on the user's public key, the user's unique identifier, and the unique identifier of the AI ​​agent bound to the user when the user passes authentication. The AI ​​agent account generation unit is used to generate an AI agent account based on the AI ​​agent's attribute information, communication information, and associated user's account information when the target digital signature verification is successful; wherein, the attribute information includes the AI ​​agent's unique identifier; and the target digital signature is a signature generated by signing the AI ​​agent's attribute information and communication information using the private key corresponding to the bound user. The information storage unit is used to store the user account and the AI ​​agent account to the blockchain.

5. The AI ​​agent identity management system according to claim 4, characterized in that, It also includes a proxy discovery module, which is used for: Obtain the attribute information and communication information of the other AI agents in the blockchain; Based on the attribute and communication information of the remaining AI agents, a target AI agent is selected; Send a communication establishment request to the target AI agent.

6. The AI ​​agent identity management system according to claim 1, characterized in that, The identity verification module includes a calling unit, a generation unit, a matching unit, and an identity confirmation unit; The invocation unit is used to invoke the target unique identifier of the operator associated with the target operation instruction when a target operation instruction is received. The generation unit is used to generate a temporary biometric module for the operator based on a preset biometric authentication module. The matching unit is used to match the temporary biometric module with the target registration module associated with the target unique identifier; The identity verification unit is used to determine that the operator's identity verification is successful if a match is found.

7. The AI ​​agent identity management system according to claim 6, characterized in that, The authentication module also includes a random value generation unit; The random value generation unit is used to generate a random challenge value and send it to the biometric authentication module when a target operation instruction is received. The matching unit is further configured to generate an expected response value based on the temporary biometric module and the random challenge value, and to generate a target response value based on the target registration template and the random challenge value, and to match the expected response value with the target response value.

8. The AI ​​agent identity management system according to claim 1, characterized in that, The authorization module includes a credential generation unit and a signature unit; The credential generation unit is used to generate verifiable credentials based on the attribute information and runtime environment information of the associated AI agent; wherein, the verifiable credentials include the unique identifier of the associated AI agent, the unique identifier of the operator, task information, and permission information; The signing unit is used to sign the verifiable credential using the private key corresponding to the operator, and to store the signed verifiable credential to the associated AI agent.

9. The AI ​​agent identity management system according to claim 1, characterized in that, It also includes a permission verification module, which is used for: When a permission verification request is received, a zero-knowledge proof is generated based on the running code and runtime environment information of the AI ​​agent; Based on the zero-knowledge proof, the AI ​​agent's permissions are verified.

10. An AI agent identity management method, characterized in that, include: Based on the user-defined security configuration file and the running code of the AI ​​agent bound to the user, a unique identifier for the AI ​​agent is constructed; wherein, the security configuration file includes the user's identity information; Store the account information of all users and the AI ​​agent in the blockchain; When a target operation instruction is received, the identity information of the operator associated with the target operation instruction is verified; When the operator's identity is verified, the authorization information set by the operator is stored in the associated AI agent.

Images