Database encryption methods, devices, and systems based on large-scale multi-agent collaboration

Abstract

This application provides a database encryption method, device, and system based on large-scale model multi-agent collaboration. By setting up a data request control agent and an encryption / decryption execution agent, the data request control agent, upon receiving a database operation request, determines the operation request type and the operation request object. If it determines that the operation request object has an encryption strategy, it sends an encryption / decryption processing request for the operation request object to the encryption / decryption execution agent based on the operation request type. The encryption / decryption execution agent, based on a reinforcement learning algorithm, determines the optimal resource scheduling scheme from multiple candidate resource scheduling schemes and performs encryption / decryption processing on the operation request object according to the determined optimal resource scheduling scheme. By dynamically scheduling encryption resources based on real-time monitored performance indicators of various types of encryption resources, resource utilization is improved, and the real-time performance of encryption / decryption processing is enhanced.

Description

Technical Field

[0001] This application relates to the field of data security, and in particular to a database encryption method, device and system based on large-scale multi-agent collaboration. Background Technology

[0002] With the acceleration of digitalization, the amount of sensitive information stored in databases is increasing, and data encryption has become a core means of ensuring information security.

[0003] Traditional database encryption technologies primarily employ static encryption strategies, such as Transparent Data Encryption (TDE), column-level encryption, or application-layer encryption / decryption. These rely on preset rules and fixed algorithms (such as AES and SM4) and typically utilize static resource allocation strategies, resulting in low resource utilization and poor real-time performance. Under high-concurrency scenarios, system performance degrades sharply. Summary of the Invention

[0004] In view of this, this application provides a database encryption method, device and system based on large-scale multi-agent collaboration.

[0005] Specifically, this application is implemented through the following technical solution:

[0006] According to a first aspect of the embodiments of this application, a database encryption method based on large-scale model multi-agent cooperation is provided, applied to a database encryption system based on large-scale model multi-agent cooperation, the database encryption system including a data request control agent and an encryption / decryption execution agent, the method comprising:

[0007] Upon receiving a database operation request, the data request control agent uses the first major model to perform semantic parsing on the database operation request to determine the type of operation request and the object of the operation request.

[0008] If it is determined that the operation request object has an encryption policy, the data request control agent sends an encryption / decryption processing request for the operation request object to the encryption / decryption execution agent according to the operation request type;

[0009] Upon receiving an encryption / decryption request for the operation request object, the encryption / decryption execution agent determines the optimal resource scheduling scheme from multiple candidate resource scheduling schemes based on a reinforcement learning algorithm. The multiple candidate resource scheduling schemes are generated by the encryption / decryption execution agent using a second model based on the performance indicators of various types of encrypted resources monitored in real time.

[0010] The encryption / decryption execution agent performs encryption / decryption processing on the operation request object according to the optimal resource scheduling scheme.

[0011] According to a second aspect of the embodiments of this application, a database encryption system based on large-scale multi-agent collaboration is provided, comprising: a data request control agent and an encryption / decryption execution agent; wherein:

[0012] A data request control agent is used to perform semantic parsing on the database operation request using a first major model when a database operation request is received, in order to determine the type of operation request and the object of the operation request.

[0013] The data request control agent is also configured to, when it is determined that the operation request object has an encryption policy, send an encryption / decryption processing request for the operation request object to the encryption / decryption execution agent according to the operation request type.

[0014] An encryption / decryption execution agent is used to determine the optimal resource scheduling scheme from multiple candidate resource scheduling schemes based on a reinforcement learning algorithm when receiving an encryption / decryption processing request for the operation request object; wherein, the multiple candidate resource scheduling schemes are generated by the encryption / decryption execution agent using a second model based on the performance indicators of various types of encrypted resources monitored in real time.

[0015] The encryption / decryption execution agent is also used to perform encryption / decryption processing on the operation request object according to the optimal resource scheduling scheme.

[0016] According to a third aspect of the embodiments of this application, an electronic device is provided, including a processor and a memory, wherein:

[0017] Memory, used to store computer programs;

[0018] The processor, when executing a program stored in memory, implements the method provided in the first aspect above.

[0019] The database encryption method based on a large model and multi-agent collaboration in this application embodiment sets up a data request control agent and an encryption / decryption execution agent. When the data request control agent receives a database operation request, it can use a first large model to perform semantic parsing on the received database operation request to determine the operation request type and operation request object. If it is determined that the operation request object has an encryption strategy, the data request control agent can send an encryption / decryption processing request for the operation request object to the encryption / decryption execution agent according to the operation request type. When the encryption / decryption execution agent receives the encryption / decryption processing request for the operation request object, it can determine the optimal resource scheduling scheme from multiple candidate resource scheduling schemes based on a reinforcement learning algorithm, and perform encryption / decryption processing on the operation request object according to the determined optimal resource scheduling scheme. By dynamically scheduling encryption resources based on the performance indicators of various types of encryption resources monitored in real time, the resource utilization rate is improved, and the real-time performance of encryption / decryption processing can be improved. Attached Figure Description

[0020] Figure 1 This is a flowchart illustrating an exemplary embodiment of a database encryption method based on large-scale multi-agent collaboration, as shown in this application.

[0021] Figure 2 This is a schematic diagram illustrating the architecture of a database encryption system based on large-scale model multi-agent collaboration, as an exemplary embodiment of this application.

[0022] Figure 3 This is a schematic diagram illustrating a process for implementing database encryption through collaboration among various intelligent agents, as shown in an exemplary embodiment of this application.

[0023] Figure 4 This is a schematic diagram illustrating the processing flow of a data request control agent for a received database operation request, as shown in an exemplary embodiment of this application.

[0024] Figure 5 This is a schematic diagram illustrating a pre-decryption process of a pre-decryption agent, as shown in an exemplary embodiment of this application.

[0025] Figure 6 This is a schematic diagram illustrating a process for an encryption policy agent to generate an encryption policy, as shown in an exemplary embodiment of this application.

[0026] Figure 7 This is a schematic diagram illustrating a process for a security monitoring intelligent agent to implement security monitoring, as shown in an exemplary embodiment of this application.

[0027] Figure 8 This is a schematic diagram of the hardware structure of an electronic device as illustrated in an exemplary embodiment of this application. Detailed Implementation

[0028] To enable those skilled in the art to better understand the technical solutions provided in the embodiments of this application, some technical terms involved in the embodiments of this application will be briefly explained below.

[0029] 1. Large Model: refers to a deep learning model trained on massive amounts of data. It typically has significant characteristics such as a large number of parameters, a large amount of training data, and large computing resources, and has powerful data processing and generation capabilities.

[0030] 2. Agent: An AI system driven by a large model. Unlike a large model, which must receive instructions, an agent can perceive the environment, make decisions, and perform complex tasks. It can take the form of a software program or a robot.

[0031] To make the above-mentioned objectives, features and advantages of the embodiments of this application more apparent and understandable, the technical solutions of the embodiments of this application will be further described in detail below with reference to the accompanying drawings.

[0032] Please see Figure 1 This is a flowchart illustrating a database encryption method based on large-scale model multi-agent collaboration, provided in an embodiment of this application. The database encryption system based on large-scale model multi-agent collaboration includes a data request control agent and an encryption / decryption execution agent, such as... Figure 1 As shown, this database encryption method based on large-scale multi-agent collaboration may include the following steps:

[0033] Step S100: Upon receiving a database operation request, the data request control agent uses the first major model to perform semantic parsing on the database operation request to determine the type of operation request and the object of the operation request.

[0034] Step S110: If it is determined that the operation request object has an encryption policy, the data request control agent sends an encryption / decryption processing request for the operation request object to the encryption / decryption execution agent according to the operation request type.

[0035] In this embodiment of the application, the database encryption system based on large model multi-agent collaboration can be configured with a data request control agent. This data request control agent can serve as the system entry point to receive database operation requests (also known as application requests) from the application system.

[0036] The data request control agent can use a large model (which can be called the first large model) to perform semantic parsing on the received database operation requests, identify the operation type and the operation request object (such as the table field corresponding to the database operation request).

[0037] Once the object of the operation request is identified, the data request control agent can also determine whether the object of the operation request has an encryption policy.

[0038] If it is determined that the operation request object has an encryption policy, the data request control agent can send an encryption / decryption processing request (encryption processing request or decryption processing request) to the encryption / decryption execution agent according to the operation request type.

[0039] For example, when the operation request type is a query request, the data request control agent can send a decryption processing request for the operation request object to the encryption / decryption execution agent.

[0040] If the operation request type is determined to be a write / update request, the data request control agent can send an encryption processing request for the operation request object to the encryption / decryption execution agent.

[0041] Step S120: Upon receiving an encryption / decryption processing request for the operation request object, the encryption / decryption execution agent determines the optimal resource scheduling scheme from multiple candidate resource scheduling schemes based on a reinforcement learning algorithm. The multiple candidate resource scheduling schemes are generated by the encryption / decryption execution agent using the second major model based on the performance indicators of various types of encrypted resources monitored in real time.

[0042] For example, encrypted resources (also known as encryption / decryption resources) may include, but are not limited to, one or more of the following: CPU, GPU, and cryptographic card.

[0043] For example, performance metrics for encrypted resources may include algorithm support types, computing power, latency, energy consumption, and concurrency support.

[0044] In this embodiment of the application, considering that the usage of encrypted resources is usually dynamic during system operation, adopting a static resource scheduling method is prone to problems such as low resource utilization and poor real-time performance of encryption and decryption processing.

[0045] To improve the flexibility of encrypted resource scheduling, thereby increasing resource utilization and enhancing the real-time performance of encryption and decryption processing, an encryption / decryption execution agent can be set up in the system.

[0046] The encryption / decryption execution agent can monitor the performance metrics of various types of encrypted resources in real time, and based on the real-time monitoring of the performance of various types of encrypted resources, generate multiple candidate resource scheduling schemes (also known as resource scheduling strategies) using a pre-trained large model (which can be called the second large model).

[0047] For example, the second major model and the first major model mentioned above can be the same major model, or they can be different major models.

[0048] In this embodiment of the application, when the encryption / decryption execution agent receives an encryption / decryption processing request for the operation request object, it can determine the optimal resource scheduling scheme from multiple candidate resource scheduling schemes based on a reinforcement learning algorithm.

[0049] In one example, the encryption / decryption agent uses a reinforcement learning algorithm to determine the optimal resource scheduling scheme from multiple candidate schemes, which may include:

[0050] The encryption / decryption execution agent is based on a reinforcement learning algorithm and determines the reward for each candidate resource scheduling scheme according to the core performance quantification indicators of each candidate resource scheduling scheme. Among them, the core performance quantification indicators include some or all of the query latency, resource utilization, and energy consumption.

[0051] The encryption / decryption execution agent determines the optimal resource scheduling scheme from multiple candidate resource scheduling schemes based on the rewards of each candidate resource scheduling scheme.

[0052] For example, the encryption / decryption execution agent can determine the reward of each candidate resource scheduling scheme based on the core performance quantification indicators of the candidate resource scheduling schemes using a reinforcement learning algorithm. The encryption / decryption execution agent can then determine the optimal resource scheduling scheme based on the rewards of each candidate resource scheduling scheme.

[0053] For example, the encryption / decryption agent can determine the reward for candidate resource scheduling schemes in the following ways:

[0054] Reward = α•T 降低率 + β•U 资源利用率 - γ•E 能耗

[0055] Among them, α, β, and γ are weighting coefficients used to adjust the importance of each item in the total reward.

[0056] T 降低率 Latency reduction rate is used to measure the improvement in system response speed brought about by the scheduling scheme.

[0057] U 资源利用率 Resource utilization rate is used to measure the efficiency of system resource (such as CPU, GPU, cryptographic card) usage.

[0058] E 能耗Energy consumption is used to measure the power consumption level brought about by the scheduling scheme; this item has a negative impact, so the value of this item needs to be subtracted in the reward function (i.e., the higher the energy consumption, the lower the reward).

[0059] For example, you can choose a reward ( Reward The highest-ranking candidate resource scheduling scheme is the optimal resource scheduling scheme.

[0060] Step S130: The encryption / decryption agent performs encryption / decryption processing on the operation request object according to the determined optimal resource scheduling scheme.

[0061] In this embodiment of the application, the encryption / decryption execution agent can respond to the encryption / decryption processing request according to the determined optimal resource scheduling scheme, and perform encryption / decryption processing on the operation request object.

[0062] It can be seen that, in Figure 1 In the illustrated method flow, by setting up a data request control agent and an encryption / decryption execution agent, the data request control agent, upon receiving a database operation request, can use the first major model to perform semantic parsing on the received database operation request, determine the operation request type and the operation request object, and, if it is determined that the operation request object has an encryption strategy, the data request control agent can send an encryption / decryption processing request for the operation request object to the encryption / decryption execution agent according to the operation request type. Upon receiving the encryption / decryption processing request for the operation request object, the encryption / decryption execution agent can, based on a reinforcement learning algorithm, determine the optimal resource scheduling scheme from multiple candidate resource scheduling schemes, and perform encryption / decryption processing on the operation request object according to the determined optimal resource scheduling scheme. By dynamically scheduling encrypted resources based on the performance indicators of various types of encrypted resources monitored in real time, resource utilization is improved, and the real-time performance of encryption / decryption processing is enhanced.

[0063] In some embodiments, the data request control agent sending an encryption / decryption processing request for an operation request object to the encryption / decryption execution agent may include:

[0064] If the operation request type is determined to be a query request, the data request control agent determines whether plaintext data of the operation request object exists in the cache;

[0065] If plaintext data of the operation request object exists in the cache, retrieve the plaintext data of the operation request object from the cache;

[0066] If the plaintext data of the operation request object is not found in the cache, a decryption processing request for the operation request object is sent to the encryption / decryption execution agent.

[0067] For example, when the data request control agent determines that the operation request object has an encryption policy and that the operation request type is a query request, the data request control agent can determine whether there is plaintext data of the operation request object in the cache.

[0068] For example, the plaintext data stored in the cache can be the plaintext data that the encryption / decryption agent decrypts and saves in the cache, or the plaintext data stored in the cache can be the plaintext data that the pre-decryption agent decrypts and stores in the cache (see the relevant description below for specific implementation).

[0069] For example, a validity period can be set for plaintext data in the cache. If the validity period is exceeded, the cached plaintext data can be deleted.

[0070] For example, if it is determined that plaintext data of the operation request object exists in the cache, the data request control agent can retrieve the plaintext data of the operation request object from the cache.

[0071] If it is determined that the plaintext data of the operation request object does not exist in the cache, the data request control agent can send a decryption processing request for the operation request object to the encryption / decryption execution agent.

[0072] It should be noted that, in the embodiments of this application, when the operation request object also has an integrity protection strategy, the encryption and decryption execution agent can also perform integrity verification on the ciphertext of the operation request object before decrypting it, and decrypt the ciphertext of the operation request object if the integrity verification is successful.

[0073] If the encryption / decryption execution agent obtains the plaintext data of the operation request object, it can return the plaintext data of the operation request object to the data request control agent.

[0074] For example, if the data request control agent obtains the plaintext data of the operation request object, it can also determine whether the operation request object has a de-identification strategy.

[0075] If it is determined that the object of the operation request has a de-identification strategy, the data request control agent can also perform de-identification processing on the plaintext data of the object of the operation request.

[0076] For example, the specific processing method for the data request control agent to de-identify the plaintext data of the operation request object can be determined based on the de-identification strategy.

[0077] For example, desensitization strategies may include desensitization in the middle, desensitization at both ends, desensitization before a certain character, desensitization after a certain character, etc.

[0078] For example, if the data request control agent obtains the de-identified plaintext data of the operation request object in the manner described above, it can return the de-identified plaintext data to the request initiator.

[0079] It should be noted that, in the embodiments of this application, if there is no desensitization strategy for the operation request object, the data request control agent can return the plaintext data of the operation request object obtained in the above manner to the request initiator.

[0080] In addition, the plaintext data of the operation request object obtained by the data request control agent may also include the plaintext data of the operation request object obtained from the database when there is no encryption policy for the operation request object.

[0081] In this embodiment of the application, when the operation request type is a write / update request, and it is determined that the operation object has an encryption strategy, and it is also determined that the operation request object has an integrity protection strategy, the encryption / decryption execution agent can also perform integrity protection on the ciphertext of the operation request object after encrypting the plaintext of the operation request object. For example, the encryption / decryption execution agent can calculate an integrity check value (e.g., MAC or digital signature) on the ciphertext of the operation request object, and associate and store the integrity check value with the ciphertext of the operation request object.

[0082] In addition, when the operation request type is an update request, the old data in the database needs to be replaced during the process of writing the encrypted data of the operation request object to the database.

[0083] In some embodiments, a database encryption system based on large model multi-agent collaboration also includes a pre-decryption agent.

[0084] The database encryption method based on large-model multi-agent collaboration provided in this application embodiment may further include:

[0085] The pre-decryption agent obtains access record data from the database;

[0086] The pre-decryption agent uses an attention-enhanced sequence model to analyze database access records and identify regular data query patterns.

[0087] The pre-decryption agent determines the decryption timing of the target data based on regular data query patterns, and sends a decryption processing request for the target data to the encryption / decryption execution agent when the decryption timing is reached.

[0088] The pre-decryption agent stores the decrypted target data in a cache.

[0089] For example, in order to improve database query efficiency, a pre-decryption agent can be set up in the system. This pre-decryption agent can analyze database access behavior data to determine regular data query patterns and improve the access efficiency of the corresponding data by pre-decrypting the corresponding data.

[0090] For example, the pre-decryption agent obtains access record data from the database, determines user behavior data such as user access time, IP distribution, and operation frequency, and uses an attention-enhanced sequence model based on the user behavior data to determine regular data query patterns.

[0091] For example, attention-enhanced sequence models can include, but are not limited to, LSTM (Long Short Term Memory) + Attention temporal models, or large models based on Transformer, etc.

[0092] For example, regular data query patterns may include:

[0093] Periodic high-frequency queries (such as daily report queries at 9:00 AM);

[0094] Querying trending data (such as querying product information during promotional events);

[0095] User group preference queries (such as finance department inquiries about salary tables).

[0096] For example, the pre-decryption agent determines the decryption timing of the target data based on regular data query patterns, and when the decryption timing of the target data is reached, it sends a decryption processing request for the target data to the encryption / decryption executor.

[0097] For example, suppose a pre-decryption agent analyzes database query history and user behavior to discover that users frequently query a certain table around 5 PM every Friday. Based on this pattern, around 4:50 PM every Friday, the pre-decryption agent performs a pre-decryption operation on the encrypted fields of that table using encryption / decryption execution agents, and stores the decrypted data in a cache. When a user queries around 5 PM, the decrypted data can be quickly retrieved from the cache, achieving a fast response.

[0098] For example, suppose the pre-decryption agent analyzes database query history and user behavior to discover a surge in salary table queries around 8:50 AM on the 1st of each month. Based on this pattern, the pre-decryption agent can pre-decrypt encrypted fields in the salary table around 8:30 AM on the 1st of each month, storing the decrypted data in a cache. When a user queries around 8:50 AM, the decrypted data can be quickly retrieved from the cache, enabling a rapid response.

[0099] In some embodiments, a database encryption system based on large-model multi-agent collaboration may further include a key management agent.

[0100] The database encryption method based on large-model multi-agent collaboration provided in this application embodiment may further include:

[0101] The key management agent uses the third major model to determine whether there is a risk of key leakage based on the context information of key operations;

[0102] If it is determined that there is a risk of key leakage, the key management agent will update the key for the key that is at risk of leakage.

[0103] For example, to improve key security, a key management agent can be set up in the system. The key management agent can monitor the risk of key leakage and update the key if it is determined that there is a risk of key leakage.

[0104] For example, for any given key, the key management agent can use the third major model to determine whether the key is at risk of being leaked, based on the context information of the key operations performed on that key. If it is determined that the key is at risk of being leaked, the agent can update the key.

[0105] For example, the first, second, and third models can be completely identical, completely different, or partially identical.

[0106] For example, in order to mitigate the system performance degradation caused by key updates, a dual-key parallel + incremental migration mechanism can be used for key updates.

[0107] In one example, the key management agent updates keys for keys at risk of being compromised, including:

[0108] The key management agent generates new keys for keys that are at risk of being leaked;

[0109] The key management agent uses a new key instead of the old key to encrypt newly written data; and,

[0110] The key management agent uses a new key to re-encrypt data encrypted with an old key, and archives or destroys the old key after the data re-encryption is completed; the old key before being archived or destroyed is allowed to be used for data decryption.

[0111] For example, if a key management agent determines that a key is at risk of being leaked, it can generate a new key for the key at risk of being leaked.

[0112] When a new key is generated, on the one hand, the new key can be used to encrypt newly written data instead of the old key.

[0113] On the other hand, a new key can be used to re-encrypt data encrypted with the old key.

[0114] For example, in order to reduce the impact of data re-encryption on system performance, data re-encryption can be performed during system idle periods.

[0115] For example, the system's idle time period can be determined by the pre-decryption agent analyzing the database access record data.

[0116] For example, during the data re-encryption process, a selective re-encryption method can be used, prioritizing the re-encryption of frequently accessed data.

[0117] Once all data migration is complete (i.e., data encrypted with the old key has been re-encrypted), the old key can be automatically archived or destroyed.

[0118] The archived old keys are no longer used for data encryption and decryption.

[0119] In some embodiments, a database encryption system based on large-model multi-agent collaboration may further include an encryption policy agent.

[0120] The database encryption method based on large-model multi-agent collaboration provided in this application embodiment may further include:

[0121] The encryption strategy agent periodically scans the data and extracts the metadata from the scanned data;

[0122] The encryption strategy agent uses the fourth model to perform semantic understanding of the metadata of the scanned data and determine the sensitive fields in the scanned data;

[0123] The encryption policy agent generates a security protection policy for sensitive fields based on the field type and business context; the security protection policy includes one or more of the following: encryption policy, integrity protection policy, and de-identification policy.

[0124] For example, in order to reduce manual intervention, improve the accuracy and coverage of policies, and reduce the complexity and error rate of security protection policy formulation, an encryption policy agent can also be set up in the system. The encryption policy agent can use the semantic understanding capabilities of large models to automatically identify sensitive fields and generate encryption policies.

[0125] It should be noted that, in the embodiments of this application, the large model used by different intelligent agents can be the same large model or different large models.

[0126] For example, the encryption policy agent can periodically scan the data and extract the metadata of the scanned data.

[0127] For example, metadata may include, but is not limited to, some or all of the information such as field names, data types, comments, and foreign key relationships.

[0128] The encryption strategy agent uses the fourth model to perform semantic understanding of the metadata of the scanned data and identify sensitive fields in the scanned data, such as "ID card number", "bank card number", "salary" etc.

[0129] The encryption policy agent can generate security protection policies for sensitive fields based on the field type and business context.

[0130] For example, security protection strategies may include, but are not limited to, one or more of encryption strategies, integrity protection strategies, and de-identification strategies.

[0131] In one example, a database encryption system based on large-scale multi-agent collaboration can also include a security monitoring agent.

[0132] The database encryption method based on large-scale multi-agent collaboration provided in this application embodiment may further include:

[0133] If the operation request type is determined to be a delete request, the data request control agent reports the database operation request to the security monitoring agent so that the security monitoring agent can perform security analysis on the database operation request.

[0134] For example, to further improve the security of database data, a security monitoring agent can also be set up in the system. The security monitoring agent can perform security analysis on high-risk operations on the database to determine whether there are any anomalies.

[0135] For example, high-risk operations may include database operations such as deleting tables or fields.

[0136] Accordingly, if the data request control agent determines that the operation request type is a deletion request, it can report the database operation request to the security monitoring agent.

[0137] When the security monitoring agent receives the database operation request, it can perform security analysis on the database operation request.

[0138] For example, a security monitoring agent analyzes multi-dimensional contextual information to determine whether a database operation request is an abnormal operation.

[0139] For example, the above multi-dimensional contextual information may include some or all (or more) of the following information:

[0140] The current user's identity and permissions;

[0141] Operation time (whether it is outside of working hours);

[0142] Source IP address of the operation (whether it is a non-unknown IP);

[0143] The objects being manipulated (tables, fields, etc.);

[0144] Historical behavioral patterns;

[0145] SQL statement characteristics (whether it is a high-risk statement).

[0146] In one example, a database encryption method based on large-scale multi-agent collaboration may also include:

[0147] The security monitoring agent performs real-time monitoring of database access behavior.

[0148] For any user, if abnormal behavior of that user is detected, the security monitoring agent will carry out a coordinated threat response.

[0149] For example, to further improve database security, the security monitoring agent can also perform security monitoring on database access.

[0150] For example, a security monitoring agent can perform real-time monitoring of database access behavior.

[0151] For any user, if abnormal behavior of that user is detected, a coordinated threat response can be initiated.

[0152] For example, abnormal behavior may include, but is not limited to, one or more of the following:

[0153] a. Frequent login attempts;

[0154] b. Illegal SQL operations (such as DROP TBALE, etc.);

[0155] c. Access during abnormal time periods;

[0156] d. Querying data beyond authorized permissions.

[0157] For example, threat response coordination may include, but is not limited to, one or more of the following:

[0158] Send a session restriction instruction for the user to the data request control agent;

[0159] Trigger key update processing;

[0160] Record audit logs and issue alerts.

[0161] To enable those skilled in the art to better understand the technical solutions provided in the embodiments of this application, the technical solutions provided in the embodiments of this application are described below with reference to specific examples.

[0162] In this embodiment, a database encryption scheme based on large-scale model multi-agent collaboration is provided. By constructing multiple specialized agents, including a data request control agent, an encryption / decryption execution agent, a pre-decryption agent, a key management agent, an encryption strategy agent, and a security monitoring agent, intelligent optimization of the entire database encryption process is achieved. Its system architecture can be as follows: Figure 2 As shown. Wherein:

[0163] The data request control agent is responsible for receiving and processing database operation requests from the application system;

[0164] The encryption / decryption execution agent dynamically schedules hardware resources such as CPU, GPU, and cryptographic cards to perform cryptographic operations based on reinforcement learning algorithms;

[0165] The pre-decryption agent uses a large model to analyze user query history and behavior patterns, predicts high-frequency query needs, and performs pre-decryption operations.

[0166] The key management agent enables the dynamic generation, updating, and rotation of keys;

[0167] The encryption policy agent is responsible for formulating protection policies for table fields, such as encryption, integrity, and desensitization.

[0168] The security monitoring intelligent agent monitors the security status of the system in real time.

[0169] For example, the flowchart illustrating the collaborative implementation of database encryption by the aforementioned intelligent agents can be as follows: Figure 3 As shown.

[0170] By using the above-mentioned large-scale model-based multi-agent collaboration, the problems of low resource utilization, high query response latency, and static key management in traditional database encryption technologies are solved, significantly improving encryption efficiency, reducing system overhead, and achieving an adaptive balance between security and performance.

[0171] The following provides an exemplary description of the specific functional implementation of each intelligent agent.

[0172] I. Data Request Control Agent.

[0173] For example, the data request control agent acts as the system entry point, receiving database operation requests such as SQL CRUD operations from the application system.

[0174] 1.1 Request reception and semantic parsing.

[0175] For example, the data request control agent acts as the system entry point, receiving SQL CRUD and other database operation requests from the application system. It uses a large model to perform semantic parsing on the received database operation requests, identifying the operation type, the table fields involved (which can be called target table fields, i.e. the object of the above-mentioned request operation), user identity, and contextual intent.

[0176] For example, user identity can be used to establish a behavioral baseline. For any user, if the user's behavior does not match their historical behavior (such as a regular user performing a deletion operation late at night), an abnormal alarm may be triggered.

[0177] For example, contextual intent refers to the system's determination of "why" and "in what scenario" a user performs an action by analyzing their actions and the current environment. For instance, if an accountant checks the payroll on the 1st of each month, the contextual intent is "preparing for payroll." If a regular employee tries to check the payroll, the contextual intent might be "attempting unauthorized access."

[0178] Based on the above data, the security monitoring intelligent agent can accurately identify user identity and intent, achieving more intelligent, secure, and efficient data access control.

[0179] 1.2 Task Distribution.

[0180] For example, a data request control agent can distribute tasks to the appropriate agents based on the semantic parsing results of database operation requests.

[0181] 1) For query requests, the data request control agent can query the encryption policy agent to determine whether the target table field has an encryption policy or an anonymization policy.

[0182] If the target table field does not have an encryption strategy or a de-identification strategy, then the plaintext data from the database will be sent to the application system.

[0183] If the target table field has an encryption policy, it can be determined whether the plaintext data of the target table field exists in the cache. If it exists, the plaintext data of the target table field in the cache is sent to the application system. If it does not exist, the encryption / decryption agent is called to decrypt the ciphertext and send it to the application system.

[0184] If a data masking strategy exists for the target table fields, the plaintext data of the obtained target table fields will be masked, and the masked data will be sent back to the application system.

[0185] For example, the data request control agent can also send the query request action to the pre-decryption agent to assist the pre-decryption agent in analyzing and determining regular data query patterns.

[0186] 2) For write / update requests, the data request control agent can query the encryption policy agent to determine whether the target table field requires an encryption policy.

[0187] When the target table field requires an encryption strategy, the data request control agent sends the target table field to the encryption / decryption execution agent, which then encrypts the target table field and writes it to the database.

[0188] 3) For high-risk operations such as deleting tables or fields, report to the security monitoring intelligence agent for behavior analysis.

[0189] For example, the processing flow of the data request control agent for receiving database operation requests can be found in [reference needed]. Figure 4 .

[0190] II. Encryption and decryption of the execution agent.

[0191] For example, the encryption / decryption execution agent can intelligently schedule encryption resources and execute specific encryption / decryption operations.

[0192] 2.1 Resource identification and modeling.

[0193] For example, during system initialization, the encryption / decryption execution agent can automatically identify available encrypted resources within the system and establish a resource capability profile.

[0194] For example, encrypted resources may include, but are not limited to, one or more of encrypted resources such as CPU, GPU, and cryptographic cards.

[0195] Resource capability profiles can include algorithm support types, computing power, latency, energy consumption, and concurrency support.

[0196] 2.2 Dynamic scheduling strategy.

[0197] 1) Monitor the performance metrics of various encrypted resources in real time.

[0198] For example, performance metrics for encrypted resources may include some or all of the metrics such as utilization, queue length, and response latency.

[0199] 2) Utilize pre-trained large models to generate multiple candidate resource scheduling schemes (such as "prioritize GPU processing of batch queries" and "activate cryptographic card clusters during peak periods").

[0200] 3) Based on reinforcement learning algorithms, select the optimal resource scheduling scheme from multiple candidate resource scheduling schemes.

[0201] For example, the reward function can be designed as follows:

[0202] Reward = α•T 降低率 + β•U 资源利用率 - γ•E 能耗

[0203] For example, you can choose a reward ( Reward The highest-ranking candidate resource scheduling scheme is the optimal resource scheduling scheme.

[0204] For example, the encryption / decryption execution agent can also dynamically expand its capacity during the process of scheduling encrypted resources.

[0205] For example, in the event of a surge in queries, increased latency, or excessive resource usage, or when the predicted peak period is reached, a standby GPU node can be automatically activated.

[0206] For example, a surge in queries can be detected when the number of queries increases beyond a preset threshold within a unit of time.

[0207] It can determine when resources such as CPU, memory, and GPU are partially or fully utilized beyond the corresponding threshold, indicating that resources are busy.

[0208] It should be noted that after enabling the standby GPU node, the system can automatically reclaim resources based on the load recovery status, that is, set the enabled standby GPU node back to standby status.

[0209] It is evident that by generating multiple candidate resource scheduling strategies using a pre-trained large model, and then selecting the optimal resource scheduling strategy based on a reinforcement learning algorithm and a multi-dimensional reward function, and dynamically scheduling encrypted resources such as CPU, GPU, and cryptographic cards according to the optimal resource scheduling strategy, the problems of low resource utilization and poor real-time performance caused by traditional static scheduling are solved.

[0210] III. Pre-decrypted intelligent agents.

[0211] For example, a pre-decryption agent can predict high-frequency query needs by analyzing user behavior patterns and then perform pre-decryption operations.

[0212] 3.1 Data collection and analysis.

[0213] For example, a pre-decryption agent can continuously collect database access log data.

[0214] For example, database access records may include, but are not limited to, behavioral data such as user access time, IP distribution, and operation frequency.

[0215] Pre-decryption agents can determine database access records by parsing database query logs.

[0216] The pre-decryption agent can use an LSTM+Attention time series model for time series analysis and pattern recognition to identify regular data query patterns (data queries with certain regularity and predictability):

[0217] Periodic high-frequency queries (such as daily report queries at 9:00 AM);

[0218] Querying trending data (such as querying product information during promotional events);

[0219] User group preference queries (such as finance department inquiries about salary tables).

[0220] 3.2 Prediction and Preprocessing.

[0221] For example, the pre-decryption agent analyzes the access records of the database to determine regular data query patterns, predicts data queries based on the determined regular data query patterns, and performs pre-decryption processing based on the prediction results.

[0222] For example, suppose a pre-decryption agent analyzes database query history and user behavior to discover that users frequently query a certain table around 5 PM every Friday. Based on this pattern, the agent automatically pre-decrypts the encrypted fields of that table around 4:50 PM every Friday and stores the decrypted data in a cache. When a user queries around 5 PM, the decrypted data can be quickly retrieved from the cache, enabling a fast response.

[0223] For example, a schematic diagram of the pre-decryption process implemented by the pre-decryption agent can be found here. Figure 5 .

[0224] It is evident that by continuously collecting and analyzing database query history and user behavior data; utilizing large-scale model analysis technology to identify query patterns and periodic regularities, determining regular data query patterns, and performing targeted data pre-decryption, database query response efficiency is improved while ensuring security.

[0225] For example, before the predicted peak period for data queries arrives, the system automatically pre-decrypts the relevant data; the pre-decrypted data is then stored in the cache, awaiting user queries.

[0226] In actual testing, when the pre-decryption strategy was adopted, the database query response time was reduced by an average of about 90% during peak access periods, significantly improving the user experience.

[0227] IV. Encryption Strategy Intelligent Agent.

[0228] For example, an encryption policy agent is used to formulate encryption, integrity, and de-identification protection policies for table fields.

[0229] 4.1 Data asset identification.

[0230] For example, the encryption strategy agent can scan the structure of all tables in the database to extract metadata such as field names, data types, comments, and foreign key relationships. It then uses a large model for semantic understanding to determine field sensitivity (such as "ID number," "bank card number," "salary," etc.).

[0231] 4.2 Strategy Generation.

[0232] For example, the encryption policy agent can dynamically generate encryption policies based on field types and business context. For instance:

[0233] Confidentiality protection strategies include selecting appropriate encryption algorithms, such as SM4 and AES.

[0234] Integrity protection strategies include selecting appropriate message authentication algorithms, such as HMAC_SM3 and HMAC_SHA256.

[0235] Desensitization strategies include selecting appropriate desensitization algorithms, such as desensitizing the middle, desensitizing both ends, desensitizing before a certain character, or desensitizing after a certain character.

[0236] For example, a flowchart illustrating the process by which the encryption policy agent generates the encryption policy can be found here. Figure 6 .

[0237] It is evident that by leveraging the semantic understanding capabilities of large models to automatically identify sensitive fields and generate encryption strategies (such as confidentiality protection strategies, integrity protection strategies, and desensitization strategies), manual intervention can be reduced, the accuracy and coverage of strategies can be improved, and the complexity and error rate of encryption strategy formulation can be lowered.

[0238] V. Security Monitoring Intelligent Agent.

[0239] For example, a security monitoring agent can monitor the security status of a system in real time, identify abnormal behavior, and take countermeasures.

[0240] 5.1 Real-time behavior monitoring.

[0241] For example, a security monitoring agent can collect database access log data. It can then use large models for anomaly detection to identify unusual behavior.

[0242] For example, large models can perform anomaly detection and identify abnormal behavior based on information such as user login behavior and SQL statement characteristics in database access logs.

[0243] For example, abnormal behavior may include, but is not limited to, one or more of the following:

[0244] a. Frequent login attempts;

[0245] b. Illegal SQL operations (such as DROP TBALE, etc.);

[0246] c. Access during abnormal time periods;

[0247] d. Querying data beyond authorized permissions.

[0248] 5.2 Threat Response Coordination.

[0249] For example, upon detecting abnormal behavior, the data request control agent can be notified to restrict the user session; the key management agent can be notified to update the emergency key; a complete audit log can be logged and an alert can be issued.

[0250] For example, a flowchart illustrating the security monitoring process implemented by a security monitoring intelligent agent can be found here. Figure 7 .

[0251] VI. Key Management Agent.

[0252] For example, a key management agent can be used for key management. Key management can include, but is not limited to, some or all of the management operations such as encryption key generation, distribution, rotation, updating, archiving, and destruction.

[0253] Unlike traditional static key management systems, in this embodiment, the key management agent can be driven by a large model and combined with multi-source contextual information (such as user behavior, system load, security events, business cycles, etc.) to achieve adaptive, predictive, and dynamic key management strategies, significantly improving the security and operational efficiency of the database encryption system.

[0254] For example, the key management agent can record the complete context of all key operations (generation, use, rotation, destruction), and combine this with the access logs of the security monitoring agent to use a large model to determine whether there is a risk of key leakage.

[0255] If a risk of leakage is identified, a proactive key update process should be initiated.

[0256] For example, to avoid the performance impact caused by the full data re-encryption due to traditional key updates, this embodiment can adopt a dual-key parallel + gradual migration mechanism:

[0257] 1) After a new key is generated, the old key enters a "retirement" state but can still be used to decrypt historical data;

[0258] 2) Newly written data is encrypted using a new key;

[0259] 3) Utilize system idle periods (predicted by the pre-decryption agent) to asynchronously start selective re-encryption tasks in the background, prioritizing the processing of frequently accessed data;

[0260] 4) Automatically archive or destroy old keys when all data migration is complete or the old keys have no access records for a threshold period of time.

[0261] As can be seen, by using context awareness and risk prediction to achieve dynamic key rotation, and adopting a dual-key parallel + gradual migration mechanism, the key exposure window is shortened by an average of more than 80% compared with the implementation scheme of fixed-period key rotation, and the system performance degradation caused by key updates is avoided.

[0262] In this embodiment, by constructing six specialized intelligent agents, task distribution, state synchronization, and event linkage are achieved, enabling the encryption system to be adaptive and optimized in a closed loop, improving the overall intelligence level, and solving the problems of fragmented modules and difficult optimization in traditional encryption systems.

[0263] This application also provides an electronic device, including a processor and a memory, wherein the memory is used to store computer programs; and the processor is used to implement the database encryption method based on large model multi-agent cooperation described above when executing the program stored in the memory.

[0264] Please see Figure 8This is a schematic diagram of the hardware structure of an electronic device provided in an embodiment of this application. The electronic device may include a processor 801 and a memory 802 storing machine-executable instructions. The processor 801 and the memory 802 can communicate via a system bus 803. Furthermore, by reading and executing the machine-executable instructions in the memory 802 corresponding to the database encryption logic based on large-model multi-agent cooperation, the processor 801 can execute the database encryption method based on large-model multi-agent cooperation described above.

[0265] The memory 802 mentioned in this document can be any electronic, magnetic, optical, or other physical storage device that can contain or store information such as executable instructions, data, etc. For example, machine-readable storage media can be: RAM (Random Access Memory), volatile memory, non-volatile memory, flash memory, storage drives (such as hard disk drives), solid-state drives, any type of storage disk (such as optical discs, DVDs, etc.), or similar storage media, or combinations thereof.

[0266] In some embodiments, a machine-readable storage medium, such as Figure 8 The memory 802 in the machine-readable storage medium stores machine-executable instructions, which, when executed by the processor, implement the database encryption method based on large-model multi-agent cooperation described above. For example, the machine-readable storage medium can be ROM, RAM, CD-ROM, magnetic tape, floppy disk, and optical data storage device, etc.

[0267] This application also provides a computer program product that stores a computer program, and when a processor executes the computer program, it causes the processor to execute the database encryption method based on large model multi-agent cooperation described above.

[0268] This application also provides a database encryption system based on large-scale multi-agent collaboration, comprising: a data request control agent and an encryption / decryption execution agent; wherein:

[0269] A data request control agent is used to perform semantic parsing on the database operation request using a first major model when a database operation request is received, in order to determine the type of operation request and the object of the operation request.

[0270] The data request control agent is also configured to, when it is determined that the operation request object has an encryption policy, send an encryption / decryption processing request for the operation request object to the encryption / decryption execution agent according to the operation request type.

[0271] An encryption / decryption execution agent is used to determine the optimal resource scheduling scheme from multiple candidate resource scheduling schemes based on a reinforcement learning algorithm when receiving an encryption / decryption processing request for the operation request object; wherein, the multiple candidate resource scheduling schemes are generated by the encryption / decryption execution agent using a second model based on the performance indicators of various types of encrypted resources monitored in real time.

[0272] The encryption / decryption execution agent is also used to perform encryption / decryption processing on the operation request object according to the optimal resource scheduling scheme.

[0273] In some embodiments, the encryption / decryption execution agent determines the optimal resource scheduling scheme from multiple candidate resource scheduling schemes based on a reinforcement learning algorithm, including:

[0274] Based on reinforcement learning algorithms, the rewards for each candidate resource scheduling scheme are determined according to the core performance quantification indicators of each candidate resource scheduling scheme. The core performance quantification indicators include some or all of the following: query latency, resource utilization, and energy consumption.

[0275] Based on the rewards of each candidate resource scheduling scheme, the optimal resource scheduling scheme is determined from the multiple candidate resource scheduling schemes.

[0276] In some embodiments, the data request control agent sends an encryption / decryption processing request for the operation request object to the encryption / decryption execution agent, including:

[0277] If the operation request type is determined to be a query request, determine whether plaintext data of the operation request object exists in the cache;

[0278] If the plaintext data of the operation request object exists in the cache, retrieve the plaintext data of the operation request object from the cache;

[0279] If the plaintext data of the operation request object is not present in the cache, a decryption processing request for the operation request object is sent to the encryption / decryption execution agent.

[0280] In some embodiments, the database encryption system based on large model multi-agent collaboration further includes a pre-decryption agent;

[0281] A pre-decryption agent is used to obtain access record data from the database; it analyzes the access record data from the database using an attention-enhanced sequence model to determine regular data query patterns; it determines the decryption timing of target data based on the regular data query patterns, and when the decryption timing of the target data is reached, it sends a decryption processing request for the target data to the encryption / decryption execution agent; and it stores the decrypted target data in a cache.

[0282] In some embodiments, the database encryption system based on large model multi-agent collaboration further includes a security monitoring agent;

[0283] The data request control agent is also configured to report the database operation request to the security monitoring agent when it is determined that the operation request type is a deletion request.

[0284] A security monitoring agent is used to perform security analysis on the database operation requests.

[0285] In some embodiments, the security monitoring agent is also used to monitor real-time database access behavior.

[0286] For any user, if abnormal behavior of that user is detected, a coordinated threat response will be initiated.

[0287] The threat response linkage process includes one or more of the following:

[0288] Send a session restriction instruction for the user to the data request control agent;

[0289] Trigger key update processing;

[0290] Record audit logs and issue alerts.

[0291] In some embodiments, the database encryption system based on large model multi-agent cooperation further includes a key management agent;

[0292] The key management agent is used to determine whether there is a risk of key leakage based on the context information of key operations and the third major model; if it is determined that there is a risk of key leakage, the agent will update the key for the key with the risk of key leakage.

[0293] In some embodiments, the key management agent updates keys that are at risk of key leakage, including:

[0294] Generate new keys for keys that are at risk of being leaked;

[0295] The newly written data is encrypted using the new key instead of the old key; and...

[0296] The new key is used to re-encrypt the data encrypted with the old key, and the old key is archived or destroyed after the data re-encryption is completed; wherein the old key before being archived or destroyed is allowed to be used for data decryption.

[0297] In some embodiments, the database encryption system based on large model multi-agent collaboration further includes an encryption policy agent;

[0298] An encryption strategy agent is used to periodically scan data and extract metadata from the scanned data. The agent uses a fourth model to perform semantic understanding of the metadata of the scanned data to determine sensitive fields in the scanned data. Based on the field type and business context of the sensitive fields, a security protection strategy for the sensitive fields is generated. The security protection strategy includes one or more of encryption strategies, integrity protection strategies, and de-identification strategies.

Claims

1. A database encryption method based on large model multi-agent cooperation, characterized in that, The application is applied to a database encryption system based on large model multi-agent cooperation, the database encryption system comprises a data request control agent and an encryption and decryption execution agent, and the method comprises the following steps: The data request control agent performs semantic analysis on the database operation request by using a first large model when receiving the database operation request, determines the operation request type and the operation request object; When it is determined that the operation request object has an encryption strategy, the data request control agent sends an encryption / decryption processing request for the operation request object to the encryption and decryption execution agent according to the operation request type; The encryption and decryption execution agent determines an optimal resource scheduling scheme from a plurality of candidate resource scheduling schemes based on a reinforcement learning algorithm when receiving the encryption / decryption processing request for the operation request object; wherein the plurality of candidate resource scheduling schemes are generated by the encryption and decryption execution agent by using a second large model according to the performance indicators of each type of encryption resource monitored in real time; The encryption and decryption execution agent performs encryption / decryption processing on the operation request object according to the optimal resource scheduling scheme.

2. The method of claim 1, wherein, The encryption and decryption execution agent determines an optimal resource scheduling scheme from a plurality of candidate resource scheduling schemes based on a reinforcement learning algorithm, comprising: The encryption and decryption execution agent determines the reward of each candidate resource scheduling scheme according to the core performance quantitative indicators of the current candidate resource scheduling scheme based on a reinforcement learning algorithm; wherein the core performance quantitative indicators include part or all of the number of query delays, resource utilization rates and energy consumptions; An optimal resource scheduling scheme is determined from the plurality of candidate resource scheduling schemes according to the rewards of the candidate resource scheduling schemes.

3. The method of claim 1, wherein, The data request control agent sends an encryption / decryption processing request for the operation request object to the encryption and decryption execution agent, comprising: When it is determined that the operation request type is a query request, the data request control agent determines whether there is clear data of the operation request object in the cache; When there is clear data of the operation request object in the cache, the clear data of the operation request object is obtained from the cache; When there is no clear data of the operation request object in the cache, a decryption processing request for the operation request object is sent to the encryption and decryption execution agent.

4. The method of claim 3, wherein, The database encryption system based on large model multi-agent cooperation further comprises a pre-decryption agent, and the method further comprises the following steps: The pre-decryption agent obtains access record data of a database; The pre-decryption agent analyzes the access record data of the database by using an attention-enhanced sequence model to determine a regular data query mode; The pre-decryption agent determines a decryption timing of target data according to the regular data query mode, and sends a decryption processing request for the target data to the encryption and decryption execution agent when the decryption timing of the target data is reached; The pre-decryption agent stores the decrypted target data in the cache.

5. The method of claim 1, wherein, The database encryption system based on large model multi-agent cooperation further comprises a security monitoring agent, and the method further comprises: In a case where it is determined that the operation request type is a deletion request, the data request control agent reports the database operation request to the security monitoring agent, so that the security monitoring agent performs security analysis on the database operation request.

6. The method of claim 5, wherein, The method further comprises: The security monitoring agent performs real-time database access behavior monitoring; For any user, in a case where it is determined that abnormal behavior of the user is monitored, threat response linkage processing is performed; The threat response linkage processing comprises one or more of the following: sending a session restriction instruction for the user to the data request control agent; triggering key update processing; recording an audit log and alarming.

7. The method of claim 1, wherein, The database encryption system based on large model multi-agent cooperation further comprises a key management agent, and the method further comprises: The key management agent determines whether there is a key leakage risk by using a third large model according to context information of key operation; In a case where it is determined that there is a key leakage risk, the key management agent performs key update for the key with the key leakage risk.

8. The method of claim 7, wherein, The key management agent performs key update for the key with the key leakage risk, comprising: The key management agent generates a new key for the key with the leakage risk; The key management agent uses the new key to replace the old key to encrypt the new write data received; and, The key management agent uses the new key to re-encrypt the data encrypted by the old key, and in a case where the data re-encryption is completed, archives or destroys the old key; wherein the old key before archiving or destroying allows to be used for data decryption.

9. The method of claim 1, wherein, The database encryption system based on large model multi-agent cooperation further comprises an encryption policy agent, and the method further comprises: The encryption policy agent periodically performs data scanning and extracts meta information of the scanned data; The encryption policy agent uses a fourth large model to perform semantic understanding on the meta information of the scanned data, and determines sensitive fields in the scanned data; The encryption policy agent generates a security protection policy for the sensitive fields according to field types of the sensitive fields and business context; wherein the security protection policy comprises one or more of an encryption policy, an integrity protection policy, and a desensitization policy.

10. An electronic device, comprising: comprising: a processor and a memory, wherein: the memory is used to store a computer program; the processor is used to execute the program stored on the memory, and realize the method of any one of claims 1-9.

11. A database encryption system based on large model multi-agent cooperation, characterized in that, comprising: a data request control agent and an encryption and decryption execution agent; wherein: the data request control agent is used to, in a case where a database operation request is received, use a first large model to perform semantic analysis on the database operation request, determine an operation request type and an operation request object; The data request control agent is further configured to, in a case where it is determined that the operation request object exists an encryption policy, send, according to the operation request type, an encryption / decryption processing request for the operation request object to a decryption / encryption execution agent. The decryption / encryption execution agent is configured to, in a case where the encryption / decryption processing request for the operation request object is received, determine, based on a reinforcement learning algorithm, an optimal resource scheduling scheme from a plurality of candidate resource scheduling schemes; wherein the plurality of candidate resource scheduling schemes are generated by the decryption / encryption execution agent according to performance indicators of each type of encryption resource monitored in real time, by using a second large model. The decryption / encryption execution agent is further configured to perform encryption / decryption processing on the operation request object according to the optimal resource scheduling scheme.

Images