An agent development and safe running method and system based on a private cloud

Abstract

The application discloses a kind of private cloud-based intelligent body development and safe operation method and system.The method first constructs multistage security virtual private cloud architecture;Second, containerized intelligent body platform is deployed in each security domain, application is created through microservice architecture and is bound to exclusive knowledge base, establishes the one-to-one security channel of application-knowledge base based on digital signature;Third, implement fine-grained permission control mechanism, dynamically verify data secret level label using access control model, sensitive information security is guaranteed in combination with privacy technology;Then integrate prompt word optimization engine to improve intelligent body interaction performance, use dynamic load balancing algorithm to realize efficient scheduling of large model cluster;Finally, through AK / SK authentication system, end-to-end security protection chain is built.The application controls from multiple angles to secret-related intelligent body, realizes the safe development and efficient operation of intelligent body under secret-related environment, and guarantees the controllable safety of secret-related knowledge information.

Description

Technical Field

[0001] This invention belongs to the field of cloud computing and artificial intelligence technology, specifically relating to a method and system for the development and secure operation of intelligent agents based on private clouds. Background Technology

[0002] With the rapid development of artificial intelligence technology, intelligent agents are being used more and more widely in various business scenarios. However, in confidential environments, the development and operation of intelligent agents face multiple challenges, including data isolation, access control, and model security. Existing public cloud or ordinary private cloud architectures are insufficient to meet the high security requirements of confidential networks, posing risks of data leakage and unauthorized access. Therefore, there is an urgent need for an architectural solution that can balance the implementation of intelligent agent functions with the secure and controllable handling of confidential data. Summary of the Invention

[0003] To overcome the shortcomings of insufficient data security control during agent development and runtime in classified network environments, high risks of cross-classified access, and low efficiency of large-scale model deployment, this invention provides a method and system for agent development and secure operation based on a private cloud. Through a multi-level security partitioning architecture, dynamic access control mechanisms, and a large-scale model secure cluster deployment strategy, it achieves the goals of full lifecycle management of classified data, compliance assurance in agent development, and efficient inference and training in classified environments. This invention is applicable to agent development and operation scenarios requiring high security.

[0004] To achieve the above objectives, the present invention adopts the following technical solution:

[0005] In a first aspect, the present invention provides a method for the development and secure operation of intelligent agents based on a private cloud. Through multi-level security isolation and access control, it ensures the security and controllability of classified knowledge and information, specifically including the following steps:

[0006] Step 1: Divide the classified network according to its security level, and divide the classified network into Virtual Private Clouds (VPCs) with different security levels.

[0007] Step 2: Deploy the agent platform in each of the partitioned VPCs;

[0008] Step 3: Create an application within each intelligent agent platform, and simultaneously establish a knowledge base corresponding to each application, and set a permission security level control field for the knowledge base; the knowledge base is restricted to access only through the corresponding application; the access data of the knowledge base includes the permission security level control field;

[0009] Step 4: Configure the permission security level parameter in the application, pass the permission security level parameter when calling the application, and retrieve the data that meets the requirements in the knowledge base corresponding to the application;

[0010] Step 5: Use AK / SK (Access Key / Secret Key) authentication to authenticate and manage the permissions of users accessing the application;

[0011] Step 6: Configure the agent to support access to large models and implement cluster deployment of large models, and call model resources according to business needs.

[0012] Secondly, the present invention provides a private cloud-based intelligent agent development and secure operation system, comprising:

[0013] The partitioning module is used to partition classified networks according to their security level, dividing the classified network into VPCs of different security levels;

[0014] The deployment module is used to deploy the agent platform in each of the partitioned VPCs.

[0015] A creation module is used to create applications within each intelligent agent platform, establish a knowledge base corresponding to each application, and set a permission security level control field for the knowledge base; the knowledge base is restricted to access only through the corresponding application; the access data of the knowledge base includes the permission security level control field;

[0016] The application configuration module is used to configure the permission security level parameters in the application, pass the permission security level parameters when calling the application, and retrieve data that meets the requirements from the knowledge base corresponding to the application.

[0017] The authentication module is used to authenticate and manage the permissions of users accessing the application using AK / SK authentication methods.

[0018] The agent configuration module is used to configure agents to support access to large models and to implement cluster deployment of large models, and to call model resources according to business needs.

[0019] Thirdly, the present invention provides an electronic device, comprising: one or more processors; and a memory for storing one or more programs; wherein, when the one or more programs are executed by the one or more processors, the one or more processors enable the aforementioned method for developing and securely operating intelligent agents based on a private cloud.

[0020] Fourthly, the present invention provides a computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, enable the processor to implement the aforementioned method for developing and securely operating intelligent agents based on a private cloud.

[0021] The beneficial effects of this invention are as follows:

[0022] 1. High security: Through VPC security classification, permission security control fields and AK / SK authentication mechanism, and knowledge base data security permission control, multi-layer security protection is achieved to ensure the security and controllability of classified data.

[0023] 2. Flexibility and scalability: Supports cluster deployment and flexible invocation of large models to meet the computing needs of different business scenarios.

[0024] 3. High-efficiency interaction: Optimize the interaction performance of intelligent agents through prompt word engineering technology to improve data processing efficiency and user experience. Attached Figure Description

[0025] Figure 1 This is a flowchart of the method for developing and securely operating intelligent agents based on private clouds according to the present invention.

[0026] Figure 2 This is a flowchart illustrating a method for developing and securely operating intelligent agents based on a private cloud, according to an embodiment of the present invention. Detailed Implementation

[0027] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0028] The term “exemplary” as used herein means “serving as an example, embodiment, or illustration.” Any embodiment illustrated herein as “exemplary” is not necessarily to be construed as superior to or better than other embodiments.

[0029] The terms “first”, “second”, etc., are used to distinguish similar objects, not to describe or indicate a specific order or sequence.

[0030] The term "comprising" or any other similar term is intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus / device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent in such process, method, article, or apparatus / device.

[0031] Furthermore, to better illustrate the present invention, numerous specific details are provided in the following detailed embodiments. Those skilled in the art should understand that the present invention can be practiced without certain specific details. In some instances, methods, means, elements, and circuits well known to those skilled in the art have not been described in detail in order to highlight the spirit of the invention.

[0032] Figure 1 The flowchart illustrates the private cloud-based intelligent agent development and secure operation method of the present invention, as shown below. Figure 1 As shown, the method includes:

[0033] Step 1: Divide the classified network according to its security level, and divide the classified network into VPCs of different security levels.

[0034] For example, step 1 specifically includes: proposing a VPC classification method that conforms to confidentiality standards based on the technical requirements for graded protection of classified information systems, dividing the classified private cloud into three levels: Top Secret, Confidential, and Secret, with each level corresponding to an independent VPC environment. In terms of technical implementation, a Software Defined Network (SDN) architecture is adopted to configure a dedicated Classless Inter-Domain Routing (CIDR) address range, routing table, and Access Control List (ACL) for each VPC level, ensuring logical isolation between VPCs of different classification levels and preventing unauthorized cross-VPC communication. Access control strictly follows the mandatory access control principles in the basic requirements of network security level protection for information security technology, implementing role-based fine-grained permission control through an Identity and Access Management (IAM) system to ensure that users can only access VPC resources matching their classification level.

[0035] Step 2: Deploy the agent platform in each of the partitioned VPCs to provide a runtime environment for the subsequent implementation of agent functions.

[0036] For example, step 2 specifically includes: when deploying the agent platform in each VPC with a defined security level, strictly adhering to the relevant provisions of the technical requirements for graded protection of classified information systems and the basic requirements for network security level protection of information security technology. The security level of the agent platform is determined according to the principle of "choosing the highest security level," meaning the security level of the agent platform must not be lower than the security level of the VPC it resides in, and also not lower than the highest security level of the agent applications and data it hosts. Each agent platform is configured with an independent identity authentication system, using multi-factor authentication (MFA) and attribute-based access control mechanisms to ensure that only approved users can access platform resources of the corresponding security level.

[0037] For example, each VPC deploys only an agent platform that meets the current confidentiality requirements, and the agent platform only accesses data that meets the current security level requirements.

[0038] Step 3: Create an application within each intelligent agent platform, and simultaneously establish a knowledge base corresponding to each application, and set a permission security level control field for the knowledge base; the knowledge base is restricted to access only through the corresponding application; the access data of the knowledge base must contain the permission security level control field information.

[0039] For example, step 3 specifically includes: In the intelligent agent platform, applications are created using a microservice architecture. Each application is automatically associated with an independent knowledge base, and this one-to-one binding relationship is ensured to be tamper-proof through digital signature technology. Strict access control is implemented for knowledge base access, allowing only the corresponding application to access it through an Application Programming Interface (API) gateway, and employing an attribute-based access control model. The knowledge base sets permission level control fields, and all accessed data must contain permission level control fields signed with digital certificates. When accessing data, the system verifies in real time the matching between the application's permission level and the permission level control fields in the data, ensuring that high-level data is not used by low-level applications.

[0040] Step 4: Configure the permission security level parameter in the application, pass the permission security level parameter when calling the application, and retrieve the data that meets the requirements from the knowledge base corresponding to the application.

[0041] For example, step 4 specifically includes: configuring access control security parameters in accordance with the basic requirements for network security level protection in information security technology. The access control parameters are divided into three levels: top secret, confidential, and secret, using an attribute-based access control model. When the application calls the application, the encrypted access control parameters are passed through digital signature technology to ensure the security of the parameter transmission process. During knowledge base retrieval, a dynamic data filtering mechanism is used to compare the access control parameters in the request with the security level tags of the data records, returning only the data with matching permissions.

[0042] For example, the method may further include: applying prompt word engineering techniques in the application to optimize the interaction and data processing performance of the intelligent agent and improve the user experience by constructing a structured prompt template that includes task instructions, example inputs, example outputs, and constraints. Specifically, this includes: when applying prompt word engineering techniques in the intelligent agent application, using a deep learning-based dynamic prompt word optimization algorithm to automatically generate context-related prompt templates by analyzing the user's historical interaction data; the system implements a multi-turn dialogue memory function, dynamically adjusting the prompt word weights using an attention mechanism to improve the accuracy of the intelligent agent's response; and for sensitive information processing, the system integrates differential privacy technology to automatically embed privacy protection parameters into the prompt words.

[0043] For example, the method may further include: using encryption algorithms to encrypt and store user instructions, interaction data, and prompt word parameters throughout their entire lifecycle; combining role-based access control mechanisms to restrict access to sensitive data; and deploying a security audit module to monitor prompt word engineering-related operations in real time, so as to ensure the confidentiality and integrity of interaction data, effectively prevent data leakage risks, and improve the security protection level of intelligent agent interaction.

[0044] Step 5: Use AK / SK authentication to verify the identity and manage the permissions of users accessing the application.

[0045] For example, step 5 specifically includes: authenticating users and applications using AK / SK authentication; implementing a dynamic signature mechanism based on the HMAC-SHA256 algorithm; assigning a unique key pair to each user; and automatically updating the key through a key rotation strategy. Access management employs a role-based access control (RBAC) model, providing fine-grained control over API access scope. To prevent key leakage, all key storage is encrypted with FIPS 140-2 Level 3 certification.

[0046] Step 6: Configure the agent to support access to large models and implement cluster deployment of large models, and call model resources according to business needs.

[0047] For example, step 6 specifically includes: The agent application adopts an agent system architecture that integrates and schedules multi-source large models. It employs a modular design and can simultaneously access open-source and closed-source models through standardized API interfaces. For cluster deployment, distributed computing resource scheduling is implemented based on the Kubernetes container orchestration platform. Model parallelism and pipeline parallelism technologies are used to intelligently shard large model parameters across multiple computing nodes. A dynamic load balancing algorithm monitors the utilization of the Graphics Processing Unit (GPU) in real time and automatically scales computing resources elastically. It should be noted that the large model is only used to provide inference services and computing power; it is not stored and does not retain any data in the knowledge base.

[0048] For example, the large model includes open-source models and closed-source models; the large model supports distributed cluster deployment mode.

[0049] For example, by employing load balancing algorithms and resource scheduling strategies, model resources can be flexibly invoked based on business needs such as business traffic fluctuations and task complexity, thereby enabling the dynamic expansion or contraction of computing nodes.

[0050] For example, the method may further include: implementing multi-level permission authentication and data desensitization mechanisms in the model resource call and data processing stages, limiting the interaction scope of data with different security levels, ensuring that the large model runs stably and efficiently in high-concurrency scenarios, while protecting system data security and business privacy, and reducing security risks in the operation process.

[0051] The present invention provides a method for the development and secure operation of intelligent agents based on private clouds. It divides VPCs according to security levels, ensuring that only intelligent agent platforms meeting current security requirements are deployed within the same VPC. These intelligent agent platforms only access data that meets the current security level requirements, achieving service-level access control. Applications are created within the intelligent agent platform, and a knowledge base corresponding to each application is established. Access to the knowledge base is restricted to the corresponding application, while the application uses AK / SK authentication to verify the identity and manage permissions of accessing users and applications, preventing unauthorized access and achieving application-level access control. Permission security level parameters and control fields are set for the applications on the intelligent agent platform and their associated knowledge bases. When an application calls a knowledge base, the permission security level parameters are passed in, and data meeting the requirements is retrieved from the knowledge base, achieving data-level access control.

[0052] The following examples illustrate the method for developing and securely operating intelligent agents based on private clouds according to the present invention.

[0053] Figure 2 A flowchart illustrating a method for developing and securely operating intelligent agents based on a private cloud, according to an embodiment of the present invention, is shown below. Figure 2 As shown, it may include the following steps:

[0054] Step S1: Divide the VPC according to the security level to divide the classified network into independent network environments with different security levels, thereby achieving basic security isolation.

[0055] Step S1 specifically includes:

[0056] Step S1.1, Security Level Classification and VPC Instantiation:

[0057] Based on the security domain division requirements for the graded protection of classified information systems, three independent security domain levels are created: Top Secret VPC instance, Confidential VPC instance, and Secret VPC instance. Each VPC instance is configured with the following technical parameters:

[0058] (1) Network address space: Non-overlapping private IP address ranges are used and allocated in accordance with RFC 1918 standard;

[0059] (2) Network isolation mechanism: Deploy SDN controller based on OpenFlow 1.5 protocol, and configure independent Virtual Routing and Forwarding (VRF) instance and network ACL policy for each VPC instance.

[0060] Step S1.2, Implementation of access control policy:

[0061] In accordance with the mandatory access control requirements of the basic requirements for network security level protection in information security technology, the following control measures shall be implemented:

[0062] (1) Identity authentication: A two-factor authentication mechanism is adopted, combining digital certificates and dynamic passwords;

[0063] (2) Access Control: The Attribute-Based Access Control (ABAC) model defined by NIST SP 800-162 is adopted. In the IAM system, a "security level" attribute label is set, and the following access rules are implemented:

[0064] ① Access is permitted when the user's security level is greater than or equal to the target VPC's security level.

[0065] ②Prohibit the flow of high-density data to low-density VPCs, which is achieved through Data Labeling Policy (DLP);

[0066] (3) Audit trail: All access records are stored in an encrypted log system that conforms to the FIPS 140-2 Level 3 standard.

[0067] Step S2: Deploy the agent platform in each of the divided VPCs to provide a runtime environment for the subsequent implementation of agent functions.

[0068] Step S2 specifically includes:

[0069] Step S2.1, Determining and Deploying the Security Level of the Intelligent Agent Platform:

[0070] In accordance with the technical requirements for graded protection of classified information systems and the basic requirements for network security level protection of information security technology, the following operations shall be performed:

[0071] (1) Security level determination: The principle of "choosing the higher level" is adopted. The security level of the agent platform is MAX(VPC security level, highest security level of agent application, highest security level of data), where MAX() means taking the maximum value;

[0072] (2) Deployment architecture: Deploy an independent intelligent agent platform instance for each VPC, wherein: the top secret VPC is deployed using physically isolated bare metal servers, the confidential VPC is deployed using Kubernetes-based containerization, and the secret VPC is deployed using a virtual machine cluster.

[0073] Step S2.2, Implementation of secure access control:

[0074] (1) Identity authentication: integrate digital certificate authentication that conforms to the GM / T 0036-2014 standard; implement multi-factor authentication, including biometrics + dynamic token;

[0075] (2) Access control: The attribute-based access control model defined by NIST SP 800-162 is adopted, and attribute labels such as "security permission level" and "department" are set to realize dynamic access control decision.

[0076] Step S3: Create an application within the intelligent agent platform and simultaneously establish a knowledge base that corresponds one-to-one with the application. Restrict access to the knowledge base to the corresponding application only, and set a permission security level control field for the knowledge base. Subsequent access data to the knowledge base must include the aforementioned permission security level control field information.

[0077] Step S3 specifically includes:

[0078] Step S3.1: Creation and binding of applications and knowledge bases:

[0079] (1) Application creation: A microservice architecture is adopted, and each application instance is deployed in an independent Docker container;

[0080] (2) Knowledge base association: A dedicated knowledge base is automatically created for each application, and a binding relationship is established through digital signature. The signature information includes the application ID, knowledge base ID and timestamp.

[0081] Step S3.2, Implementation of access control mechanism:

[0082] (1) API Gateway Configuration: Deploy the API Gateway to generate a unique access token for each application-knowledge base pair;

[0083] (2) Access control: Set attribute tags such as "application security level" and "data category".

[0084] Step S3.3, Data Security Level Management:

[0085] (1) Security Classification Field Settings: The knowledge base has preset security classification control fields with values ​​including top secret, confidential, and secret; the field signature uses a digital certificate defined by the International Organization for Standardization.

[0086] (2) Data access verification: Real-time verification of the matching between the permission security level control field in the data and the application permissions. If they do not match, an emergency response process is triggered.

[0087] Step S4: Configure the permission security level parameter in the application, pass the permission security level parameter when the application is called, and retrieve the data that meets the requirements from the knowledge base.

[0088] Step S4 specifically includes:

[0089] Step S4.1, Configure permission and security level parameters:

[0090] (1) In accordance with the access control provisions of the basic requirements for network security level protection of information security technology, set the access control parameters in the application system;

[0091] (2) Divide the security level into three levels: top secret, confidential, and secret, and configure a digital signature for each access level parameter.

[0092] Step S4.2, Secure Transmission and Verification: When the application makes a call, it transmits the permission level parameters; the server verifies the integrity of the digital signature.

[0093] Step S4.3, Dynamic Data Retrieval Control:

[0094] (1) When retrieving knowledge from the knowledge base, a dynamic data filtering mechanism is implemented;

[0095] (2) Establish real-time comparison rules: return complete data when the requested security level is greater than or equal to the data security level, and return an empty dataset when the requested security level is less than the data security level;

[0096] (3) Record all retrieval operations in the audit log.

[0097] Step S4.4, Anomaly Handling Mechanism: When parameter tampering is detected, a security event response process is triggered. If abnormal access attempts exceed 3 times, the account is locked.

[0098] Step S5: Apply prompt word engineering techniques in the application to optimize the interaction and data processing performance of the intelligent agent.

[0099] Step S5 specifically includes:

[0100] Step S5.1, Optimize dynamic prompt words:

[0101] (1) A prompt word generation model based on the Transformer architecture is adopted to automatically generate context-related prompt templates by analyzing users' historical interaction data;

[0102] (2) To realize the multi-turn dialogue memory function, the weight of prompt words is dynamically adjusted by using the multi-head attention mechanism.

[0103] Step S5.2, Performance Optimization Implementation: Model quantization technology is used to improve the model inference speed.

[0104] Step S6: Use AK / SK authentication to verify the identity and manage the permissions of users and applications to prevent unauthorized access.

[0105] Step S6 specifically includes:

[0106] Step S6.1, Key Generation and Distribution:

[0107] (1) Generate a unique key pair for each user, wherein: the Access Key conforms to the RFC 4122 standard, and the Secret Key conforms to the FIPS 180-4 requirements;

[0108] (2) The key is distributed for encrypted transmission and digital signature is used to verify the identity of the recipient.

[0109] Step S6.2, Implementation of Access Control:

[0110] (1) Role definitions include dimensions such as "operation type" and "resource scope", and follow the principle of least privilege allocation;

[0111] (2) API access control: The Open Policy Agent (OPA) policy engine is used, and the audit logs comply with PCI DSSv4.0 requirements.

[0112] Step S7: Enable the agent to access open-source or closed-source large models and realize the cluster deployment of large models. Flexibly call model resources according to business needs to improve computing power and system stability.

[0113] Step S7 specifically includes:

[0114] Step S7.1, Implementation of Multi-Model Access Architecture:

[0115] (1) The microservice architecture is used to design the access layer, which can uniformly access open source models (such as LLaMA-2) and closed source models (such as GPT-4) through standardized REST API interfaces.

[0116] (2) The protocol conversion function is implemented through the model adapter module, which supports the artificial intelligence model exchange format standard.

[0117] Step S7.2, Distributed Model Deployment: Build a containerized deployment platform, split the model parameters by layer, and set the number of pipeline stages.

[0118] Step S7.3, Dynamic Resource Scheduling:

[0119] (1) Load balancing algorithm implementation: Real-time collection of GPU utilization, and dynamic adjustment of resource allocation based on proportional-integral-derivative (PID) controller;

[0120] (2) Flexible scaling strategy: expand and shrink capacity horizontally and vertically according to industry standards.

[0121] This invention presents a method for the development and secure operation of intelligent agents based on private clouds. First, it constructs a multi-level secure virtual private cloud architecture according to confidentiality standards, employing software-defined networking technology to achieve logical isolation and mandatory access control across multiple security levels. Second, it deploys a containerized intelligent agent platform in each security domain, creating applications and binding them to dedicated knowledge bases through a microservice architecture, establishing a one-to-one secure channel between the application and knowledge base based on digital signatures. Third, it implements a fine-grained permission control mechanism, dynamically verifying data security level labels using an access control model, and combining privacy technologies to ensure the security of sensitive information. Next, it integrates a prompt word optimization engine to improve intelligent agent interaction performance and uses a dynamic load balancing algorithm to achieve efficient scheduling of large model clusters. Finally, it constructs an end-to-end security protection chain through an AK / SK authentication system. This invention manages and controls classified intelligent agents from multiple perspectives, featuring high security, flexibility, and efficient interaction. It is suitable for intelligent agent application scenarios in classified networks, achieving secure development and efficient operation of intelligent agents in classified environments, and ensuring the security and controllability of classified knowledge and information.

[0122] This invention also proposes a private cloud-based intelligent agent development and secure operation system for implementing the aforementioned private cloud-based intelligent agent development and secure operation method. The system includes:

[0123] The partitioning module is used to partition classified networks according to their security level, dividing the classified network into VPCs of different security levels;

[0124] The deployment module is used to deploy the agent platform in each of the partitioned VPCs.

[0125] A creation module is used to create applications within each intelligent agent platform, establish a knowledge base corresponding to each application, and set a permission security level control field for the knowledge base; the knowledge base is restricted to access only through the corresponding application; the access data of the knowledge base includes the permission security level control field;

[0126] The application configuration module is used to configure the permission security level parameters in the application, pass the permission security level parameters when calling the application, and retrieve data that meets the requirements from the knowledge base corresponding to the application.

[0127] The authentication module is used to authenticate and manage the permissions of users accessing the application using AK / SK authentication methods.

[0128] The agent configuration module is used to configure agents to support access to large models and to implement cluster deployment of large models, and to call model resources according to business needs.

[0129] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes and related descriptions of each module of the system described above can be found in the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0130] The present invention also proposes an electronic device, comprising: one or more processors; a memory for storing one or more programs; wherein, when the one or more programs are executed by the one or more processors, the one or more processors enable the aforementioned method for developing and securely operating intelligent agents based on a private cloud.

[0131] The present invention also proposes a computer-readable storage medium storing executable instructions that, when executed by a processor, enable the processor to implement the aforementioned method for developing and securely operating intelligent agents based on a private cloud.

[0132] The contents not described in detail in this specification are existing technologies known to those skilled in the art.

[0133] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above descriptions are merely specific embodiments of the present invention and are not intended to limit the present invention. The above descriptions are exemplary and not exhaustive. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for developing and securely operating intelligent agents based on a private cloud, characterized in that, include: Step 1: Divide the classified network according to its security level, and divide the classified network into Virtual Private Clouds (VPCs) with different security levels; Step 2: Deploy the agent platform in each of the partitioned VPCs; Step 3: Create an application within each intelligent agent platform, and simultaneously establish a knowledge base corresponding to each application, setting a security level control field for the knowledge base. The knowledge base is restricted to access only through the corresponding application. The access data of the knowledge base includes the security level control field. The applications are created based on a microservice architecture, and each application is automatically associated with an independent knowledge base upon creation. The one-to-one binding relationship between the application and the knowledge base is ensured to be tamper-proof through digital signature technology. Strict access control is implemented for the knowledge base, allowing only the corresponding application to initiate access through the API gateway, and an attribute-based access control model is adopted. All access data of the knowledge base must contain a security level control field signed with a digital certificate. When accessing data, the matching between the application's security level and the security level control field in the data is verified in real time to ensure that high-security data is not used by low-security applications. Step 4: Configure the permission security level parameter in the application, pass the permission security level parameter when calling the application, and retrieve the data that meets the requirements in the knowledge base corresponding to the application; Step 5: Use AK / SK authentication to verify the identity and manage the permissions of users accessing the application; Step 6: Configure the agent to support access to large models and implement cluster deployment of large models, and call model resources according to business needs; wherein, the large models are only used to provide inference services and computing power, and are not stored, and will not retain any data in the knowledge base.

2. The method according to claim 1, characterized in that, Each VPC deploys only an agent platform that meets the current confidentiality requirements, and this agent platform only accesses data that meets the current security level requirements.

3. The method according to claim 1, characterized in that, The method further includes: The application employs prompt word engineering techniques to optimize the interaction and data processing performance of the intelligent agent by constructing structured prompt templates that include task instructions, example inputs, example outputs, and constraints.

4. The method according to claim 3, characterized in that, The method further includes: User commands, interaction data, and prompt parameters are all encrypted throughout their entire lifecycle for storage and transmission using encryption algorithms. Combined with role-based access control mechanisms to restrict access to sensitive data, and by deploying a security audit module to monitor prompt engineering-related operations in real time, the confidentiality and integrity of interaction data are ensured, effectively preventing data leakage risks and improving the security protection level of intelligent agent interaction.

5. The method according to claim 1, characterized in that, The large model includes both open-source and closed-source models; the large model supports distributed cluster deployment mode.

6. The method according to claim 1, characterized in that, In step 6, a load balancing algorithm and resource scheduling strategy are adopted to flexibly call model resources according to business needs, so as to realize the dynamic expansion or contraction of computing nodes; the business needs include business traffic fluctuations and task complexity.

7. The method according to claim 1, characterized in that, The method further includes: In the process of model resource access and data processing, a multi-level permission authentication and data anonymization mechanism is implemented to limit the scope of interaction of data with different security levels, so as to ensure that large models run stably and efficiently in high-concurrency scenarios, while protecting data security and business privacy and reducing security risks in the operation process.

8. A private cloud-based intelligent agent development and secure operation system, characterized in that, include: The partitioning module is used to partition classified networks according to their security level, dividing the classified network into VPCs of different security levels; The deployment module is used to deploy the agent platform in each of the partitioned VPCs. A creation module is used to create applications within each intelligent agent platform, establish a knowledge base corresponding to each application, and set permission security level control fields for the knowledge base. The knowledge base is restricted to access only through its corresponding application. The access data of the knowledge base includes the permission security level control fields. The applications are created based on a microservice architecture, and each application is automatically associated with an independent knowledge base upon creation. The one-to-one binding relationship between applications and knowledge bases is ensured to be tamper-proof through digital signature technology. Strict permission control is implemented for access to the knowledge base, allowing only its corresponding application to initiate access through an API gateway, and an attribute-based access control model is adopted. All access data to the knowledge base must contain permission security level control fields signed with digital certificates. During data access, the matching between the application's security level and the permission security level control fields in the data is verified in real time to ensure that high-security data is not used by low-security applications. The application configuration module is used to configure the permission security level parameters in the application, pass the permission security level parameters when calling the application, and retrieve data that meets the requirements from the knowledge base corresponding to the application. The authentication module is used to authenticate and manage the permissions of users accessing the application using AK / SK authentication methods. The agent configuration module is used to configure agents to support access to large models and to implement cluster deployment of large models, and to call model resources according to business needs; wherein, the large models are only used to provide inference services and computing power, and are not stored, and will not retain any data in the knowledge base.

9. An electronic device, characterized in that, include: One or more processors; Memory, used to store one or more programs; Wherein, when one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the method according to any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, It stores executable instructions that, when executed by a processor, enable the processor to perform the method described in any one of claims 1-7.

Images