Method for authorizing external service and computing device

Abstract

A method for authorizing an external service and a computing device, the method being executed by a large model application server in which first authorization information for the external service is currently stored, the method comprising: updating an authorization update policy according to an authorization update policy set by a developer of a large model application, creating a re-authorization notification task corresponding to the external service; displaying re-authorization reminding information; sending an authorization request to an authorization server in response to an indication of re-authorization by the developer; receiving an identity authentication interface from the authorization server, and performing identity authentication on the developer based on the identity authentication interface; under the condition that the identity authentication is passed, second authorization information is received from the authorization server, the second authorization information comprises second authorization content and a signature of the authorization server to the second authorization content, and the second authorization content comprises an identifier of the developer, a second authorization range and second authorization time information; and storing the second authorization information.

Description

Technical Field

[0001] The embodiments in this specification belong to the field of large language model technology, and in particular relate to a method and computing device for authorizing external services. Background Technology

[0002] The Model Context Protocol (MCP) is an open protocol for connecting Large Language Model (LLM) applications with external data sources and tools. An LLM application can include one or more agents. The agent, acting as the brain of the LLM, understands natural language tasks and performs tasks such as task planning and tool invocation. An LLM application can be an application of the LLM workflow paradigm, which may include multiple pre-defined or agent-planned operational steps.

[0003] MCP provides a unified, machine-readable description of all external services (such as tools and databases), essentially providing a specification for the interaction between agents in LLM applications and external services. The MCP architecture includes the MCP host, MCP clients, and the MCP server. The MCP host, typically referring to the AI ​​application, is the initiator of the interaction. The MCP client, located within the MCP host, is used to discover services provided by the MCP server and to transmit information between the LLM and the MCP server. The MCP server provides external services to the LLM. Specifically, the MCP server connects to external systems such as databases and web services, receives service call requests from the MCP client, forwards these requests to the external systems, receives responses from the external systems, and forwards the responses back to the MCP client, thus providing diverse functionalities for the LLM.

[0004] Open Authorization (OAuth) is an open security protocol that provides an authorization standard for third-party applications to access user resources. Its key feature is the granting of resource access permissions through a token mechanism, preventing third parties from obtaining sensitive information such as user account passwords. The main components of the OAuth framework include: resource owner, resource server, client, and authorization server. The resource owner's resources (such as external services) are stored on the resource server. The client is an application, website, application programming interface (API), or device requesting access to the resources. The client can request authorization from the authorization server. After confirming the resource owner's consent, the authorization server sends an access token to the client, allowing the client to access the resource owner's resources on the resource server based on this token. The access token may specify, for example, the scope of resources the client can access and the duration of access, and includes the authorization server's signature. The resource server verifies the access token by verifying the signature.

[0005] The current MCP service authorization incorporates OAuth-based authentication and access authorization capabilities. A typical scenario involves the LLM application development team completing the development and authorizing the MCP server as the resource owner. This access authorization scheme is unsuitable for scenarios where services are provided externally based on the LLM application; in such cases, the developer needs to provide a long-term authorization for the MCP service. Summary of the Invention

[0006] The purpose of this invention is to provide a method for authorizing external services, enabling long-term authorization of external services in scenarios where LLM-based applications provide services to the outside world.

[0007] This specification provides a method for authorizing external services, executed by a large model application server. The large model application server currently stores first authorization information for the external services. This first authorization information includes first authorization content and a signature of the first authorization content by the authorization server. The first authorization content includes the developer's identifier, a first authorization scope, and first authorization time information. The method includes:

[0008] Based on the authorization update policy set by the developer of the large model application, a reauthorization notification task corresponding to the external service is created, and the reauthorization notification task includes the reauthorization time information;

[0009] Display a reauthorization reminder message based on the time information;

[0010] In response to the developer's instruction to re-authorize, an authorization request is sent to the authorization server, the authorization request including a second authorization scope and the developer's identifier;

[0011] The interface for receiving identity authentication from the authorization server is used to authenticate the developer's identity based on the identity authentication interface;

[0012] If the identity authentication is successful, the system receives second authorization information from the authorization server. The second authorization information includes second authorization content and the authorization server's signature on the second authorization content. The second authorization content includes the developer's identifier, the scope of the second authorization, and the time information of the second authorization.

[0013] Store the second authorization information for use in authorizing the external service within the time range indicated by the second authorization time information.

[0014] A second aspect of this specification provides a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to perform the method described in the first aspect.

[0015] A third aspect of this specification provides a computing device, including a memory and a processor, wherein the memory stores executable code, and the processor executes the executable code to implement the method described in the first aspect.

[0016] A fourth aspect of this specification provides a computer program product including a computer program / instructions that, when executed by a processor, implement the steps of the method described in the first aspect.

[0017] The solution provided in the embodiments of this specification allows the large model application server to create a re-authorization notification task based on the authorization update policy set by the developer. The re-authorization notification task guides the developer to re-authorize, thereby providing the MCP service with long-term authorization from the developer. When an external application calls the LLM application, the LLM application can call the MCP service at any time based on the developer's authorization. Attached Figure Description

[0018] To more clearly illustrate the technical solutions of the embodiments in this specification, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments recorded in this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 This is a system architecture diagram of the embodiments in this specification;

[0020] Figure 2 This is a flowchart illustrating the authorization initialization method in the embodiments of this specification;

[0021] Figure 3 This is a flowchart illustrating the method by which a developer initially authorizes the MCP service in the embodiments of this specification;

[0022] Figure 4 This is a flowchart illustrating the method by which the developer updates the authorization for the MCP service in the embodiments of this specification;

[0023] Figure 5 This is a flowchart illustrating the method for accessing external MCP services in an LLM application, as described in the embodiments of this specification. Detailed Implementation

[0024] To enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this specification, and not all embodiments. Based on the embodiments in this specification, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this specification.

[0025] In this specification, the Large Language Model (LLM) may also be referred to simply as the Large Model. A Large Language Model is a natural language processing model based on deep learning techniques, typically with billions to hundreds of billions or even more parameters, possessing powerful language understanding and generation capabilities. Large Language Models can employ the Transformer architecture or its variants (such as GPT, BERT, etc.), which utilizes an attention mechanism to globally model sequential data, efficiently handling long-distance dependencies and thus performing exceptionally well in natural language tasks. Large Language Models learn the statistical features and semantic relationships of language through pre-training on large-scale corpora, giving them outstanding generalization capabilities. The core capabilities of Large Language Models include, but are not limited to: understanding contextual semantics, generating coherent and grammatically correct text, performing logical reasoning, and handling multi-task scenarios. Its usage typically includes two modes: direct inference and fine-tuning. In direct inference mode, the user guides the Large Language Model to generate specific outputs by designing prompts. Cue words can be task descriptions or instructions in text form, used to stimulate the semantic understanding and generation capabilities of large language models. In fine-tuning mode, large language models are further trained on small-scale datasets in specific domains to optimize their performance on specific tasks. The powerful generalization ability and flexibility of large language models make them an important tool in the field of artificial intelligence, providing efficient and accurate solutions for automated text generation and understanding.

[0026] In some embodiments, large language models can also understand and generate data from other modalities (such as visual and audio data). In this case, large language models can also be called multimodal large language models (MLLMs). MLLMs provide a richer and more natural interactive experience by integrating multiple types of input and output, such as text, images, and sound. The core advantage of MLLMs lies in their ability to process and understand information from different modalities and fuse this information to complete complex tasks. For example, MLLMs can analyze an image and generate descriptive text, or generate a corresponding image based on a text description. This cross-modal understanding and generation capability makes MLLMs widely applicable across multiple fields.

[0027] It should be noted that the key technologies of large language models can be found in the detailed description in the paper "A Survey of Large Language Models" (paper number: arXiv:2303.18223v16, published on March 11, 2025, public link: https: / / doi.org / 10.48550 / arXiv.2303.18223), and will not be repeated here.

[0028] Figure 1 This is a system architecture diagram for an embodiment of this specification. Figure 1 As shown, the system may include an external application server (hereinafter referred to as the external application), an LLM application server, an authorization server, and an MCP server. The client of the external application is installed on the user's mobile terminal. The user connects to the server of the external application through the client, thereby using the functions provided by the external application. The external application pre-configures an LLM Application Programming Interface (API), i.e. Figure 1 The large model application provides an open interface. External applications can invoke services provided by the LLM application (such as question-and-answer services) by sending a request to the LLM application server to call the LLM application API. The MCP server is used to provide external services to the LLM application. It should be understood that the embodiments in this specification are not limited to providing external services through the MCP server, but can be provided through existing external servers based on other protocols. The following description uses the MCP server as an example.

[0029] The LLM application server may contain LLM applications and an LLM application development platform (i.e., Figure 1The system includes modules such as the Large Model Application Open Platform, the MCP Server Management Module, and the MCP Server Authorization Management Service Module (hereinafter referred to as the Authorization Management Module). The LLM application provides an open interface (i.e., the LLM application API) for external applications to call. The MCP proxy responds to MCP access requests sent by the LLM application to access the MCP Server services. The MCP proxy includes multiple MCP Server plugins corresponding to multiple MCP servers. The services provided by the MCP Server include, for example, tool invocation services and interface invocation services.

[0030] The LLM application development platform is used to develop and deploy LLM applications. It includes modules for Agent development, Workflow development, and MCP Server management. Developers can configure the various MCP Server plugins through the MCP Server management module and save the configuration information to a file such as... Figure 1 The MCPServer metadata shown includes configuration information for the MCP Server plugin, which may include authorization method information to limit the authorization method for the MCP service. In this embodiment, the authorization method for the MCP service is limited to authorization by the LLM application developer. The configuration information of the MCP Server plugin may also include the corresponding MCP Server connection address, parameters, and other information. The MCP Server plugin includes an MCP Client, allowing the MCP Client to connect to the MCP Server and invoke the corresponding MCP service based on the MCP Server plugin's configuration information.

[0031] The authorization management module connects to the authorization server to manage authorization information, so as to update the authorization information in a timely manner after the authorization information expires and maintain the validity of the authorization information.

[0032] In one example, an external application provides a photo-based object recognition function. After the external application's client sends the photo to be recognized, the external application calls the LLM application through an interface provided by the LLM application to recognize the photo. Based on this recognition task, after identifying the entity name in the photo, the LLM application can call the knowledge base query service provided by the MCP Server to query the relevant knowledge corresponding to the entity name, and generate a response to be returned to the external application by combining the entity name and its relevant knowledge. In this example, there is a need for the developer to provide a long-term license for the knowledge base query service, so that the LLM application can continuously call the knowledge base query service based on this long-term license each time the external application calls the LLM application.

[0033] The following is for reference. Figures 2-5 This specification describes a flowchart illustrating the method for providing long-term licenses for MCP services in the embodiments of this specification.

[0034] Figure 2 This is a flowchart illustrating the authorization initialization method in the embodiments of this specification.

[0035] like Figure 2 As shown, in step S201, the LLM application server creates the MCP Server plugin.

[0036] Developers can instruct the MCP Server management module within the LLM application server to create MCP Server plugins via its user interface. This instruction can include information such as authorization method, MCP Server connection address, and parameters. The authorization method can restrict authorization of the MCP service to the developer. Specifically, in response to user instructions, the MCP Server management module creates multiple MCP Server plugins corresponding to multiple MCP Servers. As mentioned above, the configuration information of these MCP Server plugins is stored in the MCP Server metadata, including authorization method information, MCP Server connection address, and parameters.

[0037] As mentioned above, the MCP Server plugin created above is deployed in the MCP agent in the LLM application server. It is used to respond to the MCP access request from the LLM application, generate a service access request for a specific MCP server, and send the service access request to the specific MCP server through the MCP client in the MCP agent.

[0038] In step S203, the LLM application server obtains the MCP server protected resource information from the MCP server.

[0039] Specifically, in the LLM application server, the MCP Server management module can connect to the MCP server via the MCP proxy to obtain MCP Server protected resource information.

[0040] The MCP Server protected resource information indicates which resources of the MCP Server require authorization for use.

[0041] In step S205, the LLM application server obtains authorization service information from the authorization server.

[0042] Specifically, in the LLM application server, the MCP Server management module can connect to the authorization server through the authorization management service module to obtain authorization service information from the authorization server.

[0043] The authorization service information includes relevant parameters of the authorization server, such as whether refresh is supported, expiration time, and re-authorization interval.

[0044] In step S207, the LLM application server updates the MCP server metadata.

[0045] After obtaining the MCP Server protection resource information and authorization service information as described above, the MCP Server management module can store the MCP Server protection resource information and authorization service information in the configuration information of the corresponding MCP Server plugin in the MCP Server metadata.

[0046] Figure 3 This is a flowchart illustrating the method by which a developer initially authorizes the MCP service in the embodiments of this specification.

[0047] like Figure 3 As shown, in step S301, the LLM application server sends an authorization request to the authorization server in response to the developer's instruction.

[0048] Specifically, the MCP Server management module receives authorization instructions from developers and can notify the authorization management service module. (See reference) Figure 1 As shown, the authorization management service module first registers the client with the authorization server, and then sends the authorization request to the authorization server through the client.

[0049] The authorization request may include the scope of authorization and a developer identifier. The scope of authorization may include, for example, the granularity of authorization. The granularity may include, for example, the LLM application granularity, the Agent granularity, or the session granularity. When the authorization granularity is at the LLM application level, the authorization request may include the identifiers of one or more LLM applications for which authorization is requested. When the authorization granularity is at the Agent granularity, the authorization request may include the identifiers of one or more Agents for which authorization is requested. When the authorization granularity is at the session granularity, the authorization request may include the session identifier for which authorization is requested (e.g., the identifier of the currently ongoing session). This session identifier is used to uniquely identify the user's current session with the LLM application in an external application. This session refers to the multi-turn interactive dialogue between the user and the LLM application, in which the LLM application possesses contextual understanding and memory coherence. In one implementation, the developer identifier may be the identity identifier of the LLM application's developer. In another implementation, the developer identifier may be information uniquely corresponding to the developer, such as the developer's mobile phone number. The authorization request may also include the identifier of the MCP service to be authorized and / or the identifier of the MCP Server. Additionally, the authorization request may also include MCP access operation permissions, etc.

[0050] In step S303, the authorization server authenticates the user's identity to determine that the operator is the developer corresponding to the developer identifier.

[0051] After receiving the authorization request, the authorization server returns the authentication interface to the client, and then the authorization management service module sends the authentication interface to the MCP Server management module.

[0052] The MCP Server management module can guide developers to log in to the authorization server via an authentication interface, authenticating their identity by having them enter their username and password. After login, the authorization server obtains the identity identifier corresponding to the account and verifies its authenticity by confirming that the identifier matches the one provided in the authorization request. Alternatively, the authorization server can also authenticate developers using SMS verification codes, fingerprints, or other methods. After completing the authentication request, the authorization server will... Figure 1 As shown, the authorization request information (such as the scope of authorization and the time of authorization) can also be displayed to the developer through the MCP Server management system to obtain the developer's authorization to access the resources.

[0053] In step S305, after the authorization server completes the user's identity authentication, it generates authorization information (i.e., a token) based on the authorization request and returns the authorization information to the LLM application server.

[0054] The authorization information includes the authorized content and the authorization server's signature on the authorized content. The authorized content may include a developer identifier, authorization scope, and authorization time information. The authorization scope may include, for example, authorization granularity. For instance, the authorization scope may include authorization scopes of any of the following granularities: session granularity, agent granularity, or LLM application granularity. The authorization time information may include, for example, authorization effective time and authorization expiration time. In one embodiment, the authorized content may also include the identifier of the authorized MCP server and the identifier of the MCP service. The authorization server generates a signature on the authorized content by signing it with its private key, and this signature can be verified using the authorization server's public key.

[0055] The authorization server can return authorization information to the authorization management service.

[0056] In step S307, the LLM application server stores the authorization information.

[0057] Specifically, in the LLM application server, the authorization management service can store the authorization information in the MCP server metadata, specifically in the plugin configuration information corresponding to the MCP server.

[0058] Figure 4 This is a flowchart illustrating the method by which the developer updates the authorization of the MCP service in the embodiments of this specification.

[0059] In step S401, the LLM application server creates a reauthorization notification task based on the authorization update policy set by the developer. In step S403, a token timed refresh task is created based on the authorization update policy set by the developer.

[0060] Before step S301 (or after receiving the authorization information), the MCP Server authorization management service module can obtain the stored authorization service information from the MCP Server metadata and display this authorization service information to the developer through the MCP Server management module. As mentioned above, this authorization service information includes relevant parameters of the authorization server, such as whether refresh is supported, expiration time t1, re-authorization interval t2, etc.

[0061] Developers can formulate authorization update policies based on this authorization service information, such as refreshing the token every t1 and sending a reauthorization notification to developers every t2. This authorization update policy is then input into the MCPServer management module of the LLM application server. The MCPServer management module can send the authorization update policy to the authorization management service module, which can then create scheduled token refresh tasks and reauthorization notification tasks based on this policy.

[0062] In step S405, the LLM application server refreshes the task periodically based on the token and retrieves the authorization information from the authorization server again.

[0063] Specifically, assuming the authorization information currently stored in the MCP Server metadata is the initial authorization information m1 mentioned above, the authorization management service module in the LLM application server, according to the token timed refresh task, refreshes the token every t1 seconds, starting from the effective time T1 in the authorization information m1. Specifically, after a period slightly less than t1 elapsed from the effective time T1, the authorization management service module sends the current soon-to-expire authorization information m1 to the authorization server. The authorization server, verifying that the re-authorization interval t2 has not exceeded the effective time T1 of the initial authorization information m1, generates refreshed authorization information m2. This refreshed authorization information m2 may include, for example, the effective time T1 of the initial authorization information and its own effective time T2. After a period slightly less than t1 elapsed from the effective time T2, the authorization management service module sends the current soon-to-expire authorization information m2 to the authorization server. The authorization server, verifying that the re-authorization interval t2 has not exceeded the effective time T1 of the initial authorization information, generates refreshed authorization information m3.

[0064] In step S407, after the LLM application server obtains the refreshed authorization information from the authorization server each time, it updates the authorization information in the MCP Server metadata, that is, it stores the refreshed authorization information and deletes the expired authorization information.

[0065] It is understood that the above steps S403-S407 are not necessary. For example, if the authorization server does not allow authorization refresh, the developer can be notified periodically by the LLM application server to re-authorize, thereby ensuring that the developer's authorization for the MCP service is valid in the long term.

[0066] In step S409, the LLM application server notifies the developer based on the reauthorization notification task.

[0067] Specifically, the authorization management service module in the LLM application server, based on the reauthorization notification task, determines when the reauthorization interval t2 is about to arrive, starting from the effective time T1 of the initial authorization information m1. It then displays a reauthorization reminder message to the developer through the MCPServer management module, notifying the developer to reauthorize the MCP service. Figure 1 As shown, developers are notified of license renewals / expirations.

[0068] In step S411, the LLM application server sends an authorization request to the authorization server in response to the developer's instruction. In step S411, the authorization server authenticates the developer's identity through the LLM application server. In step S413, after completing the developer's authentication, the authorization server regenerates the authorization information and sends it to the LLM application server.

[0069] Steps S411-S417 can be referred to the above text. Figure 3 The process described is not repeated here.

[0070] Through the above Figures 2-4 As shown in the process, the LLM application server always stores the developer's valid authorization information for the MCP service, so that when an external application calls the LLM application, the LLM application can call the MCP service based on the valid authorization information.

[0071] Figure 5 This is a flowchart illustrating the method for accessing external MCP services in an LLM application, as described in the embodiments of this specification.

[0072] like Figure 5 As shown, in step S501, the external application server sends a large model application call request to the LLM application server.

[0073] External applications can send a request to the LLM application API to invoke the LLM application API. This request includes a session identifier and a prompt for input from the LLM application. In one implementation, the request may also include any of the following: the identifier of the LLM application, the identifier of the Agent included in the LLM application, etc.

[0074] In step S503, the LLM application server generates an MCP service access request based on the LLM application call request, obtains the authorization information corresponding to the MCP service access request, and sends the MCP service access request and authorization information to the MCP server.

[0075] After receiving an LLM application call request, the LLM application server sends the LLM application call request to the LLM application in the LLM server.

[0076] As described above, an LLM application may include one or more Agents, each of which performs tasks based on the LLM. Assuming that any Agent in the LLM application determines, based on the aforementioned Prompt, that it needs to invoke the MCP service, it generates an MCP service invocation request according to the Prompt. This MCP service invocation request may include at least a session identifier.

[0077] When a large model application server connects to multiple MCP servers, the MCP service call request may also include the identifier of the MCP server. When the large model application server can call multiple MCP services, the MCP service call request may also include the identifier of the MCP service to be called, as well as the parameter values ​​of the MCP service. Furthermore, when the MCP service provides multiple access operations, the MCP service call request may also include the identifier of the access operation. For example, in the above example of object recognition by image capture, the MCP service call request may include the parameter values ​​of the MCP service, i.e., the name of the entity to be queried.

[0078] Then, the LLM application can send the MCP service call request to the MCP agent. The MCP agent can call the corresponding MCPServer plugin, obtain the metadata of the MCP Server plugin from the MCP Server metadata, initialize the MCP Server plugin based on the metadata, and determine whether the MCP Server plugin needs authorization.

[0079] If the MCP agent determines that the MCP Server plugin requires developer authorization, it can use the authorization management service module to determine from the MCP Server metadata whether there is currently valid developer authorization information for the session stored.

[0080] As described above, the granularity of this authorization information can include multiple granularities, such as the granularity of the LLM application, the granularity of the Agent, and the granularity of one or more sessions. Specifically, the authorization information at the LLM application granularity indicates that all sessions initiated by the target LLM application have the developer's authorization for the specific MCP service; the authorization information at the Agent granularity indicates that all sessions initiated by the target Agent have the developer's authorization for the specific MCP service; and the authorization information at the one or more session granularity indicates that one or more target sessions have the developer's authorization for the specific MCP service.

[0081] The authorization management service module can determine whether the current session has authorization information based on the authorization information of various granularities stored in the session authorization cache, that is, whether the current session has been authorized to use a specific MCP service at the current time.

[0082] If authorization information is confirmed for the current session, the MCP agent executes the MCPServer plugin based on the MCP service call request, thereby generating an MCP service access request. The MCP service access request and authorization information are then sent to the MCP server. This MCP service access request may include at least a session identifier. When the large model application server is connected to multiple MCP Servers, the MCP service access request may also include the identifier of the MCP Server. When the large model application server can call multiple MCP services, the MCP service access request may also include the identifier of the MCP service to be accessed, as well as the parameter values ​​of the MCP service. Furthermore, if the MCP service provides multiple access operations, the MCP service access request may also include the identifier of the access operation.

[0083] It is understood that although this embodiment describes the execution of the MCP Server plugin by the MCP agent to access the MCP service, this specific implementation is only for illustrative purposes, and the embodiments in this specification are not limited thereto.

[0084] In step S505, the MCP Server calls the MCP service after verifying the authorization information.

[0085] The MCP Server first verifies the signature in the authorization message using the authorization server's public key. After successful signature verification, the MCP Server can verify the current validity of the authorization message based on the authorization time information. Then, the MCP Server can determine whether the developer possesses the specific permissions granted by the authorization server based on local permission records, resource attributes, historical records, etc.

[0086] After the authorization information is verified, the MCP Server calls the specific MCP service according to the parameter values ​​of the MCP service in the MCP service access request, thereby obtaining the access result of the MCP service.

[0087] In step S507, the MCP Server returns the MCP service access result to the LLM application server.

[0088] Specifically, the MCP Server can return the MCP service access result to the MCP Agent, which in turn can return the received MCP service access result to the LLM application. Based on the MCP service access result and the Prompt in the LLM application call request, the LLM application generates a response to the Prompt and returns the response to the external application for presentation to the user.

[0089] The above Figures 2-5The method shown implements a continuous open authorization for the MCP service in the LLM application server, so that when an external application calls the LLM application, the LLM application can call the MCP service at any time based on the developer's authorization.

[0090] In the 1990s, improvements to a technology could be clearly distinguished as either hardware improvements (e.g., improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the methodology). However, with technological advancements, many methodological improvements today can be considered direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved methodology into the hardware circuit. Therefore, it cannot be said that a methodological improvement cannot be implemented using hardware physical modules. For example, a Programmable Logic Device (PLD) (such as a Field Programmable Gate Array (FPGA)) is such an integrated circuit whose logic function is determined by the user programming the device. Designers can program and "integrate" a digital system onto a PLD themselves, without needing chip manufacturers to design and manufacture dedicated integrated circuit chips. Furthermore, nowadays, instead of manually manufacturing integrated circuit chips, this programming is mostly implemented using "logic compiler" software. Similar to the software compiler used in program development, the original code before compilation must be written in a specific programming language, called a Hardware Description Language (HDL). There are many HDLs, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, and RHDL (Ruby Hardware Description Language). Currently, the most commonly used are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should understand that by simply performing some logic programming on the method flow using one of these hardware description languages ​​and programming it into an integrated circuit, the hardware circuit implementing the logical method flow can be easily obtained.

[0091] The controller can be implemented in any suitable manner. For example, it can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicon Labs C8051F320. A memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also recognize that, in addition to implementing the controller in purely computer-readable program code form, the same functionality can be achieved by logically programming the method steps to make the controller take the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers. Therefore, such a controller can be considered a hardware component, and the means included therein for implementing various functions can also be considered as structures within the hardware component. Alternatively, the means for implementing various functions can be considered as both software modules implementing the method and structures within the hardware component.

[0092] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or physical entities, or by products with certain functions. A typical implementation device is a server system. Of course, this application does not exclude the possibility that, with the future development of computer technology, the computer implementing the functions of the above embodiments can be, for example, a personal computer, a laptop computer, an in-vehicle human-machine interaction device, a cellular phone, a camera phone, a smartphone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or any combination of these devices.

[0093] While one or more embodiments of this specification provide the operational steps of the methods described in the embodiments or flowcharts, more or fewer operational steps may be included based on conventional or non-inventive means. The order of steps listed in the embodiments is merely one possible order of execution among many steps and does not represent the only possible order. In actual device or end product execution, the methods shown in the embodiments or drawings may be executed sequentially or in parallel (e.g., in a parallel processor or multi-threaded processing environment, or even a distributed data processing environment). The terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, product, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, product, or apparatus. Without further limitations, the presence of other identical or equivalent elements in the process, method, product, or apparatus that includes the elements is not excluded. For example, the use of terms such as "first," "second," etc., is to denote names and does not indicate any particular order.

[0094] For ease of description, the above devices are described in terms of function, divided into various modules. Of course, when implementing one or more of these specifications, the functions of each module can be implemented in one or more software and / or hardware components, or a module that performs the same function can be implemented by a combination of multiple sub-modules or sub-units. The device embodiments described above are merely illustrative. For example, the division of units is only a logical functional division; in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces, indirect coupling or communication connection between devices or units, and may be electrical, mechanical, or other forms.

[0095] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0096] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0097] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0098] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0099] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0100] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information by any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage, graphene storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0101] Those skilled in the art will understand that one or more embodiments of this specification can be provided as a method, system, or computer program product. Therefore, one or more embodiments of this specification may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, one or more embodiments of this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0102] One or more embodiments of this specification can be described in the general context of computer-executable instructions, such as program modules, that are executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform a particular task or implement a particular abstract data type. One or more embodiments of this specification can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0103] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, system embodiments are basically similar to method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments. In the description of this specification, the terms "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of this specification. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described can be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification and the features of different embodiments or examples.

[0104] The above description is merely an embodiment of one or more embodiments of this specification and is not intended to limit the scope of these embodiments. Various modifications and variations can be made to these embodiments by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this specification should be included within the scope of the claims.

Claims

1. A method for authorizing external services, executed by a large model application server, wherein the large model application server currently stores first authorization information for the external services, the first authorization information including first authorization content and a signature of the first authorization content by the authorization server, the first authorization content including the developer's identifier, first authorization scope, and first authorization time information, the method comprising: Based on the authorization update policy set by the developer of the large model application, a reauthorization notification task corresponding to the external service is created, and the reauthorization notification task includes the reauthorization time information; Display a reauthorization reminder message based on the reauthorization time information; In response to the developer's instruction to re-authorize, an authorization request is sent to the authorization server, the authorization request including a second authorization scope and the developer's identifier; The interface for receiving identity authentication from the authorization server is used to authenticate the developer's identity based on the identity authentication interface; If the identity authentication is successful, the system receives second authorization information from the authorization server. The second authorization information includes second authorization content and the authorization server's signature on the second authorization content. The second authorization content includes the developer's identifier, the scope of the second authorization, and the time information of the second authorization. Store the second authorization information for use in authorizing the external service within the time range indicated by the second authorization time information.

2. The method according to claim 1, further comprising: Based on the authorization update policy set by the developer of the large model application, an authorization refresh task corresponding to the external service is created. The authorization refresh task includes authorization refresh time information, which corresponds to the first authorization time information. Based on the authorization refresh time information, the first authorization information is sent to the authorization server; Receive third authorization information from the authorization server. The third authorization information includes third authorization content and the authorization server's signature on the third authorization content. The third authorization content includes the developer's identifier, the first authorization scope, and the third authorization time information. Store third authorization information for use in authorizing the external service within the time range indicated by the third authorization time information.

3. The method according to claim 1, further comprising: In response to the developer's instructions, a plugin corresponding to the external server is created. The configuration information of the plugin includes authorization method information, connection address of the external server, and parameters. Obtain the protection resource information of the external service from the external server; Obtain authorization service information from the authorization server, and store the protected resource information and the authorization service information in the configuration information of the plugin; The storage of the second authorization information includes storing the second authorization information in association with the configuration information of the plugin.

4. The method according to claim 1, further comprising: In response to the developer's initial authorization instruction, an authorization request is sent to the authorization server, the authorization request including a first authorization scope and the developer's identifier; The interface for receiving identity authentication from the authorization server is used to authenticate the developer's identity based on the identity authentication interface; If the identity authentication is successful, the first authorization information is received from the authorization server.

5. The method according to claim 1, wherein the first authorization scope or the second authorization scope includes authorization scopes of any of the following granularities: agent granularity, large model application granularity, and session granularity.

6. The method according to claim 3, further comprising: In response to a large model application call request from an external application server, an external service access request is generated based on the configuration information of the plugins on the external server. The external service access request includes the session identifier of the session corresponding to the large model application call request. The external service request and the second authorization information are sent to the external server.

7. The method according to claim 6, wherein the external service access request may further include any one of the following: the identifier of the external server; the identifier of the external service; and the parameter value of the external service.

8. The method according to claim 1, wherein the first authorization content or the second authorization content may further include any of the following information: the identifier of the external service, the identifier of the external server, and an indication of whether the large model application server is allowed to automatically refresh the authorization information upon expiration.

9. The method according to claim 1, wherein the external service includes the Model Context Protocol (MCP) service.

10. A computing device comprising a memory and a processor, wherein the memory stores executable code, and the processor, when executing the executable code, implements the method of any one of claims 1-9.

Images