A password resource compliance monitoring and management platform and method based on multiple AI agents

Abstract

This invention belongs to the field of information security technology and relates to cryptographic compliance monitoring and governance. The platform adopts a bypass architecture that separates business data from the management plane, including an access layer, a data and knowledge hub, an intelligent agent federation collaboration layer, and a governance execution channel. It acquires end-to-end data through non-intrusive data collection and constructs a unified view through a data fusion processing module. The intelligent agent federation collaboration layer uses a task workflow orchestration intelligent agent as the coordinator, collaborating with execution intelligent agents such as situational awareness, compliance auditing, and intelligent operations. Closed-loop governance is achieved based on an OODA loop, and all governance decisions are submitted to human experts for final adjudication. This invention addresses the shortcomings of existing technologies, such as fragmented business and resource monitoring, highly intrusive deployment, lack of intelligent closed-loop governance, and insufficient human-machine collaboration, achieving unified, intelligent, and secure compliance governance of cryptographic resources in a multi-cloud environment.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to a cryptographic resource compliance monitoring and governance platform and method based on multiple AI agents. Background Technology

[0002] With the deepening of enterprise digital transformation and the popularization of multi-cloud and hybrid cloud environments, cryptographic technology, as a core means of ensuring data security, is increasingly widely used. Enterprises typically deploy various heterogeneous cryptographic infrastructures, such as hardware security modules and key management systems. Meanwhile, domestic and international regulations and standards have put forward clear requirements for the compliance of cryptographic applications. Existing technologies mainly rely on dedicated management tools provided by cryptographic equipment manufacturers, cloud service provider consoles, or general IT monitoring platforms. These solutions generally have limitations, with monitoring dimensions limited to a single resource layer and unable to correlate with business application behavior, resulting in compliance risks at the business level (such as the use of weak algorithms, key expiration, etc.) becoming blind spots in monitoring.

[0003] More fundamentally, existing technical solutions typically employ intrusive deployment in their architecture, requiring modifications to business applications or underlying infrastructure, increasing complexity and security risks. In terms of governance models, they remain at the passive alert level, relying on manual processes from discovery to remediation, lacking intelligent closed-loop capabilities. Furthermore, in system design, human intervention is often placed outside the system for post-event approval, failing to achieve real-time decision-making through deep human-machine collaboration. These shortcomings collectively lead to inefficient cryptographic compliance governance, delayed responses, and difficulty adapting to dynamically changing compliance requirements and complex multi-cloud environments. Therefore, there is an urgent need for an innovative technical solution that can achieve end-to-end business and resource connectivity, support non-intrusive deployment, possess intelligent closed-loop governance capabilities, and deeply integrate human-machine collaboration.

[0004] Therefore, this invention proposes a cryptographic resource compliance monitoring and governance platform and method based on multiple AI agents. Summary of the Invention

[0005] This invention provides a cryptographic resource compliance monitoring and governance platform and method based on multiple AI agents. Through the innovative design of "bypass architecture + intelligent agent federation collaboration", it constructs a cryptographic compliance governance system that covers the entire link from business to resources, is non-intrusive, intelligent closed loop and human-machine collaborative, and completely changes the defects of traditional solutions such as fragmented monitoring, intrusive deployment, passive governance and human-machine separation.

[0006] This invention provides a cryptographic resource compliance monitoring and governance platform based on multiple AI agents. It adopts an architecture design that separates the business data plane and the management plane. The management plane monitors and governs the business data plane through a bypass method. The management plane includes access layer components, a data and knowledge hub, an agent federation collaboration layer, and a governance execution channel. The access layer components include a northbound interface module and a southbound interface module. The northbound interface module connects to the business application layer through a standardized interface and collects API call logs, application configurations, and business change events. The southbound interface module connects to the heterogeneous cryptographic resource pool through the adapter interface, collects device operating status, key lifecycle information and configuration parameters, and receives governance instructions to perform configuration change operations. The northbound and southbound interface modules adopt an agentless deployment method, collect data through out-of-band channels, and support breakpoint resume and data supplementation mechanisms. The data and knowledge hub includes a data fusion and processing module and a cryptographic compliance knowledge engine: The data fusion processing module receives heterogeneous data and performs feature extraction, entity alignment and deduplication processing to build a unified end-to-end view of the business application layer and the cryptographic resource layer. The cryptographic compliance knowledge engine is built on a graph database, storing and managing regulatory metadata graphs, business scenario graphs, and device capability graphs. It establishes a four-layer mapping relationship between regulatory clauses, compliance strategies, detection rules, and device capabilities, and provides a shared knowledge base and rule reasoning services. The intelligent agent federation collaboration layer includes task workflow orchestration intelligent agents, intelligent agent collaboration bus, situational awareness intelligent agents, compliance audit intelligent agents, intelligent operation intelligent agents, business cryptography adaptation intelligent agents, and human experts. Each intelligent agent achieves loosely coupled communication through the intelligent agent collaboration bus, forming a star-shaped federation collaboration structure around the data and knowledge hub, and achieving closed-loop governance based on the OODA loop. The governance execution channel includes a governance instruction issuance module, which receives governance decisions approved by humans and issues operation instructions to the cryptographic resource layer through the southbound interface module.

[0007] Preferably, the data fusion processing module processes the following steps: receiving heterogeneous data collected from the north and south via a message queue, extracting key attributes, achieving cross-data source entity alignment and deduplication through string matching and semantic similarity calculation, associating the fused data with the knowledge graph in the cryptographic compliance knowledge engine, and establishing a mapping relationship between business call behavior and the underlying cryptographic resource status. Key attributes include algorithm type, protocol version, and key identifier.

[0008] Preferably, the task workflow orchestration agent is a coordinating agent, responsible for task understanding and planning, subtask decomposition and distribution, execution process monitoring, result summarization and integration, submitting governance decisions to human experts for final adjudication, receiving human adjudication results and distributing them to the corresponding execution agents; the agent collaboration bus is based on message queues to realize task distribution, message routing, event broadcasting and state synchronization, and supports dynamic agent expansion and real-time human-machine interaction.

[0009] Preferably, the situational awareness agent performs business cryptographic compliance situational awareness based on fused data and knowledge graphs, analyzes cryptographic call behavior, identifies algorithm call types, key usage frequency and protocol configuration status, monitors the lifecycle status of keys and certificates, generates early warning notifications for keys and certificates that are about to expire, applies anomaly detection algorithms to identify configuration drift and abnormal call patterns, integrates the evaluation results of compliance, performance and threat dimensions, calculates the business compliance health index, and generates a risk profile report.

[0010] Preferably, the compliance audit agent uses natural language processing technology to parse cryptographic regulations, extract compliance requirements and constraints, and transform them into executable business strategy templates. Based on the strategy templates, it scans the code configuration and cryptographic call records of business applications, detects non-compliance items, performs correlation analysis with risk data, assesses business impact and risk transmission paths, and generates compliance audit reports and rectification work orders. Non-compliant items include the use of weak encryption algorithms, insecure protocol configurations, violations of key lifecycle rules, and hard-coded credentials.

[0011] Preferably, the intelligent operation agent receives governance decisions approved by humans, simulates execution in an isolated environment through shadow mode to assess potential impact before execution, executes governance tasks, automatically creates a snapshot of the target system state before execution, records complete operation logs during execution to form an immutable audit trail, and automatically triggers a rollback mechanism based on the snapshot to restore the state to the state before execution when execution fails, and generates an anomaly report to notify human experts for review. The governance tasks include configuration updates, key rotation, and log archiving.

[0012] Preferably, the business cryptography adaptation intelligent agent generates compliance templates and integration guidelines based on rectification work orders and best practices, simulates business change scenarios to pre-assess compliance risks, compares the business compliance health index before and after governance to verify the governance effect, collects business feedback and regulatory update information, triggers incremental updates of the knowledge graph of the cryptography compliance knowledge engine, and realizes the continuous evolution of the knowledge engine.

[0013] Preferably, human experts interact with each agent in real time through an intelligent agent collaboration bus, participating in knowledge teaching, process consultation, and experience transfer, and making final decisions on governance decisions. A two-factor judgment is made based on the risk level and the confidence level output by the agent: confidence level ≥ 80% is high confidence level, 50% ≤ confidence level < 80% is medium confidence level, and confidence level < 50% is low confidence level. Low-risk + high confidence level matters can be confirmed in batches, medium-risk matters need to be reviewed and confirmed, and high-risk or low confidence level matters need to be evaluated in detail before being decided. The decision results adopt an electronic signature mechanism to ensure the traceability of the operation.

[0014] Preferably, it supports private deployment in multi-cloud and hybrid cloud environments, is compatible with locally deployed large language models and domestically produced hardware devices, and manages various cryptographic resources through active scanning discovery, interface probing, manual registration, or expert-agent collaborative teaching methods. The expert-agent collaborative teaching mode supports human experts to impart the capability characteristics and operational experience of cryptographic resources to the agent through interactive dialogue, example demonstrations, or knowledge annotation. After learning, the agent can automatically identify similar devices and infer the corresponding capability attributes.

[0015] This invention provides a method for compliance monitoring and governance of cryptographic resources based on multiple AI agents, applied to the above platform, and includes the following steps: Step 1: Build a cryptographic compliance knowledge engine. Based on a graph database, establish a regulatory metadata graph, a business scenario graph, and a device capability graph to form a four-layer mapping relationship between regulatory clauses, compliance strategies, detection rules, and device capabilities. Step 2: Establish a business asset knowledge base and connect it to the enterprise configuration management database, asset management system, application publishing platform or metadata management platform to form a unified asset view of business applications and data resources; Step 3: Establish a cryptographic resource knowledge base, and manage heterogeneous cryptographic resources through proactive scanning and discovery, interface probing, manual registration, or expert-agent collaborative teaching methods to form a unified asset view of cryptographic infrastructure; Step 4: Deploy a non-intrusive data acquisition channel, establish bidirectional acquisition channels to the north and south through out-of-band channels, and configure breakpoint resume and data supplementation mechanisms; Step 5: Perform multi-source heterogeneous data fusion processing, extract key attributes, and achieve entity alignment and deduplication to build a unified end-to-end view of the business application layer and the cryptographic resource layer; Step Six: Perform business cryptographic compliance situational awareness and generate a business compliance health index and risk profile report; Step 7: Perform compliance strategy analysis and audit testing, and generate a compliance audit report and rectification work order; Step 8: Implement intelligent decision-making and human adjudication. Generate governance decision recommendations through two-factor judgment, and then proceed to the implementation stage after approval by human experts. Step 9: Perform automated governance and remediation operations, ensuring execution security through shadow mode verification and state snapshot rollback mechanisms; Step 10: Perform business adaptation and closed-loop optimization, verify the governance effect and trigger incremental updates of the knowledge graph, and enter the next round of governance process based on OODA loop.

[0016] The beneficial effects of this invention compared to existing technologies are as follows: By adopting a bypass architecture that separates the business data plane from the management plane, and constructing a closed-loop governance system with a multi-agent federated collaboration layer at its core, it effectively overcomes the fundamental defects of existing cryptographic resource management technologies. First, it solves the problems of limited monitoring dimensions and the separation between the business layer and the resource layer in traditional technologies, achieving end-to-end monitoring from business applications to cryptographic resources. Second, it eliminates the system complexity, performance impact, and security risks caused by deploying agent programs or modifying code through non-intrusive data collection. Third, it upgrades the passive alarm mode to an intelligent closed-loop governance based on the OODA loop, significantly improving the automation level and response efficiency from risk discovery to remediation verification. Fourth, it innovatively integrates human experts deeply into the agent collaboration system, ensuring that high-risk decisions are ultimately decided by humans while maintaining governance efficiency, thus balancing intelligence and controllability.

[0017] Other features and advantages of the invention will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the invention. The objects and other advantages of the invention may be realized and obtained by means of the structures particularly pointed out in this application.

[0018] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description

[0019] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings: Figure 1 This is an overall architecture design diagram of the cryptographic resource compliance monitoring and governance platform based on multiple AI agents in this embodiment of the invention; Figure 2 This is a flowchart illustrating the overall process of the cryptographic resource compliance monitoring and governance method based on multiple AI agents in this invention. Figure 3 This is a schematic diagram of the continuous governance phase based on the OODA loop in an embodiment of the present invention; Figure 4 This is a flowchart of the OODA loop governance process in an embodiment of the present invention; Figure 5 This is a structural diagram of the cryptographic compliance knowledge engine in an embodiment of the present invention; Figure 6 This is a flowchart illustrating the intelligent decision-making and manual adjudication process in an embodiment of the present invention; Figure 7 This is a flowchart illustrating the automated governance execution process in an embodiment of the present invention; Figure 8This is a schematic diagram of the expert-agent collaborative teaching mode in an embodiment of the present invention. Detailed Implementation

[0020] The preferred embodiments of the present invention will be described below with reference to the accompanying drawings. It should be understood that the preferred embodiments described herein are for illustration and explanation only and are not intended to limit the present invention.

[0021] like Figures 1 to 8 As shown, the present invention provides an embodiment of a cryptographic resource compliance monitoring and governance platform based on multiple AI agents. It adopts an architecture design that separates the business data plane and the management plane. The management plane monitors and governs the business data plane through a bypass method. The management plane includes an access layer component, a data and knowledge hub, an agent federation collaboration layer, and a governance execution channel. The access layer components include a northbound interface module and a southbound interface module. The northbound interface module connects to the business application layer through a standardized interface and collects API call logs, application configurations, and business change events. The southbound interface module connects to the heterogeneous cryptographic resource pool through the adapter interface, collects device operating status, key lifecycle information and configuration parameters, and receives governance instructions to perform configuration change operations. The northbound and southbound interface modules adopt an agentless deployment method, collect data through out-of-band channels, and support breakpoint resume and data supplementation mechanisms. The data and knowledge hub includes a data fusion and processing module and a cryptographic compliance knowledge engine: The data fusion processing module receives heterogeneous data and performs feature extraction, entity alignment and deduplication processing to build a unified end-to-end view of the business application layer and the cryptographic resource layer. The cryptographic compliance knowledge engine is built on a graph database, storing and managing regulatory metadata graphs, business scenario graphs, and device capability graphs. It establishes a four-layer mapping relationship between regulatory clauses, compliance strategies, detection rules, and device capabilities, and provides a shared knowledge base and rule reasoning services. The intelligent agent federation collaboration layer includes task workflow orchestration intelligent agents, intelligent agent collaboration bus, situational awareness intelligent agents, compliance audit intelligent agents, intelligent operation intelligent agents, business cryptography adaptation intelligent agents, and human experts. Each intelligent agent achieves loosely coupled communication through the intelligent agent collaboration bus, forming a star-shaped federation collaboration structure around the data and knowledge hub, and achieving closed-loop governance based on the OODA loop. The governance execution channel includes a governance instruction issuance module, which receives governance decisions approved by humans and issues operation instructions to the cryptographic resource layer through the southbound interface module.

[0022] In this embodiment, the business data plane refers to the set of hardware and software environments that support the operation of the enterprise's core business, including various business application systems and heterogeneous cryptographic resource pools. Business applications and cryptographic resources interact directly through dedicated business call channels to realize cryptographic services such as encryption and signing. The platform does not intervene in the business data flow of this channel to ensure that business operations are not affected. The management plane is an independent architecture layer specifically used for compliance monitoring and governance of cryptographic resources. It obtains relevant information from the business data plane in a non-intrusive manner through a bypass and performs governance operations. The separation of the two designs can avoid the interference of governance behavior with business continuity.

[0023] In this embodiment, the access layer component serves as the interface bridge for data interaction between the management plane and the business data plane. The standardized interfaces of the northbound interface module include common interface types such as RESTful API and WebService, which can connect to various business applications such as e-commerce transaction systems and financial core systems. The collected API call logs include information such as call time, interface address, and request parameters. The application configuration covers content such as encryption algorithm selection and key storage path. Business change events include application version updates and functional module adjustments. The adaptable interfaces of the southbound interface module can be customized according to the private protocols of different manufacturers' cryptographic devices, adapting to heterogeneous cryptographic resources such as hardware security modules, key management systems, and virtual cryptographic machines. The collected device operating status includes indicators such as CPU utilization and memory usage. Key lifecycle information includes key generation time, validity period, and rotation records. Configuration parameters include protocol version and encryption strength.

[0024] In this embodiment, the Agentless deployment method refers to collecting data through out-of-band channels such as network sniffing, log reading, and device native management interfaces without installing any agent programs or modifying code in business applications or cryptographic devices. The out-of-band channel is a dedicated communication channel independent of the business data transmission channel. The breakpoint resume mechanism can continue transmitting unfinished data from the breakpoint when data transmission is restored after a network interruption. The data supplementation mechanism can automatically collect data for the missing period after the interface recovers from an anomaly, ensuring the integrity of data collection.

[0025] In this embodiment, the feature extraction of the data fusion processing module is to filter out key information related to cryptographic compliance from heterogeneous data, such as extracting algorithm type and key identifier from API call logs, and extracting protocol version and running status from device operation data; entity alignment is to associate and match information describing the same business application or cryptographic device in different data sources through string matching, semantic similarity analysis, etc., for example, associating the business system name with the corresponding cryptographic device call record; deduplication is to remove duplicate data to avoid data redundancy affecting the analysis results; the end-to-end unified view integrates the entire process data of business application calling cryptographic resources, forming a complete data link visualization presentation from business initiation, cryptographic service call to result return, which is convenient for tracing the source of compliance risks.

[0026] In this embodiment, the graph database of the cryptographic compliance knowledge engine adopts professional graph database products such as Neo4j and NebulaGraph. The regulatory metadata graph stores the provisions of the "Cryptography Law of the People's Republic of China", GM / T series standards, NIST framework and other regulations, as well as the hierarchical and referential relationships between the provisions. The business scenario graph models the cryptographic call patterns under different business scenarios such as e-commerce payment and government data transmission, including data flow, encryption requirements, key usage frequency and so on. The device capability graph describes the functional characteristics of various cryptographic resources, such as algorithm types, protocol versions, key specifications, and performance indicators. The four-layer mapping relationship transforms abstract regulatory provisions into executable compliance policies, then breaks down the compliance policies into specific detection rules, and finally matches the detection rules with the capabilities of cryptographic devices. For example, the regulatory provision that "symmetric key length is not less than 128 bits" is transformed into a compliance policy of "checking the key length of all symmetric encryption operations", and then broken down into detection rules of "scanning key configuration, extracting length attributes, and comparing with the 128-bit threshold", and finally matching cryptographic devices that support the generation of keys of 128 bits or more.

[0027] In this embodiment, the intelligent agent federation collaboration layer is the core of the platform's intelligent closed-loop governance. The task workflow orchestration intelligent agent, as a coordinating intelligent agent, can receive user-initiated tasks such as compliance audits and risk handling, decompose them into sub-tasks such as situational awareness, compliance detection, and governance execution, and distribute them to the corresponding execution intelligent agents. At the same time, it monitors the execution progress of sub-tasks, summarizes the execution results, and submits them for manual adjudication. The intelligent agent collaboration bus is based on message queue technologies such as Kafka and RabbitMQ to realize message transmission, task distribution, and state synchronization between intelligent agents. It supports the rapid access and dynamic expansion of new intelligent agent modules and also supports human experts to issue instructions and transfer knowledge to intelligent agents through the bus. The anomaly detection algorithms of the situational awareness intelligent agent include isolated forests, LSTM autoencoders, etc., which can identify behaviors that deviate from the normal baseline, such as abnormal fluctuations in key call frequency and unauthorized algorithm use. The business compliance health index is a comprehensive quantitative score that integrates multiple dimensions of indicators such as compliance compliance rate, risk level, and equipment stability. The risk profile report includes information such as risk type, scope of affected business, and urgency.

[0028] In this embodiment, the natural language processing technology of the compliance audit agent can parse the compliance requirements and constraints in the regulatory text. For example, it can extract the core requirement of "keys must be rotated every 90 days" from the regulatory clauses and convert it into an automatically executable business strategy template. Then, based on the template, it can scan the key management records of the business application to detect non-compliance items such as keys that have expired and not been rotated. Correlation analysis can assess the chain risks that non-compliance items may cause, such as the risk of data leakage that may be caused by the cracking of weak encryption algorithms. The compliance audit report includes a description of non-compliance items, risk level, impact assessment and rectification suggestions. The rectification work order clarifies the responsible party for rectification, the rectification period and specific rectification operations.

[0029] In this embodiment, the governance decisions received by the intelligent operation agent include operation instructions such as configuration optimization, key rotation, and log archiving. The shadow mode verification before execution is performed in a simulated environment isolated from the production environment to assess the potential impact of the operation on system performance and business availability. The transactional mechanism during execution ensures the atomicity of the operation, that is, the operation is either fully executed or not executed at all, avoiding system anomalies caused by partial execution. The immutable audit trail means that the operation log is stored in an append-only manner and cannot be modified or deleted, ensuring that the operation is traceable. The rollback mechanism in case of execution failure can restore the normal state before the operation is executed based on the system state snapshot created before execution.

[0030] In this embodiment, the compliance templates generated by the business cryptography adaptation agent include cryptography application integration specifications, key management process templates, etc., which can be directly reused by the business development team during system development. Simulating business change risks refers to pre-assessing the compliance risks that changes may introduce before upgrading or adjusting business systems, such as the risk of unauthorized cryptography service calls that may exist in newly added business modules. Incremental knowledge graph updates refer to supplementing the three types of knowledge graphs of the cryptography compliance knowledge engine with new information such as compliance issues reported by the business and newly released regulatory requirements, so as to realize the continuous evolution of the knowledge engine.

[0031] In this embodiment, human experts, as participants in human-machine collaboration, can impart knowledge such as cryptographic device configuration experience and compliance judgment rules to intelligent agents through the intelligent agent collaboration bus. The adjudication of governance decisions includes batch confirmation of low-risk matters, review of medium-risk matters, and detailed assessment of high-risk matters. The electronic signature mechanism can record the identity of the adjudicator, the adjudication time, and the adjudication content, ensuring that the adjudication operation is traceable and avoiding unclear responsibilities.

[0032] In this embodiment, after receiving the governance decision approved by the human, the governance instruction issuing module of the governance execution channel converts it into operation instructions that can be recognized by the cryptographic device, and issues them to the target cryptographic resource through the southbound interface module to perform governance operations such as configuration change and key rotation, forming a complete governance closed loop from risk discovery, decision adjudication to execution and repair.

[0033] In this embodiment, the OODA loop refers to a closed-loop governance process based on observation (situational awareness), orientation (compliance audit), decision-making (intelligent decision-making and manual adjudication), and action (automated governance). Each step is advanced sequentially and continuously iterated. Through business adaptation and closed-loop optimization, the governance strategy and knowledge engine are continuously improved to enhance the accuracy and efficiency of compliance governance.

[0034] In this embodiment, the star-shaped federated collaboration structure is centered on a data fusion processing module and a cryptographic compliance knowledge engine. Each agent is connected to the core component through an agent collaboration bus to achieve data sharing and collaborative work. This structure facilitates independent upgrades and functional expansion of each agent, enhancing the platform's flexibility and scalability.

[0035] Furthermore, the data fusion processing module processes the following steps: it receives heterogeneous data collected from the north and south via a message queue, extracts key attributes, performs cross-data source entity alignment and deduplication through string matching and semantic similarity calculation, associates the fused data with the knowledge graph in the cryptographic compliance knowledge engine, and establishes a mapping relationship between business call behavior and the underlying cryptographic resource status. Key attributes include algorithm type, protocol version, and key identifier.

[0036] In this embodiment, the data fusion processing module specifically processes the following: by using message queue technologies such as Kafka and RabbitMQ, it receives heterogeneous data such as API call logs, application configurations, and business change events collected by the northbound interface module, and device operating status, key lifecycle information, and configuration parameters collected by the southbound interface module, to ensure high throughput and low latency of data transmission.

[0037] In this embodiment, the key attribute extraction step focuses on core information directly related to cryptographic compliance, specifically including algorithm type, protocol version, and key identifier: the algorithm type covers specific categories such as symmetric encryption algorithms, asymmetric encryption algorithms, and hash algorithms, such as AES, RSA, and SHA-256; the protocol version refers to the communication protocol version used when business applications interact with cryptographic devices, such as TLS 1.2 and TLS 1.3; the key identifier is a unique identification information assigned to each key, used for the entire lifecycle operations of key generation, invocation, rotation, and revocation.

[0038] In this embodiment, cross-data source entity alignment is achieved through string matching and semantic similarity calculation: string matching targets standardized fields such as device names and application identifiers, directly comparing character consistency to complete the association; semantic similarity calculation targets non-standardized descriptions, analyzing text semantics through natural language processing technology, for example, determining "hardware encryption module" and "HSM" as the same entity, achieving accurate association of the same business application or cryptographic device in different data sources; deduplication is carried out by comparing key attribute combinations to eliminate redundant data collected repeatedly, ensuring data uniqueness.

[0039] In this embodiment, associating the fused data with the knowledge graph in the cryptographic compliance knowledge engine means mapping and matching the extracted key attributes such as algorithm type, protocol version, and key identifier with the compliance requirements in the regulatory metadata graph, the application requirements in the business scenario graph, and the support scope in the device capability graph. Ultimately, this establishes a correspondence between the behavior of business applications calling cryptographic services and the operating status of underlying cryptographic resources, providing associated data support for subsequent compliance situation awareness and audit detection.

[0040] Furthermore, the task workflow orchestration agent is a coordinating agent, responsible for task understanding and planning, subtask decomposition and distribution, execution process monitoring, and result aggregation and integration. It submits governance decisions to human experts for final adjudication, receives human adjudication results, and distributes them to the corresponding execution agents. The agent collaboration bus is based on message queues to realize task distribution, message routing, event broadcasting, and state synchronization, and supports dynamic agent expansion and real-time human-machine interaction.

[0041] In this embodiment, the task workflow orchestration agent, as a coordinating agent, is the core coordination hub of the agent federation collaboration layer. Its task understanding and planning functions can analyze the business needs initiated by users, such as compliance audits and risk handling. Combined with the knowledge graph of the cryptographic compliance knowledge engine, it can clarify the task objectives, execution steps and required agent resources. For example, the "quarterly cryptographic compliance audit" task can be planned as key links such as situational awareness, compliance detection and report generation.

[0042] In this embodiment, the subtask decomposition and distribution function breaks down complex tasks into multiple independently executable subtasks according to business logic, and distributes them to the corresponding intelligent agents according to the functional positioning of each execution-type intelligent agent. For example, the compliance audit task is broken down into "legal clause analysis", "non-compliance item detection" and "risk assessment" subtasks, which are distributed to the compliance audit intelligent agent and the situational awareness intelligent agent for collaborative execution, respectively. The distribution process is realized through the intelligent agent collaboration bus to ensure accurate transmission of subtask instructions.

[0043] In this embodiment, the execution process monitoring function receives real-time task progress feedback from each execution-type intelligent agent and tracks the execution status of sub-tasks, including whether the task has started, whether any abnormalities have occurred during execution, and whether the preset node has been reached. For example, it monitors the regulatory analysis progress of the compliance audit intelligent agent and the governance operation execution status of the intelligent operation intelligent agent. If a task times out or fails to execute, it automatically triggers a retry or alarm mechanism.

[0044] In this embodiment, the result aggregation and integration function collects the execution results of all sub-tasks, performs data cleaning, correlation analysis and logical integration to form a complete task result. For example, it integrates the risk profile of the situational awareness agent and the non-compliance list of the compliance audit agent into a comprehensive compliance audit report, extracts core conclusions and governance suggestions, and provides unified data support for manual adjudication.

[0045] In this embodiment, the governance decision submission and adjudication result reception function transforms the integrated task results into structured governance decision suggestions, including suggested governance operations, expected effects, and potential risks, and submits them to human experts through the intelligent agent collaboration bus; at the same time, it receives the adjudication results (approval, rejection, adjustment) of human experts and synchronizes the adjudication results to the corresponding execution intelligent agents to ensure that the governance process proceeds according to human decision-making.

[0046] In this embodiment, the agent collaboration bus implements underlying communication based on message queue technologies such as Kafka and RabbitMQ. The task distribution function can accurately route the instructions of the task workflow orchestration agent to the target agent according to the agent identifier. The message routing function supports path planning according to message type and priority, such as prioritizing the transmission of high-priority risk handling instructions. The event broadcasting function can synchronize public events such as updates to cryptographic regulations and changes in system status to all relevant agents. The status synchronization function ensures that each agent shares information such as task progress and data results in real time, maintaining collaborative consistency.

[0047] In this embodiment, the dynamic expansion function of intelligent agents supports the addition of new intelligent agent modules to the collaboration bus through standardized interfaces without modifying the existing intelligent agent architecture. For example, when adding a "cryptographic device vulnerability scanning intelligent agent", only the interface protocol needs to be configured to work collaboratively with the existing intelligent agents. The real-time human-machine interaction function supports human experts to issue instructions, transfer knowledge, and approve decisions to intelligent agents through operating terminals. For example, human experts can issue task adjustment instructions to the task workflow orchestration intelligent agent through the bus, or supplement the regulatory interpretation rules to the compliance audit intelligent agent.

[0048] Furthermore, the situational awareness agent performs business cryptographic compliance situational awareness based on fused data and knowledge graphs, analyzes cryptographic call behavior, identifies algorithm call types, key usage frequency and protocol configuration status, monitors the lifecycle status of keys and certificates, generates early warning notifications for keys and certificates that are about to expire, applies anomaly detection algorithms to identify configuration drift and abnormal call patterns, integrates evaluation results from compliance, performance and threat dimensions, calculates the business compliance health index, and generates risk profile reports.

[0049] In this embodiment, the situational awareness agent's parsing of password call behavior refers to performing in-depth analysis of API call logs and protocol interaction data generated during the interaction between business applications and password resources, extracting key interaction information from the data, and clarifying the specific behavioral details of business applications calling password services.

[0050] In this embodiment, algorithm call type identification refers to distinguishing the specific cryptographic algorithm categories used by business applications in operations such as encryption, signing, and signature verification, including symmetric encryption algorithms, asymmetric encryption algorithms, hash algorithms, etc., such as AES, RSA, SHA-256, SM4, etc. At the same time, it identifies whether the algorithm belongs to a deprecated weak encryption algorithm, providing a basis for compliance testing.

[0051] In this embodiment, the key usage frequency statistics refer to recording the number of times a specific key is called within a preset time period to form a key call frequency curve. By comparing it with the historical baseline, keys that are called abnormally frequently or have not been used for a long time can be identified. The former may pose a risk of malicious attack, while the latter may indicate a problem with key management.

[0052] In this embodiment, protocol configuration status recognition refers to detecting the protocol type and version used when the business application communicates with the cryptographic device, such as TLS 1.2, TLS 1.3, SSH, etc., and verifying whether the protocol configuration parameters comply with security specifications, such as whether insecure encryption suites are disabled or whether authentication mechanisms are enabled, and identifying insecure protocol configurations.

[0053] In this embodiment, monitoring the lifecycle status of keys and certificates refers to tracking the entire process of keys from generation, activation, rotation, revocation to destruction, as well as the status of certificates such as issuance, effectiveness, expiration, and revocation. A lifecycle ledger is established, and status information is updated in real time to ensure that the status of each key and certificate can be accurately controlled.

[0054] In this embodiment, the warning for keys and certificates that are about to expire refers to a preset warning period. When the remaining validity period of a key or certificate is less than the warning period, a warning notification is automatically generated. The notification content includes information such as key / certificate identifier, current validity period, associated business application, and suggested rotation / update time. It supports triggering proactive rotation reminders based on preset strategies to avoid business interruption due to expiration.

[0055] In this embodiment, the anomaly detection algorithm includes algorithms such as isolated forest, LSTM autoencoder, and statistical baseline comparison. Configuration drift identification refers to detecting whether the configuration parameters of the cryptographic device deviate from the initial configuration baseline or security configuration standard, such as changes in algorithm activation status or key length adjustment. Abnormal call pattern identification refers to identifying cryptographic service call behaviors that deviate from normal patterns, such as high-frequency calls outside of working hours, calls initiated by unauthorized IP addresses, and batch calls that exceed business requirements.

[0056] In this embodiment, compliance assessment refers to evaluating whether cryptographic call behavior, key management, protocol configuration, etc., comply with the requirements of the "Cryptography Law of the People's Republic of China" and the GM / T series standards, based on the regulatory requirements and detection rules in the cryptographic compliance knowledge engine; performance assessment refers to analyzing the operating status indicators of cryptographic devices, such as CPU utilization, memory usage, and request response time, to determine whether the device is in normal operating condition and whether there are performance bottlenecks; threat assessment refers to identifying potential security threats such as malicious attacks and unauthorized access during cryptographic service calls by combining network security threat intelligence.

[0057] In this embodiment, the business compliance health index is a comprehensive quantitative indicator that integrates the evaluation results of compliance, performance and threat dimensions. It is calculated by setting reasonable weights for each dimension and using a weighted summation method. The index range can be set from 0 to 100 points. The higher the score, the better the business password compliance status, which intuitively reflects the overall health level of password use in business applications.

[0058] In this embodiment, the risk profile report is the core output of the situational awareness agent. It includes risk type (such as weak algorithm usage, key expiration risk, configuration drift, abnormal calls, etc.), risk impact scope (related business applications, cryptographic resources, data assets, etc.), risk urgency level (high, medium, and low), risk description, potential harm, and preliminary handling suggestions, providing a clear risk basis for subsequent compliance audits and governance decisions.

[0059] Furthermore, the compliance audit agent uses natural language processing technology to parse cryptographic regulations, extract compliance requirements and constraints, and transform them into executable business strategy templates. Based on the strategy templates, it scans the code configuration and cryptographic call records of business applications to detect non-compliance items. It then combines risk data to conduct correlation analysis, assess the business impact and risk transmission path, and generate compliance audit reports and rectification work orders. Non-compliant items include the use of weak encryption algorithms, insecure protocol configurations, violations of key lifecycle rules, and hard-coded credentials.

[0060] In this embodiment, the compliance audit agent employs natural language processing technologies covering text segmentation, semantic parsing, entity recognition, and rule extraction. It can perform structured parsing of cryptographic regulations such as the Cryptography Law of the People's Republic of China, GM / T series standards, and the NIST framework, accurately identifying compliance requirements and constraints related to cryptographic applications, such as key management specifications, algorithm usage restrictions, and protocol security requirements.

[0061] In this embodiment, the process of transforming compliance requirements and constraints into business policy templates involves converting abstract regulatory clauses into structured rules that can be automatically executed. This clarifies the applicable objects of the policy (such as specific business applications and cryptographic resource types), the judgment conditions (such as algorithm types and key validity thresholds), and the execution logic (such as detection frequency and alarm thresholds). For example, the regulatory requirement that "keys must be rotated every 90 days" is transformed into a business policy template that "scans the generation time of all keys, and if it is more than 90 days from the current time and has not been rotated, it is judged as non-compliant."

[0062] In this embodiment, the scanning objects based on the policy template include the code configuration files of the business application (such as configuration items and key storage modules) and password call records (such as API call logs and algorithm usage logs). The scanning process obtains data by connecting to the log system and configuration management platform of the business application. Full or sample detection can be completed without manual intervention, ensuring the comprehensiveness and efficiency of the detection coverage.

[0063] In this embodiment, non-compliant use of weak encryption algorithms refers to business applications calling encryption algorithms that have been banned or phased out by regulations, including DES, 3DES, MD5, SHA-1, etc. The compliance audit agent determines whether it is a weak encryption algorithm by identifying the algorithm identifier and version information, and at the same time detects the use of the algorithm in scenarios such as data encryption and signature verification.

[0064] In this embodiment, non-compliant items in insecure protocol configuration include insecure communication protocols and versions used when business applications interact with cryptographic devices, such as TLS 1.0, TLS 1.1, SSH v1, etc., as well as issues such as disabling security encryption suites or not enabling identity authentication in the protocol configuration. The compliance audit agent determines the security of the protocol configuration by parsing the protocol interaction logs and configuration parameters.

[0065] In this embodiment, non-compliance items in the key lifecycle cover violations in the entire process of key generation, storage, use, rotation, and revocation, including failure to rotate expired keys, failure to back up keys as required, continued use of keys after revocation, and unencrypted storage. The intelligent agent makes the judgment by associating key lifecycle information, call records, and regulatory requirements.

[0066] In this embodiment, non-compliant hard-coded credentials refer to sensitive credentials such as keys and passwords that are directly embedded in the code and configuration files of business applications and are not managed uniformly through the key management system. The compliance audit agent identifies the sensitive credential information stored in plaintext by scanning the code files and configuration parameters and determines it to be non-compliant.

[0067] In this embodiment, correlation analysis refers to the fusion analysis of detected non-compliance items with risk data (such as risk level, scope of impact, and business compliance health index) provided by the situational awareness agent to assess the security impact of non-compliance items on business systems (such as data leakage risk and business interruption risk), as well as the transmission path of risks between business applications and cryptographic resources. For example, the cracking of weak encryption algorithms may lead to the leakage of core business data, thereby affecting the compliance of related business systems.

[0068] In this embodiment, the compliance audit report includes a summary of non-compliance items, a detailed description of each non-compliance item (such as the violation scenario, resources involved, and legal basis), a risk level assessment, a business impact analysis, and suggestions for rectification. The rectification work order clarifies the responsible party for rectification, the rectification period, specific rectification operation steps (such as algorithm replacement, protocol upgrade, and key rotation), and verification standards, providing clear guidance for subsequent governance implementation.

[0069] Furthermore, the intelligent operation agent receives governance decisions approved by humans, simulates execution in an isolated environment through shadow mode to assess potential impacts before execution, executes governance tasks, automatically creates a snapshot of the target system state before execution, records complete operation logs during execution to form an immutable audit trail, and automatically triggers a rollback mechanism based on the snapshot to restore the state to the state before execution when execution fails, and generates an anomaly report to notify human experts for review. The governance tasks include configuration updates, key rotation, and log archiving.

[0070] In this embodiment, the governance decisions received by the intelligent operation agent and approved by humans refer to structured execution instructions that have undergone two-factor judgment and classification and human expert review and confirmation. The instructions clearly specify the type of governance task, target object, operation parameters, expected effect and execution time limit, such as "perform a rotation operation on the symmetric key with key ID XXX used by the XX business system" or "update the TLS protocol version of the XX cryptographic device to 1.3".

[0071] In this embodiment, shadow mode refers to replicating the execution process of governance tasks in a simulated environment (sandbox environment) that is physically isolated from and configured identically to the production environment. The simulated environment includes a mirror image of the business data, a copy of the cryptographic device configuration, and the network topology of the production environment. It is only used to assess the impact of operations and does not produce actual business changes. For example, when simulating key rotation operations, only new keys are generated in the sandbox and the key synchronization effect is verified, without affecting the use of keys in the production environment.

[0072] In this embodiment, the potential impact assessment of the isolated environment simulation execution refers to analyzing the potential impact of the governance task execution on system performance, business availability, data consistency, and compatibility of related components. For example, assessing whether configuration updates cause delays in the response of cryptographic device interfaces, whether key rotation affects ongoing encryption services, and whether log archiving consumes excessive storage resources. The assessment results form an impact assessment report, providing a risk reference for actual execution.

[0073] In this embodiment, the three specific types of governance tasks are as follows: Configuration update refers to modifying the cryptographic-related configuration parameters of cryptographic devices or business applications, including enabling / disabling algorithms, switching protocol versions, adjusting access control policies, and configuring key storage paths; Key rotation refers to the entire process of generating new keys according to preset policies, synchronizing them to relevant business systems, and abolishing old keys, supporting the rotation of symmetric and asymmetric keys, and covering both automatic and manual rotation modes; Log archiving refers to migrating the operation logs of cryptographic devices, key operation logs, compliance audit logs, etc., to archiving storage devices according to time periods or storage thresholds and storing them in encrypted form, while retaining log retrieval and traceability permissions.

[0074] In this embodiment, the target system state snapshot automatically created before execution refers to a complete record of key data such as the core configuration information, running status parameters, current key version, and current log node of the target object before the execution of the governance task. The snapshot data is stored in an encrypted manner and serves as the basis for rollback operations. For example, before executing key rotation, the snapshot will record information such as the ID of the current key, generation time, associated business system, and permission configuration.

[0075] In this embodiment, the complete operation log recorded during the execution process includes the operation timestamp, the executor (intelligent operation agent identifier + manual approver identifier), the unique ID of the operation object, the status before the operation, the specific content of the operation, the status after the operation, the execution progress, and other information. The log is stored in an append-only manner and cannot be modified or deleted, forming an immutable audit trail, which meets the traceability requirements for compliance auditing in the Cryptography Law of the People's Republic of China.

[0076] In this embodiment, scenarios where execution fails include network interruption leading to command failure, cryptographic device malfunction causing operation to fail, business system compatibility issues causing configuration to fail to take effect, and related system synchronization failure during key rotation. The rollback mechanism that is automatically triggered when execution fails refers to reversing the operation command based on the state snapshot created before execution, restoring the target system to the configuration and state before the operation. For example, when key rotation fails, the newly generated key is deleted, the enabled state of the old key is restored, and the key configuration of the related system is synchronized.

[0077] In this embodiment, the anomaly report includes the failure time, failure scenario description, failure cause analysis (such as equipment failure, network anomaly, parameter error, etc.), executed operation steps, rollback execution status, current system status, retry suggestions, etc. It is pushed to the operation terminal of human experts in real time through the intelligent agent collaboration bus to remind human experts to review and handle the issue, and to avoid the continuous exposure of compliance risks.

[0078] Furthermore, the business cryptography adaptation intelligent agent generates compliance templates and integration guidelines based on rectification work orders and best practices, simulates business change scenarios to pre-assess compliance risks, compares the business compliance health index before and after governance to verify the governance effect, collects business feedback and regulatory update information, triggers incremental updates of the knowledge graph of the cryptography compliance knowledge engine, and realizes the continuous evolution of the knowledge engine.

[0079] In this embodiment, the compliance template generated by the business cryptography adaptation intelligent agent covers cryptography application integration specifications, key management process templates, protocol configuration standards, etc. The integration guide includes the operation steps, parameter configuration instructions, and troubleshooting solutions for business systems connecting to cryptography services. It can be directly reused by the business development team during system development or upgrade, reducing the threshold for compliance integration.

[0080] In this embodiment, the simulated business change scenario pre-assessment of compliance risks refers to the business cryptographic adaptation agent using the knowledge graph of the cryptographic compliance knowledge engine to simulate the calling mode, algorithm selection, key usage, and other scenarios of the cryptographic services after the change, based on the knowledge graph of the cryptographic compliance knowledge engine before changes such as adding new functional modules, upgrading the technology stack, and adjusting data processes in the business system. This identifies possible compliance risks such as the use of weak encryption algorithms and non-standard key management, and outputs risk warnings and avoidance suggestions in advance.

[0081] In this embodiment, the governance effect is verified by comparing the business compliance health index before and after governance: the index before governance reflects the initial compliance status of the business application password use, and the index after governance reflects the compliance improvement after the rectification operation. By comparing the differences in the values ​​and changes in the dimension scores of the two, the actual effect of governance operations such as configuration updates and key rotation is quantitatively evaluated to confirm whether non-compliance items have been completely eliminated.

[0082] In this embodiment, business feedback collection includes receiving information from the business development team and operations team via the northbound interface module, such as issues related to the applicability of compliance templates, operational questions regarding integration guidelines, and compliance requirements not covered in actual business scenarios; regulatory update information is obtained by monitoring the dynamics of regulations such as the "Cryptography Law of the People's Republic of China" and GM / T series standards to ensure timely response to new compliance requirements.

[0083] In this embodiment, the incremental update triggering process of the knowledge graph is as follows: the business cryptography adaptation agent organizes the collected business feedback and regulatory update information into a knowledge update request, submits it to the task workflow orchestration agent for review through the agent collaboration bus, and triggers the update operation of the cryptography compliance knowledge engine after the review is approved. This allows for the addition, modification or improvement of nodes, relationships or attributes in the regulatory metadata graph, business scenario graph, and device capability graph, so as to realize the continuous evolution of the knowledge engine with changes in business needs and regulations.

[0084] Furthermore, artificial intelligence experts interact with each intelligent agent in real time through the intelligent agent collaboration bus, participating in knowledge teaching, process consultation, and experience transfer, and making final decisions on governance decisions. A two-factor judgment is made based on the risk level and the confidence level output by the intelligent agent: confidence level ≥80% is high confidence level, 50% ≤ confidence level < 80% is medium confidence level, and confidence level < 50% is low confidence level. Low-risk + high confidence level matters can be confirmed in batches, medium-risk matters need to be reviewed and confirmed, and high-risk or low confidence level matters need to be evaluated in detail before being decided. The decision results adopt an electronic signature mechanism to ensure the traceability of the operation.

[0085] In this embodiment, real-time interaction between human experts and various intelligent agents is achieved through an intelligent agent collaboration bus. The interaction scenarios include knowledge teaching, process consultation, and experience transfer: knowledge teaching refers to human experts imparting professional knowledge in the field of cryptographic compliance to intelligent agents, such as interpretation of legal provisions, experience in configuring cryptographic devices, and rules for determining compliance risks; process consultation refers to intelligent agents consulting human experts when they encounter questions during task execution, such as qualitative judgments on complex non-compliance items and compliance adaptation suggestions for special business scenarios; experience transfer refers to human experts sharing their practical experience in handling similar compliance issues with intelligent agents, such as troubleshooting techniques for specific cryptographic devices and precautions for high-risk governance operations, to help intelligent agents optimize their decision-making logic.

[0086] In this embodiment, the two-factor decision-making mechanism is a comprehensive decision-making mechanism that combines risk level and agent output confidence level. It is used to classify the priority and processing method of pending matters: the risk level is divided into low risk, medium risk and high risk according to the scope of impact, urgency and potential harm of non-compliance items. Low risk is a compliance issue with minor configuration deviation or no security risks. Medium risk is an issue with potential security risks that needs to be rectified within a time limit. High risk is an urgent issue that may lead to serious consequences such as data leakage and business interruption. Confidence level is a quantitative indicator of the reliability of the agent's own output results. It is calculated by factors such as data quality, rule matching degree and historical verification accuracy. Confidence level ≥ 80% is high confidence level, 50% ≤ confidence level < 80% is medium confidence level, and confidence level < 50% is low confidence level.

[0087] In this embodiment, the decision-making methods corresponding to different dual-factor combinations are clearly defined: low-risk + high-confidence matters are routine compliance optimization issues, which can be efficiently approved by human experts through batch confirmation without item-by-item review; medium-risk matters, regardless of confidence level, require human experts to review the rationality of the decision recommendations, including the necessity of governance operations and the feasibility of expected effects, before implementation; high-risk or low-confidence matters require detailed evaluation by human experts. High-risk matters require comprehensive judgment based on business scenarios, compliance requirements, and potential impacts, while low-confidence matters require verification of the data source and reasoning logic output by the intelligent agent, supplementing data or adjusting the decision-making scheme if necessary, and finally making a decision to execute, reject, or adjust.

[0088] In this embodiment, the electronic signature mechanism is used to ensure the traceability of the adjudication operation. After the human expert completes the adjudication, the system automatically records information such as the operator's identity, adjudication time, adjudication result, and relevant matter number, and generates an unalterable electronic signature record, which is stored in the audit log. This meets the requirements of the Cryptography Law of the People's Republic of China for compliant operation traceability and facilitates the verification of the responsible party and operation process during subsequent internal audits and external regulatory inspections.

[0089] Furthermore, it supports private deployment in multi-cloud and hybrid cloud environments, is compatible with locally deployed large language models and domestically produced hardware devices, and manages various cryptographic resources through active scanning discovery, interface probing, manual registration, or expert-agent collaborative teaching methods. The expert-agent collaborative teaching mode supports human experts to impart the capability characteristics and operational experience of cryptographic resources to the agent through interactive dialogue, example demonstrations, or knowledge annotation. After learning, the agent can automatically identify similar devices and infer the corresponding capability attributes.

[0090] In this embodiment, private deployment refers to deploying all functional components of the platform (access layer, data and knowledge hub, intelligent agent federation collaboration layer, governance execution channel) in the enterprise intranet or private cloud environment, without relying on external public cloud services or external interface calls. This ensures that sensitive information such as cryptographic resource data, business application data, and compliance audit data does not leave the enterprise network boundary, meeting the stringent requirements of industries such as finance, government affairs, and energy for data security and independent controllability.

[0091] In this embodiment, compatibility with locally deployed large language models means that the platform supports interface with large language models already deployed in the enterprise intranet (such as domestically developed large language models and open-source large language models), without relying on external large language model services, and realizes intelligent analysis functions such as natural language processing, legal text parsing, and semantic similarity calculation through local models; and domestic hardware device adaptation means that the platform supports compatible operation with domestic software and hardware environments such as domestic servers, domestic cryptographic devices, and domestic operating systems, meeting the technical requirements of independent control.

[0092] In this embodiment, the four methods for managing cryptographic resources are as follows: Active scanning discovery refers to the platform automatically detecting online cryptographic devices within the enterprise network using network scanning technology, identifying basic information such as device type, manufacturer model, and network address; Interface detection refers to obtaining detailed information such as device capabilities and configuration parameters by calling the native management interface of the cryptographic device, thus completing device management; Manual registration refers to manually adding device information, interface protocols, authentication methods, and other parameters to the cryptographic resource knowledge base for cryptographic devices that cannot be automatically detected; Expert-agent collaborative teaching refers to imparting device-related knowledge through interaction between human experts and intelligent agents, thereby achieving device management.

[0093] In this embodiment, the interactive dialogue in the expert-agent collaborative teaching model refers to the human expert communicating with the agent through natural language, informing them of the capabilities, configuration specifications, and operational precautions of the cryptographic device. For example, the expert might explain through dialogue that "a certain model of virtual cryptographic machine supports the SM4 symmetric encryption algorithm, but the key length is limited to 128 bits." Example demonstrations refer to the expert performing typical operations on the cryptographic device (such as key generation and configuration modification). The agent learns the device's operational logic and capability boundaries by capturing the operation process, interface call logs, and configuration change records. Knowledge annotation refers to the expert annotating the device's technical documents, configuration parameter tables, interface descriptions, and other materials to clarify the correspondence between key information and device capabilities. The agent learns device knowledge by parsing the annotated information.

[0094] In this embodiment, the intelligent agent's automatic identification of similar devices after learning refers to the intelligent agent's structured storage of device knowledge (such as manufacturer, model, protocol type, and capability characteristics) imparted by experts, forming a device capability template. When a new device is detected, the intelligent agent compares the new device's basic information, interface characteristics, and capability declaration with the stored device capability template to determine whether it is a similar device. Capability attribute inference refers to the intelligent agent's inference of the supported algorithm type, protocol version, key specification, operation process, and other undetected capability attributes of similar new devices based on the learned knowledge, and marking the inference confidence level for human experts to confirm. This is applicable to the management scenarios of new devices lacking standardized interfaces or enterprise-developed cryptographic service components.

[0095] This invention provides an embodiment of a method for monitoring and governing cryptographic resources based on multi-AI agents, applied to the above platform, including the following steps: Step 1: Build a cryptographic compliance knowledge engine. Based on a graph database, establish a regulatory metadata graph, a business scenario graph, and a device capability graph to form a four-layer mapping relationship between regulatory clauses, compliance strategies, detection rules, and device capabilities. Step 2: Establish a business asset knowledge base and connect it to the enterprise configuration management database, asset management system, application publishing platform or metadata management platform to form a unified asset view of business applications and data resources; Step 3: Establish a cryptographic resource knowledge base, and manage heterogeneous cryptographic resources through proactive scanning and discovery, interface probing, manual registration, or expert-agent collaborative teaching methods to form a unified asset view of cryptographic infrastructure; Step 4: Deploy a non-intrusive data acquisition channel, establish bidirectional acquisition channels to the north and south through out-of-band channels, and configure breakpoint resume and data supplementation mechanisms; Step 5: Perform multi-source heterogeneous data fusion processing, extract key attributes, and achieve entity alignment and deduplication to build a unified end-to-end view of the business application layer and the cryptographic resource layer; Step Six: Perform business cryptographic compliance situational awareness and generate a business compliance health index and risk profile report; Step 7: Perform compliance strategy analysis and audit testing, and generate a compliance audit report and rectification work order; Step 8: Implement intelligent decision-making and human adjudication. Generate governance decision recommendations through two-factor judgment, and then proceed to the implementation stage after approval by human experts. Step 9: Perform automated governance and remediation operations, ensuring execution security through shadow mode verification and state snapshot rollback mechanisms; Step 10: Perform business adaptation and closed-loop optimization, verify the governance effect and trigger incremental updates of the knowledge graph, and enter the next round of governance process based on OODA loop.

[0096] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of this invention and its equivalents, this invention also intends to include these modifications and variations.

Claims

1. A cryptographic resource compliance monitoring and governance platform based on multiple AI agents, characterized in that, The architecture design separates the business data plane and the management plane. The management plane monitors and governs the business data plane in a bypass manner. The management plane includes access layer components, data and knowledge hub, intelligent agent federation collaboration layer and governance execution channel. The access layer components include a northbound interface module and a southbound interface module. The northbound interface module connects to the business application layer through a standardized interface and collects API call logs, application configurations, and business change events. The southbound interface module connects to the heterogeneous cryptographic resource pool through the adapter interface, collects device operating status, key lifecycle information and configuration parameters, and receives governance instructions to perform configuration change operations. The northbound and southbound interface modules adopt an agentless deployment method, collect data through out-of-band channels, and support breakpoint resume and data supplementation mechanisms. The data and knowledge hub includes a data fusion and processing module and a cryptographic compliance knowledge engine: The data fusion processing module receives heterogeneous data and performs feature extraction, entity alignment and deduplication processing to build a unified end-to-end view of the business application layer and the cryptographic resource layer. The cryptographic compliance knowledge engine is built on a graph database, storing and managing regulatory metadata graphs, business scenario graphs, and device capability graphs. It establishes a four-layer mapping relationship between regulatory clauses, compliance strategies, detection rules, and device capabilities, and provides a shared knowledge base and rule reasoning services. The intelligent agent federation collaboration layer includes task workflow orchestration intelligent agents, intelligent agent collaboration bus, situational awareness intelligent agents, compliance audit intelligent agents, intelligent operation intelligent agents, business cryptography adaptation intelligent agents, and human experts. Each intelligent agent achieves loosely coupled communication through the intelligent agent collaboration bus, forming a star-shaped federation collaboration structure around the data and knowledge hub, and achieving closed-loop governance based on the OODA loop. The governance execution channel includes a governance instruction issuance module, which receives governance decisions approved by humans and issues operation instructions to the cryptographic resource layer through the southbound interface module.

2. The cryptographic resource compliance monitoring and governance platform based on multiple AI agents as described in claim 1, characterized in that, The data fusion processing module processes the following steps: it receives heterogeneous data collected from the north and south via a message queue, extracts key attributes, performs cross-data source entity alignment and deduplication through string matching and semantic similarity calculation, associates the fused data with the knowledge graph in the cryptographic compliance knowledge engine, and establishes a mapping relationship between business call behavior and the underlying cryptographic resource status. Key attributes include algorithm type, protocol version, and key identifier.

3. The cryptographic resource compliance monitoring and governance platform based on multiple AI agents as described in claim 1, characterized in that, The task workflow orchestration agent is a coordinating agent, responsible for task understanding and planning, subtask decomposition and distribution, execution process monitoring, result summarization and integration, submitting governance decisions to human experts for final adjudication, receiving human adjudication results and distributing them to the corresponding execution agents; the agent collaboration bus is based on message queues to realize task distribution, message routing, event broadcasting and state synchronization, and supports dynamic agent expansion and real-time human-machine interaction.

4. The cryptographic resource compliance monitoring and governance platform based on multiple AI agents as described in claim 1, characterized in that, The situational awareness agent performs business cryptographic compliance situational awareness based on fused data and knowledge graphs, analyzes cryptographic call behavior, identifies algorithm call types, key usage frequency and protocol configuration status, monitors the lifecycle status of keys and certificates, generates early warning notifications for keys and certificates that are about to expire, applies anomaly detection algorithms to identify configuration drift and abnormal call patterns, integrates evaluation results from compliance, performance and threat dimensions, calculates the business compliance health index, and generates risk profile reports.

5. The cryptographic resource compliance monitoring and governance platform based on multi-AI intelligent agents according to claim 1, characterized in that, The compliance audit agent uses natural language processing technology to parse cryptographic regulations, extract compliance requirements and constraints, and transform them into executable business strategy templates. Based on the strategy templates, it scans the code configuration and cryptographic call records of business applications to detect non-compliance items. It combines risk data to conduct correlation analysis, assesses the business impact and risk transmission path, and generates compliance audit reports and rectification work orders. Non-compliant items include the use of weak encryption algorithms, insecure protocol configurations, violations of key lifecycle rules, and hard-coded credentials.

6. The cryptographic resource compliance monitoring and governance platform based on multiple AI agents according to claim 1, characterized in that, The intelligent operation agent receives governance decisions approved by humans. Before execution, it simulates execution in an isolated environment through shadow mode to assess potential impacts. It executes governance tasks, automatically creates a snapshot of the target system state before execution, records complete operation logs during execution to form an immutable audit trail, and automatically triggers a rollback mechanism based on the snapshot to restore the state to the state before execution when execution fails. It also generates an anomaly report to notify human experts for review. The governance tasks include configuration updates, key rotation, and log archiving.

7. The cryptographic resource compliance monitoring and governance platform based on multiple AI agents according to claim 1, characterized in that, The business cryptography adaptation intelligent agent generates compliance templates and integration guidelines based on rectification work orders and best practices, simulates business change scenarios to pre-assess compliance risks, compares the business compliance health index before and after governance to verify the governance effect, collects business feedback and regulatory update information, triggers incremental updates of the knowledge graph of the cryptography compliance knowledge engine, and realizes the continuous evolution of the knowledge engine.

8. The cryptographic resource compliance monitoring and governance platform based on multi-AI intelligent agents according to claim 1, characterized in that, Artificial experts interact with each agent in real time through an intelligent agent collaboration bus, participating in knowledge teaching, process consultation, and experience transfer. They make the final decisions on governance decisions, using a two-factor judgment based on risk level and the confidence level output by the agent. Confidence level ≥80% is considered high confidence, 50% ≤ confidence level < 80% is considered medium confidence, and confidence level < 50% is considered low confidence. Low-risk + high confidence matters can be confirmed in batches, medium-risk matters require review and confirmation, and high-risk or low confidence matters require detailed evaluation before adjudication. The adjudication results use an electronic signature mechanism to ensure traceability of operations.

9. The cryptographic resource compliance monitoring and governance platform based on multiple AI agents according to claim 1, characterized in that, It supports private deployment in multi-cloud and hybrid cloud environments, is compatible with locally deployed large language models and domestically produced hardware devices, and manages various cryptographic resources through active scanning discovery, interface probing, manual registration, or expert-agent collaborative teaching methods. The expert-agent collaborative teaching mode allows human experts to impart the capability characteristics and operational experience of cryptographic resources to agents through interactive dialogue, example demonstrations, or knowledge annotation. After learning, agents can automatically identify similar devices and infer the corresponding capability attributes.

10. A method for compliance monitoring and governance of cryptographic resources based on multiple AI agents, characterized in that, Applied to any of the platforms described in claims 1-9, the method includes the following steps: Step 1: Build a cryptographic compliance knowledge engine. Based on a graph database, establish a regulatory metadata graph, a business scenario graph, and a device capability graph to form a four-layer mapping relationship between regulatory clauses, compliance strategies, detection rules, and device capabilities. Step 2: Establish a business asset knowledge base and connect it to the enterprise configuration management database, asset management system, application publishing platform or metadata management platform to form a unified asset view of business applications and data resources; Step 3: Establish a cryptographic resource knowledge base, and manage heterogeneous cryptographic resources through proactive scanning and discovery, interface probing, manual registration, or expert-agent collaborative teaching methods to form a unified asset view of cryptographic infrastructure; Step 4: Deploy a non-intrusive data acquisition channel, establish bidirectional acquisition channels to the north and south through out-of-band channels, and configure breakpoint resume and data supplementation mechanisms; Step 5: Perform multi-source heterogeneous data fusion processing, extract key attributes, and achieve entity alignment and deduplication to build a unified end-to-end view of the business application layer and the cryptographic resource layer; Step Six: Perform business cryptographic compliance situational awareness and generate a business compliance health index and risk profile report; Step 7: Perform compliance strategy analysis and audit testing, and generate a compliance audit report and rectification work order; Step 8: Implement intelligent decision-making and human adjudication. Generate governance decision recommendations through two-factor judgment, and then proceed to the implementation stage after approval by human experts. Step 9: Perform automated governance and remediation operations, ensuring execution security through shadow mode verification and state snapshot rollback mechanisms; Step 10: Perform business adaptation and closed-loop optimization, verify the governance effect and trigger incremental updates of the knowledge graph, and enter the next round of governance process based on OODA loop.

Images