Anti-quantum intent perception intelligent agent hierarchical resource control system and method

Abstract

This invention discloses a quantum-resistant intention-aware agent hierarchical resource control system and method, comprising: performing local semantic analysis on the target resource requested by the agent, dynamically classifying the target resource into multiple security sensitivity levels based on a preset semantic hierarchical strategy; concatenating the agent's execution instructions, target object, and specific operation purpose, and generating an operation intention digest using a hash algorithm; calling a preset algorithm vector according to the security level to perform identity and intention binding signature; verifying the signature at the agent gateway, and authorizing execution only when the operation intention digest is consistent, the anti-replay identifier is verified, and the hybrid signature is verified. This invention ensures that identity and authorization information possess quantum attack resistance characteristics through hybrid quantum cryptography, strongly binds the execution instructions, target resource, and operation purpose through the operation intention digest to prevent obfuscation proxy attacks, and achieves instantaneous erasure of the authorization key after the task is completed through physical anchoring.

Description

Technical Field

[0001] This invention belongs to the field of artificial intelligence security technology, and relates to a quantum-resistant intention-aware intelligent agent hierarchical resource control system and method. Background Technology

[0002] With the widespread adoption of autonomous AI agent architectures, artificial intelligence has gained the ability to directly manipulate users' local systems, manage sensitive files, and execute financial transactions. These agents typically employ a gateway-centralized architecture, triggering tasks via heartbeat frequency and connecting to various communication platforms. However, this deep integration also introduces significant security vulnerabilities: if an agent is subjected to a prompt injection attack, it may exploit its file system or execution privileges to steal credit card information, private notes, or system credentials.

[0003] Current defense mechanisms face two major challenges: first, the vulnerability of classical asymmetric encryption algorithms to quantum computing (such as Shor's algorithm); and second, the lack of awareness of the agent's intent in existing permission models, making it impossible to dynamically adjust security levels during task execution. While existing technologies include guardrail mechanisms that filter through prompt words, these are static defenses at the content level and are insufficient to address the risks of identity forgery and dynamic privilege escalation in the quantum era. Summary of the Invention

[0004] To address the aforementioned issues, this invention provides a quantum-resistant intention-aware agent hierarchical resource control system and method. It ensures that identity and authorization information are resistant to quantum attacks through hybrid post-quantum cryptography (PQC), strongly binds execution instructions, target resources, and operation purposes through operation intent digests (µ-hash) to prevent obfuscation proxy attacks, and achieves instantaneous erasure of authorization keys after task completion through physical anchoring.

[0005] The technical solution adopted in this invention is a hierarchical resource control method for quantum-resistant intention-aware intelligent agents, comprising the following steps: S1, perform local semantic analysis on the target resource requested by the intelligent agent, and dynamically divide the target resource into multiple security sensitivity levels based on the preset semantic classification strategy; S2, the execution instructions, target object, specific operation purpose, and current anti-replay identifier of the intelligent agent are concatenated, and an operation intent digest is generated by a hash algorithm, converting the ambiguous natural language "intent" into a mathematically verifiable hash value; through μ-hash binding, even if an attacker gains file read and write permissions, if the purpose description does not match the original intent, or the resource is tampered with, the signature will directly become invalid; the anti-replay identifier can be a timestamp, a nonce, or a sequence number; S3, according to the security level, call the preset algorithm vector to perform identity and intent binding signature; wherein, when the security level is the second highest level or the highest level, it is mandatory to include at least one post-quantum cryptography algorithm component, and the operation intent digest is included in the signature message body; S4. Verify the signature at the agent gateway and compare whether the operation intent digest recalculated at runtime is consistent with the operation intent digest in the signature. Authorize execution only if the operation intent digest is consistent, the anti-replay identifier verification is passed, and the hybrid signature verification is passed.

[0006] Furthermore, in S3, when the security level is the second highest level, the algorithm vector supports a redundant hybrid mode, that is, simultaneously verifying the classical elliptic curve algorithm and the post-quantum digital signature algorithm for joint signature.

[0007] Furthermore, in S3, when the security level is the highest level, the algorithm vector supports a redundant hybrid mode, that is, it uses both lattice-based ML-DSA and hash-based SLH-DSA post-quantum algorithms for joint signature.

[0008] Furthermore, if in S1 the target resource is dynamically divided into five levels, SL0-SL4, in S3, when the security level is SL0-SL1, the algorithm vector is a classical cryptographic algorithm; when the security level is SL2, the algorithm vector is a binding operation intent digest; when the security level is SL3, the algorithm vector supports a redundant hybrid mode, that is, simultaneously verifying the classical elliptic curve algorithm and the post-quantum digital signature algorithm for joint signature; when the security level is SL4, the algorithm vector supports a redundant hybrid mode, that is, simultaneously using two post-quantum algorithms, lattice-based ML-DSA and hash-based SLH-DSA, for joint signature.

[0009] Furthermore, when the security level is at its highest level, a physically anchored zero long-term privilege policy is enforced.

[0010] Furthermore, in S4, when the security level is SL0-SL1, automatic silent authorization is executed; when the security level is SL2, policy-triggered approval is executed; when the security level is SL3, human-in-the-loop approval is executed; and when the security level is SL4, a physically anchored zero-long-term privilege policy is forcibly implemented.

[0011] Furthermore, the physically anchored zero long-term privilege policy includes: The execution key must be generated after the user triggers physical presence verification by a trusted hardware unit; the trusted hardware unit includes, but is not limited to, an external USB token, an embedded secure element (SE), a trusted platform module (TPM), or a hardware module with integrated biometric recognition functionality.

[0012] A time-sensitive temporary working key is negotiated using a post-quantum key encapsulation mechanism; After the task is completed, the gateway or the underlying firmware of the hardware encryption chip will forcefully trigger the physical overwrite and zeroing of the protected memory area to ensure that the authorization credentials are irrecoverable and destroyed instantly in memory.

[0013] Furthermore, when the local semantic analysis discovers hidden advanced privacy information in a low-sensitivity task, the system automatically performs dynamic privilege escalation, suspends the current task, and enters a human-in-the-loop approval mode. The system scans the task context in real time, and once a sensitive feature is detected, it forcibly updates the algorithm vector and requires a re-initiation of physical presence verification to negotiate a new temporary key.

[0014] A quantum-resistant hierarchical resource control system for intention-aware intelligent agents, comprising: The semantic awareness classifier performs local semantic analysis on the target resources requested by the agent and dynamically divides the target resources into multiple security sensitivity levels based on a preset semantic classification strategy. An intent binder is used to concatenate the agent's execution instructions, target object, specific operation purpose, and current anti-replay identifier (such as timestamp or random number), and generate an operation intent summary through a hash algorithm; The hybrid signature module is used to invoke a preset algorithm vector according to the security level to perform identity and intent binding signature; wherein, when the security level is the second highest or the highest level, it is mandatory to include at least one post-quantum cryptography algorithm component and include the operation intent digest in the signature message body; The intelligent agent gateway is used to verify the validity of the signature and compare whether the operation intent digest recalculated at runtime is consistent with the operation intent digest in the signature. Execution is authorized only if the operation intent digest is consistent, the anti-replay identifier verification is passed, and the hybrid signature verification is passed.

[0015] Furthermore, it also includes a physical anchoring module, which, when the security level is at the highest level, triggers the user to verify the physical presence of a trusted hardware unit that supports post-quantum cryptography, and negotiates and generates a time-sensitive temporary working key through a post-quantum key encapsulation mechanism. After the task is completed, the gateway or the underlying firmware of the hardware encryption chip forcibly triggers the physical overwrite and zeroing of the protected memory area.

[0016] The beneficial effects of this invention are as follows: 1. Quantum attack resistance: The embodiments of the present invention use a hybrid quantum cryptography mechanism to ensure that identity verification and authorization information has quantum attack resistance characteristics, thus defending against the potential risk of "intercepting now and decrypting later".

[0017] 2. Deep binding of intent: In this embodiment of the invention, the execution instructions, target resources and operation purpose of the intelligent agent are bound to the signature token through µ-hash, which effectively prevents obfuscation proxy attacks and cross-domain reuse of authorization tokens.

[0018] 3. Dynamic sensitivity adjustment: This embodiment of the invention monitors resource flow in real time based on NLP semantic analysis, realizes dynamic privilege escalation of low-sensitivity resources, and ensures that high-risk operations must be confirmed by humans.

[0019] 4. Hardware-level zero-privilege management: This embodiment of the invention combines physical presence verification (PPV) and post-quantum key encapsulation to achieve instantaneous erasure of the authorization key after the task is completed. Attached Figure Description

[0021] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0022] Figure 1 This is a schematic diagram of the overall architecture and data flow of the control system according to an embodiment of the present invention.

[0023] Figure 2 This is a flowchart of the approval sequence flow that is intended to be bound to and physically anchored in an embodiment of the present invention.

[0024] Figure 3 This invention relates to a dynamic sensitivity enhancement and human-in-the-loop approval process.

[0025] Figure 4 This is an overall flowchart of the control method according to an embodiment of the present invention. Detailed Implementation

[0026] The technical solutions of the present invention will be clearly and completely described below with reference to the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0027] Example 1

[0028] A quantum-resistant hierarchical resource control system for intention-aware intelligent agents, such as Figure 1 As shown, it includes an intelligent agent gateway, a traffic interception and enhancement engine, a semantic awareness classifier, a hybrid signature module, an intent binder, and a physical anchoring module.

[0029] The semantic-aware classifier analyzes resource attributes using a lightweight local model and classifies controlled resources into multiple security sensitivity levels based on preset strategies. In this embodiment, a classification into five sensitivity levels (SL0-SL4) is used as an example; the mapping relationship between specific resource levels and defense strength is shown in Table 1. It should be noted that the multiple security sensitivity levels described in this invention can be flexibly configured according to actual business scenarios (e.g., 3 levels, 5 levels, or more). If classified into 3 levels, the following are the classifications: Low sensitivity level (e.g., SL0-SL1 in this embodiment): typically corresponds to public or routine data. Medium sensitivity level (e.g., SL2-SL3 in this embodiment): corresponds to internal files / system paths, sensitive / personal identification information. High sensitivity level (e.g., SL4 in this embodiment): corresponds to financial / core credentials. To facilitate understanding of the technical solution of this invention, the following detailed explanation uses a classification into five levels (SL0-SL4) as an example.

[0030] Table 1. Mapping Matrix between Resource Sensitivity (SL) and Defense Strength

[0031] In Table 1, " / " indicates "or" (parallel optional relationship), meaning that satisfying any one of the characteristics is sufficient. SL2 resources are internal files, meaning they are internally restricted but not core confidential files (such as intranet notifications and ordinary project documents), and have certain access barriers.

[0032] The hybrid signature module supports cross-generational mixing of classical and post-quantum algorithms, as well as redundancy-resistant mixing of post-quantum algorithms from various mathematical categories. For different sensitivity levels, the system invokes preset algorithm vectors through the hybrid signature module. This provides differentiated authorization protection to ensure security while minimizing system overhead. It is responsible for selecting algorithm vectors based on the Security Level (SL), scheduling the signature process, and combining classic and PQC algorithms. The hybrid encryption chip is a hardware accelerator or security element (SE) that performs specific mathematical operations (such as lattice operations and hash operations).

[0033] Algorithm Vector Refers to an ordered set of predefined encryption / signature algorithms, as shown in the following formula:

[0034] In the formula, This represents a classical cryptographic algorithm component, indicating a traditional, non-quantum-resistant cryptographic algorithm (such as the ECC elliptic curve algorithm), used to ensure compatibility with existing systems and traditional security strength.

[0035] The term represents the master-post quantum cryptography algorithm component, which is the quantum-resistant algorithm selected as the master (usually a lattice-based algorithm, such as ML-DSA), providing core resistance to quantum attacks.

[0036] The redundant quantum cryptographic algorithm component represents a second quantum-resistant algorithm based on a different mathematical principle (usually a hash-based algorithm, such as SLH-DSA), introduced to prevent a single mathematical problem from being compromised, and used to achieve security redundancy.

[0037] For example, for SL3, algorithm vectors (Intergenerational hybrid).

[0038] For example, for SL4, algorithm vectors (Resistant redundancy mixing).

[0039] An intent binder is used to compute a digest (µ-hash) of the action intent and strongly bind it to the authorization signature.

[0040] like Figure 1 As shown, all external communication commands are intercepted through the gateway. When the agent inference engine generates a tool call command, the traffic interception and enhancement engine first redirects it to the semantic-aware grader. The semantic-aware grader does not rely on static resource attributes or preset parameters, but instead utilizes a local model to scan the content and context of the target resource in real time. For example, when a routine file reading task marked as low-sensitivity (e.g., SL2) detects that the content contains high-level privacy features (e.g., SL4-level core credential features), the system automatically triggers a dynamic privilege escalation process, immediately suspending the current task and requiring human intervention for in-loop approval. This real-time dynamic privilege escalation mechanism based on content semantics compensates for the shortcomings of traditional static geofencing or fixed-parameter scheduling strategies in addressing the risk of dynamic data leakage.

[0041] Dynamic privilege escalation refers to the system's ability to immediately escalate the current permission management policy from a low level (e.g., SL2 policy-triggered approval) to a high level (e.g., SL4 physical anchoring + ZSP) during task execution if the semantic-aware classifier detects that the actual sensitivity of the data involved (e.g., discovering core credentials) is higher than the initially requested level (e.g., ordinary file read). See Table 2 for details on permission management policy switching. If a high-level privacy is detected, the escalation depends on the type of high-level privacy detected. For example, if a task marked as SL1 detects content containing SL3, the escalation to SL3 is more in line with the principle of least privilege for resource control.

[0042] The intelligent agent gateway is not only a router, but also has security verification logic, and has the following functions: Dual verification: simultaneously verifying the identity signature and intent digest ( -hash).

[0043] Active defense: It has the ability to detect quantum brute-force attack characteristics (such as abnormally high frequency of key negotiation requests) and trigger circuit breakers.

[0044] ZSP executor: Responsible for sending instructions to the hardware to erase the key.

[0045] The physical anchoring module, at security level SL4, triggers physical presence verification of a trusted hardware unit supporting post-quantum cryptography. It negotiates and generates a time-sensitive temporary working key through a post-quantum key encapsulation mechanism. Upon completion, the gateway or the underlying firmware of the hardware encryption chip forcibly triggers a physical overwrite and zeroing of the protected memory area. The physical anchoring module provides trusted physical user presence verification (PPV) and performs hardware-level key generation and destruction. It ensures that the key is generated through human action in the physical world, rather than automatic software invocation.

[0046] The intelligent agent gateway is the decision-maker. When it determines that SL4 level permissions are required, it sends a command to the physical anchoring module. The physical anchoring module performs verification and returns a temporary key to the gateway (or directly participates in decryption).

[0047] Example 2

[0048] A quantum-resistant hierarchical resource control method for intention-aware agents, such as Figure 4 As shown, it includes the following steps: S1: Semantic Aware Hierarchy. Utilizes a local lightweight model to scan target resource attributes in real time; target resources include file content (locally stored documents and code files), system status (environment variables, clipboard content, and browser cookies), and API interaction data. API interaction data consists of JSON payloads that the agent will send to external APIs or response data received from external sources.

[0049] The local lightweight model has requirements such as privacy protection and high-frequency operation, including but not limited to a lightweight Transformer architecture based on attention mechanism, convolutional neural network, or a hybrid discriminative model combining regular expressions and vector space distance, which divides the controlled resources into multiple security sensitivity levels. In this embodiment, five sensitivity levels (SL0-SL4) are used as an example for illustration.

[0050] When the semantic-aware classifier discovers hidden high-level privacy information in a low-sensitivity task, the system automatically performs dynamic privilege escalation, suspends the current task, and enters a human-in-the-loop approval mode. The user (human) first needs to confirm the legitimacy of the operation. After confirmation, a physical touch (PPV) is performed to generate the key required for execution. The specific logic of this process is as follows: Figure 3 As shown, the system scans the task context in real time. Once a sensitive feature is detected, it will force an update of the algorithm vector and require a re-initiation of physical existence verification to negotiate a new temporary key.

[0051] S2: Intent Summary Generation. The intent binder concatenates the agent's command, target object, and specific operation purpose, and uses a hash algorithm to generate an operation intent summary (µ-hash), transforming the ambiguous natural language "intent" into a mathematically verifiable hash value. Through μ-hash binding, even if an attacker gains file read / write permissions, the signature will become invalid if the purpose description does not match the original intent or if the resource has been tampered with.

[0052] The hash algorithm used in this embodiment is SHAKE256, which is NIST standard compatible and quantum resistant. Existing post-quantum signature standards (such as ML-DSA / Dilithium) widely use SHAKE256 internally. Using the same hash function allows for the reuse of hardware acceleration modules, reducing chip area. SHAKE256 belongs to the SHA-3 family and has a variable output length (XOF), making it more flexible and secure than SHA-2 in resisting quantum attacks (such as the Grovers algorithm). It can be replaced with SHA-384 or SHA-512.

[0053] S3: Hybrid Signature Authorization. Based on the level described in S1, the hybrid signature module invokes a preset algorithm vector. Identity and intent binding signatures are performed; for SL3 and above, at least one post-quantum cryptography (PQC) algorithm component is mandatory, and µ-hash is included in the signature message body. PQC algorithms typically result in long signatures and slow computation; the challenge lies in implementing PQC hybrid signatures on edge devices (mobile phones / PCs) without lag. This embodiment of the invention solves this problem through on-demand scheduling of algorithm vector A; algorithm vector A is shown in the following formula:

[0054] In the formula, This represents the final generated hybrid digital signature message; This represents a mixed signature operation function; This represents a hybrid private key set (containing classical private keys and post-quantum private keys). This represents a fragment of a signature value generated by a classical algorithm; This represents a fragment of the signature value generated by the post-quantum algorithm.

[0055] The algorithm vector It supports cross-generational hybrid mode, that is, simultaneously verifying classical elliptic curve algorithms (such as Ed25519) and post-quantum digital signature algorithms (such as ML-DSA).

[0056] The algorithm vector It supports a redundant hybrid mode, which means using two or more post-quantum algorithms of different mathematical categories (such as lattice-based ML-DSA and hash-based SLH-DSA) for joint verification.

[0057] This embodiment uses configurable algorithm vectors. Authentication is performed. For SL4 level resources, the system implements a redundant hybrid mode, requiring joint verification using two post-quantum algorithms: lattice-based ML-DSA and hash-based SLH-DSA. The intent binder calculates the µ-hash using the following formula:

[0058] Before executing the tool, the gateway will recalculate the current environment. The hash is matched against the value in the signed message; any attempt to tamper with it will invalidate the signature. Furthermore, the system possesses proactive defense capabilities against quantum attacks. When the traffic interception and enhancement engine detects high-frequency repetitive requests or abnormal algorithm response characteristics, it determines that a quantum brute-force attack attempt may be occurring. The system proactively updates the algorithm vector of the current SL3 level resources. The system is forced to switch from a "cross-generational hybrid mode" to a "redundant hybrid mode" with mathematical resistance in real time, thereby increasing the difficulty of cracking the algorithm by adding algorithmic components with different mathematical foundations.

[0059] S4: Gateway Verification and Execution. Before executing tool calls, the intelligent agent gateway recalculates the µ-hash of the current environment's intent and compares it with the signature token. Resource access is granted only if the hashes match and all components of the mixed signature pass verification. When abnormal privilege escalation or quantum attack characteristics are detected, the system can proactively switch algorithm redundancy and enforce secondary verification.

[0060] For SL0-SL1 level resources, automatic silent authorization is performed; for SL2 level resources, policy-triggered approval is performed; for SL3 level resources, human-in-the-loop approval is performed.

[0061] For SL4 level extremely sensitive resources (such as credit card payments), such as Figure 2 As shown, a physically anchored zero long-term privilege (ZSP) policy is enforced: The execution key must be generated after the user triggers physical presence verification by a trusted hardware unit (such as a hardware token or biometric module); A time-sensitive temporary working key is negotiated using a post-quantum key encapsulation (KEM) mechanism. After the task is completed, the gateway or the underlying firmware of the hardware encryption chip will forcefully trigger the physical overwrite and zeroing of the protected memory area (instantly erasing the key) to ensure that the authorization credentials are unrecoverable and instantly destroyed in memory.

[0062] The forced triggering of physically overwriting and zeroing the protected memory region specifically includes the following two implementation mechanisms: Software / firmware layer: Protection against optimization overwriting.

[0063] In gateways or ordinary computing units, ordinary memory release functions (such as `free`) or simple assignment to zero (such as `memset`) are not used to prevent the compiler from identifying them as dead store and optimizing them out. The system uses volatile function pointers or standard security functions (such as `memset_s` in the C11 standard, `OPENSSL_cleanse` in OpenSSL, or `explicit_bzero` at the OS level) to force the CPU to perform multiple random number overwrites and zero-value overwrites on the physical memory address of the stored key, ensuring that magnetic media or charge residues are completely cleared.

[0064] Hardware layer: Security element (SE) reset.

[0065] For hardware tokens or encryption chips that support post-quantum cryptography, when the task end signal is triggered, the underlying firmware directly calls the chip's secure reset instruction or power-off scrambling mechanism. This mechanism instantly cuts off the power supply to the secure registers and on-chip SRAM, and quickly depletes the charge using the built-in discharge circuit. At the same time, it performs a physical-level random flip on the key storage area to prevent the key from being recovered using a cold boot attack.

[0066] In this embodiment, the irrecoverable and instantaneous destruction is specifically achieved by calling compiler-protected secure memory overwrite functions such as explicit_bzero or memset_s, in conjunction with the hardware security unit's volatile register forced reset instruction.

[0067] Under this strategy, the system authorization key is not pre-stored by the system, and no long-term credentials are retained in memory. Key generation must be triggered by a hardware token supporting the FIDO2 PQC standard via a user physical touch (PPV). At the moment of touch, the hardware token negotiates with the gateway in real time through a post-quantum key encapsulation (KEM) mechanism to generate a one-time valid temporary working key. This key is only valid within a limited time window (e.g., 60 seconds) for that task. Once the window closes or the task ends, the underlying firmware of the hardware chip forcibly physically overwrites and resets the storage area to zero. This mechanism ensures that the granting of permissions is based on real-time physical existence rather than static configuration, effectively distinguishing it from traditional passive defense schemes that only destroy keys when verification fails.

[0068] In this embodiment of the invention, the intent binder is configured to receive the agent's command, target resource, and operation purpose, concatenate them, and use the SHAKE256 algorithm to calculate and generate an intent digest (µ-hash). During user approval on the mobile device, this µ-hash is forcibly included in the signed message body m. Unlike traditional verification mechanisms based solely on geographic location hashing or task vector scheduling, this embodiment of the invention deeply binds the operation purpose to a specific resource. This ensures that even if an attacker gains command execution privileges, if they modify the operation purpose (e.g., changing "legitimate transfer" to "steal funds") or replace the target resource through prompt injection, the generated µ-hash will fail the gateway's signature verification, thus effectively defending against intent obfuscation attacks.

[0069] This invention addresses the high-frequency, automated characteristics of AI agents through a countermeasure mechanism (forcing human presence in the loop). It achieves resistance to quantum attacks, deep intent binding, and hardware-level dynamic privilege management, effectively defending against intent confusion and unauthorized access issues caused by attacks on AI agents. Conventional gateways or acceleration systems typically aim to reduce human intervention rather than forcibly introducing physical contact in high-risk situations. Traditional geofencing assumes "I'm at home, therefore I'm safe." However, if an AI agent is attacked by a hacker through dialogue-based prompt injection, the AI ​​agent might proactively send your files to the hacker. In this case, the device location is legitimate, but the intent is malicious. This invention forces the hashing of "to whom (Resource)" and "what (Purpose)." If the AI ​​is injected, attempting to change "transfer money to Zhang San" to "transfer money to the hacker,"... The hash will change, causing previous signatures to become invalid. Furthermore, even if AI tries to secretly read a file, the semantic-aware grader in this embodiment of the invention will analyze the file content and declare: "This is a financial statement (SL4)," instead of the "ordinary log (SL1)" claimed by the AI, thereby forcing human approval.

[0070] Experimental data and safety analysis: Experiments show that the introduction of semantic-aware classification and hybrid signature verification in this embodiment of the invention has minimal impact on response speed. On a mobile SoC equipped with an NPU, the additional latency introduced by the hybrid signature verification (Ed25519+ML-DSA-44) in this embodiment of the invention is only 4.2ms, which is imperceptible to the user. In terms of defense performance, in a test set containing 1000 malicious prompt injection samples, the intent binding mechanism of this system successfully intercepted 100% of the target resource tampering attacks. The physical anchoring module completes key overwriting and destruction in less than 10ns.

[0071] The above description is merely a preferred embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention are included within the scope of protection of the present invention.

Claims

1. A method for hierarchical resource control of quantum-resistant intention-aware intelligent agents, characterized in that, Includes the following steps: S1, perform local semantic analysis on the target resource requested by the intelligent agent, and dynamically divide the target resource into multiple security sensitivity levels based on the preset semantic classification strategy; S2, the execution instructions, target object, specific operation purpose and current anti-replay identifier of the intelligent agent are concatenated, and an operation intent summary is generated by a hash algorithm; S3, according to the security level, call the preset algorithm vector to perform identity and intent binding signature; wherein, when the security level is the second highest level or the highest level, it is mandatory to include at least one post-quantum cryptography algorithm component, and the operation intent digest is included in the signature message body; S4. Verify the signature at the agent gateway and compare whether the operation intent digest recalculated at runtime is consistent with the operation intent digest in the signature. Authorize execution only if the operation intent digest is consistent, the anti-replay identifier verification is passed, and the hybrid signature verification is passed.

2. The quantum-resistant intention-aware agent hierarchical resource control method according to claim 1, characterized in that, In S3, when the security level is the second highest, the algorithm vector supports a redundant hybrid mode, that is, it simultaneously verifies the classical elliptic curve algorithm and the post-quantum digital signature algorithm for joint signature.

3. The quantum-resistant intention-aware agent hierarchical resource control method according to claim 1, characterized in that, In S3, when the security level is the highest level, the algorithm vector supports a redundant hybrid mode, that is, it uses both lattice-based ML-DSA and hash-based SLH-DSA post-quantum algorithms for joint signature.

4. The quantum-resistant intention-aware agent hierarchical resource control method according to claim 1, characterized in that, If in S1, the target resource is dynamically divided into five levels, SL0-SL4, then in S3, when the security level is SL0-SL1, the algorithm vector is a classical cryptographic algorithm; when the security level is SL2, the algorithm vector is a binding operation intent digest; when the security level is SL3, the algorithm vector supports a redundant hybrid mode, that is, simultaneously verifying the classical elliptic curve algorithm and the post-quantum digital signature algorithm for joint signature; when the security level is SL4, the algorithm vector supports a redundant hybrid mode, that is, simultaneously using two post-quantum algorithms, lattice-based ML-DSA and hash-based SLH-DSA, for joint signature.

5. The quantum-resistant intention-aware agent hierarchical resource control method according to claim 1, characterized in that, When the security level is at its highest level, a physically anchored zero long-term privilege policy is enforced.

6. The quantum-resistant intention-aware agent hierarchical resource control method according to claim 4, characterized in that, In step S4, when the security level is SL0-SL1, automatic silent authorization is executed; when the security level is SL2, policy-triggered approval is executed; when the security level is SL3, human-in-the-loop approval is executed; and when the security level is SL4, a physically anchored zero-long-term privilege policy is forcibly implemented.

7. A quantum-resistant intention-aware agent hierarchical resource control method according to claim 5 or 6, characterized in that, The physically anchored zero long-term privilege policy includes: The execution key must be generated after the user triggers a physical presence verification of the trusted hardware unit; A time-sensitive temporary working key is negotiated using a post-quantum key encapsulation mechanism; After the task is completed, the gateway or the underlying firmware of the hardware encryption chip will forcefully trigger the physical overwrite and zeroing of the protected memory area to ensure that the authorization credentials are irrecoverable and destroyed instantly in memory.

8. The quantum-resistant intention-aware agent hierarchical resource control method according to claim 7, characterized in that, When the local semantic analysis discovers hidden advanced privacy information in a low-sensitivity task, the system automatically performs dynamic privilege escalation, suspends the current task, and enters a human-in-the-loop approval mode. The system scans the task context in real time, and once a sensitive feature is detected, it forcibly updates the algorithm vector and requires a re-initiation of physical presence verification to negotiate a new temporary key.

9. A quantum-resistant hierarchical resource control system for an agent that senses intent, employing the quantum-resistant hierarchical resource control method for an agent that senses intent as described in claim 1, characterized in that... include: The semantic awareness classifier performs local semantic analysis on the target resources requested by the agent and dynamically divides the target resources into multiple security sensitivity levels based on a preset semantic classification strategy. An intent binder is used to concatenate the agent's execution instructions, target object, specific operation purpose, and current anti-replay flag, and generate an operation intent digest using a hash algorithm; The hybrid signature module is used to invoke a preset algorithm vector according to the security level to perform identity and intent binding signature; wherein, when the security level is the second highest or the highest level, it is mandatory to include at least one post-quantum cryptography algorithm component and include the operation intent digest in the signature message body; The intelligent agent gateway is used to verify the validity of the signature and compare whether the operation intent digest recalculated at runtime is consistent with the operation intent digest in the signature. Execution is authorized only if the operation intent digest is consistent, the anti-replay identifier verification is passed, and the hybrid signature verification is passed.

10. A quantum-resistant intention-aware agent hierarchical resource control system according to claim 9, characterized in that, It also includes a physical anchoring module, which, when the security level is at the highest level, triggers the user to verify the physical presence of a trusted hardware unit that supports post-quantum cryptography, and negotiates and generates a time-sensitive temporary working key through a post-quantum key encapsulation mechanism. After the task is completed, the gateway or the underlying firmware of the hardware encryption chip will forcefully trigger the physical overwrite and zeroing of the protected memory area.

Images