Agent-oriented multi-solver secure execution and isolation scheduling method and system

Abstract

This invention relates to a method and system for secure execution and isolated scheduling of multiple solvers for intelligent agents. The method includes the following steps: Step 1: Matching a suitable target solver for the current task based on the user's task objective; Step 2: Creating an independent temporary working directory for the current task and generating corresponding input files for the target solver; Step 3: Calling and running the target solver in a controlled environment, with the target solver calculating results based on the input files; Step 4: Encapsulating the obtained results into a standardized result object in a unified format and returning it to the upper-level intelligent agent. The system includes a unified scheduling unit, an isolated execution unit, a security management unit, and a unified return unit. This invention can achieve operational isolation between different solvers, reduce the risk of dependency conflicts and task interference, and improve the security and controllability of tool calls through control of the execution process.

Description

Technical Field

[0001] This invention relates to a method and system for secure execution and isolated scheduling of multiple solvers for intelligent agents, belonging to the field of computing resource management technology. Background Technology

[0002] In scientific intelligent agent systems, different tasks often require the invocation of different types of solvers or external tools. Different solvers have different requirements for the operating environment, dependent versions, input file formats, directory structures, and execution commands. Existing scientific intelligent agent systems typically employ a unified operating environment or a coarse-grained scheduling approach. For example, patent application CN121585662A discloses a distributed multi-agent cooperative scheduling and dynamic trust method based on the MCP protocol. This method includes: each agent deploying an emergency policy network, acquiring a situational state vector containing uncertain parameters, outputting an action probability distribution, and randomly sampling to determine a decision; after execution, acquiring a scalar reward signal, calculating a gradient update vector, broadcasting the gradient update vector via the MCP bus, and updating the local network weights after federated fusion. This method eliminates the dependence on static cost assumptions, enabling agents to autonomously learn and evolve cooperative policies through interaction with uncertain environments, and internalizing trust as an emergent property of the policy network, thus achieving a unity of scheduling and reliability. For example, patent application CN119225986A discloses an adaptive multi-granularity cloud resource orchestration method based on hierarchical reinforcement learning. This method proposes an adaptive multi-granularity cloud resource orchestration framework, AMG-RL, which adaptively groups cloud tasks into K task clusters, predicts the resource requirements of different task clusters, and performs multi-granularity cloud resource orchestration based on the different task clusters and their corresponding resource requirements to achieve task resource allocation and scheduling. It also includes performance feedback on the multi-granularity cloud resource orchestration strategy to optimize the strategy. This method can adapt to the diversity of cloud tasks, reveal the similarities and complementarities between tasks, lay the foundation for differentiated resource configuration, accurately predict future load changes, maximize resource utilization efficiency and reduce costs while meeting task performance constraints, and continuously improve the long-term performance of the system through strategy improvement. The above technologies each have their own characteristics and are applicable to various adaptive work scenarios. However, using a unified operating environment or coarse-grained scheduling method can easily lead to problems such as dependency conflicts, directory pollution, file overwriting, command injection, and cross-task interference. Furthermore, the lack of strict permission restrictions, input checks, and a unified error return mechanism when calling external solvers poses risks to the system's stability and security. Summary of the Invention

[0003] To overcome the aforementioned deficiencies of the prior art, this invention provides a method and system for secure execution and isolation scheduling of multiple solvers for intelligent agents, which can achieve operational isolation between different solvers, reduce the risk of dependency conflicts, and improve the security and controllability of tool calls.

[0004] The technical solution adopted in this invention is: a method for safe execution and isolated scheduling of multiple solvers for intelligent agents, comprising the following steps:

[0005] Step 1: Match a suitable goal solver for the current task based on the user's task objectives; Step 2: Create a separate temporary working directory for the current task and generate the corresponding input files for the target solver; Step 3: Invoke and run the objective solver in a controlled environment. The objective solver calculates the results based on the input file. Step 4: Encapsulate the obtained results into a standardized result object with a unified format and return it to the upper-level intelligent agent.

[0006] Preferably, in step 1, while matching the target solver suitable for the current task, several candidate solvers are also matched.

[0007] Furthermore, the target solver and candidate solvers are sorted according to a preset matching priority, wherein the target solver is the solver with the highest matching priority among the matched solvers.

[0008] Preferably, step 1 includes: Step 101: Establish a solver registry to record and store the metadata of each solver; Step 102: Analyze the task objectives and structure the task objective requirements; Step 103: Based on the solver metadata in the solver registry, filter out solvers suitable for completing the current task.

[0009] Preferably, the metadata includes the solver's name, dependent environment, input format, output format, executable path, and / or security policy.

[0010] Preferably, in step 2, the user-inputted task target parameters are converted into input files that the target solver can recognize according to the target solver's preset template and input rules (Schema rules), and the path, file name, and parameter content are checked for validity.

[0011] Preferably, the controlled environment in step 3 includes restrictions on command scope, directory access scope, and / or execution permissions.

[0012] Preferably, the results obtained in step 4 are divided into success results and failure results, and the results include output, logs and exceptions.

[0013] Preferably, when the target solver fails to execute and obtains a failure result, temporary resource reclamation is triggered, and the temporary working directory created for the current task is deleted.

[0014] A multi-solver secure execution and isolation scheduling system for intelligent agents, employing any of the multi-solver secure execution and isolation scheduling methods for intelligent agents disclosed in this invention, includes: Unified scheduling unit: used to match a suitable target solver for the current task based on the user's task objectives; Isolation Execution Unit: Used to create an independent temporary working directory for the current task and generate corresponding input files for the objective solver; Safety Management Unit: Used to invoke and run the objective solver in a controlled environment; the objective solver calculates results based on the input file. Unified return unit: Used to encapsulate the obtained results into a standardized result object in a unified format and return it to the upper-level intelligent agent.

[0015] Preferably, the unified scheduling unit includes: Solver registration module: Used to create a solver registry, record and store the metadata of each solver; Task input module: Used to receive user task target requests; Task identification module: used to parse task objectives and structure them; Solver Matching Module: Used to match a suitable solver to complete the current task based on the solver metadata in the solver registry.

[0016] Preferably, the isolated execution unit includes: Isolation workspace management module: Used to create a separate temporary working directory for the current task; Safe Input Building Block: Used to generate corresponding input files for the target solver.

[0017] Preferably, the security management unit includes: Controlled execution module: used to call and run the objective solver; Security policy control module: Used to manage and constrain the execution process of the controlled execution module.

[0018] Furthermore, the security policy control module is also used to standardize the output format.

[0019] Preferably, the unified return unit includes: Unified Result Packaging Module: Used to encapsulate the obtained results into standardized result objects in a unified format; Result return module: Used to return the successful results obtained by the target solver to the upper-level agent; Error return module: Used to return the failure result obtained by the target solver to the upper-level agent and trigger resource reclamation.

[0020] The result return module and the exception return module can first send the solver's calculation results (successful results or failure results) to the security policy control module to standardize the output format before returning them.

[0021] The beneficial effects of this invention are as follows: By creating an independent temporary working directory for each task objective, this invention achieves operational isolation between different solvers, reducing the risk of dependency conflicts and task interference; by controlling the execution process, it improves the security and controllability of tool calls; by uniformly encapsulating the calculation results, it enhances the compatibility of the upper-layer system and solves the problem of inconsistent return results from different solvers, making it difficult to incorporate into the intelligent agent framework; and by automatically reclaiming resources, it avoids system instability caused by task execution failures. This invention effectively resists malicious input and unauthorized operations through three layers of protection: input validation, isolated execution, and permission restrictions. This invention adopts a modular design, facilitating the access, expansion, and maintenance of multiple solvers, effectively enhancing system stability. Attached Figure Description

[0022] Figure 1 This is a flowchart of the method of the present invention; Figure 2 This is a flowchart of the target matching solver stage of the method of the present invention; Figure 3 This is a flowchart illustrating the isolated workspace step of the method of the present invention; Figure 4 This is a flowchart of the unified result encapsulation and exception return process of the method of the present invention; Figure 5 This is the overall architecture diagram of the system of the present invention. Detailed Implementation

[0023] See Figures 1-4 This invention discloses a method for secure execution and isolated scheduling of multiple solvers for intelligent agents, comprising the following steps: Step 1: Match a suitable goal solver for the current task based on the user's task objectives; Step 2: Create a separate temporary working directory (or workspace) for the current task, and generate the corresponding input files for the target solver; Step 3: Invoke and run the objective solver in a controlled environment. The objective solver calculates the results based on the input file. Step 4: Encapsulate the obtained results into a standardized result object with a unified format and return it to the upper-level intelligent agent.

[0024] In step 1, while matching a target solver suitable for the current task, several candidate solvers are also matched, achieving single matching and multiple candidates. The target solver and candidate solvers can be sorted according to a preset matching priority, where the target solver is the solver with the highest matching priority among the matched solvers.

[0025] Step 1 preferably includes: Step 101: Establish a solver registry to record and store the metadata of each solver, facilitating quick searching, filtering, and use later; Meta-information preferably includes the solver name, dependent environment, input format, output format, executable path, and / or security policy.

[0026] The solver registry can be persistently stored, such as in a database or JSON file, to prevent data loss upon program restart.

[0027] Each solver should ideally have a unique name to prevent conflicts during matching.

[0028] Step 102: Analyze the task objectives (task objectives, parameter characteristics, tool requirements) and structure the task objective requirements; Step 103: Based on the solver metadata in the solver registry, filter (match) solvers suitable for completing the current task.

[0029] When matching solvers, matching can be based on input format, output format, and task keywords. This means matching must be performed based on the user-provided parameter fields conforming to the solver's input schema, the user-expected output format matching the solver's output format, and the keywords in the task objective appearing in the solver's name / description. Alternatively, matching can be performed by assigning a score to each matching dimension. For example, output format matching scores 3 points, keyword matching scores 2 points, and when the total score is greater than or equal to a preset score threshold, the solver is listed as a candidate (sorted by score). Combining this with the solver's historical execution success rate and execution time, the optimal solver is selected as the target solver.

[0030] Step 2 preferably includes: Step 201: Create a separate workspace for each received task, isolating input files, intermediate files, log files, and result files; This means that each time a task is executed, a separate temporary workspace is created, and all files related to this task are placed in this space, completely separated from files of other tasks to avoid mutual interference.

[0031] The workspace path should ideally include a unique task ID to avoid duplicate names. Tasks should be automatically deleted after completion or scheduled for cleanup.

[0032] A workspace can include an input file area, an intermediate file area, a log file area, and a result file area. Cross-workspace access is prohibited between different workspaces. The workspace is isolated from the system control layer. This setting can effectively prevent directory pollution, file overwriting, and cross-task interference.

[0033] Step 202: Convert the user-inputted task target parameters into an input file (e.g., JSON or XML) that the target solver can recognize, according to the target solver's preset template and input rules (Schema rules), and perform a validity check on the path, file name, and parameter content.

[0034] A validity check may include the following: (1) Parameter validity check Type checking: The solver requires the file path to be a string, so numbers cannot be passed. Required field check: All parameters required by the solver must be provided and none can be missing.

[0035] (2) Path security check: Prevent path traversal attacks: Deny user input attempting to access sensitive system files; File names are restricted: Special characters are prohibited to prevent the creation of illegal files.

[0036] (3) Content security check: Filter out malicious content in the parameters.

[0037] The controlled environment in step 3 preferably includes restrictions on command scope, directory access scope, and / or execution permissions. That is, when running the target solver, only specified commands are allowed to be executed, only specified directories can be accessed, and / or only low-privilege operations are allowed to be performed, to avoid unauthorized command execution and to prevent the solver from performing malicious operations (such as deleting files or accessing sensitive system data).

[0038] In step 4, regardless of whether the target solver succeeds or fails, the results, logs, and error messages are converted into standardized result objects in a unified format, allowing the upper-level agent to process them directly without adapting to the output formats of different solvers. The obtained results are categorized as success and failure results, including output, logs, and exceptions. When the target solver succeeds and a success result is obtained, the result file, logs, and summary are extracted, and the result file path, summary, logs, and status code are encapsulated into a unified result object and returned. When the target solver fails and a failure result is obtained, exception information is extracted, and the error type, exception information, associated solver, log location, and status code are encapsulated into a unified error object. Simultaneously, temporary resource reclamation is triggered, cleaning up temporary files, shutting down the execution environment, and releasing directory occupancy to prevent workspace pollution and residual files occupying disk space. Then, the error result is returned.

[0039] See Figure 5 The present invention also discloses a multi-solver safe execution and isolation scheduling system for intelligent agents, employing any of the multi-solver safe execution and isolation scheduling methods for intelligent agents disclosed in this invention, including: Unified scheduling unit: used to match a suitable target solver for the current task based on the user's task objectives; Isolation Execution Unit: Used to create an independent temporary working directory for the current task and generate corresponding input files for the objective solver; Safety Management Unit: Used to invoke and run the objective solver in a controlled environment; the objective solver calculates results based on the input file. Unified return unit: Used to encapsulate the obtained results into a standardized result object in a unified format and return it to the upper-level intelligent agent.

[0040] The unified scheduling unit preferably includes: Solver registration module: Used to create a solver registry, record and store the metadata of each solver; Task input module: Used to receive the user's task target request and raw parameters; Task identification module: used to parse task objectives and structure them (e.g., extract task type, input / output format requirements, etc.). Solver Matching Module: Used to match a suitable solver for the current task based on the solver metadata in the solver registry (e.g., matching input format, output format, dependent environment, etc.).

[0041] The isolated execution unit preferably includes: Isolation workspace management module: Used to create an independent temporary working directory for the current task, isolating input files, intermediate files, log files and result files to avoid interference between tasks; Secure Input Module: Used to generate corresponding input files for the target solver, while verifying the validity of paths and parameters to prevent malicious input.

[0042] The security management unit preferably includes: Controlled execution module: used to call and run the objective solver; Security policy control module: Used to manage and constrain the execution process of the controlled execution module, restricting command scope, directory access and execution permissions.

[0043] The security policy control module is also used to standardize the output format and ensure that the final returned data contains only four types of security data: result files, log information, exception information, and status codes.

[0044] The unified return unit preferably includes: Unified Result Packaging Module: Used to encapsulate the obtained results into standardized result objects in a unified format; Result return module: Used to return the successful results obtained by the target solver to the upper-level agent; Error return module: Used to return the failure result obtained by the target solver to the upper-level agent and trigger resource reclamation.

[0045] The result return module and the exception return module preferably send the solver's calculation results (successful results or failure results) to the security policy control module to standardize the output format before returning them.

[0046] Example: Taking the example of a scientific intelligent agent simultaneously supporting multiple material calculation solvers, the system first configures the dependency information and security policies of different solvers in the solver registry. When a user submits a task, the system selects the corresponding solver based on the task type and creates an independent working directory for that task. Then, it automatically constructs the input file according to the template and starts the solver in a controlled environment. After execution, the system extracts the target results, logs, and exception information, encapsulates them into a unified result object, and returns it. If a solver fails, the system only affects the currently isolated workspace and will not pollute other tasks or other solver environments.

[0047] Unless otherwise specified or further limited to one preferred or optional technical means being another, the preferred and optional technical means disclosed in this invention can be arbitrarily combined to form several different technical solutions.

Claims

1. A method for safe execution and isolated scheduling of multiple solvers for intelligent agents, characterized in that... Includes the following steps: Step 1: Match a suitable goal solver for the current task based on the user's task objectives; Step 2: Create a separate temporary working directory for the current task and generate the corresponding input files for the target solver; Step 3: Invoke and run the objective solver in a controlled environment. The objective solver calculates the results based on the input file. Step 4: Encapsulate the obtained results into a standardized result object with a unified format and return it to the upper-level intelligent agent.

2. The agent-oriented multi-solver secure execution and isolation scheduling method according to claim 1, characterized in that... Step 1 includes: Step 101: Establish a solver registry to record and store the metadata of each solver; Step 102: Analyze the task objectives and structure the task objective requirements; Step 103: Based on the solver metadata in the solver registry, filter out solvers suitable for completing the current task.

3. The agent-oriented multi-solver secure execution and isolation scheduling method according to claim 2, characterized in that... The metadata includes the solver's name, dependent environment, input format, output format, executable path, and / or security policy.

4. The agent-oriented multi-solver secure execution and isolation scheduling method according to claim 1, characterized in that... In step 2, the user-inputted task target parameters are converted into input files that the target solver can recognize, according to the preset template and input rules of the target solver, and the path, file name and parameter content are checked for validity.

5. The agent-oriented multi-solver secure execution and isolation scheduling method according to claim 1, characterized in that... The controlled environment in step 3 includes restrictions on command scope, directory access scope, and / or execution permissions.

6. The method for secure execution and isolated scheduling of multiple solvers for intelligent agents according to claim 1, characterized in that... The results obtained in step 4 are divided into success results and failure results, including output, logs and exceptions.

7. The agent-oriented multi-solver secure execution and isolation scheduling method according to claim 6, characterized in that... When the objective solver fails and obtains a failure result, temporary resource reclamation is triggered, and the temporary working directory created for the current task is deleted.

8. A multi-solver secure execution and isolation scheduling system for intelligent agents, characterized in that... The agent-oriented multi-solver secure execution and isolation scheduling method according to any one of claims 1-7 includes: Unified scheduling unit: used to match a suitable target solver for the current task based on the user's task objectives; Isolation Execution Unit: Used to create an independent temporary working directory for the current task and generate corresponding input files for the objective solver; Safety Management Unit: Used to invoke and run the objective solver in a controlled environment; the objective solver calculates results based on the input file. Unified return unit: Used to encapsulate the obtained results into a standardized result object in a unified format and return it to the upper-level intelligent agent.

9. The agent-oriented multi-solver secure execution and isolation scheduling system according to claim 8, characterized in that... The unified scheduling unit includes: Solver registration module: Used to create a solver registry, record and store the metadata of each solver; Task input module: Used to receive user task target requests; Task identification module: used to parse task objectives and structure them; Solver Matching Module: Used to match a suitable solver to complete the current task based on the solver metadata in the solver registry.

10. The agent-oriented multi-solver secure execution and isolation scheduling system according to claim 8, characterized in that... The security management unit includes a controlled execution module and a security policy control module. The controlled execution module is used to call and run the target solver, and the security policy control module is used to manage and constrain the execution process of the controlled execution module.

Images