A multi-service scenario large model calling content security control method and system

Abstract

The application discloses a kind of big model calling content security control method and system in multi-service scene, belong to artificial intelligence security technical field.The method includes: obtaining service scene identification in the big model calling link under multiple calling topologies;According to the service scene identification, the corresponding security policy set is dynamically loaded;Based on input detection strategy, the security detection is executed to input content, and according to the detection result, release, alarm release, intercept, return preset reply or alternative reply is executed;After input detection passes, the output content is obtained by calling back-end big model service;Based on output detection strategy, the security detection is executed to output content, and according to the detection result, release, alarm release, desensitization, block or return preset reply is executed.The application realizes the differentiated content security control of same big model under different service scenes, and adapts the service scene identification transmission under multiple calling topologies.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence security technology, specifically to a method and system for security control of large model call content in multiple business scenarios. Background Technology

[0002] With the development of large-scale model technology, more and more business systems are using large-scale models to achieve functions such as intelligent customer service, knowledge base Q&A, business assistants, and business intent recognition. To reduce the risks of model outputting illegal content, leakage of sensitive information, and prompt word attacks, enterprises have begun to deploy security guardrail systems in the large-scale model call chain to detect and control the model input and output content. In real-world enterprise environments, multiple business systems often share the same large backend model service, and the content security requirements for different business scenarios vary significantly. For example, some business scenarios require allowing specific business terminology, business codes, or process-related content to pass through normally, while other business scenarios require implementing stricter content review strategies.

[0003] Existing security fence products typically configure security policies based on model dimensions, meaning the same model corresponds to the same set of security policies. When multiple business scenarios share the same large model, it is easy for normal business content to be mistakenly blocked, or for content that should be blocked to be mistakenly allowed to pass, making it difficult to meet the differentiated security needs of different business scenarios. Furthermore, in actual enterprise deployments, large-scale model call chains may involve various call topologies, such as a unified large-scale model gateway, direct connections to business systems, and calls to third-party workflow platforms. The transmission methods of business scenario identifiers differ under different call topologies, which can easily lead to issues such as missing business scenario identifiers, inability to pass through them, or failure to be correctly identified by security barriers. This can affect the loading and execution of security policies based on business scenarios.

[0004] Therefore, there is an urgent need for a method and system for controlling the security of large model call content that can adapt to multiple call topologies and dynamically load security policies based on business scenario identifiers. This would solve the problems of difficulty in finely configuring security policies and effectively transmitting business scenario identifiers when multiple business scenarios share the same large model, and achieve differentiated content security control of the same large model in different business scenarios. Summary of the Invention

[0005] The purpose of this invention is to provide a method and system for security control of large model call content in multi-business scenarios, in order to solve the following problems existing in the prior art: First, existing large-model security barrier systems typically configure security policies uniformly at the model level. However, in real-world enterprise environments, the same backend large-model service is often called by multiple different business systems and functional scenarios, and these different scenarios have significantly different security requirements for input and output content. If security policies are still uniformly implemented at the model level, it is easy to cause false blocking or false access, making it difficult to meet the differentiated security control needs when multiple business scenarios share the same large model.

[0006] Secondly, in the large model call chain, the business scenario identifier is easily lost when it passes through the unified large model gateway, third-party workflow platform or proxy forwarding due to the complexity of the call chain or interface format limitations. This makes it impossible for the security guard system to accurately identify the actual business scenario, and thus impossible to dynamically load the corresponding security policy for different business scenarios.

[0007] Third, the architecture for calling large models varies significantly among different enterprises. There may be scenarios where business systems without a unified large model gateway directly call backend large model services, or scenarios where a unified large model gateway is placed before or after the service. There may also be scenarios where large models are called through a third-party workflow platform. Existing large model content security control solutions lack a technical solution that can adapt to multiple calling topologies and stably transmit business scenario identifiers under different calling topologies.

[0008] Based on this, the present invention provides a method and system for content security control of large models in multiple business scenarios. By obtaining business scenario identifiers under various call topologies and dynamically loading the corresponding security policy set for the business scenario based on the business scenario identifiers, differentiated content security control of the same large model under different business scenarios can be achieved.

[0009] To achieve the above objectives, the present invention provides the following technical solution.

[0010] This invention provides a method for security control of large model call content in multiple business scenarios, comprising the following steps: Obtain business scenario identifiers from large model call chains under multiple call topologies; Based on the business scenario identifier, the set of security policies corresponding to the business scenario is matched and dynamically loaded from the pre-configured policy library; Based on the input detection strategies in the security strategy set, input security detection is performed on the input content in the large model call request, and corresponding input-side security control processing is performed according to the input security detection results; Once the input security check passes, the request is forwarded to the backend large model service to obtain the output content generated by the model; Based on the output detection strategies in the security strategy set, output security detection is performed on the model output content, and corresponding output-side security control processing is performed according to the output security detection results. The results of the detection and processing are returned to the business system.

[0011] The business scenario identifier consists of an application system identifier and a functional scenario identifier. The business scenario identifier can be obtained in at least one of the following ways: the business system actively carries the application system identifier and functional scenario identifier in the request header or request body; the unified big model gateway injects the application system identifier and functional scenario identifier into the request header before request forwarding, based on the mapping relationship between business authentication credentials and business scenario identifiers; code nodes in a third-party workflow platform actively carry the application system identifier and functional scenario identifier in the request parameters when calling the security guardrail detection interface; if neither the business system nor the unified big model gateway carries the application system identifier and functional scenario identifier, the unified big model gateway transparently transmits the business authentication credentials, and the security guardrail system maintains the mapping relationship between the business authentication credentials and business scenario identifiers, and determines the corresponding business scenario identifier based on this mapping relationship.

[0012] The security policy set includes input detection policies, output detection policies, and auxiliary security policies. The auxiliary security policies include at least one of the following: blacklist / whitelist policies, sensitive information de-identification policies, and proxy answering policies. The security policy set is stored in a policy library according to business scenario identifiers and supports hot reloading.

[0013] The input security detection is executed independently based on the input detection strategy in the security strategy set, and the output security detection is executed independently based on the output detection strategy in the security strategy set. The auxiliary security strategy participates in input security detection, output security detection, or both, as needed for security control. The input-side security control processing includes at least one of the following: allowing access, allowing access after an alarm, blocking access, returning a preset response, or generating an alternative response from the built-in response model of the security barrier. The output-side security control processing includes at least one of the following: allowing access, allowing access after an alarm, desensitizing access, blocking access, or returning a preset response.

[0014] When the security barrier receives a request that does not carry a business scenario identifier, or the business scenario identifier it carries cannot match a registered business scenario configuration, it will refuse to call the backend large model service, return an error message, and record an exception log.

[0015] In a preferred embodiment, in a call topology where the unified big model gateway is located before the security fence system and is responsible for business identity authentication, the unified big model gateway maintains the mapping relationship between business authentication credentials and business scenario identifiers, and injects the application system identifier and functional scenario identifier into the request header before forwarding the request to the security fence system; the security fence system matches and dynamically loads the corresponding security policy set based on the application system identifier and functional scenario identifier injected by the gateway.

[0016] In one implementation, in a call topology where the unified big model gateway is located after the security fence system, when a business system initiates a request to the security fence system, it proactively carries the application system identifier, the functional scenario identifier, and the business authentication credentials for accessing the unified big model gateway. The security fence system matches and dynamically loads the corresponding security policy set based on the application system identifier and the functional scenario identifier, and forwards the business authentication credentials along with the request to the unified big model gateway after the input security check passes. The unified big model gateway performs identity authentication on the business authentication credentials and then forwards the request to the backend big model service. The output content generated by the backend big model service is returned to the security fence system via the unified big model gateway, and the security fence system performs output security checks before returning it to the business system.

[0017] In one implementation, in a scenario where a business system calls a backend large model service through a third-party workflow platform, code nodes are set before and after the execution of the large model node in the workflow. The code nodes call the security guardrail detection interface and actively carry the application system identifier and functional scenario identifier when calling the security guardrail detection interface. A conditional branch node is set after the code node to control the workflow to continue or terminate execution based on the detection result returned by the security guardrail detection interface.

[0018] In one implementation, under a call topology without a unified large model gateway, the business system modifies the original interface address for accessing the backend large model service to the reverse proxy interface address of the security guard system, and actively carries the application system identifier and functional scenario identifier; when the backend large model service enables the authentication mechanism, the security guard system forwards the request with the authentication credentials required to access the backend large model service after the input security check passes.

[0019] Furthermore, when the backend large model service returns output content in a streaming manner, the security guard system performs incremental detection on the streaming output content; when illegal output content is detected, the subsequent streaming transmission of the original output content is blocked.

[0020] This invention also provides a security control system for large model calls in multiple business scenarios, including a business application system, a security guard system, and a backend large model service. In a call topology with a unified large model gateway, it also includes a unified large model gateway. The system comprises the following components: a business application system for initiating large model call requests; a security guardrail system for obtaining business scenario identifiers in large model call chains under various call topologies; matching and dynamically loading a set of security policies corresponding to the business scenario from a pre-configured policy library based on the business scenario identifier; performing input security checks on the input content based on the input detection policies in the security policy set; forwarding the request to the backend large model service after the input security check passes; performing output security checks on the output content based on the output detection policies in the security policy set; and performing corresponding security control processing based on the input security check results and the output security check results. The backend large model service receives requests forwarded by the security guardrail system and returns the output content generated by the model. The unified large model gateway performs identity authentication on business requests and transmits the business scenario identifier or business authentication credential to the security guardrail system, or injects the business scenario identifier when the request is forwarded to the security guardrail system based on the mapping relationship between the business authentication credential and the business scenario identifier.

[0021] Compared with the prior art, the present invention has at least the following beneficial effects: 1. This invention enables the application of different security policies to the same large backend model service in different business scenarios through a dynamic policy loading mechanism based on business scenario identifiers. This solves the problem that existing technologies that uniformly configure policies according to model dimensions are prone to false blocking or false allowing.

[0022] 2. This invention solves the problem of easy loss of business scenario information in complex call chains by obtaining, passing through, injecting or mapping business scenario identifiers under various call topologies, and improves the security guardrail system's ability to identify actual business scenarios.

[0023] 3. This invention is compatible with various calling topologies, including those without a unified large model gateway, with a unified large model gateway in front, with a unified large model gateway in back, and calls from third-party workflow platforms. It can adapt to the requirements of business scenario identifier transmission and security policy loading under different calling topologies, thus improving the applicability of the solution to complex enterprise environments.

[0024] 4. By separating input security detection from output security detection and allowing auxiliary security policies to participate in security control at the input and output stages as needed, this invention makes security policy configuration more in line with the actual needs of multiple service scenarios.

[0025] 5. This invention supports incremental detection of streaming output content and blocks subsequent streaming transmission when illegal output content is detected, thereby improving content security control capabilities in streaming response scenarios. Attached Figure Description

[0026] Figure 1 This is a schematic diagram of the overall architecture of the present invention; Figure 2 This is a schematic diagram of the dynamic routing process for security policies based on business scenario identifiers. Figure 3 This diagram illustrates the security barrier access methods under different call topologies. Figure 3 In the diagram, (a) represents topology 1: no gateway; Figure 3 (b) in the diagram represents Topology 2: the guardrail is in front of the gateway; Figure 3 (c) in the diagram represents topology 3: the guardrail is behind the gateway; Figure 4 This is a schematic diagram illustrating the workflow of calling the security guardrail interface based on code nodes in a third-party low-code platform scenario. Detailed Implementation

[0027] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

[0028] I. Definitions In the description of this invention, for ease of understanding, the following terms are defined: Business scenario identifier: This refers to the identification information used to distinguish different business application systems and their functional scenarios. It consists of an application system identifier and a functional scenario identifier. The application system identifier distinguishes different business applications, while the functional scenario identifier distinguishes different functional points within the same business application. The business scenario identifier can be actively carried by the business system, injected by the unified big data model gateway based on the mapping relationship between business authentication credentials and business scenario identifiers, or, in the case where the unified big data model gateway transparently transmits business authentication credentials, the security barrier system determines the corresponding business scenario identifier based on the locally maintained mapping relationship.

[0029] A security barrier system is an intermediary system deployed between the business system and the backend large-scale model service to perform security detection and control on input and output content. The security barrier system can dynamically load a set of security policies corresponding to the business scenario based on the business scenario identifier, and supports reverse proxy access mode and detection interface call mode.

[0030] Hot loading refers to a mechanism that makes security policy sets or their configuration changes take effect in real time or near real time without restarting the security fence system service.

[0031] Proxy reply: This refers to a situation where, during the input security detection phase, when the input content triggers the blocking rules, the input content is no longer forwarded to the backend large model service. Instead, the security guard's built-in reply model generates an alternative reply and returns it to the business system.

[0032] Preset responses: These refer to fixed response content pre-configured in the safety barrier system, used to directly return information to the business system when input or output safety detection triggers corresponding rules. The preset responses can be implemented as a single fixed response or by selecting response content from a pre-configured set of response statements.

[0033] Alarm release: This means that when the safety barrier system detects a risk in the input or output content, it outputs a risk warning message, records an alarm log, and continues to execute the subsequent processing flow, without intercepting, blocking, desensitizing, returning a preset response, or replacing the response for the current request.

[0034] Streaming mode: This refers to a response mode in which the backend large model service generates and returns output content in real time, word by word, sentence by sentence, or block by block. In streaming mode, the security barrier system performs incremental detection on the streaming output content and blocks the subsequent streaming transmission of the original output content when illegal output content is detected.

[0035] Non-streaming mode: This refers to a response mode where the backend large model service returns all output content at once after it has been fully generated. In non-streaming mode, the security barrier system performs output security checks after receiving the complete output content, and performs actions such as allowing access, alarm allowing access, desensitizing, blocking, or returning a preset response based on the check results.

[0036] II. System Architecture Overview like Figure 1As shown, this invention provides a security control architecture for large model calls across multiple business scenarios. This architecture includes a business application system, a large model security barrier system, a unified large model gateway (optional), and a computing server deploying backend large model services. The business application system initiates large model call requests. The large model security barrier system obtains a business scenario identifier in the large model call chain, matches and dynamically loads a set of security policies corresponding to the business scenario based on the business scenario identifier, and performs security checks and corresponding security control processing on the input and output content. The security barrier system can receive and forward large model call requests using a reverse proxy mode, or provide input and output detection interfaces to the business system or a third-party workflow platform using an API call mode. The unified large model gateway performs identity authentication, access control, and traffic management in call topologies with a gateway, and transparently transmits the business scenario identifier or business authentication credential sent by the business system to the security barrier system, or injects the business scenario identifier based on the mapping relationship between the business authentication credential and the business scenario identifier. The computing server deploys backend large model services, which receive requests forwarded by the security barrier system and return the output content generated by the model.

[0037] Combination Figure 1 The process illustrated, where request and response transmission can be summarized as follows: Without a unified large model gateway, the business application system must first initiate a request carrying a business scenario identifier. With a unified large model gateway, the business system can initiate the request carrying the business scenario identifier, or the unified large model gateway can inject the business scenario identifier before forwarding the request to the security barrier. After the unified large model gateway performs pass-through or injection of the business scenario identifier, it forwards the request to the security barrier system. The security barrier system performs input security checks on the input content; if the checks pass, it forwards the request to the backend large model service. The backend large model service returns the model output content. The security barrier system performs output security checks on the output content and returns the result after processing. With a unified large model gateway, the unified large model gateway then returns the result to the business application system. In a call topology without a unified large model gateway, requests and responses can be directly transmitted between the business application system, the security barrier system, and the backend large model service.

[0038] like Figure 2The diagram illustrates the dynamic routing process of the security policy based on business scenario identifiers according to the present invention. Upon receiving a request, the security barrier system first extracts the business scenario identifier carried in the request, namely the `biz_code` and `scene_code` corresponding to the application system identifier and functional scenario identifier, and determines whether the business scenario identifier exists and has been registered. If the request does not carry a business scenario identifier, or the carried business scenario identifier does not exist or is not registered, the security barrier system should reject the request, return a prompt message such as "Missing business identifier or unregistered business scenario," and record the exception log. If a business scenario identifier exists and has been registered, the security guardrail system loads the set of security policies corresponding to that business scenario and performs input security checks on the input content. When the input content is risky, input-side security control processes such as alarm release, interception, returning a preset response, or using a built-in response model to answer can be performed. After the input security check passes, the request is forwarded to the backend large model service, and output security checks are performed after receiving the model output content. When the output content is risky, output-side security control processes such as alarm release, blocking, desensitization, or returning a preset response can be performed. After the output security check passes, a normal response is returned to the business application system.

[0039] like Figure 3 The diagram shown illustrates the three main call topology access methods supported by this invention. Figure 3 In the example (a), the topology is a direct connection without a unified large model gateway. The business system directly calls the security barrier system, which holds the model authentication credentials required to access the backend large model service and forwards them to the backend large model service after completing content detection. Figure 3 In the diagram (b), the security fence system is located before the unified big model gateway. Business requests first pass through the security fence for content inspection, and then the security fence transmits the gateway authentication credentials to the unified big model gateway. After the gateway completes the identity authentication, it forwards the request to the backend big model service. Figure 3 In the diagram (c), it indicates that the security fence system is located after the unified big model gateway. Business requests first pass through the unified big model gateway to complete identity authentication and the transparent transmission or injection of business scenario identifiers. Then, the security fence performs content security detection based on the obtained business scenario identifiers.

[0040] like Figure 4The diagram illustrates a workflow for calling a security guardrail interface based on code nodes in a third-party low-code platform scenario. After the workflow begins, code node 1 first calls the security guardrail input detection interface, carrying `biz_code` and `scene_code` with it. When the input detection result is "pass", it enters the large model node, calling the large model address or unified large model gateway address to obtain the model output content. After receiving the model output content, code node 2 calls the security guardrail output detection interface. When the output detection result is "pass", it returns the original output and ends the workflow. When the output detection result is "block", it performs desensitization or blocking on the output content and then ends the workflow. If the input detection stage returns "block", it directly returns a rejection message and ends the workflow. The code nodes can embed programming languages ​​that support HTTP requests, such as Python and JavaScript.

[0041] When an enterprise has both business systems that directly call the large model via code and those that call the large model via a third-party workflow platform, the business department, security department, and operations department can collaboratively determine a unified method for carrying the business scenario identifier to ensure consistency in the definition of the business scenario identifier field under different calling methods. This unified method can be carried in the request header or in the request body.

[0042] The present invention will be described in detail below with reference to specific embodiments.

[0043] III. Example 1 (Method Example - The unified large model gateway is located in front of the security fence, preferred implementation method) This embodiment, as a preferred implementation of the present invention, uses a unified large-model gateway located before the security fence system as the calling topology, such as... Figure 3 As shown in (c), the business system first sends a request to the unified big model gateway. There is no need to carry the business scenario identifier in the request. The unified big model gateway is responsible for business identity authentication and maintaining the mapping relationship between business authentication credentials and business scenario identifiers. It also injects the business scenario identifier before forwarding the request to the security barrier system. After the input security check passes, the security barrier system forwards the request to the backend big model service. After receiving the model output content, it performs output security check and then returns the result of the check passing or security control processing to the business system.

[0044] In a certain enterprise, the "Customer Intent Recognition" function of the "Smart Hall" application system and the "Intelligent Customer Service" function of the "Mobile Banking" application system share the same backend large model service. A unified large model gateway assigns different business authentication credentials to different business systems and maintains the mapping relationship between business authentication credentials and business scenario identifiers. Specifically, the business authentication credential api-key-zhjt corresponds to biz_code=hall and scene_code=intent_rec, while the business authentication credential api-key-znkf corresponds to biz_code=mbank and scene_code=ai_chat.

[0045] When a business system initiates a request to call a large model, the request first reaches the unified large model gateway. The unified large model gateway performs identity authentication on the business authentication credentials. After successful authentication, the gateway, based on its pre-maintained mapping relationship, injects the corresponding application system identifier and functional scenario identifier (i.e., `biz_code` and `scene_code`) into the request header or request body before forwarding the request to the security barrier system. Upon receiving the request, the security barrier system extracts the received `biz_code` and `scene_code`, and matches and loads the corresponding set of security policies for the business scenario from the policy library.

[0046] For biz_code=hall and scene_code=intent_rec, the corresponding security policy set may include a business term whitelist policy; for biz_code=mbank and scene_code=ai_chat, the corresponding security policy set may include an input-side proxy answering policy, an input blocking policy, an output blocking policy, and an output desensitization policy.

[0047] In the customer intent recognition scenario of the smart hall, when the input is "Please check the processing progress of business code Y3010", the security barrier system detects that the business code belongs to the configured whitelist, thus determining that the input security check passes and forwarding the request to the backend big model service. After the backend big model service returns the model output content, the security barrier system continues to perform output security checks; if no illegal content is detected, the big model output content is returned to the business system through the unified big model gateway.

[0048] For intelligent customer service scenarios in mobile banking, when the input contains sensitive information and triggers input blocking rules, the security barrier system can directly intercept the request, either returning a preset response or generating an alternative response from the security barrier's built-in response model and returning it to the business system, instead of forwarding the request to the backend large model service. When the input security check passes, the request is forwarded to the backend large model service; if the model output contains sensitive information such as ID card numbers or mobile phone numbers, the security barrier system will desensitize the corresponding fields according to the output desensitization strategy before returning it to the business system; if the large model output contains illegal content, the subsequent transmission of the original output content will be blocked in streaming mode, or a preset response will be returned in non-streaming mode.

[0049] If the request received by the security barrier system does not carry the business scenario identifier that should be injected by the unified large model gateway, or if the carried business scenario identifier cannot match the registered business scenario configuration, the security barrier system will refuse to call the backend large model service, return an error message, and record an exception log.

[0050] Through this embodiment, in a call topology where the unified large model gateway is located before the security guardrail system and the unified large model gateway maintains the mapping relationship between business authentication credentials and business scenario identifiers, collaborative processing of business identity authentication, business scenario identifier injection, and differentiated security policy loading is realized. This improves the enterprise's security control capabilities for large model application content in scenarios where different functional points of different business systems call the same backend large model service.

[0051] IV. Example 2 (Method Example - Unified Large Model Gateway Located Behind Security Fence) This embodiment uses a unified large-model gateway located after the security fence system as the calling topology, such as... Figure 3 As shown in (b), the business system first sends a request to the security barrier system. After the security barrier system passes the input security check, it forwards the request and the business authentication credentials used to access the unified big model gateway to the unified big model gateway. The unified big model gateway then completes the identity authentication and forwards it to the backend big model service.

[0052] In a certain enterprise, the "Customer Intent Recognition" function of the "Smart Hall" application system and the "Intelligent Customer Service" function of the "Mobile Banking" application system share the same backend large model service. When the business system initiates a request to the security barrier system, it proactively carries the application system identifier, the function scenario identifier, and the business authentication credentials. Specifically, the business scenario identifiers corresponding to the "Customer Intent Recognition" scenario in the "Smart Hall" application system are biz_code=hall and scene_code=intent_rec, while the business scenario identifiers corresponding to the "Intelligent Customer Service" scenario in the "Mobile Banking" application system are biz_code=mbank and scene_code=ai_chat.

[0053] Upon receiving a request, the security barrier system first extracts the `biz_code` and `scene_code` carried in the request and matches them against the corresponding security policy set for the business scenario in the policy library. For `biz_code=hall` and `scene_code=intent_rec`, the corresponding security policy set may include a business term whitelist policy; for `biz_code=mbank` and `scene_code=ai_chat`, the corresponding security policy set may include input-side proxy answering policy, input interception policy, output blocking policy, and output de-identification policy.

[0054] In the customer intent recognition scenario of a smart hall, when the input is "Please check the processing progress of business code Y3010", the security barrier system detects that the business code belongs to the configured whitelist, thus determining that the input security check has passed, and forwards the request along with the business authentication credentials to the unified big model gateway. After the unified big model gateway completes identity authentication, it forwards the request to the backend big model service. After the backend big model service returns the model output content, the security barrier system continues to perform output security checks; if no illegal content is detected, the original output result is returned to the business system.

[0055] For intelligent customer service scenarios in mobile banking, when the input contains sensitive information and triggers input blocking rules, the security barrier system can directly intercept the request, either returning a preset response or generating an alternative response from the security barrier's built-in response model and returning it to the business system, instead of forwarding the request to the unified big model gateway and backend big model service. After the input security check passes, the request is forwarded to the backend big model service via the unified big model gateway. If the model output contains sensitive information such as ID card numbers or mobile phone numbers, the security barrier system desensitizes the corresponding fields according to the output desensitization strategy before returning it to the business system. If the output content triggers output blocking rules, the system blocks subsequent transmission of the original output content in streaming mode or returns a preset response in non-streaming mode.

[0056] If the request received by the security barrier system does not carry the business scenario identifier that should be actively carried by the business system, or if the carried business scenario identifier cannot match the registered business scenario configuration, the security barrier system will refuse to call the unified big model gateway and the backend big model service, return an error message and record an exception log.

[0057] This embodiment enables differentiated content security control for the same backend large model service in different business scenarios under a call topology where the unified large model gateway is located after the security guardrail system.

[0058] V. Example 3 (Method Example - Direct Connection Topology Without Unified Large Model Gateway) This embodiment uses a direct connection scenario without a unified large model gateway as an example to provide a detailed explanation of the large model call content security control method for multi-service scenarios described in this invention. For example... Figure 3 As shown in (a), the business system changes the original interface address for accessing the backend large model service to the reverse proxy interface address of the security guard system, and actively carries the business scenario identifier in the request. The security guard system is responsible for maintaining and carrying the authentication credentials of the backend large model service. After the input security check is passed, the system forwards the request to the backend large model service with the large model authentication credentials information.

[0059] In a certain enterprise, the "Contract Review" function of the "Intelligent Document Review" application system and the "Code Generation" function of the "Intelligent Code Assistance" application system share the same backend large model service. The security guard system configures corresponding business scenario identifiers and security policy sets for these two business scenarios respectively. Specifically, the contract review scenario can be configured with keyword whitelists for input and output, and output anonymization policies; the code generation scenario can be configured with policies to block unauthorized output.

[0060] When a contract review scenario involves submitting text for review, the business system proactively includes the corresponding `biz_code` and `scene_code` in the request header or body. The security guard system loads the corresponding security policy set based on the business scenario identifier and performs input security checks on the input content. If the input content contains sensitive information that should not be processed, it directly performs interception processing and returns a preset response without calling the backend large model service. If the input content security check passes, the request is forwarded to the backend large model service. The large model's output content first passes through the security guard; if the security guard detects that the content returned by the large model contains sensitive information, it is anonymized before being returned to the business system.

[0061] When a code generation request is submitted, the security barrier system, after passing the input security check, forwards the request along with the authentication credentials required to access the backend large model service to the backend large model service. After the backend large model service returns the model output content, the security barrier system performs output security checks on the output content; if it detects that the output content contains sensitive information or high-risk content that needs to be processed, it can execute alarm release, de-identification, blocking, or return a preset response according to the corresponding policy.

[0062] This embodiment illustrates how to implement differentiated security policy loading and content security control based on business scenario identifiers in a call topology without a unified large model gateway.

[0063] VI. Example 4 (Method Example - Third-Party Workflow Platform Topology) This embodiment uses a scenario where a third-party workflow platform calls a backend large model service as an example to provide a detailed explanation of the content security control method for large model calls in multi-business scenarios described in this invention. Figure 4 As shown, code nodes are set before and after the execution of the large model node in the workflow. The code nodes actively call the content security detection interface provided by the security guard and carry the business scenario identifier in the request header or request body.

[0064] A company builds multiple workflow applications based on a third-party low-code platform, with different workflows potentially sharing the same backend large model. Since the large model nodes built into the workflow platform cannot directly pass through business scenario identifiers, a solution is adopted: setting input detection code nodes and output detection code nodes within the workflow. The input detection code node calls the security barrier input detection interface, carrying the corresponding business scenario's `biz_code` and `scene_code`. If the input detection result is successful, it proceeds to the large model node to call the backend large model service; if the input detection result is blocked, it directly returns a rejection message and terminates the workflow. After the large model node generates the output content, the output detection code node calls the security barrier output detection interface, continuing to carry the same `biz_code` and `scene_code`. If the output detection result is successful, it returns the original output result; if the output detection result is alarm-allowed, it records the alarm information and continues to return the output result; if the output detection result is de-identified, it returns the de-identified output result; if the output detection result is blocked, it terminates the original output content return process and returns a preset response. In this implementation, the security barrier system achieves content security control through externally provided input and output detection interfaces, regardless of whether the backend large model service is called through the unified large model gateway or the deployment location of the unified large model gateway.

[0065] For example, for the "Intelligent Analysis of Daily Production Reports" workflow, an output anonymization strategy can be configured to anonymize specific production data in the output content; for the "Employee Q&A Assistant" workflow, an input interception strategy can be configured to directly return a preset or alternative response when the user inputs sensitive information such as salary or performance, without entering the large model node.

[0066] In this embodiment, even when a third-party workflow platform cannot directly transmit the business scenario identifier in the large model call chain, the business scenario identifier can still be transmitted and differentiated content security control can still be achieved by calling the security guardrail detection interface through code nodes.

[0067] VII. Example 5 (Method Example - Business Authentication Credential Mapping Catcher Topology) This embodiment uses a fallback scenario where the unified large model gateway lacks the ability to inject business scenario identifiers as an example to provide a detailed explanation of the large model call content security control method for multiple business scenarios described in this invention. In this scenario, the unified large model gateway is located before the security barrier system, but it cannot inject application system identifiers and functional scenario identifiers during request forwarding. Therefore, the unified large model gateway transparently transmits business authentication credentials, and the security barrier system determines the corresponding business scenario identifier based on the mapping relationship between locally maintained business authentication credentials and business scenario identifiers.

[0068] In a certain enterprise, multiple business systems call the same backend big model service through a unified big model gateway. The unified big model gateway assigns different business authentication credentials to different business systems and forwards these credentials to the security barrier system. The security barrier system locally maintains the mapping relationship between business authentication credentials and business scenario identifiers. For example, business authentication credential api-key-a corresponds to biz_code=service_a and scene_code=qa, and business authentication credential api-key-b corresponds to biz_code=service_b and scene_code=assistant.

[0069] When a request arrives at the security barrier system, the system first extracts the transmitted business authentication credentials and determines the corresponding `biz_code` and `scene_code` based on the locally maintained mapping relationship. Then, it loads the corresponding security policy set according to the determined business scenario identifier. If no corresponding mapping relationship is found, the system refuses to call the backend large model service, returns an error message, and logs the exception.

[0070] Once the corresponding mapping relationship is found, the security barrier system performs input security checks on the input content. After the input security check passes, the request is forwarded to the backend large model service. After the backend large model service returns the model output content, the security barrier system further performs output security checks and performs processing such as alarm release, desensitization, blocking, or returning a preset response based on the check results.

[0071] In this embodiment, even when neither the unified large model gateway nor the business system can directly send requests carrying the business scenario identifier, the business scenario identification and dynamic loading of security policies can still be achieved through business authentication credential mapping, thereby improving the adaptability of this invention to complex call topologies.

[0072] The above description is merely a preferred or representative embodiment of the present invention and is not intended to limit the scope of protection of the present invention. The scope of protection claimed by the present invention is determined by the claims.

[0073] Those skilled in the art should understand that, without departing from the technical principles of the present invention, several modifications and equivalent substitutions can be made to the above embodiments, and all such modifications and substitutions should fall within the protection scope of the present invention.

Claims

1. A method for content security control in large-scale model calls across multiple business scenarios, characterized in that, Includes the following steps: Obtain business scenario identifiers from large model call chains under multiple call topologies; Based on the business scenario identifier, the set of security policies corresponding to the business scenario is matched and dynamically loaded from the pre-configured policy library; Based on the input detection strategies in the security strategy set, input security detection is performed on the input content in the large model call request, and corresponding input-side security control processing is performed according to the input security detection results; Once the input security check passes, the request is forwarded to the backend large model service to obtain the output content generated by the model; Based on the output detection strategies in the security strategy set, output security detection is performed on the model output content, and corresponding output-side security control processing is performed according to the output security detection results. The results of the detection and processing are returned to the business system.

2. The method for content security control of large models in multiple business scenarios according to claim 1, characterized in that, The business scenario identifier consists of an application system identifier and a functional scenario identifier; the business scenario identifier is obtained in at least one of the following ways: the business system actively carries the application system identifier and the functional scenario identifier in the request header or request body; Based on the mapping relationship between business authentication credentials and business scenario identifiers, the unified big model gateway injects the application system identifier and functional scenario identifier into the request header before request forwarding. When the code nodes in the third-party workflow platform call the security guardrail detection interface, they actively carry the application system identifier and functional scenario identifier in the request parameters. If neither the business system nor the unified big model gateway carries the application system identifier and functional scenario identifier, the unified big model gateway transparently transmits the business authentication credentials, and the security guardrail system determines the corresponding business scenario identifier based on the mapping relationship between the locally maintained business authentication credentials and business scenario identifiers.

3. The method for content security control of large models in multiple business scenarios according to claim 1, characterized in that, The security policy set is stored in the policy library according to the business scenario identifier dimension and supports hot loading; the security policy set includes input detection policy, output detection policy and auxiliary security policy, the auxiliary security policy includes at least one of blacklist / whitelist policy, sensitive information de-identification policy and proxy answering policy; the input security detection is executed independently based on the input detection policy in the security policy set, and the output security detection is executed independently based on the output detection policy in the security policy set. The auxiliary security policy participates in input security detection, output security detection, or both, as required by security control. Input-side security control processing includes at least one of the following: allowing passage, allowing alarms, blocking, returning a preset response, or generating an alternative response from the security fence's built-in response model. Output-side security control processing includes at least one of the following: allowing passage, allowing alarms, desensitizing, blocking, or returning a preset response.

4. The method for content security control of large models in multiple business scenarios according to claim 1, characterized in that, When the security barrier receives a request that does not carry a business scenario identifier, or the business scenario identifier it carries cannot match a registered business scenario configuration, it will refuse to call the backend large model service, return an error message, and record an exception log.

5. The method for content security control of large models in multiple business scenarios according to claim 2, characterized in that, In a call topology where the unified big model gateway is located before the security fence system and is responsible for business identity authentication, the unified big model gateway maintains the mapping relationship between business authentication credentials and business scenario identifiers. Before forwarding the request to the security fence system, it injects the application system identifier and functional scenario identifier into the request header. The security fence system matches and dynamically loads the corresponding security policy set based on the injected application system identifier and functional scenario identifier.

6. The method for content security control of large model calls in multi-service scenarios according to claim 2, characterized in that, In a call topology where the unified big model gateway is located after the security fence system, when a business system sends a request to the security fence system, it actively carries the application system identifier, the functional scenario identifier, and the business authentication credentials used to access the unified big model gateway. The security barrier system matches and dynamically loads the corresponding security policy set based on the application system identifier and functional scenario identifier. After the input security check passes, the system forwards the business authentication credential along with the request to the unified big model gateway. The unified big model gateway performs identity authentication on the business authentication credential and then forwards the request to the backend big model service. The output content generated by the backend big model service is returned to the security barrier system via the unified big model gateway. The security barrier system performs output security checks and then returns the output to the business system.

7. The method for content security control of large models in multi-service scenarios according to claim 2, characterized in that, In scenarios where a business system calls a backend large model service through a third-party workflow platform, code nodes are set before and after the execution of the large model node in the workflow. The code nodes call the security guardrail detection interface and actively carry the application system identifier and functional scenario identifier when calling the security guardrail detection interface. A conditional branch node is set after the code node to control the workflow to continue or terminate execution based on the detection result returned by the security guardrail detection interface.

8. The method for content security control of large model calls in multi-service scenarios according to claim 2, characterized in that, In a call topology without a unified large model gateway, the business system modifies the original interface address for accessing the backend large model service to the reverse proxy interface address of the security guard system, and actively carries the application system identifier and functional scenario identifier; when the backend large model service enables the authentication mechanism, the security guard system forwards the request with the authentication credentials required to access the backend large model service after the input security check passes.

9. The method for content security control of large model calls in multi-service scenarios according to claim 1, characterized in that, When the backend large model service returns output content in a streaming manner, the security guard system performs incremental detection on the streaming output content; when illegal output content is detected, it blocks the subsequent streaming transmission of the original output content.

10. A content security control system for large-scale model calls in multiple business scenarios, characterized in that, include: Business application systems are used to initiate large model call requests; The security guardrail system is used to obtain business scenario identifiers in the large model call chain under various call topologies. Based on the business scenario identifier, it matches and dynamically loads a set of security policies corresponding to the business scenario from a pre-configured policy library. Based on the input detection policies in the security policy set, it performs input security detection on the input content. After the input security detection passes, it forwards the request to the backend large model service. Based on the output detection policies in the security policy set, it performs output security detection on the output content. Finally, it performs corresponding security control processing based on the input security detection results and the output security detection results. The backend large model service is used to receive requests forwarded by the security guardrail system and return the output content generated by the model. In a call topology with a unified big model gateway, the unified big model gateway is also included. It is used to perform identity authentication on business requests and pass business scenario identifiers or business authentication credentials to the security guard system. Alternatively, based on the mapping relationship between business authentication credentials and business scenario identifiers, it can inject business scenario identifiers when forwarding requests to the security guard system.

Images