An AI interface security protection method and system based on an anti-quantum algorithm

Abstract

The application discloses an AI interface security protection method and system based on an anti-quantum algorithm, relates to the technical field of password application security and generative artificial intelligence security, and comprises the following steps: a client initiates a model calling request to an API gateway; the gateway generates a request identifier and performs continuity verification, forwards the request to a model server after verification, and returns an original response, a model version hash, quality proof data and a response quality digest; the gateway constructs three-element associated data, generates a double signature result in combination with a SM2 classical signature and an ML-DSA post-quantum signature, negotiates a level and sends the double signature result to a verification end; the verification end verifies the double signature result, decides whether to continue according to a negotiation matrix, performs threshold determination on the quality proof data if the verification end decides to continue, and allows the response to be returned if the threshold determination is passed; a next round of continuity verification value is generated after a session is completed; and whole-process information is written into an audit evidence chain. The application is suitable for large model APIs and guarantees the security, integrity, continuity and traceability of AI interface calling.

Description

Technical Field

[0001] This invention relates to the fields of cryptographic application security and generative artificial intelligence security technology, and more specifically to an AI interface security protection method and system based on quantum-resistant algorithms. Background Technology

[0002] Large language models are increasingly providing inference capabilities to business systems via APIs, and the call chain has expanded from traditional human-computer interaction to scenarios such as business orchestration, intelligent agents, automated decision-making, and compliance documentation. Compared to static document signing or ordinary message verification, LLM API responses have the following characteristics:

[0003] A response depends not only on the request content but also on the model version, prompt word policy, evaluation rules, and session context. Man-in-the-middle attackers may not directly forge signatures but instead replace the model version, replay old responses, insert low-quality content, or tamper with routing nodes, causing the client to receive semantically incorrect but formatted results. In the quantum migration resistance phase, relying solely on classical signatures poses long-term security risks, while relying solely on post-quantum signatures brings compatibility and engineering switching costs. Even if existing systems sign responses, they often use "signature verification passed" as the primary condition for allowing access, without incorporating response quality proof into the signed message body and issuing access control, making it difficult to block responses with "valid signatures but abnormal quality."

[0004] Existing AI API interfaces typically lack a secure delivery mechanism that links requests, model versions, response quality, session continuity, and signature negotiation results into a closed loop. In critical business scenarios, issues such as man-in-the-middle substitution, erroneous delivery of low-quality results, and difficulty in tracing abnormal events can still occur. Therefore, existing AI / LLM API interfaces suffer from the following problems: (1) When the AI / LLM API interface encounters a man-in-the-middle attack during transmission or gateway forwarding, the attacker may replace the model version, replay historical responses, or insert abnormal quality content, resulting in the official results being sent out incorrectly.

[0005] (2) Existing signature schemes can usually only determine whether the message has been modified, but cannot continue to determine whether the response meets the quality threshold, which may cause the result of "signature is valid but business quality is abnormal" to enter the formal path.

[0006] (3) In the post-quantum migration stage, there is a lack of auditable evidence chain for the negotiation, compatibility and rollback of classical signatures and post-quantum signatures.

[0007] (4) Existing session continuity checks mostly rely on timestamps, random numbers or token status, which cannot reflect the continuity of model status and response quality.

[0008] (5) Existing exception handling often adopts a uniform strategy, making it difficult to distinguish and handle signature verification failure, quality threshold failure and session binding failure separately and audit them separately.

[0009] Therefore, how to achieve tamper-proof response, resistance to quantum signature migration, prevention of man-in-the-middle attacks in the model distribution chain, and blocking control of abnormal quality responses for large model APIs, and complete the security protection of AI interfaces, is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0010] In view of the above problems, this invention is proposed to provide an AI interface security protection method and system based on a quantum-resistant algorithm to overcome or at least partially solve the above problems. This system is used for secure delivery of AI interface responses, anti-tampering verification, quality access control, session continuity verification, and auditable rollback control. Large model APIs, model gateway interfaces, and agent call interfaces can all be used as applicable interfaces for this invention. Typical applications include enterprise knowledge Q&A, intelligent customer service, code generation, risk assessment, model gateways, and model security operation platforms.

[0011] To achieve the above objectives, the present invention adopts the following technical solution: In a first aspect, embodiments of the present invention provide a method for protecting AI interfaces based on quantum-resistant algorithms, comprising the following steps: S1: The client sends a model invocation request to the API gateway; S2: The API gateway receives the model call request and generates a request identifier for this round based on the model call request. At the same time, it performs continuity verification on the model call request. If the verification fails, the API gateway freezes the current link and requires re-authentication. Otherwise, the API gateway forwards the model call request to the model server. S3: The model server generates the original response based on the current model call request, as well as the model version hash, quality proof data and response quality digest corresponding to the original response, and sends them to the API gateway; S4: The API gateway constructs three-factor association data based on the current request identifier, model version hash, and response quality digest, and performs normalization processing on the quality proof data to obtain a quality proof data digest; it uses signature negotiation capability to associate and encapsulate the three-factor association data and the quality proof data digest into a signed message, and performs SM2 classic signature and ML-DSA post-quantum signature respectively to obtain the double signature result and negotiation level, and sends the double signature result to the verification end; S5: The verification end verifies the dual-signature result to obtain the mixed signature verification result, obtains the signature negotiation result based on the mixed signature verification result and the negotiation matrix, and triggers the processing action based on the signature negotiation result. If the processing action is to continue processing, proceed to S6; otherwise, end the process and proceed to S8. S6: The API gateway performs a quality threshold judgment on the quality proof data and obtains the threshold judgment result. If the threshold judgment result is passed, the API gateway allows the original response to enter the formal return path; otherwise, the process ends and proceeds to S8. S7: After the current round of sessions is completed, the API gateway generates a current round of session context summary based on the model call request, and generates a new session continuity check value by combining the model version hash and response quality summary of the current round of sessions, and transmits the new session continuity check value to the client; S8: The API gateway writes the relevant information of the model call request in the current round of the session, the request identifier of this round, the model version hash, the response quality digest, the hybrid signature verification result, the negotiation level, the threshold judgment result, the handling action and the corresponding handling result, and the timestamp into an immutable audit evidence chain for traceability and compliance evidence collection, and returns S2.

[0012] Preferably, the model call request carries at least the current session identifier and the previous session continuity verification value; the API gateway writes the current session identifier and the previous session continuity verification value into the audit evidence chain.

[0013] Preferably, in S7, the API gateway performs normalization processing on the current session identifier and preset policy control information to generate a current round session context summary.

[0014] Preferably, the quality proof data includes at least a version-level quality proof reference and a response-level quality proof digest, and a response quality digest is generated based on the response-level quality proof digest.

[0015] Preferably, the processing branch is determined based on the signature negotiation result. The processing branches include the candidate formal issuance branch, the evidence chain rollback branch, the isolation review branch, and the alarm blocking branch; the negotiation matrix includes: If both the SM2 classic signature and the ML-DSA post-quantum signature are successfully verified, a processing action is triggered, which includes entering the candidate formal issuance branch for further processing. Only when the SM2 classic signature verification is successful is a handling action triggered. The handling actions include not allowing formal distribution, only allowing entry into the controlled rollback channel, returning the degradation model result or security template response, entering the rollback evidence chain branch to generate a rollback reason code as the handling result, and ending the process. Only when the quantum signature verification after ML-DSA is successful will the action be triggered, preventing formal issuance and entering the isolation review branch to end the process; When both SM2 classic signature and ML-DSA post-quantum signature verification fail, a handling action is triggered, entering the blocking alarm branch, directly blocking the process and triggering a high-risk alarm.

[0016] Preferably, both version-level quality proof references and response-level quality proof summaries include at least: task validity metrics, request consistency metrics, fact or illusion risk metrics, security compliance risk metrics, stability metrics, and version drift metrics.

[0017] Preferably, the strategy engine configures quality thresholds based on business scenarios and performs quality threshold judgments. Quality thresholds include task validity metrics, request consistency metrics, factual or illusory risk metrics, and security compliance risk metrics, which can be used as rigid blocking metrics. Stability metrics and version drift metrics can be used as canary control or degradation control metrics. The requirement is met when the corresponding metric values ​​of the task validity metrics, request consistency metrics, and stability metrics reach or exceed the quality threshold, or when the corresponding metric values ​​of the factual or illusory risk metrics, security compliance risk metrics, and version drift metrics are lower than or equal to the preset risk upper limit. If any rigid blocking metric fails to meet the requirement, the threshold judgment result is "failed," and the original response is prohibited from being officially issued. If the canary control or degradation control metrics fail to meet the requirement, the threshold judgment result is "not met for official issuance," and the strategy engine initiates canary or degradation processing instead of directly executing rigid blocking. If both rigid blocking metrics and canary control or degradation control metrics meet the requirement, the threshold judgment result is "passed."

[0018] Preferably, the new session continuity check value = H(model version hash || response quality digest || session context digest), where H represents a one-way hash function, which can be SM3, SHA-256 or an equivalent secure hash algorithm, and || represents a string concatenation operation. The new session continuity check value is used as the session continuity check value for the next round of verification and is saved to the client as the session continuity check value for the previous round. In S7, the new session continuity check value is also retained on the model server or saved as a verifiable derived value. When the next round of model call request arrives, the API gateway compares the previous round continuity check value carried by the client with the record or verifiable derived value on the model server to determine the session continuity.

[0019] Secondly, embodiments of the present invention provide an AI interface security protection system based on a quantum-resistant algorithm, comprising: The client is used to initiate model call requests and carry the current session identifier, the continuity verification value of the previous session, and write it into the audit evidence chain; The API gateway is used to receive model call requests, generate the current round request identifier, verify the previous round session continuity verification value, assemble the three-element association data, perform signature negotiation and signature call, perform quality threshold judgment, and write the processing results into the audit evidence chain. The model server is used to generate the original response, output the model version hash, and generate quality proof data and response quality summary through quality proof capabilities, and write them into the audit evidence chain; On the verification end, the double-signature result generated by the signature call is verified to obtain the hybrid signature verification result. Based on the hybrid signature verification result, the signature is entered into the negotiation matrix to generate the signature negotiation result. Based on the signature negotiation result, the processing action is triggered. The audit evidence chain is used to record the current session identifier, the previous session continuity check value, the current request identifier, the negotiation level determined by the execution signature negotiation, the hybrid signature verification result, the model version hash, the response quality digest, the threshold judgment result generated by the execution quality threshold judgment, the handling action and the corresponding handling result, and the timestamp.

[0020] As can be seen from the above technical solution, compared with the prior art, the present invention discloses an AI interface security protection method and system based on quantum-resistant algorithms, which has the following beneficial effects: (1) Constructing the request identifier, model version hash and response quality digest into three-element associated data can simultaneously prevent the request, model version and response quality status from being split and replaced, thereby improving the protection against man-in-the-middle (MITM) attacks and historical response replay.

[0021] (2) Incorporating quality verification data into the signature message body and formally issued access control can prevent responses that pass the signature verification but have quality abnormalities from entering the production path.

[0022] (3) By using SM2+ML-DSA hybrid signature and negotiation matrix, the resistance to quantum migration is enhanced while taking into account current compatibility, and an auditable basis is provided for rollback.

[0023] (4) By using the previous round model version hash + the previous round response quality summary + the previous round session context to derive the session continuity check value, the link continuity check has model semantic state characteristics, which is different from the traditional scheme that only relies on timestamps or random numbers.

[0024] (5) Mapping signature verification failure, quality threshold failure and session binding failure to different blocking actions can reduce the risk of mistaken release and improve the interpretability of abnormal handling and the controllability of operation and maintenance.

[0025] (6) By reverting the evidence chain, the signature results, negotiation level, continuity verification status and handling actions are recorded, which facilitates compliance auditing, dispute evidence collection and attack tracing. Attached Figure Description

[0026] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0027] Figure 1 This is a flowchart of an AI interface security protection method based on a quantum-resistant algorithm provided in an embodiment of the present invention; Figure 2 This is a diagram of an AI interface security protection system architecture based on a quantum-resistant algorithm provided in an embodiment of the present invention. Detailed Implementation

[0028] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0029] This invention discloses a method for protecting AI interfaces based on quantum-resistant algorithms, comprising the following steps: S1: The client sends a model invocation request to the API gateway; S2: The API gateway receives the model call request and generates a request identifier for this round based on the model call request. At the same time, it performs continuity verification on the model call request. If the verification fails, the API gateway freezes the current link and requires re-authentication. Otherwise, the API gateway forwards the model call request to the model server. S3: The model server generates the original response based on the current model call request, as well as the model version hash, quality proof data and response quality digest corresponding to the original response, and sends them to the API gateway; S4: The API gateway constructs three-factor association data based on the current request identifier, model version hash, and response quality digest, and performs normalization processing on the quality proof data to obtain a quality proof data digest; it uses signature negotiation capabilities to associate and encapsulate the three-factor association data and the quality proof data digest into a signed message, and executes or calls SM2 classic signature and ML-DSA post-quantum signature respectively to obtain the double signature result and negotiation level, and sends the double signature result to the verification end; S5: The verification end verifies the dual-signature result to obtain the mixed signature verification result, obtains the signature negotiation result based on the mixed signature verification result and the negotiation matrix, and triggers the processing action based on the signature negotiation result. If the processing action is to continue processing, proceed to S6; otherwise, end the process and proceed to S8. S6: The API gateway performs a quality threshold judgment on the quality proof data and obtains the threshold judgment result. If the threshold judgment result is passed, the API gateway allows the original response to enter the formal return path; otherwise, the process ends and proceeds to S8. S7: After the current round of sessions is completed, the API gateway generates a current round of session context summary based on the model call request, and generates a new session continuity check value by combining the model version hash and response quality summary of the current round of sessions, and transmits the new session continuity check value to the client; S8: The API gateway writes the relevant information of the model call request in the current round of the session, the request identifier of this round, the model version hash, the response quality digest, the hybrid signature verification result, the negotiation level, the threshold judgment result, the handling action and the corresponding handling result, and the timestamp into an immutable audit evidence chain for traceability and compliance evidence collection, and returns S2.

[0030] Furthermore, the model call request carries at least the current session identifier and the previous session continuity verification value; the API gateway writes the current session identifier and the previous session continuity verification value into the audit evidence chain.

[0031] Furthermore, in S7, the API gateway standardizes the current session identifier and preset policy control information to generate a current round session context summary.

[0032] Furthermore, the quality proof data includes at least a version-level quality proof reference and a response-level quality proof digest, and a response quality digest is generated based on the response-level quality proof digest; the API gateway constructs the three-element association data based on the current request identifier, model version hash, and response quality digest.

[0033] Furthermore, based on the signature negotiation results, the processing branches are determined, including the candidate formal issuance branch, the evidence chain rollback branch, the isolation review branch, and the alarm blocking branch; the negotiation matrix includes: If both the SM2 classic signature and the ML-DSA post-quantum signature are successfully verified, a processing action is triggered, which includes entering the candidate formal issuance branch for further processing. Only when the SM2 classic signature verification is successful is a handling action triggered. The handling actions include not allowing formal distribution, only allowing entry into the controlled rollback channel, returning the degradation model result or security template response, entering the rollback evidence chain branch to generate a rollback reason code as the handling result, and ending the process. Only when the quantum signature verification after ML-DSA is successful will the action be triggered, preventing formal issuance and entering the isolation review branch to end the process; When both SM2 classic signature and ML-DSA post-quantum signature verification fail, a handling action is triggered, entering the blocking alarm branch, directly blocking the process and triggering a high-risk alarm.

[0034] Furthermore, both version-level quality proof references and response-level quality proof summaries can include task validity metrics, request consistency metrics, fact or illusion risk metrics, security compliance risk metrics, stability metrics, and version drift metrics. Task validity metrics are used to characterize whether the response has achieved the current request objective; Request consistency metrics are used to characterize the degree of consistency between the response and the semantics, prompting strategies, and knowledge domain constraints of the user request. Fact or illusion risk indicators are used to characterize the degree of risk of unfounded, misattributed, or fabricated content in a response; Security and compliance risk indicators are used to characterize the risks of sensitive information leakage, unauthorized access, injection prompts, or unauthorized output; Stability metrics are used to characterize the degree of fluctuation in results when the same type of request is repeatedly invoked; Version drift metric is used to characterize the degree of deviation of the current model output relative to the baseline version or the approved version.

[0035] Furthermore, the strategy engine configures quality thresholds based on business scenarios and executes quality threshold judgments. Quality thresholds include task validity metrics, request consistency metrics, factual or hallucination risk metrics, and security compliance risk metrics, which can be used as rigid blocking metrics. Stability metrics and version drift metrics can be used as canary control or degradation control metrics. Requirements are met when the corresponding metric values ​​of task validity metrics, request consistency metrics, and stability metrics reach or exceed the quality threshold, or when the corresponding metric values ​​of factual or hallucination risk metrics, security compliance risk metrics, and version drift metrics are lower than or equal to the preset risk upper limit. If any rigid blocking metric fails to meet the requirements, the threshold judgment result is "failed," and the original response is prohibited from being officially issued. If the canary control or degradation control metrics fail to meet the requirements, the threshold judgment result is "not met for official issuance," and the strategy engine initiates canary or degradation processing instead of directly executing rigid blocking. If both rigid blocking metrics and canary control or degradation control metrics meet the requirements, the threshold judgment result is "passed."

[0036] Furthermore, the new session continuity check value = H(model version hash || response quality digest || session context digest), where H represents a one-way hash function, which can be SM3, SHA-256, or an equivalent secure hash algorithm, and || represents a string concatenation operation. The new session continuity check value is used as the session continuity check value for the next round of verification and is saved to the client as the session continuity check value for the previous round. In S7, the new session continuity check value is also retained on the model server or saved as a verifiable derived value. When the next round of model call request arrives, the API gateway compares the continuity check value carried by the client with the record or verifiable derived value on the model server to determine the session continuity.

[0037] Based on the same inventive concept, embodiments of the present invention also provide an AI interface security protection system based on quantum-resistant algorithms, such as... Figure 2 As shown, it includes at least: The client is used to initiate model call requests and carry the current session identifier, the continuity verification value of the previous session, and write it into the audit evidence chain; The API gateway is used to receive model call requests, generate the current round request identifier, verify the previous round session continuity verification value, assemble the three-element association data, perform signature negotiation and signature call, perform quality threshold judgment, and write the results into the audit evidence chain. The model server is used to generate the original response, output the model version hash, and generate quality proof data and response quality summary through the quality proof capability of the model server, and write them into the audit evidence chain; On the verification side, the double-signature result generated by the signature call is verified to obtain the hybrid signature verification result. Based on the hybrid signature verification result and the negotiation matrix, a signature negotiation result is generated, and a processing action is triggered based on the signature negotiation result. The audit evidence chain is used to record the current session identifier, the previous session continuity check value, the current request identifier, the negotiation level determined by the execution signature negotiation, the hybrid signature verification result, the model version hash, the response quality digest, the threshold judgment result generated by the execution quality threshold judgment, the handling action and the corresponding handling result, and the timestamp.

[0038] Since the principle behind the problem solved by this system is similar to the aforementioned AI interface security protection method based on quantum-resistant algorithms, the implementation of this system can refer to the implementation of the aforementioned method, and the repetitive parts will not be repeated.

[0039] On the other hand, in one specific embodiment, the API gateway is located in the control center for the formal distribution of the model interface, responsible for session continuity verification, construction of three-factor association data, signature negotiation or invocation, quality threshold determination, policy handling, and audit writing. The model server generates the original inference result and outputs the hash of the hit model version, while providing version-level quality proof references, response-level quality proof digests, and response quality digests; the model server does not directly decide whether the result can be formally distributed. An immutable audit evidence chain records continuity verification values, double-signature results, threshold determination results, rollback reason codes, and handling actions for use in tracing man-in-the-middle attacks, rollback accountability, and compliance auditing.

[0040] On the other hand, in one specific embodiment, the process of the AI ​​interface security protection method based on quantum-resistant algorithms is as follows: Figure 1 As shown, specifically: S1. When a client request arrives at the API gateway, the API gateway generates a request identifier based on the request and verifies the association between the previous session continuity check value and the current session identifier to achieve continuity verification and block cross-session splicing or replay. S2. After the continuity check passes, the API gateway requests the model server; the model server generates the original response, model version hash, quality proof data, and response quality summary. S3 and the API gateway assemble the request identifier, model version hash, and response quality digest into three-element associated data, and combine them with the quality proof data digest to form a signed message; S4. The API gateway's signature negotiation capability completes SM2 and ML-DSA dual signature or call for signed messages and returns the negotiation level; based on the dual signature result, the API gateway enters the candidate formal issuance, controlled rollback, isolation review or branch blocking through the verification and judgment of the verification end; S5. For candidate branches to be officially issued, the API gateway continues to perform quality threshold checks; the system only allows official issuance when the signature, quality, and session policy all meet the conditions; otherwise, it proceeds to degradation, gray-scale deployment, or blocking. S6, the API gateway writes the current round of continuity verification results, quality proof results, negotiation results, and handling actions into the audit evidence chain, and generates the next round of session continuity verification values.

[0041] In one specific embodiment, in an enterprise knowledge Q&A gateway scenario, a client initiates a question request to the large model API interface. After receiving the request, the API gateway first verifies whether the session continuity check value returned in the previous round is consistent with the current session context. If the session continuity check value is inconsistent, it indicates that there may be link splicing, replay, or man-in-the-middle takeover. The API gateway freezes the link and requires re-authentication.

[0042] After the session continuity check passes, the API gateway generates a request identifier and forwards the request to the model server. The model server generates the original response and outputs the hash of the matched model version. The model server's quality proof capability performs an online evaluation of the response, generating response-level quality proof data. Combined with the offline version-level quality proof reference corresponding to the model version, it outputs a response quality digest. The API gateway then constructs a three-factor association data set: Request Identifier || Model Version Hash || Response Quality Digest. The API gateway encapsulates the quality proof data digest and the three-factor association data into a signed message. Using its signature negotiation capability, the gateway signs the same message using both the SM2 private key and the ML-DSA private key, resulting in a double-signed message.

[0043] The verification end verifies the dual-signature result. If both signatures are successfully verified, the system continues with quality threshold determination. Only when both quality thresholds are met simultaneously will the API gateway return the formal response, dual-signature result, and next-round session continuity check value to the client and write them into the formal evidence chain. If only SM2 verification is successful, the system does not return the original formal response but enters a controlled fallback channel, such as returning the baseline model result or a security template reply, and the API gateway records the fallback reason code, negotiation level, and policy action. If only ML-DSA verification is successful, the system determines that the current link is in an abnormal compatibility state, does not officially allow external access, and enters isolation review. If both signatures fail, the system determines that there is high-risk tampering or signature abnormality, directly rejects the request, and triggers a key rotation alarm.

[0044] In one specific embodiment, the quality assurance data includes six categories of indicators: task validity (whether the task is completed), request consistency (whether the response conforms to the request semantics and policy boundaries), illusion risk (risk of unfounded generation), security compliance risk (risk of sensitive disclosure and unauthorized access), stability (the degree of fluctuation in repeated calls), and version drift (the degree of deviation relative to the approval baseline version). Thresholds are configured according to business scenarios, for example, task validity 80-90, request consistency 75-85, illusion risk capped at 10-20, security compliance risk capped at 5-15, stability capped at 70-85, and version drift capped at 15-25. The above values ​​are only configurations for this embodiment, and the scope of protection is not limited to this combination of values.

[0045] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to the method section.

[0046] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for protecting AI interfaces based on quantum-resistant algorithms, characterized in that, Includes the following steps: S1: The client sends a model invocation request to the API gateway; S2: The API gateway receives model call requests and generates a current round request identifier based on the model call requests, while also performing continuity verification on the model call requests; If the verification fails, the API gateway freezes the current link and requires re-authentication; Otherwise, the API gateway will forward the model call request to the model server; S3: The model server generates the original response based on the current model call request, as well as the model version hash, quality proof data and response quality digest corresponding to the original response, and sends them to the API gateway; S4: The API gateway constructs three-element association data based on the current request identifier, model version hash, and response quality digest, and performs normalization processing on the quality proof data to obtain a quality proof data digest; The signature negotiation capability is used to associate and encapsulate the three-factor associated data and the quality proof data digest into a signed message, and then perform SM2 classical signature and ML-DSA post-quantum signature respectively to obtain the double signature result and negotiation level, and send the double signature result to the verification end; S5: The verification end verifies the dual-signature result to obtain the mixed signature verification result, obtains the signature negotiation result based on the mixed signature verification result and the negotiation matrix, and triggers the processing action based on the signature negotiation result. If the processing action is to continue processing, proceed to S6; otherwise, end the process and proceed to S8. S6: The API gateway performs a quality threshold judgment on the quality proof data and obtains the threshold judgment result. If the threshold judgment result is passed, the API gateway allows the original response to enter the formal return path; otherwise, the process ends and proceeds to S8. S7: After the current round of sessions is completed, the API gateway generates a current round of session context summary based on the model call request, and generates a new session continuity check value by combining the model version hash and response quality summary of the current round of sessions, and transmits the new session continuity check value to the client; S8: The API gateway writes the relevant information of the model call request in the current round of the session, the request identifier of this round, the model version hash, the response quality digest, the hybrid signature verification result, the negotiation level, the threshold judgment result, the handling action and the corresponding handling result, and the timestamp into the audit evidence chain, and returns S2.

2. The AI ​​interface security protection method based on quantum-resistant algorithms as described in claim 1, characterized in that, The model call request carries the current session identifier and the session continuity check value from the previous round; The API gateway writes the current session identifier and the previous session continuity check value into the audit evidence chain.

3. The AI ​​interface security protection method based on quantum-resistant algorithms as described in claim 1, characterized in that, The quality proof data includes version-level quality proof references and response-level quality proof digests, and a response quality digest is generated based on the response-level quality proof digest.

4. The AI ​​interface security protection method based on quantum-resistant algorithms as described in claim 1, characterized in that, The processing branches are determined based on the results of the signature negotiation. The processing branches include the candidate formal issuance branch, the evidence chain rollback branch, the isolation review branch, and the alarm blocking branch. The negotiation matrix includes: If both the SM2 classic signature and the ML-DSA post-quantum signature are successfully verified, a processing action is triggered, which includes entering the candidate formal issuance branch for further processing. Only when the SM2 classic signature verification is successful is a handling action triggered. The handling actions include not allowing formal distribution, only allowing entry into the controlled rollback channel, returning the degradation model result or security template response, entering the rollback evidence chain branch to generate a rollback reason code as the handling result, and ending the process. Only when the quantum signature verification after ML-DSA is successful will the action be triggered, preventing formal issuance and entering the isolation review branch to end the process; When both SM2 classic signature and ML-DSA post-quantum signature verification fail, a handling action is triggered, entering the blocking alarm branch, directly blocking the process and triggering a high-risk alarm.

5. The AI ​​interface security protection method based on quantum-resistant algorithms as described in claim 3, characterized in that, Both version-level quality proof references and response-level quality proof summaries include task validity metrics, request consistency metrics, fact or illusion risk metrics, security compliance risk metrics, stability metrics, and version drift metrics.

6. The AI ​​interface security protection method based on quantum-resistant algorithms as described in claim 5, characterized in that, The strategy engine configures quality thresholds based on business scenarios and executes quality threshold judgments. Quality thresholds include rigid blocking indicators such as task validity metrics, request consistency metrics, factual or illusory risk metrics, and security compliance risk metrics, and grayscale or degradation control metrics such as stability metrics and version drift metrics. Requirements are met when the corresponding metric values ​​of task validity metrics, request consistency metrics, and stability metrics reach or exceed the quality threshold, or when the corresponding metric values ​​of factual or illusory risk metrics, security compliance risk metrics, and version drift metrics are lower than or equal to the preset risk upper limit. If any rigid blocking indicator fails to meet the requirements, the threshold judgment result is "failed." If any grayscale or degradation control indicator fails to meet the requirements, the threshold judgment result is "not met for formal deployment," and the strategy engine initiates grayscale or degradation processing. If all rigid blocking indicators, grayscale or degradation control indicators meet the requirements, the threshold judgment result is "passed." 7. The AI ​​interface security protection method based on quantum-resistant algorithms as described in claim 1, characterized in that, The new session continuity check value = H(model version hash || response quality digest || session context digest), where H represents a one-way hash function and || represents a string concatenation operation. The new session continuity check value is used as the session continuity check value for the next round of verification and is saved to the client as the session continuity check value for the previous round. In S7, the new session continuity check value is also retained on the model server or saved as a verifiable derived value. When the next round of model call request arrives, the API gateway compares the continuity check value carried by the client with the record or verifiable derived value on the model server to determine the session continuity.

8. A quantum-resistant AI interface security protection system, characterized in that, The method for protecting AI interfaces based on quantum-resistant algorithms as described in any one of claims 1-7 includes: The client is used to initiate model call requests and carry the current session identifier, the continuity verification value of the previous session, and write it into the audit evidence chain; The API gateway is used to receive model call requests, generate the current round request identifier, verify the previous round session continuity verification value, assemble the three-element association data, perform signature negotiation and signature call, perform quality threshold judgment, and write the results into the audit evidence chain. The model server is used to generate the original response, output the model version hash, and generate quality proof data and response quality summary through quality proof capabilities, and write them into the audit evidence chain; On the verification side, the double-signature result generated by the signature call is verified to obtain the hybrid signature verification result. Based on the hybrid signature verification result and the negotiation matrix, a signature negotiation result is generated, and a processing action is triggered based on the signature negotiation result. The audit evidence chain is used to record the current session identifier, the previous session continuity check value, the current request identifier, the negotiation level determined by the execution signature negotiation, the hybrid signature verification result, the model version hash, the response quality digest, the threshold judgment result generated by the execution quality threshold judgment, the handling action and the corresponding handling result, and the timestamp.

Images