A dynamic intelligent agent authentication system based on intent alignment

Abstract

The application discloses a kind of dynamic intelligent agent authentication systems based on intention alignment, including intention analysis engine module and intention audit module, intention analysis engine module receives two-way input data in parallel, the intention understanding ability of fast pre-check unit, light preliminary screening unit and depth research unit is used to evaluate the consistency of both, and output structured authentication decision package;When intention analysis engine module calculates that there is intention deviation between intelligent agent generation instruction and user original intention, and the deviation degree value is between the preset automatic blocking threshold and safety baseline, intention audit module takes over the current session control right, triggers risk control disposal process, and places main process in suspended state.The application calculates the consistency of user original intention and intelligent agent execution action in real time, can effectively identify and block those logical overreach operations, although it meets static permission rules, but in essence exceed the scope of user appeal, fill the defense blank in intention level.

Description

Technical Field

[0001] This invention relates to the field of intelligent agent system technology, and in particular to a dynamic intelligent agent authentication system based on intent alignment. Background Technology

[0002] In intelligent agent systems, access control is evolving from traditional static request matching to dynamic behavior generation. Existing authentication mechanisms lack the ability to correlate behavior with user intent. Figure 1 For consistency verification capabilities, there are currently three existing solutions:

[0003] Option 1 is static rule-based access control (RBAC / ABAC), which is currently the most mainstream approach. The system predefines the mapping between roles or attributes and resource operations. When an agent initiates a request, the authentication engine checks if its identity tag matches the pre-defined rule list (e.g., role A is allowed to call API X). However, this approach is "static," meaning it can only determine "can it be done," not "should it be done," completely ignoring the context of the request and the user's specific intent. If an attacker uses keyword injection to induce the agent to perform malicious operations within its legitimate permissions (e.g., inducing it to query all data in batches when it has "query" permissions, leading to data leakage), the static rule will fail to intercept it because it considers each individual call to be compliant.

[0004] Option 2 is input filtering based on keyword or regular expression matching. This involves deploying filters at the user command input end or the agent output end to block potentially dangerous operations by matching sensitive keywords (such as "delete", "export", "password") or regular expressions. However, this method is too rigid and easily bypassed. Large language models have extremely strong text recombination capabilities and can circumvent keyword detection through synonym replacement, metaphorical expression, or multi-step decomposition, encapsulating malicious intent in seemingly harmless natural language. In addition, this method lacks an understanding of business logic and is prone to high false positive rates (blocking normal business) or high false negative rates (allowing covert attacks).

[0005] Solution 3 is a large model intent judgment tool based on large model guardrails. The principle is to determine whether the LLM has generated content containing illusions by judging the consistency between the user input and the LLM output. However, the current guardrails focus more on the compliance of the generated content (whether something that should not have been said was said) rather than the logical consistency of the executed actions (whether something that should not have been done was done). They are good at blocking answers to "how to make a bomb", but they are not good at blocking logical fallacies such as "the user says to check the weather, but the agent calls the transfer interface". Therefore, they cannot quantitatively assess the deviation of the execution plan from the original intent, and they are not good at flexibly adapting to new business scenarios, leaving security blind spots. Summary of the Invention

[0006] The purpose of this invention is to overcome the shortcomings of the prior art and provide a dynamic intelligent agent authentication system based on intent alignment.

[0007] The objective of this invention is achieved through the following technical solution: a dynamic intelligent agent authentication system based on intent alignment, comprising an intent analysis engine module and an intent review module;

[0008] The intent analysis engine module receives two input data in parallel: one is the original intent vector extracted from the user's natural language instructions, and the other is the sequence of instructions to be executed generated by the main task agent. The engine uses the intent understanding capabilities of the fast pre-detection unit, the lightweight screening unit, and the deep analysis unit to evaluate the consistency between the two, identify hidden risk characteristics, and output a structured authentication decision package.

[0009] When the intent analysis engine module calculates that there is an intent deviation between the intelligent agent's generated instruction and the user's original intent, and the deviation value is between the preset automatic blocking threshold and the security baseline, the intent review module takes over the control of the current session, triggers the risk control process, and puts the main process in a suspended state.

[0010] The specific processing steps of the dynamic intelligent agent authentication system are as follows:

[0011] S1: Obtain user request, system prompt, and system context;

[0012] S2: Input the contents of step S1 into the agent and output the agent's execution plan;

[0013] S3: The output of the agent in step S2 is given to the intent analysis engine module to obtain the intent analysis result;

[0014] S4: Based on the intent analysis results in step S3, determine whether it is necessary to access the intent review process and obtain the final authentication result.

[0015] Preferably, the intent analysis engine module processing steps are as follows:

[0016] A1: Receives two input data streams in parallel. One stream is the original intent vector extracted from the user's natural language instructions, and the other stream is the sequence of instructions to be executed generated by the main task agent.

[0017] A2: The rapid pre-screening unit performs a preliminary high-speed screening of the input data to identify whether there are obvious abnormal features. If an anomaly is detected, it directly enters the anomaly section, rejects the branch, and terminates subsequent processing; if it is determined that there is no anomaly, it proceeds to the next step.

[0018] A3: The lightweight initial screening unit filters the data that has passed the pre-inspection and assesses potential risks. If an anomaly is found, it is transferred to the in-depth analysis unit for analysis. If it is still determined to be without anomalies, it is executed as if there are no anomalies, and the data is released directly, and the intent determination result is output.

[0019] Preferably, in step A3, the deep analysis unit calls the model to perform in-depth hierarchical analysis on the abnormal or highly sensitive content found in step A3, in order to determine whether there is any logical overreach or intentional risk.

[0020] Preferably, in step A3, the intent determination result includes a deviation score and a determination reason.

[0021] Preferably, the intent review module processing steps are as follows:

[0022] B1: The system receives the intent deviation and its judgment result output by the intent analysis engine module, and reads the system's preset threshold. ;

[0023] B2: Deviate the intended score from the preset threshold When comparing, when the deviation from the score is greater than If the deviation type is marked as clearly malicious, it is determined that no intervention is required, and the deviation score is ≤ However, if the deviation from the normal baseline or the type of deviation is due to abnormal business logic, it is determined that intervention is required.

[0024] B3: If it is determined that no intervention is required, the system terminates the session, revokes permissions, and triggers a security alarm; if it is determined that intervention is required, the system marks the current request status as suspended, suspends subsequent data transmission, and triggers a multi-factor risk control process.

[0025] B4: If the risk control process results in a failure to pass the review, the process will be redirected to direct rejection; if the risk control process results in a pass to pass the review, the process will be approved and the operation will be allowed.

[0026] Preferably, in step B1, agent interaction logs from real business environments are collected and labeled to construct a dataset containing 1000 positive and negative samples. All data in the sample library are tested, and the deviation score and corresponding false positive rate (FPR) and false negative rate (FNR) for each sample are calculated to obtain a preset threshold. ,

[0027] ;

[0028] .

[0029] This invention has the following advantages: It breaks through the traditional static matching mode based on preset rules, and achieves this through dual-path input... Figure 1Consistency comparison, which calculates the consistency between the user's original intent and the agent's actions in real time, can effectively identify and block logical overreach operations that, although conforming to static permission rules, actually exceed the scope of the user's demands. This fills the defense gap at the intent level and fundamentally solves the problem of insufficient coverage of dynamic behavior space. Attached Figure Description

[0030] Figure 1 A schematic diagram of a dynamic intelligent agent authentication system;

[0031] Figure 2 This is a schematic diagram of the dynamic intelligent agent authentication system process;

[0032] Figure 3 This is a schematic diagram of the processing flow of the intent analysis engine module;

[0033] Figure 4 This is a schematic diagram of the intent review module's processing flow. Detailed Implementation

[0034] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.

[0035] Therefore, the following detailed description of the embodiments of the invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to illustrate selected embodiments of the invention. All other embodiments obtained by those skilled in the art based on the embodiments of the invention without inventive effort are within the scope of protection of the invention.

[0036] It should be noted that, unless otherwise specified, the embodiments and features described in this invention can be combined with each other.

[0037] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0038] In the description of this invention, it should be noted that the terms "center," "upper," "lower," "left," "right," "vertical," "horizontal," "inner," and "outer," etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings, or the orientation or positional relationship commonly used when the product of this invention is in use, or the orientation or positional relationship commonly understood by those skilled in the art. They are used only for the convenience of describing this invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of this invention. In addition, the terms "first," "second," etc., are only used to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0039] In the description of this invention, it should also be noted that, unless otherwise explicitly specified and limited, the terms "set," "install," "connect," and "link" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal connection of two components. Those skilled in the art can understand the specific meaning of the above terms in this invention based on the specific circumstances.

[0040] In this embodiment, as Figure 1 As shown, a dynamic intelligent agent authentication system based on intent alignment includes an intent analysis engine module and an intent review module.

[0041] The intent analysis engine module receives two input data in parallel: one is the original intent vector extracted from the user's natural language instructions, and the other is the sequence of instructions to be executed generated by the main task agent. The engine uses the intent understanding capabilities of the fast pre-detection unit, the lightweight screening unit, and the deep analysis unit to evaluate the consistency between the two, identify hidden risk characteristics, and output a structured authentication decision package.

[0042] When the intent analysis engine module calculates that there is an intent deviation between the intelligent agent's generated instruction and the user's original intent, and the deviation value is between the preset automatic blocking threshold and the security baseline, the intent review module takes over the control of the current session, triggers the risk control process, and puts the main process in a suspended state.

[0043] The specific processing steps of the dynamic intelligent agent authentication system are as follows:

[0044] S1: Obtain user request, system prompt, and system context;

[0045] S2: Input the contents of step S1 into the agent and output the agent's execution plan;

[0046] S3: The output of the agent in step S2 is given to the intent analysis engine module to obtain the intent analysis result;

[0047] S4: Based on the intent analysis results in step S3, determine whether to integrate with the intent review process and obtain the final authentication result. Specifically, such as... Figure 2 As shown, in step S1, the system first receives the user's natural language access request. Then, the agent aggregates the user's original natural language command and the current historical dialogue context, encapsulating them into standardized prompt words. The purpose of this step is to provide complete contextual information for subsequent large-scale model processing, ensuring the accuracy of task understanding. In step S2, the encapsulated prompt words are sent to the main task large-scale language model. This model is responsible for understanding the task objective and planning specific action paths, outputting the agent's execution plan. This command typically includes a specific function name, calling parameters, and execution logic. In step S3, before the command generated by the agent is actually sent to the business system for execution, the authentication mechanism of this invention forcibly intercepts the command. The system compares the intercepted agent execution plan with the user's original command saved in step S1. Figure 1 The data is fed into the intent analysis engine module for processing. Figure 1 Consistency determination; In step S4, the intent analysis engine module performs a deep intent comparison on the two inputs and outputs the comparison result. The system performs logical judgment based on the result, and the judgment criteria include: whether the executed action exceeds the minimum scope required to complete the original task (over-authorization), whether there are additional operations unrelated to the task, and whether the execution parameters have implicit contradictions with the user's verbal intent, etc. If the judgment result is yes (i.e., there is a deviation), the system automatically selects to directly block or transfer to human-machine collaborative review based on the severity of the deviation (quantified by the deviation score output by the intent analysis engine module); if the judgment result is no (i.e., the intent is not cleared), the system performs logical judgment based on the severity of the deviation (quantified by the deviation score output by the intent analysis engine module). Figure 1 (To) the system removes the blockade, issues an execution token to the underlying business interface, and allows the agent to execute the operation as planned.

[0048] Furthermore, such as Figure 3 As shown, the intent analysis engine module processes the following steps:

[0049] A1: It receives two input data in parallel. One is the original intent vector extracted from the user's natural language instructions, and the other is the sequence of instructions to be executed generated by the main task agent, i.e. the specific function and parameters planned by LLM, which is used as the behavior object to be detected.

[0050] A2: The rapid pre-screening unit performs a preliminary high-speed screening of the input data to identify whether there are obvious abnormal features, such as parameter illusions or sensitive words. If an anomaly is detected, the system directly enters the anomaly section, rejects the branch, and terminates subsequent processing. If no anomaly is detected, the system proceeds to the next step.

[0051] A3: The lightweight initial screening unit filters the data that has passed the pre-screening and assesses potential risks. If anomalies are found, the data is transferred to the deep analysis unit for further analysis. If no anomalies are found, the data is processed without incident and the intent determination result is output. Further, in step A3, the deep analysis unit uses a model to perform in-depth hierarchical analysis on the anomaly or highly sensitive content found in step A3 to determine if there is any logical overreach or intent risk. Specifically, in step A3, the intent determination result includes a deviation score and a reason for determination. The deviation score is a quantitative value between 0 and 1, representing the degree to which the instruction deviates from the intent; the reason for determination is a specific deviation reason described in natural language, such as detecting a Delete operation when the user's original intent was only Query.

[0052] In this embodiment, as Figure 4 As shown, the processing steps of the intent review module are as follows:

[0053] B1: The system receives the intent deviation and its judgment result output by the intent analysis engine module, and reads the system's preset threshold. ;

[0054] B2: Deviate the intended score from the preset threshold When comparing, when the deviation from the score is greater than If the deviation type is marked as clearly malicious, it is determined that no intervention is required, and the deviation score is ≤ However, if the deviation from the normal baseline or the type of deviation is due to abnormal business logic, it is determined that intervention is required.

[0055] B3: If it is determined that no intervention is required, the system terminates the session, revokes permissions, and triggers a security alarm; if it is determined that intervention is required, the system marks the current request status as suspended, suspends subsequent data transmission, and triggers a multi-factor risk control process.

[0056] B4: If the risk control process results in a failed review, the process will proceed to a direct rejection; if the risk control process results in a passed review, the process will proceed and the operation will be allowed. Specifically, a preset threshold is set. Instead of being set based on human experience, the threshold is determined by a constructed sample library of agent logic overreach in real-world scenarios. Through testing and statistical evaluation, the threshold value with the best overall performance is selected as the operating threshold. Specifically, agent interaction logs from real-world business environments are collected and labeled to construct a dataset containing 1000 positive and negative samples. All data in the sample library are tested, and the deviation score, false positive rate (FPR), and false negative rate (FNR) for each sample are calculated to obtain the preset threshold. ,

[0057] ;

[0058] .

[0059] In this embodiment, the present invention breaks through the traditional static matching mode based on preset rules, and achieves this through dual-channel input. Figure 1 Consistency comparison, which calculates the consistency between the user's original intent and the agent's actions in real time, effectively identifies and blocks logically unauthorized operations that, while conforming to static permission rules, actually exceed the scope of the user's needs. This fills the gap in intent-level defense and fundamentally solves the problem of insufficient coverage of dynamic behavior space. For example, in a scenario of agent over-execution, the user instructs: "Please extract orders exceeding 100,000 from last week's sales report." The agent plans to download all order data and then filter it locally. Therefore, it calls the full raw data interface, attempting to download the full detailed table containing sensitive information such as customer phone numbers and addresses, planning to filter it locally before providing the results.

[0060] If relying on traditional permission systems, monitoring logs only show that legitimate accounts have performed internal reads. Because the user account itself has database access rights, the system cannot identify the huge discrepancy between the actual execution scope of the agent (full download) and the user's authorized intent (only checking for anomalies), resulting in the risk of unnecessary large-scale sensitive data transfer being missed.

[0061] If an intent-aligned authentication system is deployed, the system will compare the user's original command with the agent's execution plan in real time. During auditing, the risk chain can be immediately reproduced: the system first calls a regularization-based detection unit to check for sensitive words or parameter illusions; then it calls a lightweight initial screening unit, implemented using a RoBERTa model, to determine if there is any obvious unauthorized intent; finally, it calls a deep analysis unit, using LLM to accurately identify the user's intent as a small-scale feature extraction, while the agent's plan is a full plaintext export. The intents deviate from each other. Even though the agent has no malicious intent and its static permissions are legal, the system still determines it as a logical unauthorized act, automatically intercepting the request before data is written and forcibly correcting the execution strategy to only query abnormal rows. This effectively prevents data leakage risks caused by agents while ensuring business efficiency.

[0062] Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A dynamic intelligent agent authentication system based on intent alignment, characterized in that: This includes an intent analysis engine module and an intent review module; The intent analysis engine module receives two input data in parallel: one is the original intent vector extracted from the user's natural language instructions, and the other is the sequence of instructions to be executed generated by the main task agent. The engine uses the intent understanding capabilities of the fast pre-detection unit, the lightweight screening unit, and the deep analysis unit to evaluate the consistency between the two, identify hidden risk characteristics, and output a structured authentication decision package. When the intent analysis engine module calculates that there is an intent deviation between the intelligent agent's generated instruction and the user's original intent, and the deviation value is between the preset automatic blocking threshold and the security baseline, the intent review module takes over the control of the current session, triggers the risk control process, and puts the main process in a suspended state. The specific processing steps of the dynamic intelligent agent authentication system are as follows: S1: Obtain user request, system prompt, and system context; S2: Input the contents of step S1 into the agent and output the agent's execution plan; S3: The output of the agent in step S2 is given to the intent analysis engine module to obtain the intent analysis result; S4: Based on the intent analysis results in step S3, determine whether it is necessary to access the intent review process and obtain the final authentication result.

2. The dynamic intelligent agent authentication system based on intent alignment according to claim 1, characterized in that: The intent analysis engine module processes the following steps: A1: Receives two input data streams in parallel. One stream is the original intent vector extracted from the user's natural language instructions, and the other stream is the sequence of instructions to be executed generated by the main task agent. A2: The rapid pre-screening unit performs a preliminary high-speed screening of the input data to identify whether there are obvious abnormal features. If an anomaly is detected, it directly enters the anomaly section, rejects the branch, and terminates subsequent processing; if it is determined that there is no anomaly, it proceeds to the next step. A3: The lightweight initial screening unit filters the data that has passed the pre-inspection and assesses potential risks. If an anomaly is found, it is transferred to the in-depth analysis unit for analysis. If it is still determined to be without anomalies, it is executed as if there are no anomalies, and the data is released directly, and the intent determination result is output.

3. The dynamic intelligent agent authentication system based on intent alignment according to claim 2, characterized in that: In step A3, the deep analysis unit calls the model to perform in-depth hierarchical analysis on the abnormal or highly sensitive content found in step A3 to determine whether there is any logical overreach or intentional risk.

4. The dynamic intelligent agent authentication system based on intent alignment according to claim 3, characterized in that: In step A3, the intention determination result includes the deviation score and the reason for the determination.

5. The dynamic intelligent agent authentication system based on intent alignment according to claim 4, characterized in that: The intent review module processes the following steps: B1: The system receives the intent deviation and its judgment result output by the intent analysis engine module, and reads the system's preset threshold. ; B2: Deviate the intention score from the preset threshold When comparing, when the deviation from the score is greater than If the deviation type is marked as clearly malicious, it is determined that no intervention is required, and the deviation score is ≤ However, if the deviation from the normal baseline or the type of deviation is due to abnormal business logic, it is determined that intervention is required. B3: If it is determined that no intervention is required, the system terminates the session, revokes privileges, and triggers a security alert; If intervention is deemed necessary, the system will mark the current request status as suspended, pause subsequent data transmission, and trigger a multi-factor risk control process. B4: If the risk control process results in a failure to pass the review, the process will be redirected to direct rejection; if the risk control process results in a pass to pass the review, the process will be approved and the operation will be allowed.

6. The dynamic intelligent agent authentication system based on intent alignment according to claim 5, characterized in that: In step B1, agent interaction logs from real business environments are collected and labeled to construct a dataset containing 1000 positive and negative samples. All data in the sample database are tested, and the deviation score and corresponding false positive rate (FPR) and false negative rate (FNR) for each sample are calculated to obtain a preset threshold. , ； 。

Images