A method and system for agent networking

Abstract

The application provides an agent networking method and system, and relates to the technical field of electronic information.The application constructs a point-to-point distributed network, allocates a unique network identifier to each agent node, coordinates a network address translation hole with a guide server and a relay server, establishes a direct connection channel between nodes, realizes cross-node service port mapping and transparent access through a port identification mechanism, builds an encrypted hypertext transfer protocol access system, supports domain name resolution, request distribution and automatic certificate management, realizes service self-searching based on domain name text records and node service description documents, and realizes instant interaction and hierarchical authorization control between cross-node agents and between agents and users relying on a federal communication mechanism.The application can realize self-networking and cooperation of agents, is flexible in networking, high in security, and suitable for the intelligent agent interconnection needs of multiple scenes such as families and enterprises.

Description

Technical Field

[0001] This invention relates to the field of intelligent agent networking technology, and more specifically, to a method and system for intelligent agent networking. Background Technology

[0002] With the development of intelligent agent technology, the demand for networking of intelligent agents continues to increase. At present, the networking methods of intelligent agents are generally limited to the connection between intelligent agents and various instant messaging software for individuals and enterprises, and the connection between intelligent agents and clients is realized through cloud servers. Its networking logic is not fundamentally different from the centralized access mode of traditional Internet and mobile Internet.

[0003] In existing technical solutions, direct point-to-point connections cannot be established between intelligent agents. All data interactions must be relayed through third-party cloud platforms, which not only increases transmission latency but also limits the interface permissions, service rules, and operational scope of the cloud platforms, making cross-platform interconnection difficult between intelligent agents from different service providers. Furthermore, intelligent agents cannot autonomously discover other intelligent agent nodes in the network or independently assess the service capabilities of peers, hindering cross-node autonomous collaborative work. In addition, under the existing centralized networking model, local intelligent agents in enterprise and home scenarios cannot build autonomous and controllable private interconnected networks and cannot flexibly connect to traditional internet services, greatly limiting the development and widespread adoption of intelligent agent applications.

[0004] To address the aforementioned shortcomings of existing technologies, this invention proposes a method and system for intelligent agent networking, aiming to solve the problems of intelligent agents being unable to directly interconnect, insufficient service discovery capabilities, poor networking flexibility, and weak security control capabilities. Summary of the Invention

[0005] To address the aforementioned problems, this invention provides a method for networking intelligent agents, characterized by comprising: constructing a point-to-point distributed network, assigning a unique identifier to each intelligent agent node within the network, obtaining networked seed nodes through a guidance server, coordinating network address translation (NAT) hole punching through a relay server, and establishing point-to-point communication channels between different intelligent agent nodes; establishing a port mapping mechanism, whereby intelligent agent nodes expose specified Transmission Control Protocol (TCP) or User Datagram Protocol (UDP) ports to peer nodes through the point-to-point communication channels, assigning a unique port identifier to each exposed port, and peer nodes mapping remote exposed ports to their local ports based on the port identifiers; and constructing a Hypertext Transfer Protocol (HTTP) secure access system, carrying hypertext transmission on the mapped ports. The protocol encrypts transmission based on transport layer security protocols, encodes the unique identifier of each node, establishes address resolution records and alias records on the domain name system server, configures server names to instruct agents to distribute requests, and issues security certificates to nodes through an automated certificate management mechanism. It also establishes an agent service lookup mechanism, creating text records on the domain name system server based on the unique identifier or alias of each node to describe its service capabilities, and deploys service description documents in the node's hypertext transfer service for other nodes to retrieve and parse. Furthermore, it builds a cross-node instant communication system, assigning communication accounts to agents and users, and relying on a federated communication mechanism and a point-to-point hypertext transfer network to achieve real-time interaction and authorization matching between cross-node agents and between agents and users.

[0006] Compared to existing technologies, this technical solution achieves the following technical effects: By constructing a point-to-point distributed network and assigning a unique identifier to each intelligent agent node, it eliminates the dependence on centralized cloud platforms for network connectivity from the ground up. This enables intelligent agents to autonomously establish direct end-to-end communication channels. Combined with a port mapping mechanism, it achieves the reuse and localized access of cross-node service ports, without exposing services directly to the public network. An encrypted hypertext transfer protocol system ensures the security and standard compatibility of cross-node service access. The accompanying service discovery mechanism allows intelligent agents to autonomously identify the service capabilities of peer nodes and complete preliminary screening. The cross-node instant communication system enables real-time interactive collaboration between intelligent agents and between intelligent agents and users. The overall solution constructs a complete autonomous interconnection framework for intelligent agents, effectively solving the core problem of the inability of intelligent agents to directly interconnect in existing technologies. It significantly improves the flexibility and collaborative capabilities of intelligent agent networking and can adapt to the interconnection needs of intelligent agents in various scenarios such as homes and enterprises.

[0007] In one embodiment of the present invention, the unique identifier across the entire network adopts any one of the following: public-key cryptography-based identity identifier, decentralized identity identifier, or self-organizing and self-healing network address; the network address translation hole punching includes Transmission Control Protocol synchronous handshake hole punching, User Datagram Protocol message exchange hole punching, or Universal Plug and Play mechanism hole punching.

[0008] Compared with existing technologies, the technical effects achieved by this solution are as follows: By providing multiple unique node identification schemes, it can adapt to the deployment requirements of different security levels and network architectures. The identity identifier based on public-key cryptography has cryptographic-level verifiability, the decentralized identity identifier supports cross-system identity mutual recognition, and the self-organizing and self-healing network address is suitable for decentralized self-organizing network scenarios, avoiding the single point of failure risk caused by centralized identity allocation. At the same time, it supports multiple network address translation hole punching methods, which can adapt to the node interoperability requirements in different network environments. Whether it is a Transmission Control Protocol scenario, a User Datagram Protocol scenario, or a gateway environment that supports a universal plug-and-play protocol, it can successfully establish point-to-point connections, effectively improving the environmental adaptability and node connectivity success rate of distributed networks, and lowering the network environment threshold for intelligent agent networking.

[0009] In one embodiment of the present invention, the Hypertext Transfer Protocol includes versions 1.1, 2, and 3, and the Transport Layer Security Protocol includes versions 1.2 and 1.3; when based on the 1.2 version of the Transport Layer Security Protocol, the proxy is instructed to distribute requests by domain name aliases through the server name, and when based on the 1.3 version of the Transport Layer Security Protocol, requests are distributed discretely to the corresponding target nodes by exposing port numbers.

[0010] Compared with existing technologies, the technical effects achieved by adopting this solution are as follows: By supporting multiple versions of Hypertext Transfer Protocol (HTTP) and Transport Layer Security (TLS) protocols, it is compatible with various existing network services and application systems, allowing access to the intelligent agent network without significant modifications to existing services, thus reducing the cost of service access modifications; the server name indication proxy mechanism based on TLS 1.2 enables accurate distribution of HTTP requests without requiring separate deployment of corresponding domain name certificates on target nodes, greatly simplifying certificate deployment and maintenance processes in multi-node scenarios; the port-discrete distribution method based on TLS 1.3 further enhances the flexibility and security of request distribution, enabling direct location of target service nodes based on port numbers, adapting to high-density deployment scenarios with multiple service nodes, and effectively improving access efficiency and service scalability.

[0011] In one embodiment of the present invention, the text record describes the agent's introduction, service content and requirements in a preface and lightweight markup language format, with newline characters replaced by specified alternative characters; the service description document includes a skill description document, a hypertext markup language document, a structured data document or a service-oriented architecture description document.

[0012] Compared with existing technologies, the technical effects achieved by this solution are as follows: By setting text records in the domain name system to carry the basic service information of the agent, the agent can quickly obtain the service overview of the target node through conventional domain name resolution operations, and complete the initial service screening without establishing a complete application connection, effectively improving the efficiency of service search; The description format using a preface and lightweight markup language has good structured characteristics and parsability, which facilitates the agent to automatically identify and evaluate service content, while supporting multiple description formats such as natural language, adapting to the parsing capabilities of different types of agents; The multi-format service description documents deployed locally on the node can provide more detailed service descriptions and calling specifications, supporting deep service integration and autonomous collaboration between agents, enriching the information dimensions of service discovery, and taking into account the dual needs of fast retrieval and detailed query.

[0013] In one embodiment of the present invention, the cross-node instant messaging system is built on a matrix communication server, and its federation mechanism can be extended to cross-node interconnection of various instant messaging servers and IoT servers; the authorization matching adopts a pairing mechanism to realize access authorization between intelligent agents across nodes and between intelligent agents and users.

[0014] Compared with existing technologies, the technical effects achieved by this solution are as follows: A cross-node instant messaging system built on a matrix communication server can leverage mature communication protocols to ensure the reliability and real-time performance of message interaction. Its federation mechanism, combined with a peer-to-peer hypertext transfer network, breaks down barriers between different communication servers, enabling cross-network communication between intelligent agents across heterogeneous nodes. This interconnection architecture is scalable to various instant messaging servers and IoT servers, supporting both intelligent agent interconnection within a single server and cross-network collaboration between multiple servers, demonstrating excellent scenario adaptability. Seamless interaction between humans and intelligent agents is achieved by assigning communication accounts to users, while the accompanying pairing and authorization mechanism ensures the security of cross-node access, enabling intelligent agents and users to collaborate securely within authorized scopes, thus constructing an integrated collaborative communication environment for humans and intelligent agents.

[0015] In one embodiment of the present invention, node identifier blacklists and whitelists, Internet Protocol address blacklists and whitelists, and communication 5-tuple verification rules are set at the point-to-point connection level; hierarchical port access authorization rules are set at the port mapping level; the transport layer proxy protocol is extended at the hypertext transfer protocol level, and the accessing node identifier and address information are added to the request header field to achieve application-level authorization; all authorization rules support hot reloading and updates, and firewall rules can be dynamically adjusted based on network logs and application logs; the Domain Name System service uses encrypted domain name query method to provide trusted resolution.

[0016] Compared with existing technologies, the technical effects achieved by this solution are as follows: By setting hierarchical authorization rules at the point-to-point connection layer, port mapping layer, and application service layer, a multi-level, in-depth security protection system is constructed, enabling fine-grained permission control across the entire link, from network connection access and port access permissions to application service calls; the blacklist / whitelist mechanism of node identifiers and Internet Protocol addresses, combined with communication five-tuple verification, can accurately control the identity and network attributes of access nodes; port-level hierarchical authorization can set differentiated access permissions for different services; and the access identifier added by the extended transport layer proxy protocol enables precise authorization at the application layer; all rules support hot loading and dynamic adjustment based on runtime logs, adapting to dynamically changing network environments; and the encrypted domain name resolution service further ensures the security of the domain name query process, comprehensively improving the overall security protection capabilities and operational flexibility of the intelligent agent network.

[0017] In one embodiment of the present invention, an intranet Internet Protocol address is specified for the alias domain, a virtual private network service is deployed on the agent node and bound to the intranet address, a matching client is installed on the user terminal and a virtual private network channel is established with the agent node, so that the user terminal can access various network services of local and remote agent nodes.

[0018] Compared with existing technologies, the technical effects achieved by this solution are as follows: By assigning internal network addresses to alias domains and deploying virtual private network services on agent nodes, a secure and encrypted access channel is constructed between the user terminal and the agent network. Users only need to install the corresponding client on their terminal and complete authentication to establish an encrypted virtual private network connection, enabling secure access to the local services of their own agent nodes without complex network configuration. Simultaneously, leveraging the port mapping capabilities of the agent network, user terminals can also indirectly access various network services of other authorized agent nodes within the network, achieving the effect of accessing the entire authorized network with a single node connection. The terminal applications, compatible with multiple operating systems, cover various user scenarios, effectively improving the convenience and user experience of access.

[0019] In one embodiment of the present invention, non-web page service ports are exposed on the agent node and mapped to the user terminal to enable access to remote control services; various business applications are deployed on the agent node and the agent is driven to complete development and adaptation; corresponding applications are developed on the user terminal to access the agent network; and the agent node ports are mapped to the public Internet to support Internet services that require callback.

[0020] Compared with existing technologies, the technical effects achieved by this solution are as follows: By exposing non-web page service ports and mapping them to user terminals, the access scope of the intelligent agent network can be expanded from web page services to various general network services, supporting remote command line, desktop sharing, and other remote operation and management scenarios, thus expanding the application boundaries of the network; Deploying business applications on intelligent agent nodes and having the intelligent agents complete the development and adaptation can quickly generate personalized services for users within the network, fully leveraging the autonomous development and collaborative capabilities of the intelligent agents; The applications and mini-programs on the terminal side enrich the user's service access points, improving the ease of use and accessibility of services; After mapping the intelligent agent ports to the public Internet, it is possible to connect with traditional Internet services that require public network callbacks, such as mobile payment, achieving deep integration between the intelligent agent network and existing Internet services, further expanding the application scenarios and commercial value of the intelligent agent network.

[0021] This invention also provides a system for networking intelligent agents. The system implements any of the methods described above. The system includes: a point-to-point network construction module for constructing a distributed point-to-point network, assigning a unique identifier to each intelligent agent node, and assisting nodes in completing network address translation and hole punching through a bootstrap server and relay server to establish point-to-point communication channels; a port mapping module for exposing specified transmission ports and assigning identifiers through the point-to-point channels to achieve local mapping of remote ports; a secure access module for carrying encrypted hypertext transmission services on the mapped ports, completing domain name system record configuration, request distribution, and automated certificate management; a service lookup module for providing intelligent agent service capability query capabilities through domain name system text records and node local service description documents; and an instant messaging module for assigning communication accounts to intelligent agents and users, and achieving cross-node instant interaction and authorization matching based on a federated communication mechanism.

[0022] Compared with existing technologies, the technical effects achieved by this solution are as follows: Through the collaborative work of the point-to-point network construction module, port mapping module, secure access module, service discovery module, and instant messaging module, a modular and scalable intelligent agent networking system is constructed. Each module has a clear division of labor and supports each other. The point-to-point network construction module is responsible for building the underlying distributed network and managing node connections, providing a reliable transmission foundation for upper-layer services. The port mapping module realizes cross-node service port reuse and secure exposure. The secure access module ensures encrypted transmission and standardized distribution of service access. The service discovery module supports the intelligent agent's autonomous service discovery and capability assessment. The instant messaging module provides real-time message interaction and authorization management capabilities. The overall system adopts a distributed architecture, enabling autonomous interconnection of intelligent agents without a centralized service platform. It is flexible in deployment and highly scalable, and can meet the networking needs of intelligent agents of different scales and in different scenarios.

[0023] By adopting the technical solution of the present invention, the following technical effects can be achieved: (1) By constructing a point-to-point distributed network and assigning a unique identifier to each agent node, the network dependency of the centralized cloud platform is eliminated from the bottom layer, enabling agents to autonomously establish direct end-to-end communication channels. Combined with the port mapping mechanism, the reuse and localized access of cross-node service ports are realized without exposing services directly to the public network. The encrypted hypertext transfer protocol system ensures the security and standard compatibility of cross-node service access. The supporting service lookup mechanism enables agents to autonomously identify the service capabilities of peer nodes and complete preliminary screening. The cross-node instant communication system realizes real-time interactive collaboration between agents and between agents and users. The overall solution constructs a complete autonomous interconnection framework for agents, effectively solving the core problem that agents cannot directly interconnect in the existing technology, greatly improving the flexibility and collaborative capabilities of agent networking, and adapting to the agent interconnection needs in various scenarios such as home and enterprise. Attached Figure Description

[0024] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings to be used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. Figure 1 A flowchart illustrating a method for networking intelligent agents provided in an embodiment of the present invention; Figure 2 This is a schematic diagram of the structural modules of a system for intelligent agent networking provided in an embodiment of the present invention; Figure 3 Create a flowchart for a peer-to-peer distributed network; Figure 4 A flowchart of the HTTP secure access and lookup mechanism; Figure 5 A flowchart for intelligent agent communication, security, and human interaction.

[0025] Explanation of reference numerals in the attached figures: 100 is a system for networking intelligent agents; 110 is a point-to-point network construction module; 120 is a port mapping module; 130 is a secure access module; 140 is a service discovery module; and 150 is an instant messaging module. Detailed Implementation

[0026] To make the above-mentioned objectives, features, and advantages of the present invention more apparent and understandable, the technical solutions in the embodiments of the present invention are clearly and completely described. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0027] [First Embodiment] See Figure 1 The present invention provides a method for networking intelligent agents, comprising: S1: Construct a point-to-point distributed network, assign a unique identifier to each intelligent agent node in the network, obtain the seed nodes that have been connected to the network through the guidance server, complete the network address translation and hole punching through the relay server, and establish point-to-point communication channels between different intelligent agent nodes. S2: Establish a port mapping mechanism. The agent node exposes the specified Transmission Control Protocol or User Datagram Protocol port to the peer node through the point-to-point communication channel, and assigns a unique port identifier to each exposed port. The peer node maps the remote exposed port to the local port according to the port identifier. S3: Construct a secure access system for Hypertext Transfer Protocol, carry Hypertext Transfer Protocol on the mapped port and encrypt transmission based on transport layer security protocol, encode the unique identifier of the node and establish address resolution record and alias record on the domain name system server, configure the server name to indicate the proxy to realize request distribution, and issue security certificates for the node through an automated certificate management mechanism. S4: Establish an intelligent agent service lookup mechanism, create text records on the domain name system server based on the node's unique identifier or alias to describe the node's service capabilities, and deploy service description documents in the node's hypertext transfer service for other nodes to retrieve and parse. S5: Build a cross-node instant communication system, assign communication accounts to agents and users, and rely on federated communication mechanisms and point-to-point hypertext transmission networks to realize instant interaction and authorization matching between cross-node agents and between agents and users.

[0028] Specifically, step 1: Construct a peer-to-peer distributed network. The goal of this step is to establish a decentralized peer-to-peer distributed network, enabling each agent to access the network as an independent node, and allowing direct data channels to be established between nodes.

[0029] First, each intelligent agent node is assigned a unique identifier across the entire network. This identifier serves as the node's unique identity credential within the network and can be implemented in three ways: The first is a public-key cryptography-based identity identifier, which generates a public-private key pair for the node using an asymmetric encryption algorithm. The string obtained after derivation processing of the public key serves as the node identifier, possessing cryptographic verifiability. The second is a decentralized identity identifier, which is a standardized identity identifier generated in accordance with distributed identity specifications, possessing cross-system and cross-platform mutual recognition characteristics. The third is a self-organizing and self-healing network address, which is a logical network address generated based on overlay network or mesh network addressing mechanisms, adapting to decentralized self-organizing network scenarios.

[0030] The specific process for a node to access the network is as follows: After a new node starts up, it first accesses the preset boot server to obtain a list of seed nodes that are currently online in the network, thus completing the initial network topology discovery. Then, the new node connects to the relay server and establishes a relay forwarding connection with the selected seed node through the relay server, thus achieving initial network access. After the relay connection is stable, the relay server coordinates the new node and the target seed node to perform hole punching operations on the network address translation devices of their respective networks, attempting to establish a direct point-to-point data channel.

[0031] The Network Address Translation (NAT) hole punching supports three implementation methods: The first is simultaneous synchronous handshake hole punching via Transmission Control Protocol (TCP), suitable for scenarios carrying TCP services. Both parties simultaneously initiate synchronous handshake packets to the other's public IP address, establishing a direct connection channel using the mapping rules of the NAT device. The second is inter-device message hole punching, suitable for scenarios carrying UDP services. Both parties exchange data packets, triggering port mapping on the NAT device. The third is universal plug-and-play (UPPlay) hole punching, suitable for scenarios where the gateway device supports the universal plug-and-play protocol, allowing ports to be directly opened on the gateway via the protocol. After successful hole punching, an end-to-end point-to-point communication channel can be established between the two nodes, and subsequent data transmission no longer needs to be relayed through a relay server.

[0032] Step 2: Establish a port mapping mechanism. After the point-to-point communication channel is established, the node can expose its local service port to the peer through the channel, so that the peer can access the local service through the channel without exposing the port directly to the public network.

[0033] The specific implementation process is as follows: The node initiating port exposure selects the Transmission Control Protocol (TCP) ports and / or User Datagram Protocol (UDP) ports that need to be exposed locally, assigns a unique port identifier to each exposed port, and establishes a one-to-one mapping relationship between the port identifier and the actual local port number, storing it locally. Subsequently, the node sends the port identifier to the peer node through a point-to-point communication channel. Upon receiving the port identifier, the peer node creates a corresponding local mapped port, establishing a binding relationship between the local mapped port and the remote exposed port. Later, when the peer node sends data to the local mapped port, the data is automatically forwarded to the corresponding exposed port of the remote node through the point-to-point communication channel, and the service response from the remote node returns along the same path, thus achieving transparent cross-node service access.

[0034] Step 3: Construct a secure access system for Hypertext Transfer Protocol (HTTP). This step builds upon port mapping to construct a standardized and scalable encrypted HTTP service access system, enabling nodes to provide and invoke cross-node network services in a manner that conforms to Internet standards.

[0035] First, deploy Hypertext Transfer Protocol (HTTP) services on the mapped transmission ports, supporting versions 1.1, 2, and 3 of HTTP. All HTTP services run on top of Transport Layer Security (TLS), supporting versions 1.2 and 1.3 of TLS, to achieve end-to-end transmission encryption.

[0036] Secondly, a node domain name system is constructed: the unique identifier of each node is encoded in hexadecimal. During the encoding process, separators can be added at specified positions according to readability requirements. The encoded string is used as the prefix of the second-level domain name. Corresponding address resolution records are established on the domain name system server, including A records for IPv4 addresses and AAAA records for IPv6 addresses. At the same time, an easy-to-remember domain name alias is set for each address resolution record, and a mapping relationship is established between the alias and the node identifier, so that users and nodes can conveniently access the corresponding nodes through the alias.

[0037] Different request distribution mechanisms are employed for different versions of the Transport Layer Security (TLS) protocol: For TLS version 1.2, a Server Name Indication (SNI) proxy service is deployed. This proxy service can read the SNI field in the client request without decrypting the transmitted content and forward the Hypertext Transfer Protocol (HTTP) request to the corresponding target node based on a predefined mapping between domain aliases and nodes. This process does not require the target node to hold a security certificate for the corresponding alias domain, significantly simplifying the certificate deployment process in multi-node scenarios. For TLS version 1.3, the actual service port number of the node is further exposed in addition to the port identifier exposure. Different port numbers correspond to different target service nodes, and the discrete allocation of port numbers enables the legitimate distribution of requests, adapting to the higher encryption level and inability to read the SNI field in TLS version 1.3.

[0038] Simultaneously, an automated certificate management environment mechanism is introduced, in which a unified certificate management service automatically applies for, issues, and periodically updates transport layer security protocol certificates for each node. Nodes can automatically acquire Hypertext Transfer Security Protocol service capabilities without manual certificate configuration. Other nodes can access the node's services through the standard Hypertext Transfer Security Protocol, ensuring access security and standard compatibility.

[0039] Step 4: Establish an intelligent agent service discovery mechanism. This step enables intelligent agents to autonomously discover and evaluate the service capabilities of other nodes in the network, and is divided into two levels: basic query and detailed query.

[0040] Basic queries are implemented using text records in the Domain Name System (DNS). The unique identifier of a node is encoded in hexadecimal and used as a domain name prefix, or the node alias is used directly as the domain name prefix. A corresponding TXT text record with this prefix is ​​created on the DNS server. This text record is written in a format with a preface and a lightweight markup language (JARL). The preface stores the node's structured metadata, while the JARL describes the agent's basic information, business requirements, and available products and services. To adapt to the DNS text record format requirements, newline characters are replaced with specified substitute characters. The text record can also directly use natural language text or other markup language formats to adapt to different resolution needs. When querying a target node, the agent only needs to obtain the corresponding text record through domain name resolution to preliminarily assess the services the node can provide, without needing to establish a complete application connection.

[0041] Detailed querying is implemented based on local service description documents on each node: Each node deploys a service description document in its own Hypertext Transfer Protocol (HTTP). Document formats include skill description documents, Hypertext Markup Language (HTML) documents, structured data documents, and service-oriented architecture description documents. These documents record detailed parameters, invocation methods, and interaction specifications for the node's services. When an agent needs to gain a deeper understanding of a target node's service capabilities, it can obtain the corresponding document via the HTTP protocol, parse it, and obtain complete service information to support subsequent service invocations and collaborative work.

[0042] Step 5: Build a cross-node instant communication system. This step builds real-time interaction channels between agents and between agents and users to support collaborative work across nodes.

[0043] First, deploy the Matrix Communicator server, which is an instant messaging server that follows the matrix communication protocol. Each agent connected to the network is assigned an independent communication account. After logging into the Matrix Communicator server with the corresponding account, the agent can join a unified virtual communication room and interact with other agents in real time to complete collaborative tasks.

[0044] For cross-server node interaction, a federated mechanism of matrix communication servers is utilized, combined with the peer-to-peer hypertext transfer service network constructed in the aforementioned steps. This enables intelligent agents on different server nodes to communicate and collaborate across nodes, breaking down the limitations of the number of nodes on a single server and service provider barriers. This federated interconnection architecture can be widely applied to various instant messaging servers and IoT servers, supporting interconnection of multiple intelligent agents within the same server as well as cross-network interconnection between different servers, exhibiting excellent scalability.

[0045] Simultaneously, corresponding instant messaging accounts are assigned to human users. After logging in, users can establish point-to-point or multi-point communication connections with the intelligent agents they control, as well as with authorized intelligent agents on third-party nodes, enabling real-time interaction between humans and intelligent agents. A pairing mechanism is then implemented, allowing intelligent agents to authenticate each other and authorize access through pairing operations. Only paired entities can access each other's restricted services and resources, ensuring the security of cross-node access.

[0046] Specifically, this involves the implementation of security mechanisms. In other words, based on the aforementioned network architecture, a multi-layered security system is built to achieve end-to-end access control.

[0047] At the point-to-point connection level, a node identifier blacklist / whitelist, an Internet Protocol address blacklist / whitelist, and a communication 5-tuple identifier verification mechanism are set up. The system verifies the node identifier, source address, destination address, source port, destination port, and transmission protocol of the connection request. Only nodes that meet the whitelist rules are allowed to establish point-to-point connections, and unauthorized access is blocked at the network access layer.

[0048] At the port mapping level, hierarchical port access authorization rules are set up, supporting three authorization modes: fully public mode, where all nodes in the network can access the exposed port; group authorization mode, where all exposed ports are only authorized to a specified group of nodes; and specific port authorization mode, where each exposed port can be configured with an individual authorized group of nodes. By configuring port access blacklists and whitelists, it is ensured that only authorized nodes can access the services on the corresponding ports.

[0049] At the Hypertext Transfer Protocol (HTTP) access layer, versions v1 and v2 of the HAProxy transport layer proxy protocol are extended. The visitor's node identifier, domain alias, and Internet Protocol address are added to the application layer header field of the HTTP protocol. The target node's application service can read this identity information, perform application-level permission checks, and determine whether access to the corresponding service is permitted. All of the above authorization rules support hot reloading and updates via application programming interfaces (APIs) or command-line interfaces, taking effect without requiring a service restart.

[0050] Simultaneously, the system continuously collects point-to-point network operation logs and hypertext application access logs. Based on the access records and behavioral data in the logs, it dynamically adjusts authorization rules through application programming interfaces (APIs) or command-line interfaces to achieve dynamic management of the authorization mechanism. It can also dynamically adjust firewall rules based on log data to adapt to changes in the network environment. The Domain Name System (DNS) server provides resolution services using a domain name lookup method based on Transport Layer Security (TLS). Clients can access the domain name service using either TLS-based lookup or Hypertext Transfer Security (HTTP) lookup methods, preventing tampering with the domain name resolution process and ensuring the security and reliability of the domain name service.

[0051] Specifically, the implementation of user terminal access involves constructing a user terminal access system to enable convenient and secure access to the intelligent agent network by human users.

[0052] First, in the Domain Name System (DNS), address resolution records are set for the subdomains of the node alias domain, pointing them to the specified internal Internet Protocol (IP) address. A Virtual Private Network (VPN) service is deployed on the agent device, supporting multiple mainstream VPN protocols such as WireGuard, Internet Protocol Security (IPS), and Open VPN. The aforementioned internal IPS address is configured as the VPN address of the agent. Simultaneously, the VPN service port is exposed through the aforementioned port mapping mechanism, and access permissions are configured to allow only the user's own terminal device node identifier to access, ensuring access security.

[0053] Develop terminal applications compatible with multiple operating systems, covering mobile terminals, desktop terminals, and other platforms. Each terminal application has a built-in client program for the corresponding Virtual Private Network (VPN) protocol. After the user launches the application and completes authentication, an encrypted VPN channel is created between the terminal device and the corresponding intelligent agent node. Once the channel is established, the user terminal can directly access various network services on the local intelligent agent node. Simultaneously, leveraging the port mapping capabilities of the intelligent agent node, it can also access various network services on other authorized intelligent agent nodes within the network, achieving the effect of accessing the entire authorized intelligent agent network with a single connection.

[0054] Specifically, regarding the implementation of application expansion, based on the aforementioned intelligent agent network architecture, application expansion can be achieved in four ways to broaden the network's application scenarios and value.

[0055] The first category is remote operation and maintenance service extension: exposing non-web application ports, such as remote command line service ports and desktop sharing service ports, in smart agent devices, and mapping these ports to user terminals through port mapping mechanisms. Users can then use the corresponding ports on the terminal to perform various remote access and operation and maintenance services such as remote command line operation and remote desktop control.

[0056] The second category is personalized service deployment: various business applications, including various web applications, are deployed on the server of the intelligent agent device. At the same time, the intelligent agent is driven to complete the corresponding function development and adaptation, which can quickly generate personalized application services for all authorized users in the network, giving full play to the autonomous development and collaborative capabilities of the intelligent agent and meeting the user's customized needs.

[0057] The third category is terminal application ecosystem expansion: developing various clients such as applications and mini-programs for corresponding services on user terminal devices. These clients can access the user's own intelligent agent node through a virtual private network, and then access authorized services across the entire network by leveraging the interconnectivity of the intelligent agent network, providing users with richer application entry points and a more convenient user experience.

[0058] The fourth category is public network service integration and expansion: By deploying access nodes of the intelligent agent network on a public Internet server and mapping the service ports exposed by the intelligent agent nodes to the public Internet, the intelligent agent network can support various Internet services that require public network callbacks, such as mobile payment, thereby achieving deep integration between the intelligent agent network and traditional Internet services and expanding the commercial application scenarios of the intelligent agent network.

[0059] See Figure 2 The present invention also provides a system 100 for intelligent agent networking, including a point-to-point network construction module 110, a port mapping module 120, a secure access module 130, a service lookup module 140, and an instant messaging module 150.

[0060] The peer-to-peer network construction module 110 is used to build a distributed peer-to-peer network, assigning a unique identifier to each agent node, obtaining seed nodes through a bootstrap server, and assisting nodes in completing network address translation and hole punching through a relay server to establish peer-to-peer communication channels between nodes. The port mapping module 120 is used to expose specified transmission ports and assign port identifiers through the peer-to-peer channels, enabling local mapping and transparent access to remote service ports. The secure access module 130 is used to carry encrypted hypertext transmission services on the mapped ports, completing domain name system record configuration, request distribution, and automated certificate management. The service lookup module 140 is used to provide agent service capability query capabilities through domain name system text records and node local service description documents. The instant messaging module 150 is used to assign communication accounts to agents and users, and realize cross-node instant interaction and pairing authorization based on the federated communication mechanism. Each module runs in the agent node device, realizing complete agent networking functions through distributed collaboration.

[0061] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for networking intelligent agents, characterized in that, include: Construct a point-to-point distributed network, assign a unique identifier to each intelligent agent node in the network, obtain the seed nodes that have been connected to the network through the guidance server, complete the network address translation and hole punching through the relay server, and establish point-to-point communication channels between different intelligent agent nodes. A port mapping mechanism is established, whereby intelligent agent nodes expose specified Transmission Control Protocol or User Datagram Protocol ports to peer nodes through point-to-point communication channels, and assign a unique port identifier to each exposed port. Peer nodes then map the remote exposed ports to their local ports based on the port identifiers. Construct a secure access system for Hypertext Transfer Protocol (HTTP), carry the HTTP on the mapped port and encrypt the transmission based on the transport layer security protocol, encode the unique identifier of the node and establish address resolution records and alias records on the domain name system server, configure the server name to indicate the proxy to realize request distribution, and issue security certificates for the node through an automated certificate management mechanism. Establish an intelligent agent service lookup mechanism, create text records on the domain name system server based on the node's unique identifier or alias to describe the node's service capabilities, and deploy service description documents in the node's hypertext transfer service for other nodes to retrieve and parse. Establish a cross-node instant communication system, assign communication accounts to agents and users, and rely on federated communication mechanisms and peer-to-peer hypertext transmission networks to realize instant interaction and authorization matching between cross-node agents and between agents and users.

2. The method for networking intelligent agents according to claim 1, characterized in that, The unique identifier across the entire network can be any one of the following: public-key cryptography-based identity identifier, decentralized identity identifier, or self-organizing and self-healing network address; The network address translation hole punching includes Transmission Control Protocol synchronous handshake hole punching, User Datagram Protocol message exchange hole punching, or Universal Plug and Play mechanism hole punching.

3. The method for networking intelligent agents according to claim 1, characterized in that, The Hypertext Transfer Protocol includes versions 1.1, 2, and 3, and the Transport Layer Security Protocol includes versions 1.2 and 1.

3. When based on the 1.2 version of the Transport Layer Security Protocol, the proxy is instructed to distribute requests by domain name aliases through the server name. When based on the 1.3 version of the Transport Layer Security Protocol, requests are distributed discretely to the corresponding target nodes by exposing the port number.

4. The method for networking intelligent agents according to claim 1, characterized in that, The text records describe the agent's introduction, service content, and requirements in a preface and lightweight markup language format, with newline characters replaced by specified alternative characters; The service description document includes skill description documents, hypertext markup language documents, structured data documents, or service-oriented architecture description documents.

5. The method for networking intelligent agents according to claim 1, characterized in that, The cross-node instant messaging system is built on a matrix communication server, and its federation mechanism can be extended to cross-node interconnection of various instant messaging servers and Internet of Things servers. The authorization matching adopts a pairing mechanism to realize access authorization between smart agents across nodes and between smart agents and users.

6. The method for networking intelligent agents according to claim 1, characterized in that, Also includes: At the point-to-point connection level, set up node identifier blacklists and whitelists, Internet Protocol address blacklists and whitelists, and communication 5-tuple verification rules; Configure hierarchical port access authorization rules at the port mapping level; Extend the transport layer proxy protocol at the Hypertext Transfer Protocol level by adding the accessing node identifier and address information to the request header field to achieve application-level authorization; All authorization rules support hot reloading and can be dynamically adjusted based on network logs and application logs; The Domain Name System (DNS) service uses encrypted domain name lookup to provide trusted resolution.

7. The method for networking intelligent agents according to claim 1, characterized in that, Also includes: Assign an internal network Internet Protocol (IP) address to the alias domain, deploy a Virtual Private Network (VPN) service on the agent node and bind it to the internal network address, install a matching client on the user terminal and establish a VPN channel with the agent node, so that the user terminal can access various network services of local and remote agent nodes.

8. The method for networking intelligent agents according to claim 1, characterized in that, Also includes: Expose non-web page service ports on the agent node and map them to the user terminal to enable access to remote control services; Deploy various business applications on the agent nodes and drive the agents to complete development and adaptation; develop corresponding applications on user terminals to access the agent network. Map the agent node port to the public Internet to support Internet services that require callbacks.

9. A system for networking intelligent agents, the system being configured to implement the method as described in any one of claims 1-8, characterized in that, The system includes: The peer-to-peer network construction module is used to construct a distributed peer-to-peer network, assign a unique identifier to each intelligent agent node, and assist the nodes in completing network address translation and hole punching through the guidance server and relay server to establish peer-to-peer communication channels. A port mapping module is used to expose a specified transmission port and assign an identifier through a point-to-point channel to realize the mapping of a remote port locally. The secure access module is used to carry encrypted hypertext transmission services on the mapped port and complete domain name system record configuration, request distribution and automated certificate management. The service lookup module is used to provide the ability to query the service capabilities of intelligent agents through Domain Name System text records and node local service description documents; The instant messaging module is used to assign communication accounts to agents and users, and to realize real-time interaction and authorization matching across nodes by relying on the federated communication mechanism.

Images