Account hosting encryption and behavior full audit security system for digital employees

Abstract

This invention relates to the field of information security technology and discloses a security system for account hosting encryption and full behavior auditing for digital employees. The system includes an identity authorization center, a key management module, an execution terminal, a dynamic interceptor, and an evidence storage module. The identity authorization center constructs identity-bound tuples for legitimacy verification. The key management module encapsulates the target account credentials into ciphertext and sends it to the controlled sandbox environment of the execution terminal. The execution terminal decrypts the ciphertext in a locked physical memory address block and, after authentication, overwrites the physical memory address block to clear the plaintext data. The dynamic interceptor captures interaction signals and network protocol requests, calculates risk scores, and triggers multi-level control logic. The evidence storage module calculates data digests from timestamped text logs and multimedia file slices, and generates log chain nodes by combining the root hash value. This invention blocks the plaintext exposure of credentials, can intercept unauthorized actions in real time, and ensures the accuracy of operation tracing.

Description

Technical Field

[0001] This invention relates to the field of information security technology, specifically to a security system for account hosting encryption and full behavior auditing for digital employees. Background Technology

[0002] Enterprises widely introduce digital employee programs to replace manual repetitive tasks in the process of business automation. When digital employees take over external business system accounts to perform tasks, they need to provide login credentials to the target system. Existing credential management solutions expose plaintext information in the network transmission link when the credential is called on the execution end, or retain decrypted credential data in the local cache and memory area of ​​the operating system for a long time. When the host environment is invaded by external malicious processes, the external processes can extract the target account credentials through network packet capture or memory snapshot reading technology, resulting in the leakage of access permissions of the business system.

[0003] During the task execution phase, the current automated operating environment lacks dynamic control over the operation boundaries. The system assigns fixed static permissions to digital employees and cannot perform quantitative risk assessment based on real-time control interaction behavior and underlying network request load. When the automated script has logical anomalies or is maliciously tampered with, the existing system cannot intercept and control unauthorized access and high-risk business interface call actions in real time.

[0004] In the post-execution behavior auditing phase, traditional security protection systems mainly rely on discrete text logs to record operational behaviors. Existing text interface logs are insufficient to fully record the details of graphical user interface control interactions. Furthermore, the heterogeneous data collected by the system, such as screen recordings, image slices, and text logs, lacks a unified time synchronization mechanism and cryptographic anti-tampering and solidification processing. When unauthorized operation events occur, administrators cannot accurately match the underlying network requests with the front-end visual interface operations in terms of time sequence. Moreover, historical log data that has not been solidified is at risk of being tampered with or deleted. As a result, the system cannot provide a complete and trustworthy multimodal audit evidence chain, and cannot meet the need for accurate tracing of security events. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention provides a security system for account hosting encryption and full behavior auditing for digital employees. It solves the problems of plaintext theft of account credentials when digital employees perform automated tasks, lack of real-time interception and control of unauthorized operations, and difficulty in accurate tracing due to the inability to prevent tampering and solidify heterogeneous operation logs.

[0006] To achieve the above objectives, the present invention provides the following technical solution: A secure system for digital employees, featuring account escrow encryption and full behavior auditing. The system includes: Business user terminal, identity authorization center, policy control module, key management module, execution terminal, system adapter, dynamic interceptor, log collection module, evidence storage module, and audit review module; The business user terminal is communicatively connected to the identity authorization center, and the business user terminal is used to send task initiation instructions and natural person identity authentication requests to the identity authorization center; The identity authorization center is used to establish and maintain the binding relationship between users, digital employees, target accounts and current task types, and to verify the legality of the binding relationship; The strategy control module is used to generate a task token based on the verified binding relationship, and then send the task token to the execution end. The key management module is used to temporarily store the plaintext of the target account credentials, the calling key, the certificate, and the task token, and to encrypt, authorize, and periodically rotate the plaintext of the target account credentials, the calling key, the certificate, and the task token. The execution terminal is used to initiate interface calls or graphical interface operation instructions to the system adapter in a controlled environment; The system adapter is used to connect the execution terminal to an external business system; The dynamic interceptor is used to capture the operation instructions of the execution end, calculate the dynamic risk score according to the allowed operation range in the task token, compare the dynamic risk score with the risk threshold in the task token, perform interception judgment, compare whether it is within the allowed operation range, and transmit the standard operation event, interception result and approval result to the log collection module. The log collection module is used to collect screen recordings, interface screenshots, control paths, interface logs, parameter summaries, and exception information from the execution end, and transmit them to the evidence storage module. The evidence storage module is used to generate log chain nodes by combining the hash value of the previous node; The audit review module is used to read continuous log chain nodes and provides data retrieval, summary anti-tampering verification, replay execution, and structured audit report export operations. The identity authorization center verifies the legality of the binding relationship; the policy control module generates a task token based on the verified binding relationship; the key management module encrypts the target account credentials based on the task token and sends them to the execution end; the execution end decrypts and uses the target account credentials in the controlled environment.

[0007] Furthermore, the identity authorization center constructs a four-element identity binding tuple. ,in, This is the set of binding relationships that have passed verification. For the identification of business users, For the identification of digital employee instances, For the identification of the target account, This serves as the identity identifier for the current task type. Read the preset permission configuration table in the underlying database and perform cross-comparison and legality verification on the four-element identity binding tuple; When a matching entry exists in all cross-validation relationships and the permission configuration table, the system determines that the binding relationship is valid and sends a task token issuance instruction to the policy control module.

[0008] This invention constructs a binding tuple containing four dimensions: user, digital employee, target account, and task type. This completes the human-machine identity verification before the execution of automated tasks, preventing legitimate users from overstepping their authority to call digital employees in unauthorized environments or abusing external system accounts.

[0009] Furthermore, after receiving the task token issuance instruction, the strategy control module dynamically constructs a task token for the current task; The policy control module uses hash algorithms and asymmetric cryptography to calculate digital signatures; The generated data digest is signed using a private key, and the signature is encapsulated in a task token for distribution.

[0010] This invention employs an asymmetric cryptographic system to digitally sign and encapsulate a task token containing control parameters, ensuring the integrity of the task token during the process of exchanging credentials and initiating instructions in a controlled environment, and preventing the task token from being tampered with during network transfer.

[0011] Furthermore, the execution end initializes the controlled sandbox environment and blocks unauthorized external processes from accessing the memory of the controlled sandbox environment based on existing operating system process isolation technology; After the controlled sandbox environment is started, the execution end sends a credential acquisition request to the key management module and submits the task token; The key management module receives the task token and verifies the control parameters contained in the task token against the digital signature based on the digital signature verification algorithm and the public key of the identity authorization center. If the comparison is consistent, it confirms that the task token is within the set time window and completes the legal authentication of the validity of the task token. After the task token is successfully authenticated, the key management module uses a symmetric encryption algorithm to encrypt the data, generating credential ciphertext. It then uses the network public key published by the execution end in combination with an asymmetric encryption algorithm to encapsulate the symmetric key used for encryption in a digital envelope, generating key ciphertext. The key management module distributes the generated ciphertext and key ciphertext to the controlled sandbox environment.

[0012] This invention transmits credentials and symmetric keys in encrypted form in network communication links to avoid exposing plaintext credentials, while using an independent sandbox environment to isolate processes and achieve secure injection of encrypted credentials.

[0013] Furthermore, the controlled sandbox environment calls the built-in hardware private key in an independent memory area to perform asymmetric decryption on the key ciphertext to restore the symmetric key. The restored symmetric key is then used to perform symmetric decryption on the credential ciphertext to extract the plaintext of the target account credential for business authentication. After authentication, a random byte stream is used to overwrite the memory area to completely clear the plaintext credential. The number of overwrites is preset according to the business security level.

[0014] This invention confines the decryption process to the physical memory locked at the system level, and after the interface request is constructed, it uses a continuous alternating stream of random bytes to overwrite the specified memory block multiple times, eliminating the plaintext data of the credentials and blocking the reading channel of the memory snapshot tool.

[0015] Furthermore, when the execution end initiates an interface call or graphical interface operation, the dynamic interceptor injects hook functions at the operating system layer to capture the control interaction signals of the graphical user interface, and extracts the corresponding operation attributes such as the control document object model path based on the control interaction signals. At the same time, it intercepts the network protocol requests of the application layer at the network layer to obtain the corresponding network protocol message content at the underlying layer. The dynamic interceptor parses the captured discrete interaction signals and network protocol requests, extracts the target object identifier, action type code, and request payload parameters, and formats and encapsulates the extracted parameters into standard operation events according to a preset data dictionary standard. The standard operation events constitute a continuous operation stream in time series, and each standard operation event in the operation stream is appended with a timestamp and an execution end instance identifier. The dynamic interceptor transmits the standard operation events with timestamps and execution end instance identifiers to the internal cache queue.

[0016] This invention captures operation flows bidirectionally at the application layer and the system layer, and formats discrete interactive behaviors and network protocol messages into standard operation events, providing a unified data source for subsequent behavior auditing.

[0017] Furthermore, the dynamic interceptor extracts standard operation events from the internal cache queue and obtains the operation object sensitivity, data volume deviation value, time characteristic parameter, and retry frequency characteristic parameter corresponding to the standard operation event. The system objectively quantifies the degree of abnormality of operational behavior based on multi-dimensional operational characteristics. The obtained feature parameters are all feature values ​​in the range of 0 to 1. The dynamic interceptor performs a weighted summation operation on the obtained feature parameters according to the built-in weighted calculation rule that the sum of each weight is 1, and calculates the initial dynamic risk score in the range of 0 to 1. To ensure that all thresholds and comparison operations use the same scale, the dynamic interceptor performs a uniform scale conversion on the initial dynamic risk score based on the risk threshold setting scale in the task token, resulting in the final dynamic risk score used for comparison: if the risk threshold in the task token uses a numerical scale of 0 to 100, then it is explicitly stipulated that the dynamic risk score is calculated by multiplying the initial dynamic risk score by 100; if the risk threshold in the task token uses a numerical scale of 0 to 1, then the dynamic risk score is the initial dynamic risk score.

[0018] This invention extracts multi-dimensional feature parameters such as the sensitivity of the operation object, the data volume deviation, and the retry frequency for quantitative calculation, establishes a risk assessment system, and identifies abnormal requests.

[0019] Furthermore, under a unified scale, the dynamic interceptor compares the scale-converted dynamic risk score with the risk threshold and allowed operation range written in the task token, and triggers multi-level control logic; when the standard operation event exceeds the allowed operation range or the dynamic risk score is greater than or equal to the blocking threshold, the dynamic interceptor disconnects the network connection and forcibly suspends the running process of the execution end. When the dynamic risk score is less than the blocking threshold but greater than or equal to the alarm threshold, and the standard operation event is within the allowed operation range, the dynamic interceptor sends a secondary confirmation instruction to the business user terminal. At this time, the business user terminal can simultaneously display the current task execution status for business personnel to conduct comprehensive analysis and processing. Then, after receiving the authorization release instruction, the dynamic interceptor releases the running process. When the dynamic risk score is less than the alarm threshold and the standard operation event is within the allowed operation range, the dynamic interceptor releases the current operation instruction.

[0020] This invention uses a multi-level control logic triggered by score comparison to intercept high-risk actions and introduces a secondary confirmation mechanism for operations in the intermediate risk zone, thereby ensuring operational safety and business continuity.

[0021] Furthermore, the log acquisition module packages and encapsulates the screen recording stream file, high frame rate image slices, and text-formatted interface logs in the local cache; the evidence storage module receives discrete text logs, video file slices, and high frame rate image slices from the local cache; the evidence storage module calls the global system clock source synchronized and calibrated via the network time protocol to extract a standard timestamp with millisecond-level precision, and then the evidence storage module appends the standard timestamp to the data packet headers of the text logs, video file slices, and high frame rate image slices respectively, completing the heterogeneous timestamp alignment and multimodal data index marking; The evidence storage module independently calculates the corresponding text record digest, video slice digest, and image slice digest for each heterogeneous data entity after adding a timestamp using a one-way hash algorithm, generating a data digest for each data entity independently. The evidence storage module extracts the root hash value corresponding to the previous record node in the underlying database, and concatenates the extracted root hash value with the data digests calculated within the current time period in a set order to form an aggregated data stream. The evidence storage module performs a secondary hash operation on the concatenated aggregated data stream to calculate and generate the log chain node corresponding to the current operation event.

[0022] This invention utilizes a synchronous clock source to align the timestamps of heterogeneous log files. By fusing hash operations with the root hash of the previous node, a log chain data structure is constructed, enabling behavioral audit data to have tamper-proof characteristics.

[0023] Furthermore, the evidence storage module maps and binds the calculated log chain nodes with the physical storage addresses corresponding to the unstructured multimedia data to generate a multimodal mapping index; then, the evidence storage module synchronously writes the log chain nodes with the mapping index and the corresponding multimedia file slices to the underlying read-only database to perform persistent solidification processing. When the system detects a low-level process signal indicating task completion or abnormal interruption, the execution end actively sends a termination signal to the policy control module and the key management module, thereby triggering the system's pre-set authorization environment reclamation mechanism. After receiving the termination signal, the policy control module destroys the verification record corresponding to the current task token in memory and broadcasts the task token revocation message to the entire network. After receiving the termination signal, the key management module scans the physical memory address block of the execution end to verify and confirm the overwrite and cleanup status of the plaintext credentials.

[0024] This invention establishes a multi-dimensional file mapping and storage benchmark, and configures task end signaling feedback and environment recycling steps to prevent residual data residing in the execution environment from being replayed and reused.

[0025] This invention provides a security system for account escrow encryption and full behavior auditing for digital employees. It offers the following advantages: 1. This invention encapsulates the plaintext of the target account credentials into a digital envelope and sends it to a controlled sandbox environment. It also restricts the decryption operation to be executed independently within a locked physical memory address block. Simultaneously, after identity authentication is completed at the execution end, the physical memory address block is immediately overwritten with a continuous alternating stream of random bytes. This directly blocks the exposure path of the plaintext credentials in the network transmission link and removes the remaining data at the physical layer, preventing unauthorized external processes from reading the account credentials of the business system using memory snapshots.

[0026] 2. This invention captures control interaction signals and network protocol requests bidirectionally at the operating system's bottom layer and network layer. It calculates a dynamic risk score based on multi-dimensional feature parameters such as the sensitivity of the extracted operation object, and then compares it with a risk threshold to determine whether to forcibly suspend the execution process or issue a secondary confirmation instruction. This incorporates discrete operational behaviors into a quantitative evaluation system. While identifying and intercepting unauthorized and illegal actions in real time, it also introduces business personnel's comprehensive judgment of intermediate risk events, taking into account both system security control requirements and automated business continuity.

[0027] 3. This invention utilizes a global system clock source to align the collected text logs, video file slices, and high frame rate image slices with standard timestamps. After calculating the corresponding data digests, the data is concatenated with the root hash value of the previous record node and then subjected to a secondary hash operation to generate a log chain node that is connected end to end. This allows for time-series synchronization and anti-tampering binding of unstructured multimedia files and structured text logs. In the event of a security incident, this invention directly provides the audit and review module with full evidence of behavior reconstruction, ensuring the accuracy of operation tracing. Attached Figure Description

[0028] Figure 1 This is a schematic diagram of the system architecture of the present invention; Figure 2 This is a schematic diagram of the method flow of the present invention; Figure 3 This is a sequence diagram of the interactions between identity verification, cross-verification of permissions, and issuance of task tokens according to the present invention. Figure 4 This is a flowchart of the steps of the controlled sandbox environment initialization, credential acquisition and decryption, and memory overwrite and clearing according to the present invention; Figure 5 This is a time-series curve of dynamic risk scoring and threshold interception in this invention; Figure 6 This is a bar chart showing the controlled environment encryption / decryption and memory overwrite time of this invention. Detailed Implementation

[0029] The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0030] See attached document Figure 1 This invention provides a security system for account escrow encryption and full behavior auditing for digital employees. The system includes: The business user end is used to receive task initiation instructions, view task execution status, and process secondary confirmation requests. The Identity Authorization Center is used to establish and maintain the binding relationships between users, digital employees, target accounts, and current task types. The key management module is used to store the target account credentials in plaintext, access key, certificate and task token, and to encrypt, authorize and rotate the target account credentials in plaintext, access key, certificate and task token periodically. The strategy control module is used to generate task tokens based on the allowed operation range, validity period, and risk threshold. The execution end is used to initiate interface calls or graphical interface operation commands to the system adapter in a controlled environment; The dynamic interceptor is used to capture control interaction signals and network protocol requests from the execution end, calculate dynamic risk scores, and compare the dynamic risk scores with the risk thresholds in the task token under a unified numerical scale, while also comparing whether they are within the allowed operation range. The log collection module is used to collect screen recordings, interface screenshots, control paths, interface logs, parameter summaries, and exception information from the execution end. The evidence storage module is used to calculate data digests and generate log chain nodes from the received discrete text logs and multimedia file slices. The audit review module provides data retrieval, summary anti-tampering verification, replay execution, and structured audit report export operations. The system adapter is used to connect the execution end with external business systems.

[0031] The business user terminal communicates with the identity authorization center, sending task initiation instructions and natural person identity authentication requests to the identity authorization center. The identity authorization center connects with the key management module, using this connection to verify whether there is a legitimate binding relationship between the user, digital employee, target account, and current task type.

[0032] The policy control module is connected to the identity authorization center, the key management module, and the execution end, respectively. The policy control module issues task tokens to the execution end.

[0033] The execution end is connected to the system adapter. When the execution end initiates an interface call or graphical interface operation, the operation command passes through the dynamic interceptor. The dynamic interceptor performs interception judgment based on the allowed operation range and risk threshold in the task token.

[0034] The dynamic interceptor connects to the log collection module and transmits standard operation events, interception results, and approval results to the log collection module.

[0035] The log collection module is connected to the evidence storage module. The log collection module transmits discrete text logs, video file slices and high frame rate image slices to the evidence storage module. The evidence storage module combines the hash value of the previous node to generate log chain nodes.

[0036] The audit review module is connected to the evidence storage module. The audit review module reads continuous log chain nodes to perform summary anti-tampering verification and replay.

[0037] See attached document Figure 2 This invention provides a secure method for account escrow encryption and full behavior auditing for digital employees, the method comprising the following steps: S1, the business user receives the task initiation instruction and sends a natural person identity authentication request to the identity authorization center to complete the user identity verification; the identity authorization center reads the preset permission configuration table and verifies the binding relationship between the user, digital employee, target account and current task type; the policy control module generates a task token based on the verified binding relationship and writes parameters such as the allowed operation scope, validity period and risk threshold into the task token; S2, the execution end starts running in a controlled environment. The key management module parses the task token, converts the authentication information into ciphertext and sends it to the execution end. The execution end completes the credential decryption operation in an independent memory area, constructs a network request using the injected credentials, and initiates an interface call or graphical interface operation command to the system adapter. After the network request is sent, the execution end overwrites the independent memory area to clear the data and prevent plaintext credentials from remaining. S3, the dynamic interceptor captures control interaction signals at the operating system layer and network protocol requests at the application layer, encapsulates the operation actions into events, calculates a dynamic risk score, and compares the risk score with the risk threshold in the task token under a unified numerical scale, while also checking whether it is within the allowed operation range; if the operation exceeds the allowed range or triggers the risk threshold, the dynamic interceptor blocks the operation instruction and sends a secondary confirmation request to the business user terminal; during the operation execution, the log collection module synchronously collects the screen recording, interface screenshot, control path, interface log, parameter summary and exception information of the execution terminal; S4, the evidence storage module receives discrete text logs and multimedia file slices, adds timestamps to each data packet using the system clock source, calculates the current event digest in chronological order of event occurrence and combines it with the hash value of the previous node to generate a data digest using a hash algorithm; each data digest is concatenated end-to-end in the time sequence to generate a log chain node, and the log chain node is associated with the video segment index and persistently stored in the underlying database; when the task execution ends or terminates abnormally, the policy control module revokes the task token, the key management module cleans up the plaintext credentials in the controlled execution environment, and the audit review module generates an audit report based on the log chain node.

[0038] See attached document Figure 3 The step S1 provided by the present invention includes the following steps in a specific implementation: S101, in order to initiate the automated execution process, the business user terminal responds to the operation instructions of the business personnel by sending a task initiation instruction containing natural person credentials to the identity authorization center. The identity authorization center receives the task initiation instruction and verifies the legitimacy of the user. For basic account password verification or cross-domain single sign-on status verification, it is carried out according to the existing identity authentication protocol.

[0039] After successful user authentication, the identity authorization center constructs a four-tuple of identity bindings in memory to define the responsibility boundaries of this automated task. This four-tuple binding prevents legitimate users from unauthorized access to digital employees in unauthorized environments and prevents the abuse of digital employees to access unauthorized target systems, thus establishing a fine-grained traceability mechanism. The system is configured so that every digital employee operation must be executed based on a pre-established mapping relationship, and the identity binding tuple is defined as follows: The data structure representation of the identity binding tuple is as follows: ; In the formula, This is the set of binding relationships that have passed verification. For identifying business users; Identifier for digital employee instances; For the identification of the target account; This serves as the identity identifier for the current task type.

[0040] The four dimensions of identifier data are mapped in a table within the underlying relational database using foreign key constraints, to facilitate... Tracing back to the corresponding responsible natural person and the execution environment.

[0041] S102, the identity authorization center reads the preset permission configuration table from the underlying database and issues instructions to the constructed identity binding tuple. The system initiates cross-comparison and validity checks of the command, and extracts... Check if the corresponding business user has the authority to initiate the command. Authorize the position that initiates the command, and extract the information simultaneously. Initiating instructions and Check if the corresponding digital employee instance is allowed to initiate commands. When the system initiates a task and uses the corresponding target system account under the task type indicated by the command, and there are matching entries in all cross-validation relationships and permission configuration tables, the system determines that the binding relationship is valid and sends a task token issuance command to the policy control module. If there is any mismatch, the identity authorization center generates an unauthorized interception record and returns an access denial message to the business user.

[0042] After receiving the task token issuance instruction, the policy control module dynamically constructs a task token for the current task. This task token serves as an authorization credential for digital employees to obtain decryption credentials and issue commands to external systems within a controlled environment. The data structure of the task token is defined as follows: The task token's fields are represented in the following format: ; In the formula, represents the generated task token; This serves as the identity identifier for the current task type. Identifier for digital employee instances; For the identification of the target account; The allowed operation range parameters specifically include a whitelist of target system application programming interfaces that are allowed to be called and a set of interface operation instructions that are allowed to be executed; The effective time window parameter is defined by the set start and end timestamps, and the time window can be dynamically calculated and generated based on the preset execution cycle of the corresponding task. The preset execution cycle ranges from 1 to 24 hours. This is a risk threshold parameter. The value range of the risk threshold parameter is configured as a normalized value from 0 to 1 or from 0 to 100. It is preset by the administrator according to the sensitivity level of the task and is used to guide the dynamic interception decision in subsequent stages. For the generated digital signature.

[0043] S103, The policy control module uses a hash algorithm and asymmetric cryptography to calculate a digital signature to initiate the command. To prevent the task token from being intercepted and tampered with during network transfer or memory residency, the system extracts the control parameters from the task token, serializes and concatenates them according to set rules, inputs them into a one-way hash function to obtain a data digest, and then signs the generated data digest using the system's private key. The formula for calculating the digital signature is as follows: ; In the formula, For the generated digital signature; For existing digital signature algorithms; This is the existing standard one-way hash algorithm; This serves as the identity identifier for the current task type. Identifier for digital employee instances; For the identification of the target account; Parameters specifying the allowed operating range; For the effective time window parameters; This is a risk threshold parameter; This is the private key built into the identity authorization center.

[0044] After the signature encapsulation is completed, the policy control module will send the complete task token to initiate the command. Initiate instruction serialization and send it to the key management module and execution terminal to provide a verification benchmark for subsequent credential decryption and operation monitoring.

[0045] See attached document Figure 4 In a specific implementation, step S2 provided by the present invention includes the following steps: S201, the execution end allocates independent memory space and computing resources in the host operating system, initializes the controlled sandbox environment, and blocks unauthorized external processes from reading memory from the controlled sandbox environment based on existing operating system process isolation technology; after the controlled sandbox environment starts, the execution end sends a credential acquisition request to the key management module and submits a task token; the key management module receives the task token, and performs a consistency comparison between the control parameters contained in the task token and the digital signature based on existing digital signature verification algorithms and the public key of the identity authorization center. If the comparison is consistent, it confirms that the task token is within the set time window and completes the legal authentication of the validity of the task token. The set time window is a pre-configured time window of 10 to 30 minutes.

[0046] S202, after the task token is successfully authenticated, the key management module extracts the pre-stored plaintext of the target account credentials, encrypts the plaintext using a symmetric encryption algorithm to generate ciphertext, and uses the publicly available network key of the execution end in combination with an asymmetric encryption algorithm to encapsulate the symmetric key used for encryption in a digital envelope to generate key ciphertext. Then, the key management module sends the generated ciphertext and key ciphertext to the controlled sandbox environment of the execution end through the network transmission channel. Only ciphertext is transmitted in the network communication link, and there is no risk of direct exposure of plaintext credentials in the network communication link. Furthermore, the generation of the symmetric key and the data encapsulation are performed according to the existing national cryptographic algorithm calculation rules.

[0047] S203: The execution unit receives the packaged ciphertext data in an independent memory area within a controlled sandbox environment. It calls the built-in hardware private key to perform asymmetric decryption of the ciphertext, restoring the symmetric key. Subsequently, it uses the restored symmetric key to perform symmetric decryption of the credential ciphertext, extracting the plaintext of the target account credentials. The decryption operation is confined to a pre-allocated and locked physical memory address block. The locked physical memory address block physically cuts off the external read link of the plaintext data. The calculation formula for reverse decryption using the restored symmetric key is defined as follows: ; In the formula, To decrypt the obtained plaintext of the target account credentials; This is an existing standard symmetric decryption algorithm; The encrypted credentials received by the execution end; This is the symmetric key that can be recovered using the hardware private key.

[0048] S204, the execution end uses the decrypted target account credentials plaintext combined with the system adapter's interface protocol specifications to construct a network communication request to the external business system. After completing the graphical interface login operation or application programming interface authentication, it calls the system's underlying memory management interface to perform a random number overwrite operation on the locked physical memory address block. Then, the execution end actively writes random byte streams of different state modes to the physical memory address block continuously and alternately according to a set overwrite number threshold. The overwrite number threshold is pre-configured to a fixed integer of 3 to 7 times based on the target system's security level, thereby physically overwriting the original electronic state and completely eliminating the resident data of the credentials plaintext in the physical memory address block, which can physically block the channel for memory snapshot tools to read credentials data.

[0049] In a specific implementation, step S3 provided by the present invention includes the following steps: S301, when the execution end initiates an interface call or graphical interface operation, the dynamic interceptor injects hook functions at the operating system level to capture the control interaction signals of the graphical user interface and extract the corresponding operation attributes such as the control document object model path based on the control interaction signals. At the same time, it intercepts the network protocol requests of the application layer at the network layer and obtains the corresponding network protocol message content at the underlying layer. The dynamic interceptor parses the captured discrete interaction signals and network protocol requests, extracts the operation target object identifier, action type code, and request payload parameters, and formats and encapsulates the extracted parameters into standard operation events according to the preset data dictionary standard. The standard operation events constitute a continuous operation flow in time sequence, and each standard operation event in the operation flow is appended with a timestamp and the execution end instance identifier. The dynamic interceptor transmits the standard operation events with timestamps and execution end instance identifiers to the internal cache queue.

[0050] S302, the dynamic interceptor extracts standard operation events from the internal cache queue, and obtains the sensitivity of the operation object, data volume deviation value, time characteristic parameter, and retry frequency characteristic parameter corresponding to the standard operation event; the system objectively quantifies the abnormality of the operation behavior based on multi-dimensional operation characteristics, and each characteristic parameter obtained is a characteristic value in the range of 0 to 1; the dynamic interceptor performs a weighted summation operation on the obtained characteristic parameters according to the built-in weighted calculation rules, and calculates an initial dynamic risk score in the range of 0 to 1.

[0051] To ensure that all thresholds and comparison operations use the same scale, the dynamic interceptor performs a uniform scale conversion on the initial dynamic risk score based on the risk threshold setting in the task token, resulting in the final dynamic risk score used for comparison: if the risk threshold in the task token uses a numerical scale of 0 to 100, then it is explicitly stipulated that the dynamic risk score is calculated by multiplying the initial dynamic risk score by 100; if the risk threshold in the task token uses a numerical scale of 0 to 1, then the dynamic risk score is the initial dynamic risk score. The extracted feature parameters cover execution dimensions and network-level statistical data. The calculation formula for the initial dynamic risk score is defined as follows: ; In the formula, The calculated dynamic risk score; The sensitivity of the operation object is configured with a continuous value from 0 to 1, and the value is assigned by the administrator according to the data classification standard of the business system. The data volume deviation value is calculated by dividing the difference between the current request data packet size and the historical average data packet size by the historical average data packet size, and then truncated by a risk threshold and mapped to the range of 0 to 1. This is a time feature parameter. The time feature parameter takes a value of 0 when the current time is within the task's valid time window, and takes a value of 1 when it is outside the task's valid time window. This represents the retry frequency feature parameter, which is obtained by mapping the number of repeated requests per unit time to the interval of 0 to 1 using a normalization algorithm. The weighting coefficient corresponding to the sensitivity of the operation object; The weighting coefficients corresponding to the data volume deviation values; These are the weighting coefficients corresponding to the time feature parameters; These are the weighting coefficients corresponding to the retry frequency characteristic parameters; the sum of each weighting coefficient is 1, and they are pre-configured to fixed small values ​​of 0.1 to 0.4 according to security level requirements.

[0052] S303, under a unified scale, the dynamic interceptor compares the scale-converted dynamic risk score with the risk threshold and allowed operation range written in the task token, and triggers multi-level control logic; when the standard operation event exceeds the allowed operation range or the dynamic risk score is greater than or equal to the blocking threshold, the dynamic interceptor disconnects the network connection and forcibly suspends the running process of the execution end; when the dynamic risk score is less than the blocking threshold but greater than or equal to the alarm threshold and the standard operation event is within the allowed operation range, the dynamic interceptor sends a secondary confirmation instruction to the business user terminal. At this time, the business user terminal can simultaneously display the current task execution status for business personnel to make comprehensive judgments and processing. Then, after receiving the authorization release instruction, the dynamic interceptor releases the running process. When the dynamic risk score is less than the alarm threshold and the standard operation event is within the allowed operation range, the dynamic interceptor allows the current operation command. The blocking threshold and the alarm threshold are calculated by multiplying the risk threshold written in the task token with the system's preset proportional coefficient. The proportional coefficient corresponding to the blocking threshold is greater than the proportional coefficient corresponding to the alarm threshold, and the value of the proportional coefficient ranges from 0.8 to 0.95.

[0053] S304 During the processing cycle when the operation command is allowed or blocked, the log collection module runs synchronously with the dynamic interceptor and collects the multimodal logs of the execution end; the log collection module calls the multimedia interface at the bottom layer of the operating system to continuously capture the screen recording stream, and at the moment when the dynamic interceptor allows or blocks the operation command, the system uses the trigger signal to capture the high frame rate image slice corresponding to the target interactive action. The log collection module records the application programming interface request address, input and output parameters, parameter digests generated by hashing key business parameters, and exception code information thrown by the system. The log collection module packages and encapsulates screen recording stream files, high frame rate image slices, and text format interface logs in the local cache, and the underlying video stream encoding and decoding process is based on existing audio and video compression technologies.

[0054] Step S4 provided by the present invention includes the following steps in a specific implementation: S401, the evidence storage module receives discrete text logs, video file slices and high frame rate image slices from the local cache; the evidence storage module calls the global system clock source synchronized and calibrated via the network time protocol to extract standard timestamps with millisecond-level precision, and then the evidence storage module appends the standard timestamps to the data packet headers of the text logs, video file slices and high frame rate image slices respectively to complete heterogeneous timestamp alignment and multimodal data index marking. The evidence storage module independently calculates the corresponding text record digest, video slice digest, and image slice digest for heterogeneous data entities after adding timestamps using a one-way hash algorithm, generating data digests for each data entity independently. Furthermore, the underlying one-way hash algorithm calculation process is performed in accordance with the existing national cryptographic hash algorithm specifications.

[0055] S402, the evidence storage module extracts the root hash value corresponding to the previous record node in the underlying database, and concatenates the extracted root hash value with the data digests calculated within the current time period in a set order to form an aggregated data stream; the evidence storage module performs a secondary hash operation on the concatenated aggregated data stream to calculate and generate the log chain node corresponding to the current operation event. The data digests are concatenated end-to-end in the time sequence to generate a cryptographically bound tamper-proof data structure, and the calculation formula for the current log chain node is defined as follows: ; In the formula, The hash value of the log chain node generated in the current calculation; This is the existing standard one-way hash algorithm; This is the root hash value corresponding to the previous record node extracted from the underlying database; This is a byte stream concatenation operation; This is a summary of text record data calculated within the current time period; This is a summary of the video slice data calculated within the current time period; This is a summary of the image slice data calculated within the current time period.

[0056] S403, the evidence storage module maps and binds the calculated log chain nodes with the physical storage addresses corresponding to the unstructured multimedia data to generate a multimodal mapping index; then, the evidence storage module synchronously writes the log chain nodes with the mapping index and the corresponding multimedia file slices to the underlying read-only database for persistent solidification processing; when the system detects the underlying process signal of task completion or abnormal interruption, the execution end actively sends a termination signal to the policy control module and the key management module, thereby triggering the system's preset authorization environment reclamation mechanism.

[0057] S404: Upon receiving the termination signal, the policy control module destroys the verification record corresponding to the current task token in memory and broadcasts the task token revocation message to the entire network. Upon receiving the termination signal, the key management module scans the physical memory address block of the execution end, verifies and confirms the overwrite and cleanup status of the plaintext credentials. The audit review module extracts continuous log chain nodes from the underlying read-only database according to the time sequence, and then performs digest anti-tampering verification by recalculating the hash sequence. After the verification is passed, the audit review module parses each log chain node and integrates the identity binding relationship and interception records, and finally outputs a structured audit report containing identity tracing, interception behavior logs and execution replay index addresses.

[0058] See attached document Figure 5 and attached Figure 6 To aid in understanding the technical solution of this invention, the following is an application example of secure digital employee operation for cross-system automatic reconciliation in commercial banks.

[0059] During the identity verification and task token issuance phase, the business user terminal receives the task initiation instruction from the business personnel and completes two-factor authentication. The identity authorization center extracts the natural person identity identifier, digital employee instance identifier, target account identifier, and automatic reconciliation task type identifier from the underlying database to form a four-element identity binding tuple for cross-comparison. After the verification is passed, the policy control module issues a task token. The task token embeds the reconciliation system interface whitelist, the limited night execution time window, and the preset alarm threshold and blocking threshold. The system uses the built-in private key to digitally sign and encapsulate the parameters before sending them to the execution terminal.

[0060] During the controlled credential injection and environment initialization phase, the execution end starts an isolated controlled sandbox environment and submits a task token. After the key management module verifies the validity of the task token signature and the legality of the time window, it issues the target account credential ciphertext. The execution end calls the hardware private key in the underlying locked physical memory address block to restore the symmetric key and performs symmetric decryption of the credential. After completing the automatic login of the reconciliation business system, the system's underlying memory management interface continuously and alternately writes random byte streams of different state modes to the physical memory address block, covering the original electronic state at the physical level to eliminate the resident data of the credential plaintext.

[0061] During the operation flow monitoring and dynamic risk blocking phase, the dynamic interceptor injects hook functions to capture digital employee interaction signals and network protocol messages, extracts the sensitivity of the operation object, data volume deviation value, time characteristic parameters, and retry frequency characteristic parameters, and outputs a dynamic risk score according to the built-in weighted calculation rules. When the digital employee performs routine reconciliation flow capture, the dynamic risk score is less than the alarm threshold, so the operation instruction is directly released. When an unauthorized interface call is captured, causing the dynamic risk score to be greater than or equal to the alarm threshold but less than the blocking threshold, the dynamic interceptor disconnects the network connection and forcibly suspends the running process, sends a secondary confirmation instruction to the business user terminal, and waits to receive the authorization release instruction before releasing the running process.

[0062] During the multimodal data hashing evidence storage and auditing phase, the log collection module synchronously collects screen recording stream files, high frame rate image slices, and interface logs from the execution end. The evidence storage module extracts standard timestamps with millisecond-level precision and appends them to the headers of each heterogeneous data packet. It independently generates corresponding text record data digests, video slice data digests, and image slice data digests through a one-way hash algorithm. The extracted root hash value of the previous record node and each data digest are concatenated by bytes and subjected to secondary hashing operations in a set order to generate log chain nodes. The log chain nodes are synchronously written to the underlying read-only database for persistent solidification. After the task is completed, the audit review module extracts the log chain nodes according to the time sequence and outputs a structured audit report containing identity tracing, interception behavior logs, and execution replay index addresses.

[0063] The verification results show that the account hosting encryption and full behavior audit security system for digital employees provided by this invention can objectively quantify and block abnormal operation flows at the millisecond level. The overall performance overhead of controlled encryption and decryption and physical memory cleanup is lower than a fixed value. While preventing plaintext credentials from remaining and ensuring the execution of replay traceability mechanisms, it maintains the low-latency operation of business system operation instructions.

[0064] While specific embodiments of the present invention have been described above, those skilled in the art should understand that these specific embodiments are merely illustrative. Those skilled in the art can omit, substitute, and modify the details of the above methods and systems in various ways without departing from the principles and essence of the present invention. For example, combining the above method steps to perform substantially the same function and achieve substantially the same result using substantially the same method falls within the scope of the present invention.

Claims

1. A security system for account escrow encryption and full behavior auditing for digital employees, characterized in that: The system includes: business user terminal, identity authorization center, policy control module, key management module, execution terminal, system adapter, dynamic interceptor, log collection module, evidence storage module, and audit review module; The business user terminal is communicatively connected to the identity authorization center, and the business user terminal is used to send task initiation instructions and natural person identity authentication requests to the identity authorization center; The identity authorization center is used to establish and maintain the binding relationship between users, digital employees, target accounts and current task types, and to verify the legality of the binding relationship; The strategy control module is used to generate a task token based on the verified binding relationship, and then send the task token to the execution end. The key management module is used to temporarily store the plaintext of the target account credentials, the calling key, the certificate, and the task token, and to encrypt, authorize, and periodically rotate the plaintext of the target account credentials, the calling key, the certificate, and the task token. The execution terminal is used to initiate interface calls or graphical interface operation instructions to the system adapter in a controlled environment; The system adapter is used to connect the execution terminal to an external business system; The dynamic interceptor is used to capture the operation instructions of the execution end, calculate the dynamic risk score according to the allowed operation range in the task token, compare the dynamic risk score with the risk threshold in the task token, perform interception judgment, compare whether it is within the allowed operation range, and transmit the standard operation event, interception result and approval result to the log collection module. The log collection module is used to collect screen recordings, interface screenshots, control paths, interface logs, parameter summaries, and exception information from the execution end, and transmit them to the evidence storage module. The evidence storage module is used to generate log chain nodes by combining the hash value of the previous node; The audit review module is used to read continuous log chain nodes and provides data retrieval, summary anti-tampering verification, execution replay, and structured audit report export operations.

2. The account hosting encryption and full behavior auditing security system for digital employees according to claim 1, characterized in that, The identity authorization center constructs a four-element identity binding tuple. ,in, This is the set of binding relationships that have passed verification. For the identification of business users, For the identification of digital employee instances, For the identification of the target account, This serves as the identity identifier for the current task type. Read the preset permission configuration table in the underlying database and perform cross-comparison and legality verification on the four-element identity binding tuple; When a matching entry exists in all cross-validation relationships and the permission configuration table, the system determines that the binding relationship is valid and sends a task token issuance instruction to the policy control module.

3. The account hosting encryption and full behavior auditing security system for digital employees according to claim 2, characterized in that, After receiving the task token issuance instruction, the strategy control module dynamically constructs a task token for the current task; The policy control module uses hash algorithms and asymmetric cryptography to calculate digital signatures; The generated data digest is signed using a private key, and the signature is encapsulated in a task token for distribution.

4. The account hosting encryption and full behavior auditing security system for digital employees according to claim 1, characterized in that, The execution end initializes the controlled sandbox environment and blocks unauthorized external processes from reading memory from the controlled sandbox environment based on existing operating system process isolation technology; After the controlled sandbox environment is started, the execution end sends a credential acquisition request to the key management module and submits the task token; The key management module receives the task token and verifies the control parameters contained in the task token against the digital signature based on the digital signature verification algorithm and the public key of the identity authorization center. If the comparison is consistent, it confirms that the task token is within the set time window and completes the legal authentication of the validity of the task token. After the task token is successfully authenticated, the key management module uses a symmetric encryption algorithm to encrypt the data, generating credential ciphertext. It then uses the network public key published by the execution end in combination with an asymmetric encryption algorithm to encapsulate the symmetric key used for encryption in a digital envelope, generating key ciphertext. The key management module distributes the generated ciphertext and key ciphertext to the controlled sandbox environment.

5. The account hosting encryption and full behavior auditing security system for digital employees according to claim 4, characterized in that, The controlled sandbox environment calls the built-in hardware private key in an independent memory area to perform asymmetric decryption of the key ciphertext to restore the symmetric key. The restored symmetric key is then used to perform symmetric decryption of the credential ciphertext to extract the plaintext of the target account credential for business authentication. After authentication, a random byte stream is used to overwrite the memory area to completely clear the plaintext credential. The number of overwrites is preset according to the business security level.

6. The account hosting encryption and full behavior auditing security system for digital employees according to claim 1, characterized in that, When the execution end initiates an interface call or graphical interface operation, the dynamic interceptor injects hook functions at the operating system layer, captures the control interaction signals of the graphical user interface, and extracts the corresponding operation attributes such as the control document object model path based on the control interaction signals. At the same time, it intercepts the network protocol requests of the application layer at the network layer and obtains the corresponding network protocol message content at the underlying layer. The dynamic interceptor parses the captured discrete interaction signals and network protocol requests, extracts the target object identifier, action type code, and request payload parameters, and formats and encapsulates the extracted parameters into standard operation events according to the preset data dictionary standard. Standard operation events constitute a continuous operation stream in time series, and each standard operation event in the operation stream is appended with a timestamp and an execution instance identifier. The dynamic interceptor transmits the standard operation events with timestamps and execution instance identifiers to the internal cache queue.

7. The account hosting encryption and full behavior auditing security system for digital employees according to claim 6, characterized in that, The dynamic interceptor extracts standard operation events and obtains the corresponding operation object sensitivity, data volume deviation value, time characteristic parameter, and retry frequency characteristic parameter. The initial dynamic risk score is calculated based on the built-in weighted calculation rules. The initial dynamic risk score is converted to a uniform scale based on the risk threshold set in the task token to obtain a dynamic risk score for comparison.

8. The account hosting encryption and full behavior auditing security system for digital employees according to claim 7, characterized in that, The dynamic interceptor compares the scale-converted dynamic risk score with the risk threshold and allowed operation range written in the task token under a unified scale, and triggers multi-level control logic. When a standard operation event exceeds the allowed operation range or the dynamic risk score is greater than or equal to the blocking threshold, the dynamic interceptor disconnects the network connection and forcibly suspends the running process of the execution end. When the dynamic risk score is less than the blocking threshold and greater than or equal to the alarm threshold, and the standard operation event is within the allowed operation range, the dynamic interceptor sends a secondary confirmation instruction to the business user terminal. At this time, the business user terminal can simultaneously display the current task execution status for business personnel to make comprehensive judgments and processing. Then, the dynamic interceptor releases the running process after receiving the authorization release instruction. When the dynamic risk score is less than the alarm threshold and the standard operation event is within the allowed operation range, the dynamic interceptor allows the current operation instruction to proceed.

9. The account hosting encryption and full behavior auditing security system for digital employees according to claim 1, characterized in that, The log collection module packages and encapsulates the screen recording stream file, high frame rate image slices, and text-formatted interface logs in a local cache. The evidence storage module receives discrete text logs, video file slices, and high frame rate image slices from the local cache. The evidence storage module calls the global system clock source synchronized and calibrated via the network time protocol to extract a standard timestamp with millisecond-level precision. Then, the evidence storage module appends the standard timestamp to the data packet headers of text logs, video file slices, and high frame rate image slices respectively, completing the heterogeneous timestamp alignment and multimodal data index marking. The evidence storage module applies a one-way hash algorithm to each heterogeneous data entity after adding a timestamp to independently calculate the corresponding text record summary, video slice summary, and image slice summary, and independently generate the data summary of each data entity. The evidence storage module extracts the root hash value corresponding to the previous record node in the underlying database, and concatenates the extracted root hash value with the data digests calculated in the current time period in a set order to form an aggregated data stream. The evidence storage module performs a secondary hash operation on the assembled data stream to calculate and generate the log chain node corresponding to the current operation event.

10. The account hosting encryption and full behavior auditing security system for digital employees according to claim 9, characterized in that, The evidence storage module performs a mapping and binding operation between the calculated log chain nodes and the physical storage addresses corresponding to the unstructured multimedia data, generating a multimodal mapping relationship index. Next, the evidence storage module synchronously writes the log chain nodes with mapping relationship indexes and the corresponding multimedia file slices to the underlying read-only database to perform persistent solidification processing; When the system detects a low-level process signal indicating task completion or abnormal interruption, the execution end actively sends a termination signal to the policy control module and key management module, thereby triggering the system's pre-set authorization environment reclamation mechanism. After receiving the termination signaling, the policy control module destroys the verification record corresponding to the current task token in memory and broadcasts the task token revocation message to the entire network. After receiving the termination signal, the key management module scans the physical memory address block of the execution end to verify and confirm the overwrite and cleanup status of the plaintext credential.

Images