信息网络安全

信息网络安全 ›› 2026, Vol. 26 ›› Issue (9): 1447-1454.doi: 10.3969/j.issn.1671-1122.2026.09.010

• 入选论文 • 上一篇    下一篇

面向智能体工具调用的动态访问控制方法

王日1(), 李剑2, 吴亚飚1   

  1. 1 北京天融信科技有限公司， 北京 100193
    2 北京邮电大学网络空间安全学院， 北京 100876
  • 收稿日期:2026-06-09 出版日期:2026-09-10 发布日期:2026-09-30
  • 通讯作者: 王日 E-mail:wang_ri@topsec.com.cn
  • 作者简介:王日（1996—），女，山东，博士，主要研究方向为AI安全|李剑（1976—），男，陕西，教授，博士，CCF会员，主要研究方向为网络空间安全|吴亚飚（1971—），男，福建，高级工程师，硕士，主要研究方向为网络安全、人工智能

Dynamic access control method for agent tool invocation

Wang Ri1(), Li Jian2, Wu Yabiao1   

  1. 1 Topsec Technologies Inc., Beijing 100193, China
    2 School of Cyberspace Security, Beijing University of Posts and Telecommunications, Beijing 100876, China
  • Received:2026-06-09 Online:2026-09-10 Published:2026-09-30
  • Contact: Wang Ri E-mail:wang_ri@topsec.com.cn

RichHTML

2

PDF (PC)

11

摘要：

模型上下文协议为基于大模型的智能体工具调用提供了标准化的交互范式，并实现了对第三方服务端的兼容。然而，这种开放接入模式难以约束智能体多步骤工具调用中的动态行为演变，增加了运行时权限边界的不确定性，进而引发越权访问、权限漂移等安全风险。文章提出一种融合细粒度属性授权与事件流图约束的动态访问控制方法MCP-DAC，该方法在试运行阶段自动收集良性工具调用日志，生成基于策略的访问控制规则并构建每个会话的事件转移图；在运行时对每次MCP请求执行属性校验和路径校验。多场景下的MCP Server原型实验结果表明，MCP-DAC 能够阻断多种异常请求，同时对正常工具调用流程保持较低干扰。

关键词: 模型上下文协议, 动态授权, 会话事件流图, 基于策略的访问控制

Abstract:

The model context protocol provides a standardized interaction paradigm for tool invocation by LLM-based agents and enables compatibility with third-party servers. However, this open access model makes it difficult to constrain the evolving behavior of agents during multi-step tool invocation, increasing the uncertainty of runtime permission boundaries and consequently introducing risks such as unauthorized access and permission drift. This paper proposed MCP-DAC, a dynamic access control method that integrated fine-grained attribute-based authorization with event-flow graph constraints. During the trial phase, MCP-DAC automatically collected benign tool invocation logs, generated policy-based access control rules, and constructed an event transition graph for each session; at runtime, it performed attribute validation and path validation for each MCP request. Prototype experimental results with MCP Servers in multiple scenarios show that MCP-DAC effectively blocks various anomalous requests while causing limited interference with normal tool invocation workflows.

Key words: model context protocol, dynamic authorization, session event flow graph, policy-based access control

中图分类号: