arXiv cs.AI· Xiaohang Yu, Hejia Geng, Xinmeng Zeng, William Knottenbelt·· 13 小时前AI 评分40
SUDP：面向智能体系统的密钥使用委托协议
SUDP: Secret-Use Delegation Protocol for Agentic Systems
AI 导读
研究者提出 Secret-Use Delegation Protocol（SUDP），让不可信的自主请求方能够触发用户授权的密钥操作，而无需获得可复用的权限。该协议将问题形式化为 Agent Secret Use（ASU），并列出方案须满足的七项安全属性，在标准密码学假设下满足其中六项，第七项运行时内存机密性通过与硬件根信任的运行时组合实现。参考实现每次受中介调用增加不到 1 毫秒的协议开销。
正文 · 原文
Abstract:Agentic systems now act with user secrets for APIs, messaging platforms, and cloud services. Today's agent runtimes typically implement authorization by exposure: enabling action means placing a reusable secret, or a reusable artifact derived from it, inside the runtime, so a transient prompt-injection or tool-side compromise becomes durable account compromise. Existing defenses cover adjacent pieces such as secret storage, scoped delegation, sender-constrained tokens, and runtime monitoring, but none states the combined requirement: an untrusted autonomous requester should be able to cause a user-authorized secret-backed operation without gaining reusable authority over it. We formalize this as the Agent Secret Use (ASU) problem and identify seven security properties any solution must satisfy, spanning authorization integrity and secret confidentiality. We propose the Secret-Use Delegation Protocol (SUDP), in which a requester proposes a canonical operation, the user authorizes it with a fresh authenticator-backed grant, and a custodian redeems the grant to perform the bounded use; reusable authority never crosses the requester boundary. We specialize SUDP for LLM-driven agents, where it applies whenever a tool call would exercise user-enrolled authority-bearing material. Under standard cryptographic assumptions, SUDP satisfies six of the seven properties; the seventh, runtime-memory confidentiality, is closed by composition with a hardware-rooted runtime. A reference implementation, available at this https URL, adds sub-millisecond protocol overhead per mediated call.
| Subjects: | Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI) |
| Cite as: | arXiv:2604.24920 [cs.CR] |
| (or arXiv:2604.24920v4 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2604.24920 arXiv-issued DOI via DataCite |
Submission history
From: Xiaohang Yu [view email]
[v1]
Mon, 27 Apr 2026 19:02:08 UTC (200 KB)
[v2]
Fri, 1 May 2026 04:48:19 UTC (193 KB)
[v3]
Fri, 22 May 2026 15:58:46 UTC (179 KB)
[v4]
Wed, 21 Oct 2026 08:55:06 UTC (238 KB)
来源：arXiv cs.AI · arxiv.org