在 AWS 上用 X.509 PKI 保障 AI agent 身份安全

AI 摘要

AWS 机器学习博客介绍如何用 Keyfactor EJBCA 的 X.509 PKI 在 AWS 上为 AI agent 建立密码学身份，解决 MCP 缺乏内置认证标准带来的伪造、重放和越权调用风险。方案采用签名请求信封、用户签名委托断言、RFC 8693 受众限定令牌和实时 OCSP 吊销检查四层机制，并结合 Amazon Bedrock、Strands Agents SDK、RDS、Secrets Manager 等服务。该参考架构由 AWS 与 Keyfactor 工程团队合作开发，代码在 GitHub 开源，可推广到任意 MCP 兼容工具服务器。

正文节选

Securing AI agent identity with X.509 PKI on AWS When AI agents access databases, APIs, and sensitive business operations, establishing cryptographic identity through X.509 public key infrastructure (PKI) becomes a critical requirement. The core challenge is proving which agent made a request, preventing forgery between agents, and confirming that each agent acts only on behalf of an authorized user. Traditional approaches such as sharing API keys between components or passing OAuth tokens throu

发布时间：2026-10-21 00:03

抓取时间：2026-10-21 00:36

来源机构：AWS