arXiv 2602.063452026-02-06cs.CRcs.AI

面向代理支付协议的零信任运行时验证：缓解AP2中的重放和上下文绑定失败

Zero-Trust Runtime Verification for Agentic Payment Protocols: Mitigating Replay and Context-Binding Failures in AP2

eBay Inc（eBay公司）

Qianlong Lan, Anuj Kaul, Shaun Jones, Stephanie Westrum

阅读 PDF

arXiv 页面 ↗HTML 原文 ↗

AI总结：

本文提出了一种零信任运行时验证框架，通过动态生成非ces强制显式上下文绑定和一次性使用命令语义，以缓解AP2中的重放和上下文重定向攻击。

摘要：

自主AI代理能够执行商业交易的部署促使了基于命令的支付授权协议的采用，包括通用商业协议（UCP）和代理支付协议（AP2）。这些协议通过密码学发出的命令取代了交互式、基于会话的授权，使异步和自主执行成为可能。虽然AP2通过签名验证、显式绑定和过期语义提供规范级保证，但现实中的代理执行引入了重试、并发性和编排等运行时行为，挑战了关于命令使用隐含假设。在本工作中，我们对AP2命令生命周期进行了安全分析，并识别了在基于代理的支付系统运行时出现的执行漏洞。我们提出了一种零信任运行时验证框架，通过动态生成的时间绑定非ces来强制显式上下文绑定和一次性使用命令语义，确保授权决策在执行时评估而非假设自静态发行属性。通过基于模拟的评估，在高并发环境下，我们展示了上下文感知绑定和一次性使用执行解决不同的互补攻击类别，并且两者都是防止重放和上下文重定向攻击所必需的。所提出的框架在缓解所有评估的攻击的同时，保持了稳定的验证延迟，约为3.8毫秒，在每秒最多10,000笔交易的吞吐量下。我们进一步表明，所需的运行时状态受峰值并发限制而非累计交易历史，表明通过最小且可预测的开销可以实现稳健的代理支付执行运行时安全。

英文摘要：

The deployment of autonomous AI agents capable of executing commercial transactions has motivated the adoption of mandate-based payment authorization protocols, including the Universal Commerce Protocol (UCP) and the Agent Payments Protocol (AP2). These protocols replace interactive, session-based authorization with cryptographically issued mandates, enabling asynchronous and autonomous execution. While AP2 provides specification-level guarantees through signature verification, explicit binding, and expiration semantics, real-world agentic execution introduces runtime behaviors such as retries, concurrency, and orchestration that challenge implicit assumptions about mandate usage. In this work, we present a security analysis of the AP2 mandate lifecycle and identify enforcement gaps that arise during runtime in agent-based payment systems. We propose a zero-trust runtime verification framework that enforces explicit context binding and consume-once mandate semantics using dynamically generated, time-bound nonces, ensuring that authorization decisions are evaluated at execution time rather than assumed from static issuance properties. Through simulation-based evaluation under high concurrency, we show that context-aware binding and consume-once enforcement address distinct and complementary attack classes, and that both are required to prevent replay and context-redirect attacks. The proposed framework mitigates all evaluated attacks while maintaining stable verification latency of approximately 3.8~ms at throughput levels up to 10{,}000 transactions per second. We further demonstrate that the required runtime state is bounded by peak concurrency rather than cumulative transaction history, indicating that robust runtime security for agentic payment execution can be achieved with minimal and predictable overhead.

机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。

AI总结：

摘要：

英文摘要：

相关论文