Computing system and method for improving artificial intelligence code and data security

Abstract

The invention provides a computing system and method for improving artificial intelligence code and data security, and belongs to the technical field of information security. The system comprises a user computer and a service computer which are connected through the Internet, one or more secret room computing safety devices are arranged on a host of the service computer; the user computer is used for initiating artificial intelligence calculation, and providing an encrypted artificial intelligence calculation code, a corresponding digital signature, encrypted user data required by calculation and a corresponding digital signature for the service computer through the Internet; and the service computer decrypts the artificial intelligence calculation code and the user data by using the secret room calculation security device, performs digital signature verification, completes corresponding calculation, performs digital signature on a calculation result, encrypts the calculation result, and returns the calculation result to the user computer through the Internet. The method has the advantages of high safety, high efficiency, high universality and high compatibility, and artificial intelligence calculation codes and calculation results can be effectively protected.

Description

Technical Field

[0001] The present invention belongs to the field of information security technology, and specifically relates to a computing system and method for improving the security of artificial intelligence code and data. Background Art

[0002] With the booming development of big data and artificial intelligence, the importance and security of data are increasingly gaining attention and importance. How to fully utilize the value of existing data while ensuring the security and privacy of data, that is, how to truly achieve "data is available but invisible", is still an important challenge facing the current information security technology field. Existing user data privacy protection computing technology solutions can be divided into software-based solutions and hardware isolation-based solutions. Software-based solutions protect the security and privacy of data by using different software mechanisms and algorithms, mainly including secure multi-party computing technology, technologies based on homomorphic encryption and differential privacy, and federated learning mechanisms and technologies for artificial intelligence. Hardware isolation-based technologies mainly include confidential computing technologies based on trusted execution environment (TEE) (mainly including Intel SGX and ARM TrustZone), and other technologies based on on-chip computing systems independent of CPUs.

[0003] Secure multi-party computing technology is based on cryptography, and its security can be proven by cryptographic theory. However, since it contains complex cryptographic operations, it has high computational overhead and long communication time. It can be applied in key management, simple statistics and some linear machine learning models, but for complex scenarios such as deep neural networks, performance and network will become bottlenecks for its application. Since all calculations are encrypted, the technical solution based on homomorphic encryption has a high degree of privacy protection, but some homomorphic encryption algorithms support limited types of calculations and have a narrow application range. The computational overhead of full homomorphic encryption is very large, which limits its performance and application scenarios. The computing technology based on differential privacy protects the calculation results rather than the calculation process. At the same time, differential privacy will introduce noise in the data, which will reduce the accuracy of the calculation results. It is not applicable to applications that require high calculation accuracy, such as face recognition. Although local differential privacy also protects the calculation process, it introduces greater errors, so the application scenarios are more limited. Although federated learning does not move data, the current federated learning mechanism still has a certain degree of privacy leakage risk during the model update process, and its model aggregation process is also restricted by factors such as network bandwidth and latency, and there is a network bottleneck. In addition, the software-based technical solution lacks protection for the software or code itself involved in the calculation process, and its security also depends on the security of the operating environment. Compared with the software-based technical solution, the confidential computing technical solution based on hardware isolation takes into account security, versatility and efficiency, but its shortcoming is that the trusted execution environment and the untrusted execution environment in the current technical solution still need to share computing and memory resources, which leads to security risks such as side channel attacks. Although the existing hardware isolation-based technical solution protects the calculation code in the data calculation process to a certain extent, it still lacks protection for the calculation results. At the same time, the existing hardware isolation-based technical solution also introduces new computing architectures and computing instructions, thereby changing the programming method of applications and posing compatibility issues. Summary of the invention

[0004] The purpose of the present invention is to overcome the shortcomings of security technology solutions based on hardware isolation and propose a computing system and method for improving the security of artificial intelligence code and data. The present invention has high security, high efficiency, high versatility and high compatibility, can effectively protect artificial intelligence computing codes and calculation results, and further solve the problem of "data can be calculated but not visible" in all aspects.

[0005] An embodiment of the present invention proposes a computing system for improving the security of artificial intelligence codes and data, comprising a user computer and a service computer connected via the Internet; one or more secret room computing security devices are provided on the host of the service computer; the user computer is used to initiate artificial intelligence computing, and provide the service computer with encrypted artificial intelligence computing code and corresponding digital signatures and encrypted user data required for computing and corresponding digital signatures via the Internet; the service computer is used to receive the encrypted artificial intelligence computing code and corresponding digital signatures and the encrypted user data and corresponding digital signatures, and after decrypting the artificial intelligence computing code and the user data using the secret room computing security device and performing digital signature verification, completes the corresponding computing, digitally signs and encrypts the computing results, and returns them to the user computer via the Internet.

[0006] In a specific embodiment of the present invention, the service computer dispatches each of the secret room computing security devices in turn.

[0007] In a specific embodiment of the present invention, a user password processing unit is provided on the user computer for managing keys, encrypting and digitally signing the artificial intelligence computing code and the user data of the user computer, and decrypting and digitally signing the calculation results returned from the service computer.

[0008] In a specific embodiment of the present invention, the chamber computing security device comprises: a computing unit, a volatile storage unit, a non-volatile storage unit, an application and data processing unit, an artificial intelligence co-processing unit, a cryptographic processing unit and a host communication interface unit; wherein the application and data processing unit is respectively connected to the computing unit, the non-volatile storage unit, the cryptographic processing unit and the host communication interface unit through physical lines, the volatile storage unit is respectively connected to the computing unit and the non-volatile storage unit through physical lines, and the computing unit is also connected to the artificial intelligence co-processing unit through physical lines;

[0009] The application and data processing unit receives the encrypted artificial intelligence calculation code and the user data sent by the user computer to the service computer through the host communication interface unit, stores the artificial intelligence calculation code and the user data in the non-volatile storage unit after decryption and verification through the cryptographic processing unit, and encrypts and signs the calculation result after the calculation unit performs artificial intelligence calculation through the cryptographic processing unit and sends it to the service computer host through the host communication interface unit;

[0010] The non-volatile storage unit is used to store the artificial intelligence calculation code and the user data processed by the application and data processing unit, and store the calculation result after the artificial intelligence calculation performed by the calculation unit;

[0011] The volatile storage unit is used to load the artificial intelligence computing code and the user data stored in the non-volatile storage unit according to the requirements of the computing unit;

[0012] The computing unit is used to load the artificial intelligence computing code and the user data stored in the volatile storage unit and perform computing, and then store the computing result in the non-volatile storage unit through the volatile storage unit;

[0013] The password processing unit is used to cooperate with the user password processing unit to perform key management, decrypt and digitally verify the artificial intelligence code and user data in the application and data processing unit, and encrypt and digitally sign the calculation results in the application and data processing unit;

[0014] The artificial intelligence co-processing unit is used to assist the computing unit in completing artificial intelligence computing to accelerate the data computing process;

[0015] The host communication interface unit is used for communicating with the service computer host through a private dedicated channel.

[0016] In a specific embodiment of the present invention, the cryptographic processing unit includes a first key management and distribution module, a first encryption and decryption module, and a first digital signature and verification module interconnected by physical lines;

[0017] The first key management and distribution module is used to complete the generation, storage, management and distribution of encryption keys and signature keys; the first encryption and decryption module is used to execute encryption and decryption algorithms to decrypt the artificial intelligence code and the user data in the application and data processing unit, and to encrypt the calculation results in the application and data processing unit; the first digital signature and verification module is used to perform digital signature verification on the artificial intelligence code and the user data in the application and data processing unit, and to digitally sign the calculation results in the application and data processing unit.

[0018] In a specific embodiment of the present invention, the user password processing unit includes a second key management and distribution module, a second encryption and decryption module, and a second digital signature and verification module interconnected by physical lines;

[0019] The second key management and distribution module cooperates with the first key management and distribution module to jointly complete the generation, storage, management and distribution of encryption keys and signature keys; the second encryption and decryption module is used to execute the encryption and decryption algorithm to encrypt the artificial intelligence code and the user data in the user computer, and decrypt the calculation results from the service computer; the second digital signature and verification module is used to digitally sign the artificial intelligence code and the user data in the user computer, and perform digital signature verification on the calculation results from the service computer.

[0020] In a specific embodiment of the present invention, the user password processing unit and the password processing unit construct online key generation and exchange based on the SecKMS key management system.

[0021] The embodiment of the present invention further proposes a calculation method based on the above system, comprising the following steps:

[0022] 1) The user prepares user data and corresponding artificial intelligence computing code on the user's computer;

[0023] 2) The user password processing unit of the user computer communicates with the password processing unit in the selected secret room computing security device on the service computer to complete password generation and exchange; including:

[0024] The service computer host selects the secret room computing security device;

[0025] The user password processing unit of the user computer generates an encryption key: the first key through the second key management and distribution module, generates a pair of signature key pairs for signing: the user public key and the user private key, and communicates with the first key management and distribution module in the password processing unit in the selected secret room computing security device on the service computer to complete key distribution;

[0026] The password processing unit in the selected secret room computing security device on the service computer generates an encryption key: a second key through the first key management and distribution module, generates a pair of signature key pairs for signing: a service public key and a service private key, and communicates with the second key management and distribution module in the user password processing unit of the user computer to complete key distribution;

[0027] 3) The user computer signs and encrypts the artificial intelligence computing code and user data to obtain the encrypted computing code and the corresponding encrypted signature as well as the encrypted user data and the corresponding encrypted signature; including:

[0028] The user computer uses the user's private key and the pre-selected digital signature algorithm in the second digital signature and verification module in the user password processing unit to sign the artificial intelligence calculation code to obtain the calculation code signature; and signs the user data to obtain the user data signature;

[0029] The user computer uses the first key and the preselected symmetric encryption algorithm in the second encryption and decryption module of the user password processing unit to encrypt the combination of the calculation code, the calculation code signature, the user data, and the user data signature to obtain the encrypted calculation code and the corresponding encryption signature as well as the encrypted user data and the corresponding encryption signature;

[0030] 4) The user computer host sends the encrypted computing code and the corresponding encrypted signature as well as the encrypted user data and the corresponding encrypted signature to the service computer; the service computer host sends the encrypted computing code and the corresponding encrypted signature as well as the encrypted user data and the corresponding encrypted signature to the secret room computing security device selected in step 2) through a private dedicated channel;

[0031] 5) The secret room computing security device of the service computer decrypts the received encrypted computing code and the corresponding encrypted signature as well as the encrypted user data and the corresponding encrypted signature; including:

[0032] The application and data processing unit of the secret room computing security device receives the encrypted computing code and the corresponding encrypted signature and the encrypted user data and the corresponding encrypted signature sent by the service computer host through the host communication interface unit and the private dedicated channel, and stores them in the non-volatile storage unit;

[0033] The application and data processing unit uses the first encryption and decryption module in the cryptographic processing unit to use the first key and the pre-selected symmetric encryption algorithm to decrypt the encrypted computing code and the encrypted user data, and decrypt the computing code signature and the encrypted user data signature to obtain the decrypted computing code, the decrypted user data, the decrypted computing code signature and the decrypted user data signature, and store them in the non-volatile storage unit;

[0034] The cryptographic processing unit uses the digital signature and verification module to verify the decryption calculation code signature and the decrypted user data signature using the user public key and the pre-selected digital signature algorithm: if both are verified, execute step 6);

[0035] 6) The secret room computing security device processes the decrypted computing code and the decrypted user data to obtain the final computing result; including:

[0036] The application and data processing unit of the chamber computing security device loads the running environment code of the computing code stored in the non-volatile storage unit into the volatile storage unit for running by using the computing unit according to the computing requirements of the computing code;

[0037] The application and data processing unit uses the computing unit, the volatile storage unit, and the artificial intelligence co-processing unit to run the computing code stored in the volatile storage unit, processes the user data stored in the non-volatile storage unit, obtains the computing result, and stores it in the non-volatile storage unit;

[0038] 7) The secret room computing security device signs and encrypts the computing result to obtain the encrypted computing result and the signature of the encrypted computing result; including:

[0039] The cryptographic processing unit of the secret room computing security device uses the service private key and the first digital signature in the user cryptographic processing unit and the digital signature algorithm preselected by the verification module to sign the computing result and obtain the computing result signature;

[0040] The cryptographic processing unit uses the second key and the symmetric cryptographic algorithm preselected in the first encryption and decryption module of the user cryptographic processing unit to encrypt the calculation result and the calculation result signature stored in the non-volatile storage unit to obtain the encrypted calculation result and the encrypted calculation result signature;

[0041] 8) The service computer host sends the encrypted calculation result and the encrypted calculation result signature to the user computer;

[0042] 9) The second encryption and decryption module of the user password processing unit on the user computer uses the second key and the pre-selected symmetric encryption algorithm to decrypt the encrypted calculation result and the encrypted calculation result signature to obtain the decrypted calculation result and the decrypted calculation result signature;

[0043] The user password processing unit uses the second digital signature and verification module, utilizes the service public key and the pre-selected digital signature algorithm, to verify the signature of the decryption calculation result; if the verification is successful, the user computer presents the decryption calculation result to the user.

[0044] In a specific embodiment of the present invention, the verification of the decrypted calculation code signature and the decrypted user data signature further includes:

[0045] If any verification fails, a verification failure message is output as the calculation result.

[0046] In a specific embodiment of the present invention, the verification of the decryption calculation result signature further includes:

[0047] If the decryption calculation result signature verification fails, the user computer reports a calculation result transmission error to the user.

[0048] The characteristics and beneficial effects of the present invention are:

[0049] The present invention avoids the side channel attack risk brought by the sharing of computing and memory resources with the user's ordinary computing in the trusted execution environment in the existing confidential computing technology by setting a secret room computing security device with independent computing and storage resources on the service computer, so that even if the service computer is attacked, the artificial intelligence computing code and data can be protected from security risks and the leakage of code and data privacy, which has better security and compatibility than the existing hardware isolation-based method. At the same time, by using encryption technology and digital signature technology to encrypt and digitally sign the computing code (including software, program or script code, etc.) involved in the artificial intelligence computing process, the data to be processed and the data computing results, the confidentiality and integrity of the data in the data transmission and the calculation result return process are guaranteed, and the confidentiality and integrity of the code involved in the computing process are also guaranteed, and the encryption and decryption time can also be reduced. In the independent secret room computing environment based on hardware isolation, the present invention uses independent computing and storage resources to perform plain text computing on the decrypted computing code and data, which not only improves the efficiency of computing, but also provides the compatibility of the computing process. The present invention can also be used for other data processing processes other than artificial intelligence computing, such as data processing processes in the Internet of Things or Industrial Internet of Things, and is also suitable for other application fields such as finance and medical care that require data privacy protection computing. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Figure 1 It is a structural diagram of a computing system for improving the security of artificial intelligence code and data in an embodiment of the present invention.

[0051] Figure 2 It is a schematic diagram of the structure of a closed-room computing security device in a specific embodiment of the present invention.

[0052] Figure 3 It is an overall flow chart of a computing method based on the computing system for improving the security of artificial intelligence code and data in an embodiment of the present invention. DETAILED DESCRIPTION

[0053] The present invention proposes a computing system and method for improving the security of artificial intelligence code and data, which is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0054] The embodiment of the present invention provides a computing system for improving the security of artificial intelligence code and data, the structure of which is as follows: Figure 1 As shown, it includes: a user computer and a service computer, wherein the user computer and the service computer are connected via the Internet. Among them, the host of the service computer (including a common computer host or a server host) is provided with one or more secret room computing security devices. Figure 1As shown, n chamber computing security devices are provided on the host of the service computer. The user computer is used to initiate artificial intelligence computing, and provides the service computer with encrypted artificial intelligence computing code and corresponding digital signature and encrypted user data required for computing and corresponding digital signature via the Internet. The service computer is used to receive the encrypted computing code, user data and digital signature, decrypt the computing code and user data using the chamber computing security device and perform signature verification, complete the corresponding computing process, and encrypt and digitally sign the computing result and return it to the user computer via the Internet.

[0055] The embodiment of the present invention has no special requirements for the user computer and the service computer. Among them, the user computer can be an ordinary user desktop or portable PC, and in a specific embodiment of the present invention, it is an ordinary desktop PC (Dell OptiPlex 7010MT Plus). The user password processing unit is an encryption and decryption chip or a computer motherboard card; in a specific embodiment of the present invention, it is a motherboard card on the user computer. The service computer can be an ordinary server or a cloud server, and in a specific embodiment of the present invention, it is an ordinary Dell server (Dell T150). The secret room computing security device can be an independent computer or a computer motherboard card, and in a specific embodiment of the present invention, it is a motherboard card on a server computer.

[0056] Furthermore, a user password processing unit is provided on the user computer for managing keys, encrypting and digitally signing the artificial intelligence computing code and user data of the user computer, and decrypting and digitally signing the computing results returned from the service computer. In this embodiment, when there are multiple secret room computing security devices, the service computer manages the multiple secret room computing security devices and determines the scheduling of computing tasks between the security computing devices according to the current operating status of the system. In a specific embodiment of the present invention, the service computer schedules each secret room computing security device in turn.

[0057] Furthermore, the chamber computing security device has independent computing and storage resources, and the structure is as follows: Figure 2 As shown, it includes a computing unit, a volatile storage unit, a non-volatile storage unit, an application and data processing unit, an artificial intelligence co-processing unit, a cryptographic processing unit and a host communication interface unit. The application and data processing unit are respectively connected to the computing unit, the non-volatile storage unit, the cryptographic processing unit and the host communication interface unit, the volatile storage unit is respectively connected to the computing unit and the non-volatile storage unit, and the computing unit is also connected to the artificial intelligence co-processing unit. All of the above units are connected through physical lines.

[0058] Furthermore, the application and data processing unit receives the encrypted artificial intelligence calculation code and user data sent by the user computer to the service computer through the host communication interface unit, and stores the artificial intelligence calculation code and user data in the non-volatile storage unit after decryption and verification through the cryptographic processing unit, and can encrypt and sign the calculation result after the artificial intelligence calculation by the calculation unit through the host communication interface unit and send it to the service computer host, and then the service computer will return the result to the user computer. In an embodiment of the present invention, the application and data processing unit can be a SOC chip or an FPGA chip. In a specific embodiment of the present invention, the application and data processing unit is an FPGA chip.

[0059] The non-volatile storage unit is used to store the artificial intelligence calculation code and user data processed by the application and data processing unit, as well as the calculation results after the artificial intelligence calculation is performed by the calculation unit.

[0060] The volatile storage unit is used to load the artificial intelligence computing code and user data stored in the non-volatile storage unit according to the requirements of the computing unit.

[0061] The computing unit is used to load the artificial intelligence computing code and user data stored in the volatile storage unit and perform calculations, and then store the calculation results in the non-volatile storage unit through the volatile storage unit.

[0062] In this embodiment, the computing unit can be implemented as a CPU chip, the volatile storage unit is a memory, and the non-volatile storage unit is a flash memory. In a specific embodiment of the present invention, the computing unit is an ARM Cortex-A75, the volatile storage unit is a DDR SDRAM chip, and the non-volatile storage unit is a flash memory.

[0063] The cryptographic processing unit is used to collaborate with the user cryptographic processing unit to perform key management, decrypt and digitally verify the artificial intelligence code and user data in the application and data processing unit, and encrypt and digitally sign the calculation results in the application and data processing unit.

[0064] In this embodiment, the cryptographic processing unit is composed of three modules, including: a first key management and distribution module, a first encryption and decryption module, and a first digital signature and verification module, and the three modules are interconnected through physical lines. The first key management and distribution module is used to complete the generation, storage, management and distribution of encryption keys and signature keys; the first encryption and decryption module is used to execute a preset encryption and decryption algorithm to decrypt the artificial intelligence code and user data in the application and data processing unit, and to encrypt the calculation results in the application and data processing unit; the first digital signature and verification module is used to perform digital signature verification on the artificial intelligence code and user data in the application and data processing unit, and to digitally sign the calculation results in the application and data processing unit. In this embodiment, the cryptographic processing unit can be implemented as an encryption and decryption chip. In a specific embodiment of the present invention, the cryptographic processing unit is an encryption chip ATSHA204A-SSHDA-TMICROCHIP (American Microchip) plus an FPGA chip.

[0065] The artificial intelligence co-processing unit can assist the computing unit in completing the computing processing required by the artificial intelligence application; when artificial intelligence applications require a large number of complex artificial intelligence computing operations, the computing unit can request the artificial intelligence co-processing unit to complete certain complex artificial intelligence computing operations (such as matrix calculations) to accelerate the data calculation process. In this embodiment, the artificial intelligence co-processing unit can be a GPU processor with different functions and types. In a specific embodiment of the present invention, the artificial intelligence co-processing unit is an ARM Mali-G72 GPU.

[0066] The host communication interface unit is used to communicate with the service computer host through a private dedicated channel. The host communication interface unit can communicate with the service computer host through a hardware interface such as PCI Express (PCIe) or a USB interface. In a specific embodiment of the present invention, the host communication interface unit communicates with the service computer host through a PCIe 3.0 interface.

[0067] Furthermore, the user password processing unit is also composed of three modules, including: a second key management and distribution module, a second encryption and decryption module, and a second digital signature and verification module, which are interconnected through physical lines. The second key management and distribution module cooperates with the first key management and distribution module to jointly complete the generation, storage, management and distribution of encryption keys and signature keys; the second encryption and decryption module is used to execute the encryption and decryption algorithm to encrypt the artificial intelligence code and user data in the user computer, and decrypt the calculation results from the service computer, wherein the encryption and decryption algorithm executed by the second encryption and decryption module is consistent with the encryption and decryption algorithm executed by the first encryption and decryption module; the second digital signature and verification module is used to digitally sign the artificial intelligence code and user data in the user computer, and perform digital signature verification on the calculation results from the service computer. In a specific embodiment of the present invention, the user password processing unit is an encryption chip T680 (Fang Cun Microelectronics) plus an FPGA chip; the encryption chip T680 completes the encryption and decryption module and the digital signature and verification module functions, and the FPGA chip completes the key management and distribution module. The user password processing unit and the password processing unit of the secret room computing security device on the service computer perform key generation and exchange based on online or offline. In a specific embodiment of the present invention, online key generation and exchange can be constructed based on the SecKMS key management system.

[0068] Furthermore, the embodiment of the present invention also proposes a calculation method based on the above system, and the overall process is as follows: Figure 3 As shown, the following steps are included:

[0069] Step 1) The user prepares user data and its corresponding computing code, i.e., artificial intelligence computing code, on the user computer; in a specific embodiment of the present invention, the user data is a data file D; and its corresponding computing code is a PyTorch program code file P.

[0070] Step 2) The user password processing unit of the user computer communicates with the password processing unit in the selected secret room computing security device on the service computer to complete password generation and exchange; the specific steps are as follows:

[0071] Step 2.1) The service computer host selects a closed-room computing safety device according to the current system operation status. In a specific embodiment of the present invention, the closed-room computing safety device 1 is selected according to the principle of minimum load priority.

[0072] Step 2.2) The user password processing unit of the user computer generates an encryption key through the second key management and distribution module: the first key, generates a pair of signature key pairs for signing: the user public key and the user private key, and communicates with the first key management and distribution module in the password processing unit in the selected secret room computing security device on the service computer to complete the key distribution.

[0073] In a specific embodiment of the present invention, the first key is represented as ksu, the user public key is PUK, and the user private key is Puk; Puk is secretly stored by the second key management and distribution module in the password processing unit of the user computer, and ksu and PUK are distributed to the first key management and distribution module in the password processing unit of the selected secret room computing security device on the service computer;

[0074] Step 2.3) The cryptographic processing unit of the selected secret room computing security device on the service computer generates an encryption key through the first key management and distribution module: the second key, generates a pair of signature key pairs for signing: the service public key and the service private key, and communicates with the second key management and distribution module in the user cryptographic processing unit of the user computer to complete the key distribution.

[0075] In a specific embodiment of the present invention, the second key is represented as kss, the service public key is PSK, and the service private key is Psk; Psk is secretly stored by the first key management and distribution module in the cryptographic processing unit of the secret room computing security device on the service computer, and kss and PSK are distributed to the second key management and distribution module in the cryptographic processing unit on the user computer;

[0076] Step 3) The user computer signs and encrypts the artificial intelligence calculation code and user data to obtain the encrypted calculation code and the corresponding encrypted signature, as well as the encrypted user data and the corresponding encrypted signature; the specific steps are as follows:

[0077] Step 3.1) The user computer uses the user private key obtained in step 2.1) and the pre-selected digital signature algorithm in the second digital signature and verification module in the user password processing unit to sign the artificial intelligence calculation code to obtain the calculation code signature; and signs the user data to obtain the user data signature. In a specific embodiment of the present invention, the calculation code signature is Sign (P) obtained by using the user private key Pku and the pre-selected digital signature algorithm, such as RSA or ECC; the user data signature is Sign (D).

[0078] Step 3.2) The user computer uses the first key and the pre-selected symmetric encryption algorithm in the second encryption and decryption module of the user password processing unit to encrypt the combination of the calculation code, the calculation code signature, the user data, and the user data signature to obtain the encrypted calculation code and the corresponding encrypted signature as well as the encrypted user data and the corresponding encrypted signature.

[0079] In a specific embodiment of the present invention, the computing code, computing code signature, user data, and user data signature are combined into a file using the first key ksu and a preselected symmetric encryption algorithm, such as AES, and encrypted to obtain ES{ksu,P,Sign(P),D,Sign(D)}.

[0080] Step 4) The user computer host sends the encrypted calculation code and the corresponding encrypted signature as well as the encrypted user data and the corresponding encrypted signature to the service computer; the specific steps are as follows:

[0081] Step 4.1) The user computer host sends the encrypted calculation code and the corresponding encrypted signature as well as the encrypted user data and the corresponding encrypted signature to the service computer host via the Internet. In a specific embodiment of the present invention, ES{ksu,P,Sign(P),D,Sign(D)} is sent to the service computer host.

[0082] Step 4.2) The service computer host sends the encrypted computing code and the corresponding encrypted signature as well as the encrypted user data and the corresponding encrypted signature to the secret room computing security device selected in step 2) through a private dedicated channel. In a specific embodiment of the present invention, ES{ksu,P,Sign(P),D,Sign(D)} is sent to the secret room computing security device 1.

[0083] Step 5) The secret room computing security device decrypts the received encrypted computing code and the corresponding encrypted signature as well as the encrypted user data and the corresponding encrypted signature; the specific steps are as follows:

[0084] Step 5.1) The application and data processing unit of the secret room computing security device receives the encrypted computing code and the corresponding encrypted signature and the encrypted user data and the corresponding encrypted signature sent by the service computer host through the host communication interface unit and the private dedicated channel, and stores them in the non-volatile storage unit. In a specific embodiment of the present invention, the encrypted computing code and user data ES{ksu,P,Sign(P),D,Sign(D)} are stored in the non-volatile storage unit.

[0085] Step 5.2) The application and data processing unit uses the first encryption and decryption module in the cryptographic processing unit to use the first key and a pre-selected symmetric encryption algorithm to decrypt the encrypted computing code and the encrypted user data, and decrypt the computing code signature and the encrypted user data signature to obtain the decrypted computing code, the decrypted user data, the decrypted computing code signature and the decrypted user data signature, and store them in a non-volatile storage unit.

[0086] In a specific embodiment of the present invention, the encrypted computing code and user data ES{ksu,P,Sign(P),D,Sign(D)} are decrypted using the first key ksu and a preselected symmetric encryption algorithm, such as AES, to obtain the decrypted computing code P*, the decrypted computing code signature Sign(P)*, the decrypted user data D*, and the decrypted user data signature Sign(D)*.

[0087] Step 5.3) The cryptographic processing unit uses the digital signature and verification module, utilizes the user's public key and the pre-selected digital signature algorithm, to verify the decryption calculation code signature and the decrypted user data signature: if both are verified, execute step 6); otherwise, execute step 5.4).

[0088] In a specific embodiment of the present invention, the user public key PUK and a preselected digital signature algorithm, such as RSA or ECC, are used to verify whether the decrypted calculation code signature Sign(P)* and the decrypted user data signature Sign(D)* are the digital signatures of the decrypted calculation code P* and the decrypted user data D*, respectively.

[0089] Step 5.4) outputs "Verification Failed" as the calculation result, and then goes to step 7).

[0090] Step 6) The secret room computing security device processes the decrypted computing code and the decrypted user data to obtain the final computing result; the specific steps are as follows:

[0091] Step 6.1) The application and data processing unit of the chamber computing security device uses the computing unit to load the running environment code of the computing code stored in the non-volatile storage unit into the volatile storage unit for execution according to the computing requirements of the computing code. In a specific embodiment of the present invention, the PyTorch execution environment is loaded.

[0092] Step 6.2) The application and data processing unit uses the computing unit, the volatile storage unit, and the artificial intelligence co-processing unit to run the computing code stored in the volatile storage unit, processes the user data stored in the non-volatile storage unit, obtains the computing result, and stores it in the non-volatile storage unit. In a specific embodiment of the present invention, the PyTorch program code P is run to process the data file D to obtain the computing result file F.

[0093] Step 7) The secret room computing security device signs and encrypts the computing result to obtain the encrypted computing result and the signature of the encrypted computing result; the specific steps are as follows:

[0094] Step 7.1) The cryptographic processing unit of the secret room computing security device uses the service private key obtained in step 2.2) and the digital signature algorithm pre-selected by the first digital signature and verification module in the user cryptographic processing unit to sign the calculation result and obtain the calculation result signature.

[0095] In a specific embodiment of the present invention, the calculation result F is signed using the service private key Psk and a preselected digital signature algorithm, such as RSA or ECC, and the calculation result signature is obtained as: Sign(F).

[0096] Step 7.2) The cryptographic processing unit uses the second key and the preselected symmetric cryptographic algorithm in the first encryption and decryption module of the user cryptographic processing unit to encrypt the calculation result and the calculation result signature stored in the non-volatile storage unit to obtain the encrypted calculation result and the encrypted calculation result signature.

[0097] In a specific embodiment of the present invention, the calculation result and the calculation result signature are combined into a file using the second key kss and a preselected symmetric encryption algorithm, such as AES, and the file is encrypted to obtain ES{kss,F,Sign(F)}.

[0098] It should be noted that if the calculation result is "verification failed" obtained in step 5.4), the "verification failed" message as the calculation result should also be signed and encrypted to form the encrypted calculation result and the encrypted calculation result, and then transmitted.

[0099] Step 8) The service computer host sends the encrypted calculation result and the encrypted calculation result signature to the user computer; the specific steps are as follows:

[0100] Step 8.1) The application and data processing unit of the secret room computing security device transmits the encrypted calculation result and the encrypted calculation result signature to the service computer host through the host communication interface unit and the private dedicated channel. In a specific embodiment of the present invention, the encrypted calculation result and the signature are ES{kss,F,Sign(F)}.

[0101] Step 8.2) The service computer host sends the encrypted calculation result and the encrypted calculation result signature to the user computer host via the Internet.

[0102] Step 9) The user computer receives and displays the calculation results; the specific steps are as follows:

[0103] Step 9.1) The user computer host receives the encrypted calculation result and the encrypted calculation result signature via the Internet. In a specific embodiment of the present invention, the user computer host receives the encrypted calculation result and the encrypted calculation result signature ES{kss,F,Sign(F)}.

[0104] Step 9.2) The second encryption and decryption module of the user password processing unit on the user computer uses the second key obtained in step 2.2) and the pre-selected symmetric encryption algorithm to decrypt the encrypted calculation result and the encrypted calculation result signature to obtain the decrypted calculation result and the decrypted calculation result signature.

[0105] In a specific embodiment of the present invention, the encryption calculation result and signature ES{kss,F,Sign(F)} are decrypted using the second key kss and a preselected symmetric encryption algorithm, such as AES, to obtain the decrypted calculation result F* and the decrypted calculation result signature Sign(F)*.

[0106] Step 9.3) The user password processing unit uses the second digital signature and verification module, the service public key and the pre-selected digital signature algorithm to verify the signature of the decryption calculation result: if the verification passes, execute step 9.4); otherwise, execute step 9.5).

[0107] In a specific embodiment of the present invention, PSK and a preselected digital signature algorithm, such as RSA or ECC, are used to verify whether the decryption calculation result signature Sign(F)* is the digital signature of the decryption calculation result F*.

[0108] Step 9.4) The user computer presents the decryption calculation result to the user. In a specific embodiment of the present invention, the decryption calculation result F* is presented to the user.

[0109] Step 9.5) The user computer reports the calculation result transmission error to the user.

Claims

1. A computing system for improving the security of artificial intelligence code and data, characterized in that: It includes a user computer and a service computer connected via the Internet; one or more secret room computing security devices are arranged on the host of the service computer; the user computer is used to initiate artificial intelligence computing, and provides the service computer with encrypted artificial intelligence computing code and corresponding digital signature and encrypted user data required for computing and corresponding digital signature via the Internet; the service computer is used to receive the encrypted artificial intelligence computing code and corresponding digital signature and the encrypted user data and corresponding digital signature, and completes the corresponding computing after decrypting the artificial intelligence computing code and the user data and verifying the digital signature using the secret room computing security device, and then returns the computing result to the user computer via the Internet after digitally signing and encrypting it.

2. The system according to claim 1, characterized in that: The service computer dispatches each of the secret room computing security devices in turn.

3. The system according to claim 1, characterized in that: The user computer is provided with a user password processing unit for managing keys, encrypting and digitally signing the artificial intelligence computing code and user data of the user computer, and decrypting and digitally signing the calculation results returned from the service computer.

4. The system according to claim 3, characterized in that: The chamber computing security device comprises: a computing unit, a volatile storage unit, a non-volatile storage unit, an application and data processing unit, an artificial intelligence co-processing unit, a cryptographic processing unit and a host communication interface unit; wherein the application and data processing unit are respectively connected to the computing unit, the non-volatile storage unit, the cryptographic processing unit and the host communication interface unit through physical lines, the volatile storage unit is respectively connected to the computing unit and the non-volatile storage unit through physical lines, and the computing unit is also connected to the artificial intelligence co-processing unit through physical lines; The application and data processing unit receives the encrypted artificial intelligence calculation code and the user data sent by the user computer to the service computer through the host communication interface unit, stores the artificial intelligence calculation code and the user data in the non-volatile storage unit after decryption and verification through the cryptographic processing unit, and encrypts and signs the calculation result after the calculation unit performs artificial intelligence calculation through the cryptographic processing unit and sends it to the service computer host through the host communication interface unit; The non-volatile storage unit is used to store the artificial intelligence calculation code and the user data processed by the application and data processing unit, and store the calculation result after the artificial intelligence calculation performed by the calculation unit; The volatile storage unit is used to load the artificial intelligence computing code and the user data stored in the non-volatile storage unit according to the requirements of the computing unit; The computing unit is used to load the artificial intelligence computing code and the user data stored in the volatile storage unit and perform computing, and then store the computing result in the non-volatile storage unit through the volatile storage unit; The password processing unit is used to cooperate with the user password processing unit to perform key management, decrypt and digitally verify the artificial intelligence code and user data in the application and data processing unit, and encrypt and digitally sign the calculation results in the application and data processing unit; The artificial intelligence co-processing unit is used to assist the computing unit in completing artificial intelligence computing to accelerate the data computing process; The host communication interface unit is used to communicate with the service computer host through a private dedicated channel.

5. The system according to claim 4, characterized in that: The cryptographic processing unit includes a first key management and distribution module, a first encryption and decryption module, and a first digital signature and verification module interconnected by physical lines; The first key management and distribution module is used to complete the generation, storage, management and distribution of encryption keys and signature keys; the first encryption and decryption module is used to execute encryption and decryption algorithms to decrypt the artificial intelligence code and the user data in the application and data processing unit, and to encrypt the calculation results in the application and data processing unit; the first digital signature and verification module is used to perform digital signature verification on the artificial intelligence code and the user data in the application and data processing unit, and to digitally sign the calculation results in the application and data processing unit.

6. The system according to claim 5, characterized in that: The user password processing unit includes a second key management and distribution module, a second encryption and decryption module, and a second digital signature and verification module interconnected by physical lines; The second key management and distribution module cooperates with the first key management and distribution module to jointly complete the generation, storage, management and distribution of encryption keys and signature keys; the second encryption and decryption module is used to execute the encryption and decryption algorithm to encrypt the artificial intelligence code and the user data in the user computer, and decrypt the calculation results from the service computer; The second digital signature and verification module is used to digitally sign the artificial intelligence code and the user data in the user computer, and to perform digital signature verification on the calculation results from the service computer.

7. The system according to claim 6, characterized in that: The user password processing unit and the password processing unit construct online key generation and exchange based on the SecKMS key management system.

8. A calculation method based on the system as claimed in claim 6, characterized in that: The following steps are involved: 1) The user prepares user data and corresponding artificial intelligence computing code on the user's computer; 2) The user password processing unit of the user computer communicates with the password processing unit in the selected secret room computing security device on the service computer to complete password generation and exchange; include: The service computer host selects the secret room computing security device; The user password processing unit of the user computer generates an encryption key: the first key through the second key management and distribution module, generates a pair of signature key pairs for signing: the user public key and the user private key, and communicates with the first key management and distribution module in the password processing unit in the selected secret room computing security device on the service computer to complete key distribution; The password processing unit in the selected secret room computing security device on the service computer generates an encryption key: a second key through the first key management and distribution module, generates a pair of signature key pairs for signing: a service public key and a service private key, and communicates with the second key management and distribution module in the user password processing unit of the user computer to complete key distribution; 3) The user computer signs and encrypts the artificial intelligence computing code and user data to obtain the encrypted computing code and the corresponding encrypted signature as well as the encrypted user data and the corresponding encrypted signature; including: The user computer uses the user's private key and the pre-selected digital signature algorithm in the second digital signature and verification module in the user password processing unit to sign the artificial intelligence calculation code to obtain the calculation code signature; and signs the user data to obtain the user data signature; The user computer uses the first key and the preselected symmetric encryption algorithm in the second encryption and decryption module of the user password processing unit to encrypt the combination of the calculation code, the calculation code signature, the user data, and the user data signature to obtain the encrypted calculation code and the corresponding encryption signature as well as the encrypted user data and the corresponding encryption signature; 4) The user computer host sends the encrypted computing code and the corresponding encrypted signature as well as the encrypted user data and the corresponding encrypted signature to the service computer; the service computer host sends the encrypted computing code and the corresponding encrypted signature as well as the encrypted user data and the corresponding encrypted signature to the secret room computing security device selected in step 2) through a private dedicated channel; 5) The secret room computing security device of the service computer decrypts the received encrypted computing code and the corresponding encrypted signature as well as the encrypted user data and the corresponding encrypted signature; including: The application and data processing unit of the secret room computing security device receives the encrypted computing code and the corresponding encrypted signature and the encrypted user data and the corresponding encrypted signature sent by the service computer host through the host communication interface unit and the private dedicated channel, and stores them in the non-volatile storage unit; The application and data processing unit uses the first encryption and decryption module in the cryptographic processing unit to use the first key and the pre-selected symmetric encryption algorithm to decrypt the encrypted computing code and the encrypted user data, and decrypt the computing code signature and the encrypted user data signature to obtain the decrypted computing code, the decrypted user data, the decrypted computing code signature and the decrypted user data signature, and store them in the non-volatile storage unit; The cryptographic processing unit uses the digital signature and verification module to verify the decryption calculation code signature and the decrypted user data signature using the user public key and the pre-selected digital signature algorithm: if both are verified, execute step 6); 6) The secret room computing security device processes the decrypted computing code and the decrypted user data to obtain the final computing result; including: The application and data processing unit of the chamber computing security device loads the running environment code of the computing code stored in the non-volatile storage unit into the volatile storage unit for running by using the computing unit according to the computing requirements of the computing code; The application and data processing unit uses the computing unit, the volatile storage unit, and the artificial intelligence co-processing unit to run the computing code stored in the volatile storage unit, processes the user data stored in the non-volatile storage unit, obtains the computing result, and stores it in the non-volatile storage unit; 7) The secret room computing security device signs and encrypts the computing result to obtain the encrypted computing result and the signature of the encrypted computing result; including: The cryptographic processing unit of the secret room computing security device uses the service private key and the first digital signature in the user cryptographic processing unit and the digital signature algorithm preselected by the verification module to sign the computing result and obtain the computing result signature; The cryptographic processing unit uses the second key and the symmetric cryptographic algorithm preselected in the first encryption and decryption module of the user cryptographic processing unit to encrypt the calculation result and the calculation result signature stored in the non-volatile storage unit to obtain the encrypted calculation result and the encrypted calculation result signature; 8) The service computer host sends the encrypted calculation result and the encrypted calculation result signature to the user computer; 9) The second encryption and decryption module of the user password processing unit on the user computer uses the second key and the pre-selected symmetric encryption algorithm to decrypt the encrypted calculation result and the encrypted calculation result signature to obtain the decrypted calculation result and the decrypted calculation result signature; The user password processing unit uses the second digital signature and verification module, utilizes the service public key and the pre-selected digital signature algorithm, to verify the signature of the decryption calculation result; if the verification is successful, the user computer presents the decryption calculation result to the user.

9. The calculation method according to claim 8, characterized in that: The verification of the decrypted calculation code signature and the decrypted user data signature also includes: If any verification fails, a verification failure message is output as the calculation result.

10. The calculation method according to claim 8, characterized in that: The verification of the decryption calculation result signature also includes: If the decryption calculation result signature verification fails, the user computer reports a calculation result transmission error to the user.

Images