Large model security enhancement method and system based on trusted computing

Abstract

The invention provides a large model security enhancement method and system based on trusted computing, and the method comprises the steps: controlling a module through a built-in trusted platform in a terminal device in a starting process of the terminal device; verifying the current software downloaded by the trusted platform control module, the input / output system, the boot loader, the operating system, the large model and the terminal equipment from the trusted management center based on the preset verification information, and determining whether the running state of the current software is abnormal or not based on the preset permission information in the running process of the terminal equipment; and performing a preset response operation when the running state of the current software is abnormal, and performing a data encryption and decryption operation and / or an identity authentication operation based on a true random number generated by the quantum random number generator and an encryption and decryption algorithm stored in the trusted cryptographic module, thereby running the large model in the trusted execution environment. By adopting the method, the security of deployment and operation of the large model can be improved, the security of encryption and decryption operation is enhanced, and the efficiency and fairness of an encryption and decryption algorithm are improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of artificial intelligence security technology, in particular to a large model security enhancement method and system based on trusted computing. BACKGROUND

[0002] With the rapid development of artificial intelligence technology, large models are increasingly widely used in various fields, bringing unprecedented convenience and efficiency improvement to various industries. However, large models face many security risks during deployment, such as data leakage, model tampering, malicious attacks, etc. These security risks not only may lead to the leakage of user data, but also may destroy the integrity and usability of the model, causing serious impact on the business secrets and operation of enterprises. Therefore, it is particularly important to ensure the security of large model deployment. SUMMARY

[0003] In view of the above, the purpose of the present application is to provide a large model security enhancement method and system based on trusted computing to alleviate the above problems in the related art.

[0004] In a first aspect, an embodiment of the present application provides a large model security enhancement method based on trusted computing, applied to a terminal device connected with a trusted management center, wherein the terminal device is internally provided with a quantum random number generator, a trusted cryptographic module, a trusted platform control module, an input / output system, a boot loader and an operating system, the trusted platform control module is running, and the trusted platform control module is used to monitor the state of a large model running in a trusted execution environment in real time; the large model security enhancement method based on trusted computing comprises the following steps: during the startup process of the terminal device, the trusted platform control module checks the trusted platform control module, the input / output system, the boot loader, the operating system and the large model, and current software downloaded from a software whitelist of the terminal device from the trusted management center based on preset check information; wherein the software whitelist comprises a plurality of software, the preset check information comprises trusted reference values respectively allocated by the trusted management center for the trusted platform control module, the input / output system, the boot loader, the operating system and the large model, and the trusted platform control module, the input / output system, the boot loader, the operating system and the large model, and the current software is software required for running the large model; during the running process of the terminal device, the trusted platform control module determines whether the running state of the current software is abnormal based on preset permission information, so that the trusted platform control module performs a preset response operation when the running state of the current software is abnormal; wherein the preset permission information comprises permissions respectively set by the trusted management center for each software in the software whitelist; the trusted platform control module performs data encryption and decryption and / or identity authentication based on a true random number generated by the quantum random number generator and an encryption and decryption algorithm stored by the trusted cryptographic module.

[0005] In a second aspect, the embodiments of the present application also provide a large model security enhancement system based on trusted computing, which comprises a trusted management center and a terminal device connected with the trusted management center, the terminal device is internally provided with a quantum random number generator, a trusted cryptographic module, a trusted platform control module, an input / output system, a boot loader and an operating system, the trusted platform control module runs in a trusted execution environment, and the trusted platform control module is used to monitor the state of a large model running in the trusted execution environment in real time; the trusted platform control module is used to, during the startup process of the terminal device, check the trusted platform control module, the input / output system, the boot loader, the operating system and the large model and current software downloaded from a software white list of the trusted management center based on preset check information; wherein the software white list comprises a plurality of software, the preset check information comprises a trusted reference value respectively allocated by the trusted management center for each software in the trusted platform control module, the input / output system, the boot loader, the operating system and the large model and the software white list, and the current software is software required for running the large model; the trusted platform control module is also used to, during the running process of the terminal device, determine whether the running state of the current software is abnormal based on preset permission information, so as to perform a preset response operation when the running state of the current software is abnormal; wherein the preset permission information comprises permissions respectively set by the trusted management center for each software in the software white list; and the trusted platform control module is also used to perform data encryption and decryption and / or identity authentication based on a true random number generated by the quantum random number generator and an encryption and decryption algorithm stored by the trusted cryptographic module.

[0006] The embodiment of the application provides a large model security enhancement method and system based on trusted computing, which verifies the trusted platform control module, an input / output system, a boot loader, an operating system and a large model and current software downloaded from a software white list of a trusted management center by a terminal device based on preset verification information in a terminal device startup process, determines whether the running state of the current software is abnormal based on preset permission information in a terminal device running process, performs a preset response operation when the running state of the current software is abnormal, and performs data encryption and decryption and / or identity authentication based on a true random number generated by a quantum random number generator and an encryption and decryption algorithm stored by a trusted password module, so that the operating system is run in a trusted execution environment to run the large model in the trusted execution environment through the operating system, the security of the large model deployment can be improved by introducing trusted computing into a hardware device used for running the large model, the dynamic abnormal detection and response mechanism of the software running state is introduced to ensure the safe running of the large model, and the quantum random number generator is used to provide a large-flow true random number to ensure the security of the encryption and decryption operation and improve the efficiency and fairness of the encryption and decryption algorithm.

[0007] Other features and advantages of the present application will be set forth in the following description, and in part will become apparent to those skilled in the art from the description, or can be learned by practice of the present application. The objects and other advantages of the present application will be realized and achieved by the structure particularly pointed out in the description, claims and drawings.

[0008] In order to make the above-mentioned purpose, characteristics and advantages of the present application more obvious and easy to understand, the following preferred embodiments are specifically described below, and the accompanying drawings are described in detail as follows. BRIEF DESCRIPTION OF DRAWINGS

[0009] In order to more clearly illustrate the specific embodiments of the present application or the technical solutions in the prior art, the following will briefly introduce the drawings needed to be used in the specific embodiments or the prior art description. Obviously, the drawings in the following description are some embodiments of the present application, and those skilled in the art can also obtain other drawings according to these drawings without creative labor.

[0010] Figure 1 The structure diagram of the large model security enhancement system based on trusted computing in the embodiment of the present application; Figure 2 The flowchart of the large model security enhancement method based on trusted computing in the embodiment of the present application; Figure 3 The example diagram of the large model security enhancement method based on trusted computing in the embodiment of the present application; Figure 4 The example diagram of the trust chain transmission in the embodiment of the present application. DETAILED DESCRIPTION

[0011] In order to make the objects, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions of the present application will be described clearly and completely below with embodiments. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0012] At present, many security risks (such as data leakage, model tampering, malicious attacks, etc.) faced by large models in the deployment process not only may lead to leakage of user data, but also may destroy the integrity and usability of the model, and cause serious impact on the business secrets and operation of enterprises.

[0013] Based on this, the large model security enhancement method and system based on trusted computing provided by the embodiments of the present application can ensure the security of large model deployment, thereby alleviating the above problems existing in the related art.

[0014] Referring to Figure 1 As shown in the figure, the embodiments of the present application provide a large model security enhancement system based on trusted computing, which can include a trusted management center 101 and a terminal device 102 connected with the trusted management center 101. The terminal device 102 performs software distribution and centralized management and control through the trusted management center 101. The terminal device 102 is built-in with a quantum random number generator (QRNG), a trusted cryptography module (TCM), a trusted platform control module (TPCM), an input-output system, a boot loader and an operating system. The TPCM can run in a trusted execution environment (TEE). The TPCM can be used to monitor the state of the large model running in the TEE in real time. The TEE can guarantee the security of data in the process of large model training and inference and ensure the security of user input data and large model output results. At the same time, the hardware isolation and security verification mechanism of the TEE can more effectively prevent unauthorized access and attacks, and enhance the security of the large model runtime.

[0015] Referring to Figure 1 and Figure 2 As shown in the figure, the embodiments of the present application further provide a large model security enhancement method based on trusted computing, which can be applied to the terminal device 102. The method can include the following steps: In step S202, during the startup of the terminal device 102, the TPCM checks the TPCM, the input / output system, the bootloader, the operating system and the large model and the current software downloaded by the terminal device 102 from the software whitelist of the trusted management center 101 based on preset check information.

[0016] The software whitelist can include a plurality of software, the preset check information can include a trusted benchmark value assigned by the trusted management center 101 to each of the TPCM, the input / output system, the bootloader, the operating system and the large model and each software in the software whitelist, and the current software can be software required to run the large model.

[0017] For example, referring to Figure 1 As shown, the terminal device 102 is connected to the trusted management center 101, and the software on the terminal device 102 is downloaded from the software whitelist of the trusted management center 101. Relevant personnel can pre-add some software to the whitelist of the trusted management center 101, and assign corresponding trusted benchmark values to each of the TPCM, the input / output system, the bootloader, the operating system and the large model and each software in the whitelist through the trusted management center 101. During the startup of the terminal device 102, the terminal device 102 will download the required corresponding software from the whitelist of the trusted management center 101, and the TPCM can check the core code of the TPCM, the input / output system, the bootloader, the operating system and the large model and the current software downloaded by the terminal device 102 using the trusted benchmark values pre-assigned to each of the TPCM, the input / output system, the bootloader, the operating system and the large model and each software in the whitelist.

[0018] In step S204, during the running of the terminal device 102, the TPCM determines whether the running state of the current software is abnormal based on preset permission information, so that the TPCM performs a preset response operation when the running state of the current software is abnormal.

[0019] The preset permission information can include permission information and the like set by the trusted management center 101 for each software in the software whitelist.

[0020] In the foregoing example, the relevant personnel can set the respective application permissions for each software that has been added to the whitelist in advance through the trusted management center 101; in the running process of the terminal device 102, the running state of the software currently downloaded by the terminal device 102 can be supervised through the TPCM, so as to determine whether each software currently downloaded by the terminal device 102 has an abnormal behavior exceeding the application permission of the software according to the application permission set for each software in the whitelist in advance through the TPCM, and then the software having the abnormal behavior is processed (such as stopping running the software, deleting the software, etc.) through the TPCM, and the abnormal information is fed back to the trusted management center 101.

[0021] In step S206, the TPCM performs data encryption and decryption and / or identity authentication based on the true random number generated by the QRNG and the encryption and decryption algorithm stored by the TCM.

[0022] Exemplarily, the QRNG can be a quantum true random number generator based on quantum tunneling effect to generate a true random number. The quantum true random number generator can have multiple forms such as PCIe, USB, surface mount, etc. The quantum true random number generator can constantly output a large flow of true random numbers to the terminal device 102, and the true random number generated by the quantum true random number generator can be directly used to generate a key of an encryption and decryption algorithm, create an SSL / TLS session key and a token generator, generate a one-time password (OTP) in multi-factor authentication (MFA), and other scenarios requiring the use of random numbers. For example, the true random number generated by the QRNG can be used to calculate a digest value for authentication, static measurement, dynamic measurement, etc. through a cryptographic hash algorithm (such as SM3, MD5, SHA-1, SHA-256, etc.), a symmetric encryption and decryption algorithm (such as SM4, etc.), an asymmetric encryption and decryption algorithm (such as SM2, etc.), etc.

[0023] The method for enhancing security of a large model based on trusted computing provided by the embodiment of the application can run an operating system in a TEE to run a large model in the TEE through the operating system, can improve the security of deployment of the large model by introducing trusted computing into a hardware device for running the large model, and can ensure safe running of the large model by introducing a dynamic abnormality detection and response mechanism for a software running state, and can guarantee the security of encryption and decryption operations and improve the efficiency and fairness of the encryption and decryption algorithm by using a quantum random number generator to provide a large flow of true random numbers.

[0024] As a possible implementation, refer to Figure 1 and Figure 2As shown in the above step S206 (i.e., the TPCM performs data encryption and decryption and / or identity authentication based on the true random number generated by the QRNG and the encryption and decryption algorithm stored by the TPCM), the TPCM can obtain a target encryption and decryption algorithm for performing data encryption and decryption and / or identity authentication from the encryption and decryption algorithm, and generate target data of the target encryption and decryption algorithm based on the true random number, and then perform data encryption and decryption and / or identity authentication according to the target encryption and decryption algorithm using the target data; wherein the target data can include a key for performing data encryption and decryption according to a corresponding first target encryption and decryption algorithm, and / or a password for performing identity authentication according to a corresponding second target encryption and decryption algorithm.

[0025] As a possible implementation, refer to Figure 1 and Figure 2 As shown in the above step S202 (i.e., in the process of starting the terminal device 102, the TPCM performs verification on the TPCM, the input / output system, the bootloader, the operating system and the large model, and the current software downloaded from the software whitelist of the trusted management center 101 based on the preset verification information), the step S202 can include: Step A1, when the terminal device is started, the TPCM calculates a current digest value of the current software, and judges whether the current digest value is consistent with a current trusted reference value assigned to the current software by the trusted management center 101.

[0026] Step A2, if the current digest value is consistent with the current trusted reference value, the TPCM performs verification on the TPCM based on the preset verification information.

[0027] The operation mode of the above TPCM performing verification on the TPCM based on the preset verification information can include: the TPCM calculates a first digest value of itself, and judges whether the first digest value is consistent with a first trusted reference value assigned to the TPCM by the trusted management center 101, and if the first digest value is consistent with the first trusted reference value, the TPCM passes the verification.

[0028] Step A3, if the TPCM passes the verification, the TPCM performs verification on the input / output system, the bootloader and the operating system based on the preset verification information; The operation mode of the TPCM for verifying the input / output system, the boot loader and the operating system based on the preset verification information can include: the TPCM calculates a second digest value of the input / output system, and determines whether the second digest value is consistent with a second trusted reference value allocated to the input / output system by the trusted management center. If the second digest value is consistent with the second trusted reference value, the input / output system passes the verification. If the input / output system passes the verification, the TPCM calculates a third digest value of the boot loader, and determines whether the third digest value is consistent with a third trusted reference value allocated to the boot loader by the trusted management center. If the third digest value is consistent with the third trusted reference value, the boot loader passes the verification. If the boot loader passes the verification, the TPCM calculates a fourth digest value of the operating system, and determines whether the fourth digest value is consistent with a fourth trusted reference value allocated to the operating system by the trusted management center 101. If the fourth digest value is consistent with the fourth trusted reference value, the operating system passes the verification.

[0029] Exemplarily, the fourth digest value can include a sixth digest value of a kernel of the operating system, and the fourth trusted reference value can include a sixth trusted reference value corresponding to the kernel. The input / output system can be a Basic Input Output System (BIOS), a Unified Extensible Firmware Interface (UEFI) or the like. Based on this, in the case where the TPCM calculates the fourth digest value of the operating system, the following operations can be performed after the central processing unit corresponding to the operating system is started: Step A31, the TPCM determines whether the second digest value is consistent with the second trusted reference value.

[0030] Step A32, if the second digest value is consistent with the second trusted reference value, the input / output system is run, and the TPCM determines whether the third digest value is consistent with the third trusted reference value.

[0031] Step A33, if the third digest value is consistent with the third trusted reference value, the boot loader is run, and the TPCM determines whether the sixth digest value is consistent with the sixth trusted reference value.

[0032] Step A34, if the sixth digest value is consistent with the sixth trusted reference value, the kernel is loaded and run to start the operating system.

[0033] In actual application, refer to Figure 1 and Figure 2As shown in FIG. 1, the terminal device 102 can also be built-in with an AI processor corresponding to the operating system, which can adopt different architectures such as General-Purpose computing on Graphics Processing Units (GPGPU), Tensor Processing Unit (TPU), Field-Programmable Gate Array (FPGA), Application-Specific Integrated Circuit (ASIC), Domain-Specific Architecture (DSA), etc. Based on this, the following operations can be performed during the runtime of the AI processor: the TPCM obtains the current information of the AI processor, and determines whether the current information is consistent with the AI processor information previously set for the AI processor by the trusted management center 101, and if the current information is inconsistent with the AI processor information, the running of the AI processor is stopped.

[0034] In actual application process, referring to Figure 1 and Figure 2 As shown in FIG. 1, the terminal device 102 can also be built-in with an AI processor corresponding to the operating system, which can adopt different architectures such as General-Purpose computing on Graphics Processing Units (GPGPU), Tensor Processing Unit (TPU), Field-Programmable Gate Array (FPGA), Application-Specific Integrated Circuit (ASIC), Domain-Specific Architecture (DSA), etc. Based on this, the following operations can be performed during the runtime of the AI processor: the TPCM obtains the current information of the AI processor, and determines whether the current information is consistent with the AI processor information previously set for the AI processor by the trusted management center 101, and if the current information is inconsistent with the AI processor information, the running of the AI processor is stopped.

[0035] Step A4, if the input / output system, the bootloader and the operating system are all verified, the TPCM verifies the large model based on the preset verification information.

[0036] The operation mode of the above-mentioned TPCM verifying the large model based on the preset verification information can include: the TPCM calculates a fifth digest value of the large model, and determines whether the fifth digest value is consistent with a fifth trusted reference value allocated for the large model by the trusted management center 101, and if the fifth digest value is consistent with the fifth trusted reference value, the large model verification is passed.

[0037] Exemplarily, in the case where the TPCM calculates the fifth digest value of the large model, the following operations can be performed during the runtime of the operating system: the TPCM determines whether the fifth digest value is consistent with the fifth trusted reference value, and if the fifth digest value is consistent with the fifth trusted reference value, the large model is loaded and started.

[0038] In actual application, before the TPCM checks the large model based on the preset check information in the above step A4, the following operation can also be performed: the TPCM obtains authentication information for multi-factor authentication, and generates a one-time password for multi-factor authentication based on a true random number, and then performs multi-factor authentication using the authentication information, the one-time password, and preset multi-factor authentication information, so that the TPCM checks the large model based on the preset check information when the multi-factor authentication is passed.

[0039] In actual application, referring to Figure 1 and Figure 2 , the terminal device 102 connected to the trusted management center 101 can also be built-in with a large model operation platform, so as to load and run the large model through the large model operation platform; based on this, after the multi-factor authentication is performed, the following operation can be performed: the TPCM calculates an eighth digest value of the large model operation platform, and judges whether the eighth digest value is consistent with an eighth trusted reference value pre-allocated by the trusted management center 101 for the large model operation platform, if the eighth digest value is consistent with the eighth trusted reference value, the large model operation platform is started to load the large model, so that after the large model operation platform loads the large model, the TPCM judges whether the fifth digest value is consistent with the fifth trusted reference value, and in the case that the fifth digest value is consistent with the fifth trusted reference value, the large model loaded by the large model operation platform is started and run through the large model operation platform.

[0040] In actual application, referring to Figure 1 and Figure 2 , the terminal device 102 can also be built-in with a second dynamic link library corresponding to the large model; based on this, the following operation can also be performed when the second dynamic link library is running: the TPCM calculates a ninth digest value of the second dynamic link library, and judges whether the ninth digest value is consistent with a ninth trusted reference value pre-allocated by the trusted management center 101 for the second dynamic link library, if the ninth digest value is not consistent with the ninth trusted reference value, the second dynamic link library is stopped running.

[0041] As a possible implementation, referring to Figure 1 and Figure 2 , in the above step S204, during the running of the terminal device 102, the TPCM determines whether the running state of the current software is abnormal based on the preset permission information can include: the TPCM monitors the running behavior of the current software in real time, and judges whether the running behavior of the current software exceeds the permission set by the trusted management center 101 for the current software, if the running behavior of the current software exceeds the permission set by the trusted management center 101 for the current software, the TPCM determines that the running state of the current software is abnormal.

[0042] Continuing the previous example, referring to Figure 1As shown, the relevant personnel can pre-add the large model software to the white list of the trusted management center 101, and set the application permission of the large model software in the white list through the trusted management center 101; in the process of running the current large model software downloaded from the trusted management center 101 by the terminal device 102, the running state of the current large model software running by the terminal device 102 can be monitored in real time through the TPCM, so as to alarm (such as triggering voice alarm, sound and light alarm, etc.) through the TPCM, stop running the current large model software and other operations when the TPCM discovers that the current large model software has abnormal behavior exceeding the application permission, and feedback the abnormal information to the trusted management center 101.

[0043] For the sake of understanding, the embodiments of the above-mentioned large model security enhancement method based on trusted computing are described exemplarily as follows by taking specific applications as examples.

[0044] The embodiments of the above-mentioned large model security enhancement method based on trusted computing mainly can include: trust chain construction based on trusted computing technology, multi-dimensional security protection mechanism implementation, dynamic security monitoring and response implementation.

[0045] (1) Trust chain construction based on trusted computing technology.

[0046] The trust chain construction process based on trusted computing technology mainly can include the following aspects: (1.1) Hardware layer trusted implementation.

[0047] QRNG (quantum true random number generator) based on quantum tunneling effect can be used to provide large flow true random numbers, improve the security of encryption and decryption operations in the system, and improve the efficiency and fairness of encryption and decryption algorithms. TCM chip can be selected as the physical trusted root (i.e. hardware trusted root) to support trusted boot based on hardware trusted root. Hardware devices supporting TPCM for trusted computing can be used, such as selecting a server with TPCM as a trusted server to ensure the security of the hardware layer and ensure that the large model runs in a secure environment. The TPCM can be configured and managed to ensure that the TPCM runs normally and functions as a trusted computing device.

[0048] Referring to Figure 1 and Figure 2As shown, the configuration and management of the TPCM may mainly include: connecting the terminal device 102 to the trusted management center 101; adding some software that the terminal device 102 needs to download to the whitelist of the trusted management center 101; setting the application permissions of each software in the whitelist through the trusted management center 101; during the startup of the terminal device 102, the TPCM verifies the core code and other preset codes of the software currently downloaded by the terminal device 102 from the whitelist of the trusted management center 101 (i.e., the current software) to determine whether the code of the current software is consistent with the code of the software in the whitelist, and then runs the current software on the terminal device 102 when the current software code is consistent with the software code in the whitelist (i.e., the current software code passes the code verification), thereby ensuring that the software running on the terminal device 102 is the software in the whitelist that has not been tampered with; during the operation of the terminal device 102, the TPCM monitors the running status of the current software and confirms whether the current software has abnormal behavior that exceeds its application permissions based on the application permissions of the current software set by the trusted management center 101.

[0049] (1.2) Trusted implementation at the operating system layer.

[0050] When the operating system starts, TPCM can be used to measure and verify the integrity of the operating system to ensure the credibility of the operating system. It can also regularly perform security updates and patch installations on the operating system to ensure the security of the operating system.

[0051] (1.3) Application layer trusted implementation.

[0052] During the large model deployment process, TPCM can be used to regularly measure and verify the integrity of the large model to ensure that the large model code has not been maliciously tampered with or injected with malicious code. For example, when installing a large model, TPCM can use a preset message digest algorithm (such as MD5, SHA, etc.) to calculate the digest value of the large model to be installed and compare it with the digest value provided by the trusted management center 101 when it was issued (i.e., the trusted baseline value) to determine whether the digest value calculated by TPCM is consistent with the digest value provided by the trusted management center 101 when it was issued. If the two digest values ​​are consistent, the large model to be installed can be determined to be complete. For another example, during the operation of the large model, TPCM can calculate the digest value of the large model core code and determine whether it is consistent with the digest value provided by the management center when it was issued (i.e., the trusted baseline value). If the two digest values ​​are consistent, the running large model can be determined to be complete.

[0053] Strict security policies (such as access control policies, data encryption and decryption policies, etc.) can also be formulated for large models and their related applications. For example, access permissions, access duration, and specific encryption and decryption algorithms for large models and related data (such as training data for large models in the training phase, input and output data for large models in the prediction phase, etc.) can be restricted.

[0054] (II) Multi-dimensional security protection mechanism implementation.

[0055] Multi-dimensional security protection mechanism implementation can mainly include the following aspects: (2.1) Identity authentication implementation.

[0056] When accessing large models and related data, multi-factor authentication (MFA) mechanisms can be used, such as combining passwords, tokens, biometric identification, and other authentication methods to ensure that only authorized users can access large models and related data.

[0057] (2.2) Data encryption and decryption implementation.

[0058] TPCM can use encryption and decryption algorithms provided by TCM (such as national encryption algorithms, AES algorithms, RSA algorithms, etc.) to encrypt and decrypt large model training data, large model parameters, and large model inference results and store the encrypted and decrypted data, ensuring the confidentiality and integrity of large model data.

[0059] (2.3) Access control implementation.

[0060] Strict access control policies can be implemented through TPCM to restrict access sources and prevent unauthorized access. For example, the trusted management center 101 can pre-allocate access levels and operation permissions for users who may access large models according to their roles and permissions, and write the IP of users who may access large models on the terminal device 102 into the IP whitelist, so that when a user wants to access the large model on the terminal device 102, the TPCM can determine whether the user's IP is in the IP whitelist, thereby implementing IP whitelist-based access control through TPCM. For another example, the trusted management center 101 can also pre-set API keys for APIs that implement user access to large models, so that when a user wants to access the large model on the terminal device 102, the TPCM can determine whether the user has the API key required to access the large model, thereby implementing API key-based access control through TPCM.

[0061] (III) Dynamic security monitoring and response implementation.

[0062] Dynamic security monitoring and response implementation can mainly include the following aspects: (3.1) Dynamic security monitoring.

[0063] The hardware state, operating system state, application state, etc. in the large model deployment process can be monitored in real time by the TPCM.

[0064] (3.2) Dynamic security response mechanism.

[0065] The TPCM can take response measures (such as isolating infected devices, blocking malicious attacks, etc.) immediately when a security threat is discovered, ensuring the safe operation of the large model.

[0066] Referring to Figures 1 to 3 The above-mentioned large model security enhancement method based on trusted computing can be mainly implemented by a terminal device 102 connected with a trusted management center 101, the terminal device 102 being internally provided with a QRNG (quantum true random number generator) based on quantum tunneling effect, a TCM chip, a TPCM, a BIOS (input / output system at this time), an OSLoader (boot loader at this time), an operating system, an AI processor (which can adopt GPGPU, TPU, FPGA, ASIC, DSA, etc. architecture), a dynamic link library, etc. The operating environment of the operating system can be divided into a rich execution environment (REE) and a trusted execution environment (TEE), the QRNG based on quantum tunneling effect provides a large flow of true random numbers to the system inside (including REE and TEE); the TCM chip, as a physical carrier of the trusted root, can provide encryption and decryption algorithms (such as SM1, SM2, SM3, SM4, SM7, etc. national encryption algorithm and AES, RSA, SHA, ECC, etc. algorithm) when cryptographic operations such as trusted verification are needed; the large model operation platform, the core program such as the large model, etc. run in the TEE to ensure data security; the TPCM runs in the TEE, the TPCM starts first when the terminal device 102 is powered on, and the TPCM performs trust chain transmission inside the terminal device 102.

[0067] Referring to Figure 4 The trust chain transmission process is as follows: Step S1, power on the device (such as the terminal device 102 shown in Figure 1 The TPCM starts first than the CPU, the TPCM runs in the TEE of the device, and the TPCM performs self-checking.

[0068] The process of self-checking of the TPCM can mainly be: the TPCM calculates the digest value of itself and compares the digest value with the trusted reference value pre-assigned to the TPCM by the trusted management center 101 to determine whether the calculated digest value is consistent with the pre-assigned trusted reference value. If the two values are consistent, the self-checking of the TPCM is passed. If the two values are inconsistent, the self-checking of the TPCM is not passed. If the self-checking of the TPCM is not passed, an alarm is given and the TPCM is stopped.

[0069] In step S2, the TPCM checks the integrity of the BIOS. After the integrity check of the BIOS is passed, the BIOS can be run.

[0070] The process of checking the integrity of the BIOS by the TPCM can mainly be: the TPCM calculates the digest value of the BIOS and compares the digest value with the trusted reference value pre-assigned to the BIOS by the trusted management center 101 to determine whether the calculated digest value is consistent with the pre-assigned trusted reference value. If the two values are consistent, the integrity check of the BIOS is passed. If the two values are inconsistent, the integrity check of the BIOS is not passed. If the integrity check of the BIOS is not passed, an alarm is given and the BIOS is not started.

[0071] In step S3, the TPCM checks the OSLoader. After the check of the OSLoader is passed, the OSLoader can be run.

[0072] After the BIOS is run, the process of checking the OSLoader by the TPCM can mainly be: the TPCM calculates the digest value of the OSLoader and compares the digest value with the trusted reference value pre-assigned to the OSLoader by the trusted management center 101 to determine whether the calculated digest value is consistent with the pre-assigned trusted reference value. If the two values are consistent, the check of the OSLoader is passed. If the two values are inconsistent, the check of the OSLoader is not passed. If the check of the OSLoader is not passed, an alarm is given and the OSLoader is not started.

[0073] In step S4, before entering the operating system, two-factor authentication (2FA) is performed.

[0074] Two-factor authentication (2FA) is an identity authentication method that combines two different verification factors, usually including two types of verification factors from among user-known private information (such as passwords, personal identification numbers, etc.), user-owned physical information (such as software tokens of mobile phone SMS verification codes, hardware tokens of identity cards, etc.), biological characteristics (such as fingerprints, voice, facial features, etc.), location information (such as specific locations, specific devices, specific IP ranges), and time information (such as specific time periods), which can improve the security of operating system data access through double verification. Before entering the operating system, the TPCM can generate the data required for two-factor authentication (such as passwords, tokens, etc.) through the true random numbers provided by the QRNG and the encryption and decryption algorithms provided by the TCM chip to perform two-factor authentication.

[0075] Step S5, the TPCM verifies the OSkernel (i.e., the kernel of the operating system), and the OSkernel can only be loaded and run after the verification is passed. The operating system on the device is started.

[0076] After the OSLoader is loaded and run, the process of the TPCM verifying the OSkernel can mainly be: the TPCM calculates the digest value of the OSkernel and compares the digest value with the trusted reference value previously assigned to the OSkernel by the trusted management center 101 to determine whether the calculated digest value is consistent with the previously assigned trusted reference value. If the two values are consistent, the verification of the OSkernel is passed, and if the two values are not consistent, the verification of the OSkernel is not passed. If the verification of the OSkernel is not passed, an alarm is given and the OSkernel is not started.

[0077] Step S6, the AI processor is run, and the TPCM verifies the firmware code, serial number, batch number, kernel number, etc. of the running AI processor to determine whether the AI processor has been tampered with and whether the number of AI processors is abnormal.

[0078] After the AI processor is run, the process of the TPCM verifying the current information (i.e., the firmware code, serial number, batch number, kernel number, etc.) of the running AI processor can mainly be: the TPCM compares the current information of the running AI processor with the AI processor information previously set by the trusted management center 101 to determine whether the current information of the running AI processor is consistent with the previously set AI processor information. If the two parts of information are consistent, the verification of the current information of the running AI processor is passed, and if the two parts of information are not consistent, the verification of the current information of the running AI processor is not passed. If the verification of the current information of the running AI processor is not passed, an alarm is given and the running AI processor is stopped.

[0079] Step S7, the TPCM checks the measurable program and code corresponding to the operating system, which is set in advance by the trusted management center 101.

[0080] The process of the TPCM checking the measurable program and code corresponding to the operating system can mainly be: the TPCM calculates the digest value of the measurable program and code corresponding to the operating system and judges whether the digest value is consistent with the trusted reference value allocated in advance by the trusted management center 101, if the two values are consistent, the checking of the measurable program and code corresponding to the operating system is passed, if the two values are not consistent, the checking of the measurable program and code corresponding to the operating system is not passed. If the checking of the measurable program and code corresponding to the operating system is not passed, an alarm is given, and the measurable program and code corresponding to the operating system is not run or stopped.

[0081] Step S8, after entering the operating system, the TPCM measures and checks the executable program and code related to the large model operation platform, such as the large model operation platform code and dynamic link library set in advance by the trusted management center 101.

[0082] The process of the TPCM measuring and checking the measurable program and code related to the large model operation platform can mainly be: the TPCM calculates the digest value of the measurable program and code related to the large model operation platform and judges whether the digest value is consistent with the trusted reference value allocated in advance by the trusted management center 101, if the two values are consistent, the checking of the measurable program and code related to the large model operation platform is passed, if the two values are not consistent, the checking of the measurable program and code related to the large model operation platform is not passed. If the checking of the measurable program and code related to the large model operation platform is not passed, an alarm is given, and the measurable program and code related to the large model operation platform is not run or stopped.

[0083] Step S9, after the checking of the executable program and code related to the large model operation platform is passed, the executable program such as the large model operation platform is loaded.

[0084] Step S10, the TPCM checks the large model to be loaded by the large model operation platform, after the checking of the large model is passed, the large model operation platform loads the large model, and the large model starts and runs.

[0085] The process of the TPCM checking the large model can mainly be: the TPCM calculates the digest value of the core code of the large model and judges whether the digest value is consistent with the trusted reference value allocated in advance by the trusted management center 101 for the large model, if the two values are consistent, the checking of the large model is passed, if the two values are not consistent, the checking of the large model is not passed. If the checking of the large model is not passed, an alarm is given, and the large model operation platform does not load the large model.

[0086] In actual application process, the large model operation platform can not be used, and the large model program is directly installed, then after entering the operating system, the TPCM directly verifies the large model to be run, after the large model verification is passed, the large model is started and run, and the operation mode related to the large model operation platform in steps S8 to S10 is not needed.

[0087] In step S11, during the running of the large model, the TPCM monitors the running state of the large model in real time, if the TPCM finds that the large model has abnormal behavior beyond the set permission, the TPCM alarms and stops running the large model.

[0088] Through the trusted computing technology, a complete trust chain can be constructed in the large model deployment process, and the security of each link in the whole large model deployment process from the hardware device, the operating system to the GPU, the large model operation platform and the large model is ensured.

[0089] The beneficial effects of the above-mentioned large model security enhancement method based on trusted computing can mainly be reflected in the following aspects: 1) The trusted computing technology is introduced in the large model deployment process, a complete trust chain from the hardware layer to the application layer is constructed, and the security of each link in the large model deployment process is ensured.

[0090] 2) Combined with identity authentication, data encryption and decryption, access control and other technical means, a multi-dimensional and all-round security protection mechanism is formed, and the security of the large model deployment is improved.

[0091] 3) The security state in the large model deployment process is monitored in real time, and once the security threat is found, the response measures are taken immediately to ensure the safe running of the large model.

[0092] 4) The large model runs in the TEE, which can guarantee the security of data in the process of large model training and inference, ensure the security of user input data and large model output results, and also use the hardware isolation and security verification mechanism of the TEE to more effectively prevent unauthorized access and attacks, and enhance the security of the large model running time.

[0093] 5) The quantum true random number generator based on quantum tunneling effect is used to provide large-flow true random numbers, which ensures the security of encryption and decryption operation in the system and improves the efficiency and fairness of the encryption and decryption algorithm.

[0094] On the basis of the above-mentioned large model security enhancement method based on trusted computing, the embodiment of the application further provides a large model security enhancement system based on trusted computing, which is described with reference to Figure 1 and Figure 2As shown, the large model security enhancement system based on trusted computing can include a trusted management center 101 and a terminal device 102 connected with the trusted management center 101, the terminal device 102 is internally provided with a quantum random number generator, a TCM, a TPCM, an input / output system, a bootloader and an operating system, the TPCM can run in a trusted execution environment, and the TPCM can be used to monitor the state of the large model running in the trusted execution environment in real time; The TPCM can be configured to, during startup of the terminal device 102, check the TPCM, the input / output system, the bootloader, the operating system and the large model, and current software downloaded by the terminal device 102 from a software whitelist of the trusted management center 101 based on preset check information; wherein the software whitelist can include a plurality of software, the preset check information can include a trusted reference value respectively allocated by the trusted management center 101 for each software in the TPCM, the input / output system, the bootloader, the operating system and the large model and the software whitelist, and the current software can be software required for running the large model; The TPCM can also be configured to, during running of the terminal device 102, determine whether the running state of the current software is abnormal based on preset permission information, and perform a preset response operation when the running state of the current software is abnormal; wherein the preset permission information can include permissions respectively set by the trusted management center 101 for each software in the software whitelist; The TPCM can also be configured to perform data encryption and decryption and / or identity authentication based on a true random number generated by the quantum random number generator and an encryption and decryption algorithm stored by the TCM.

[0095] The large model security enhancement system based on trusted computing provided by the embodiment of the application has the same implementation principle and technical effects as the foregoing large model security enhancement method based on trusted computing, and for brevity of description, the parts not mentioned in the large model security enhancement system based on trusted computing embodiment can refer to the corresponding contents in the foregoing large model security enhancement method based on trusted computing embodiment.

[0096] Unless specifically stated otherwise, the relative steps, numerical expressions and numerical values of the components and steps set forth in these embodiments do not limit the scope of the application.

[0097] If the functions are realized in the form of software function units and sold or used as independent products, they can be stored in a nonvolatile computer readable storage medium executable by a processor. Based on this understanding, the technical solutions of the present application essentially or the parts that contribute to the prior art or parts of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a number of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in various embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various media that can store program codes.

[0098] In the description of the present application, it should be noted that the terms "center", "upper", "lower", "left", "right", "vertical", "horizontal", "inner", "outer" and the like indicate the orientation or positional relationship based on the orientation or positional relationship shown in the drawings, and are only for the convenience of describing the present application and simplifying the description, and do not indicate or imply that the devices or elements referred to must have a particular orientation, be constructed and operated in a particular orientation, and therefore cannot be understood as limiting the present application. In addition, the terms "first", "second", "third" are only for descriptive purposes and cannot be understood as indicating or implying relative importance.

[0099] Finally, it should be noted that: the above-described embodiments are only specific embodiments of the present application, used to illustrate the technical solutions of the present application, and are not limited thereto, the protection scope of the present application is not limited thereto, although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art within the technical scope disclosed by the present application can still modify or easily think of changes to the technical solutions recorded in the foregoing embodiments, or make equivalent replacements to part of the technical features; and these modifications, changes or replacements do not make the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application, and should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A large model security enhancement method based on trusted computing, characterized in that: Applied to a terminal device connected to a trusted management center, the terminal device has a built-in quantum random number generator, a trusted cryptographic module, a trusted platform control module, an input and output system, a boot loader, and an operating system. The trusted platform control module runs in a trusted execution environment and is used to monitor the status of a large model running in the trusted execution environment in real time; The large model security enhancement method based on trusted computing includes: During the startup process of the terminal device, the trusted platform control module verifies the trusted platform control module, the input / output system, the boot loader, the operating system, the large model, and the current software downloaded by the terminal device from the software whitelist of the trusted management center based on preset verification information; wherein the software whitelist includes multiple software, the preset verification information includes the trusted reference value assigned by the trusted management center to the trusted platform control module, the input / output system, the boot loader, the operating system, the large model, and each software in the software whitelist, and the current software is the software required to run the large model; During operation of the terminal device, the trusted platform control module determines whether the running state of the current software is abnormal based on preset permission information, so that the trusted platform control module performs a preset response operation when the running state of the current software is abnormal; wherein the preset permission information includes the permissions set by the trusted management center for each software in the software whitelist; The trusted platform control module performs data encryption and decryption and / or identity authentication based on the true random number generated by the quantum random number generator and the encryption and decryption algorithm stored in the trusted cryptographic module.

2. The large model security enhancement method based on trusted computing according to claim 1 is characterized in that: The trusted platform control module performs data encryption and decryption and / or identity authentication based on the true random number generated by the random number generator and the encryption and decryption algorithm stored in the trusted password module, including: The trusted platform control module obtains a target encryption and decryption algorithm for performing data encryption and decryption and / or identity authentication from the encryption and decryption algorithm, and generates target data for the target encryption and decryption algorithm based on the true random number, and then uses the target data to perform data encryption and decryption and / or identity authentication according to the target encryption and decryption algorithm; wherein the target data includes: a key for performing data encryption and decryption according to the corresponding first target encryption and decryption algorithm, and / or a password for performing identity authentication according to the corresponding second target encryption and decryption algorithm.

3. The large model security enhancement method based on trusted computing according to claim 1 is characterized in that: During the startup of the terminal device, the trusted platform control module verifies the trusted platform control module, the input / output system, the boot loader, the operating system, the large model, and the current software downloaded by the terminal device from the software whitelist of the trusted management center based on preset verification information, including: When the terminal device is started, the trusted platform control module calculates a current digest value of the current software and determines whether the current digest value is consistent with a current trusted reference value assigned to the current software by the trusted management center; If the current digest value is consistent with the current trusted reference value, the trusted platform control module verifies the trusted platform control module based on the preset verification information; If the trusted platform control module passes the verification, the trusted platform control module verifies the input and output system, the boot loader and the operating system based on the preset verification information; If the input / output system, the boot loader, and the operating system all pass verification, the trusted platform control module verifies the large model based on the preset verification information.

4. The large model security enhancement method based on trusted computing according to claim 3 is characterized in that: The trusted platform control module verifies the trusted platform control module based on the preset verification information, including: the trusted platform control module calculates a first digest value of its own, and determines whether the first digest value is consistent with a first trusted reference value assigned to the trusted platform control module by the trusted management center; if the first digest value is consistent with the first trusted reference value, then the trusted platform control module passes verification; The trusted platform control module verifies the input / output system, the boot loader, and the operating system based on the preset verification information, including: the trusted platform control module calculates a second digest value of the input / output system, and determines whether the second digest value is consistent with a second trusted reference value assigned by the trusted management center to the input / output system; if the second digest value is consistent with the second trusted reference value, the input / output system passes verification; if the input / output system passes verification, the trusted platform control module calculates a third digest value of the boot loader, and determines whether the third digest value is consistent with a third trusted reference value assigned by the trusted management center to the boot loader; if the third digest value is consistent with the third trusted reference value, the boot loader passes verification; if the boot loader passes verification, the trusted platform control module calculates a fourth digest value of the operating system, and determines whether the fourth digest value is consistent with a fourth trusted reference value assigned by the trusted management center to the operating system; if the fourth digest value is consistent with the fourth trusted reference value, the operating system passes verification; The trusted platform control module verifies the large model based on the preset verification information, including: the trusted platform control module calculates the fifth summary value of the large model, and determines whether the fifth summary value is consistent with the fifth trusted reference value assigned to the large model by the trusted management center; if the fifth summary value is consistent with the fifth trusted reference value, the large model verification passes.

5. The large model security enhancement method based on trusted computing according to claim 4 is characterized in that: During the operation of the terminal device, the trusted platform control module determines whether the operation status of the current software is abnormal based on preset permission information, including: The trusted platform control module monitors the running behavior of the current software in real time, and determines whether the running behavior of the current software exceeds the authority set by the trusted management center for the current software. If the running behavior of the current software exceeds the authority set by the trusted management center for the current software, the trusted platform control module determines that the running status of the current software is abnormal.

6. The large model security enhancement method based on trusted computing according to claim 5 is characterized in that: The fourth digest value includes a sixth digest value of a kernel of the operating system, and the fourth trusted reference value includes a sixth trusted reference value corresponding to the kernel; The trusted platform control module determines whether the fourth digest value is consistent with a fourth trusted reference value assigned by the trusted management center to the operating system, including: After the central processing unit corresponding to the operating system is started and the input / output system and the boot loader are both running, the trusted platform control module determines whether the sixth digest value is consistent with the sixth trusted reference value; If the sixth digest value is consistent with the sixth trusted reference value, the kernel is loaded and executed to start the operating system.

7. The large model security enhancement method based on trusted computing according to claim 6 is characterized in that: The terminal device also has a built-in AI processor corresponding to the operating system; the large model security enhancement method based on trusted computing also includes: When the AI ​​processor is running, the trusted platform control module obtains the current information of the AI ​​processor and determines whether the current information is consistent with the AI ​​processor information pre-set for the AI ​​processor by the trusted management center. If the current information is inconsistent with the AI ​​processor information, the AI ​​processor is stopped from running.

8. The large model security enhancement method based on trusted computing according to claim 6 is characterized in that: The terminal device also has a built-in first dynamic link library corresponding to the operating system; The large model security enhancement method based on trusted computing also includes: When the first dynamic link library is running, the trusted platform control module calculates the seventh digest value of the first dynamic link library and determines whether the seventh digest value is consistent with the seventh trusted reference value pre-assigned to the first dynamic link library by the trusted management center; if the seventh digest value is inconsistent with the seventh trusted reference value, the first dynamic link library is stopped from running.

9. The large model security enhancement method based on trusted computing according to claim 6 is characterized in that: Before the trusted platform control module verifies the large model based on the preset verification information, the large model security enhancement method based on trusted computing further includes: The trusted platform control module obtains authentication information for performing multi-factor authentication, and generates a one-time password for performing multi-factor authentication based on the true random number, and then performs multi-factor authentication using the authentication information, the one-time password, and preset multi-factor authentication information, so that when the multi-factor authentication passes, the trusted platform control module verifies the large model based on the preset verification information.

10. A large model security enhancement system based on trusted computing, characterized in that: The large model security enhancement system based on trusted computing includes a trusted management center and a terminal device connected to the trusted management center. The terminal device is equipped with a quantum random number generator, a trusted cryptographic module, a trusted platform control module, an input and output system, a boot loader and an operating system. The trusted platform control module runs in a trusted execution environment and is used to monitor the status of the large model running in the trusted execution environment in real time. The trusted platform control module is configured to: during the startup of the terminal device, verify the trusted platform control module, the input / output system, the boot loader, the operating system, the large model, and the current software downloaded by the terminal device from the software whitelist of the trusted management center based on preset verification information; wherein the software whitelist includes a plurality of software, the preset verification information includes a trusted reference value assigned by the trusted management center to each of the trusted platform control module, the input / output system, the boot loader, the operating system, the large model, and the software whitelist, and the current software is the software required to run the large model; The trusted platform control module is further configured to: during operation of the terminal device, determine whether the running state of the current software is abnormal based on preset permission information, so as to perform a preset response operation when the running state of the current software is abnormal; wherein the preset permission information includes the permissions set by the trusted management center for each software in the software whitelist; The trusted platform control module is further configured to perform data encryption and decryption and / or identity authentication based on the true random number generated by the quantum random number generator and the encryption and decryption algorithm stored in the trusted cryptographic module.

Images