Application publishing, usage method, AI model publishing method and device

Abstract

A method for publishing and using an application, an AI model publishing method, and a device. In the present application, the application owner can perform security verification on the first signature information in the application authorization request sent by the user. After the security verification is passed, the encrypted application can be loaded into the accelerator card. After obtaining the encrypted application, the accelerator card can decrypt the application for the user to use. The accelerator card itself has a decryption function and can decrypt the encrypted application and run the application. The application owner does not need to use an additional hardware encryption device, which can greatly reduce costs. The application does not need to be transmitted in plain text during the transmission process, which can ensure the security of the application and reduce the possibility of the application being stolen or misused.

Description

[0001] This application claims priority to the Chinese patent application filed with the Intellectual Property Office of the People's Republic of China on June 28, 2020, with application number 202010598752.8 and invention name "A Method and Device for Protecting AI Models", the entire contents of which are incorporated by reference into this application. Technical Field

[0002] The present application relates to the field of communication technology, and in particular to an application publishing and usage method, an AI model publishing method and a device. Background Art

[0003] Various applications (also known as application software) cover every aspect of our lives, including those installed on mobile devices and the services provided by servers. Applications that require extensive computational processing, such as artificial intelligence (AI) models, typically require loading onto specialized hardware devices, such as accelerator cards, that can support these computational processes and ensure smooth application operation.

[0004] Since this type of application involves issues such as paid licensing and application confidentiality, the user needs to obtain the right to use the application from the application owner before using the application. Only after obtaining the right to use the application can the user use the application.

[0005] Given the high value of such applications, application owners typically use the following methods to ensure application security to prevent abuse or theft:

[0006] The application owner sends the encrypted application and hardware encryption device to the user. The encrypted application is loaded into the user's server. The server is connected to the hardware encryption device. The server obtains the key from the hardware encryption device, decrypts the encrypted application, and then pushes the application to the accelerator card.

[0007] In this method, the application owner needs to configure an additional hardware encryption device, which increases the cost. In addition, the server and the accelerator card transmit the application in plain text, which is easy to detect, making the application easy to be stolen and less secure. Summary of the Invention

[0008] This application provides an application publishing and usage method, an AI model publishing method and a device to ensure the security of application A.

[0009] In the first aspect, an embodiment of the present application provides an application publishing method, in which the application owner can load the application into an accelerator card to publish it to the user. The method is applied to the application owner. In the method, the application owner can receive an application authorization request from the user, and the application authorization request can be used to request the right to use the application. The application authorization request carries a first certificate, wherein the first certificate includes a first public key and a first signature information from the accelerator card; thereafter, the application owner obtains the first signature information from the first certificate and performs security verification on the first signature information. After the security verification passes, the application owner can encrypt the application; thereafter, the encrypted application is loaded into the accelerator card.

[0010] Through the above method, the application owner performs security verification on the first signature information sent by the user to determine whether the first signature information comes from the accelerator card. After determining that it comes from the accelerator card, the encrypted application is loaded into the accelerator card. The security verification can ensure the security of the accelerator card to which the encrypted application needs to be loaded. The first signature information can establish a trust chain between the application owner and the accelerator card, and what is loaded in the accelerator card is the encrypted application, which can ensure that the application will not be transmitted in plain text, thereby ensuring the security of the application.

[0011] In a possible implementation, there are many ways for the application owner to encrypt the application. For example, the application owner can obtain a first public key from a first certificate and use the first public key to encrypt the application.

[0012] Through the above method, the method of encrypting the application using the first public key is more convenient, which can reduce the interaction between the application owner and the acceleration card, and can load the encrypted application into the acceleration card more quickly.

[0013] In one possible implementation, before encrypting the application, the application owner may also obtain a second certificate generated by the accelerator card. The second certificate includes a second public key and second signature information generated by the accelerator card. The method by which the application owner obtains the second certificate is not limited here. The application owner may obtain the second certificate directly from the accelerator card, or obtain the second certificate from the accelerator card through the user. After obtaining the second certificate, the application owner may perform security verification on the second signature information, and after the security verification is successful, initiate the encryption process for the application. When encrypting the application, the application owner may obtain the second public key from the second certificate, and then use the second public key to encrypt the application.

[0014] Through the above method, the accelerator card can provide the application owner with a second public key for encrypting the application. Before the application owner uses the second public key to encrypt the application, the application owner verifies the security of the second signature information to determine that the second signature information comes from the accelerator card, and then ensures that the second public key also comes from the accelerator card to ensure the reliability of the second public key and further ensure the security of the encrypted application.

[0015] In a possible implementation, the second signature information is obtained by encrypting the first private key. When the application owner performs security verification on the second signature information, the application owner may perform security verification on the second signature information based on the first public key.

[0016] Through the above method, the application owner performs security verification on the second signature information based on the first public key, which can maintain the trust chain established with the accelerator card through the first signature information, and the method of security verification of the second signature information through the first public key is more secure and reliable.

[0017] In one possible implementation, when the application owner encrypts the application, the application owner may also generate a key for encrypting the application by itself. Here, taking the generated keys as the second public key and the second private key as an example, the application owner uses the second public key to encrypt the application and may also send the second private key to the accelerator card so that the accelerator card can decrypt the encrypted application.

[0018] Through the above method, the application owner no longer needs to obtain the key for encrypting the application from the accelerator card. The application owner uses the key generated by itself for encrypting the application to encrypt the application, which can improve the efficiency of application encryption so that the encrypted application can be loaded into the accelerator card more quickly subsequently.

[0019] In a possible implementation, when the application owner sends the second private key to the accelerator card, the application owner may first encrypt the second private key using the first public key; and then send the encrypted second private key to the accelerator card.

[0020] By using the above method, the second private key is encrypted using the first public key, which can better ensure the security of the second private key.

[0021] In one possible implementation, the application owner may encrypt the application using a key other than the first public key and the second public key. Here, taking the key other than the first public key and the second public key as the first encryption key as an example, the application owner generates a first encryption key and encrypts the application according to the first encryption key. Afterwards, the application owner obtains a second encryption key, which may be the first public key or the second public key. Afterwards, the first encryption key is encrypted according to the second encryption key. After encrypting the first encryption key, the encrypted application and the encrypted first encryption key are loaded into the accelerator card.

[0022] Through the above method, the application owner can use the first encryption key generated by itself to encrypt the application, and then encrypt the first encryption key with the first public key or the second public key. This can ensure the security of the first encryption key, so as to ensure that the accelerator card can obtain the first encryption key and then decrypt the application.

[0023] In a possible implementation, the application owner may further perform signature protection on the encrypted application and the encrypted first encryption key before loading the encrypted application into the accelerator card.

[0024] Through the above method, by signing and protecting the encrypted application and the encrypted first encryption key, the integrity of the encrypted application and the encrypted application key can be guaranteed, and the encrypted application and the encrypted first encryption key can be prevented from being tampered with or damaged during the transmission process.

[0025] In a possible implementation, the application owner may further perform signature protection on the application before encrypting the application. The application owner may further perform signature protection on the first encryption key before encrypting the first encryption key.

[0026] By using the above method, signature protection is performed before encrypting the application, which can ensure the integrity of the application and the first encryption key before encryption.

[0027] In one possible implementation, the application owner can also load the authorization information of the application into the accelerator card. The application owner can directly load the authorization information of the application into the accelerator card, or use a similar method to load the application to generate an authorization key for encrypting the authorization information of the application, and encrypt the authorization information according to the authorization key; then, encrypt the authorization key according to a second encryption key, and load the encrypted authorization information into the accelerator card.

[0028] Through the above method, the application owner loads the application's authorization information into the accelerator card, so that the accelerator card can verify the legitimacy of the application through the application's authorization information.

[0029] In one possible implementation, the application can be an AI model or a cloud application deployed in the cloud.

[0030] Through the above method, there are many types of applications, which can effectively expand the application scenarios.

[0031] On the second aspect, an embodiment of the present application provides an application usage method, in which the application owner loads the application into an accelerator card in a cloud system to publish it to the user. The method can be executed by the accelerator card. In this method, the accelerator card can first obtain a first certificate, which includes a first public key and a first signature information. The accelerator card can also store a first private key corresponding to the first public key; thereafter, the accelerator card can publish the first certificate so that the user can obtain the first certificate and perform security verification on the application owner based on the first certificate; thereafter, the accelerator card can receive and load the encrypted application sent by the application owner after the security verification is passed; the encrypted application is decrypted to obtain the application.

[0032] Through the above method, the accelerator card can prompt the user to use the first certificate to perform security verification from the application owner by issuing the first certificate, so that the application owner can verify the source of the first certificate and determine that the first certificate comes from the accelerator card. After that, the accelerator card can obtain the encrypted application rather than the application in plain text, which can ensure the security of the application. The accelerator card itself has a decryption function, so that the decryption operation does not need to be performed through other devices, so that the application is always stored in the accelerator card to prevent the application from being stolen.

[0033] In a possible implementation, when decrypting and obtaining the application, the accelerator card may directly use the first private key associated with the first certificate to decrypt and obtain the application.

[0034] Through the above method, it is more convenient to use the first private key to decrypt the application, avoid multiple interactions between the application owner and the acceleration card, and improve the efficiency of application use.

[0035] In one possible implementation, the accelerator card may generate a second certificate before decrypting the application. The second certificate includes a second public key and a second signature information. The accelerator card may also save a second private key corresponding to the second public key. Afterwards, the accelerator card may issue the second certificate so that the application owner can perform security verification on the second certificate. When the accelerator card decrypts the application, it may use the second private key associated with the second certificate to decrypt the application.

[0036] Through the above method, the accelerator card can provide the second public key for encrypting the application to the application owner through the second certificate. After obtaining the second certificate, the application owner can determine that the second signature information comes from the accelerator card through security verification of the second signature information, and then ensure that the second public key also comes from the accelerator card to ensure the reliability of the second public key.

[0037] In a possible implementation, the second signature information is obtained by encrypting the first private key.

[0038] By using the above method, the second signature information is obtained using the first private key, and the trust chain established with the accelerator card through the first signature information can be maintained.

[0039] In a possible implementation, the accelerator card may also receive a second private key generated by the production party itself and sent by the application owner; thereafter, when decrypting the application, the second private key may be used to decrypt the application.

[0040] Through the above method, the application owner uses the key generated by itself for encrypting the application to encrypt the application, and the accelerator card can also obtain the key for decryption (that is, the second private key) from the application owner. The keys for encrypting and decrypting the application come from the application owner, which can further ensure the security of the application.

[0041] In a possible implementation, the second private key may be encrypted by the first public key associated with the first certificate and then loaded into the accelerator card. In this way, the accelerator card may decrypt the first private key to obtain the second private key.

[0042] By using the above method, the second private key is encrypted using the first public key, which can better ensure the security of the second private key.

[0043] In a possible implementation, the accelerator card may further verify the integrity of the encrypted application, and load the encrypted application after successful verification. The accelerator card may also verify the integrity of the encrypted first encryption key.

[0044] By using the above method, the integrity of the encrypted application is verified, so that the integrity of the encrypted application can be ensured, thereby preventing the encrypted application and the encrypted first encryption key from being tampered with or damaged during transmission.

[0045] In one possible implementation, when the accelerator card decrypts and obtains the application, it can decrypt the encrypted first encryption key according to the key corresponding to the second encryption key to obtain the first encryption key. The key corresponding to the second encryption key can be the first private key or the second private key; then, the first encryption key is used to decrypt and obtain the application.

[0046] Through the above method, the first private key or the second private key decrypts the first encryption key, which ensures that the accelerator card can obtain the first encryption key and then decrypt it to obtain the application.

[0047] In one possible implementation, the accelerator card can also obtain authorization information for the application. For example, the accelerator card can obtain the authorization information directly from the application owner, or through a method similar to obtaining the application. For example, the accelerator card can decrypt the encrypted authorization key using a key corresponding to the second encryption key to obtain the authorization key. The key corresponding to the second encryption key can be the first private key or the second private key. The accelerator card then uses the authorization key to decrypt the obtained application authorization information.

[0048] Through the above method, the accelerator card can obtain the authorization information of the application, so that the accelerator card can verify the legitimacy of the application through the authorization information of the application.

[0049] In a possible implementation, the accelerator card may also receive an authorization information update request sent by the application owner, wherein the authorization information update request carries the encrypted updated authorization information; and then update the authorization information according to the authorization information update request.

[0050] Through the above method, the accelerator card can obtain the updated authorization information of the application in a timely manner, so that the accelerator card can verify the legitimacy of the application through the updated authorization information of the application.

[0051] In one possible implementation, the application includes an AI model or a cloud application.

[0052] Through the above method, there are many types of applications, which can effectively expand the application scenarios.

[0053] On the third aspect, an embodiment of the present application provides an AI model publishing method, in which the AI ​​model owner can load the AI ​​model into an accelerator card to publish it to the user. The method can be executed by the AI ​​model owner. In this method, the AI ​​model owner can first obtain a model key, and then encrypt the AI ​​model according to the model key; it can also obtain an encryption key and encrypt the model key according to the encryption key. The encryption key can be generated by the accelerator card and verified by the AI ​​model owner, or it can be generated by the AI ​​model owner; thereafter, the AI ​​model owner can load the encrypted AI model and the encrypted model key into the accelerator card.

[0054] Correspondingly, after receiving the encrypted AI model and the encrypted model key, the accelerator card can use the key pair corresponding to the saved encryption key and the encrypted model key to decrypt and obtain the model key, and then use the model key to decrypt the encrypted AI model to obtain the AI ​​model.

[0055] Through the above method, the owner of the AI ​​model can use the model key to encrypt the application, and then encrypt the model key with the encryption key. This can ensure the security of the model key, so that the accelerator card can obtain the model key more safely and then decrypt it to obtain the AI ​​model.

[0056] In one possible implementation, the accelerator card generates and issues a first certificate, which includes a first public key and first signature information generated by the accelerator card. The accelerator card may also include a first private key corresponding to the first public key. The user may send an AI model authorization request carrying the first certificate to the AI ​​model owner. After receiving the AI ​​model authorization request from the user, the AI ​​model owner may verify the first signature information based on the root certificate issued by the accelerator card. If the verification is successful, it is determined that the first certificate comes from the accelerator card and the first public key is saved.

[0057] Through the above method, the owner of the AI ​​model verifies the first signature information and can determine whether the first signature information comes from the accelerator card, and then determine whether the first public key comes from the accelerator card. After determining that it comes from the accelerator card, the first public key is saved, which can ensure that the source of the saved first public key is reliable.

[0058] In one possible implementation, the encryption key obtained by the AI ​​model owner may be the first public key.

[0059] Through the above method, using the first public key as the encryption key is more convenient and the implementation is simpler.

[0060] In one possible implementation, the encryption key obtained by the AI ​​model owner may be another key from the accelerator card. Here, the other key is taken as the second key as an example.

[0061] The accelerator card can generate a second certificate on its own or upon triggering by the AI ​​model owner or user. This second certificate includes a second public key generated by the accelerator card and a second signature encrypted with the first private key. The accelerator card may also include a second private key corresponding to the second public key. The accelerator card can then issue the second certificate. After obtaining the second certificate, the AI ​​model owner can verify the second signature against the stored first public key. Upon successful verification, the second public key is used as the encryption key.

[0062] Through the above method, the accelerator card can provide the second public key to the AI ​​model owner through the second certificate, and before the application owner uses the second public key as the encryption key, the AI ​​model owner can verify the second signature information to determine that the second signature information comes from the accelerator card, and then ensure that the second public key also comes from the accelerator card to ensure the reliability of the second public key.

[0063] In one possible implementation, when obtaining the encryption key, the AI ​​model owner can also generate a second public key and a second private key by itself, and use the second public key as the encryption key; then, use the first public key to encrypt the second private key, and load the encrypted second private key into the accelerator card.

[0064] After obtaining the encrypted second private key, the accelerator card can use the first private key to obtain the second private key, and then use the second private key to decrypt the encrypted model key to obtain the model key, and then decrypt it to obtain the AI ​​model.

[0065] Through the above method, the AI ​​model owner no longer needs to obtain the encryption key from the accelerator card. The AI ​​model owner can generate the encryption key by itself, which can improve the efficiency of application encryption so that the encrypted application can be loaded into the accelerator card more quickly in the future.

[0066] In one possible implementation, the AI ​​model owner may also perform signature protection on the encrypted AI model and the encrypted model key before loading them into the accelerator card.

[0067] The accelerator card can first verify the integrity of the encrypted AI model and the encrypted model key, and then load the encrypted AI model and the encrypted model key after the verification passes.

[0068] Through the above method, by signing and protecting the encrypted AI model and the encrypted model key, the integrity of the encrypted application and the encrypted application key can be guaranteed, and the encrypted AI model and the encrypted model key can be prevented from being tampered with or damaged during the transmission process.

[0069] In one possible implementation, the AI ​​model owner can also sign the AI ​​model before encrypting it using the model key. After the accelerator card decrypts and obtains the AI ​​model, it can verify the integrity of the AI ​​model and, if the verification passes, run the AI ​​model.

[0070] Through the above method, signature protection is performed before encrypting the AI ​​model, which can ensure the integrity of the AI ​​model before encryption.

[0071] In one possible implementation, the AI ​​model owner may also load the AI ​​model's authorization information into the accelerator card. The AI ​​model owner may load the AI ​​model directly into the accelerator card, or may load the authorization information in a manner similar to loading the AI ​​model. For example, the AI ​​model owner may generate the AI ​​model's authorization information and authorization key, encrypt the authorization information based on the authorization key, then encrypt the authorization key based on the encryption key, and load the encrypted authorization information and the encrypted authorization key into the accelerator card.

[0072] After receiving the encrypted authorization information and the encrypted authorization key, the accelerator card can use the encryption key to obtain the authorization key, and then use the authorization key to decrypt the encrypted authorization information to obtain the authorization information.

[0073] Through the above method, the AI ​​model owner loads the AI ​​model's authorization information into the accelerator card so that the accelerator card can verify the legitimacy of the application through the AI ​​model's authorization information.

[0074] In one possible implementation, the AI ​​model owner may also perform signature protection on the encrypted authorization information before loading it into the accelerator card.

[0075] After the acceleration card decrypts and obtains the encrypted authorization information, the integrity of the encrypted authorization information can be verified. After the verification passes, the authorization information can be decrypted and obtained.

[0076] Through the above method, the integrity of the encrypted authorization information can be guaranteed, and the encrypted authorization information can be prevented from being tampered with.

[0077] In one possible implementation, the AI ​​model owner can also update the authorization information; the AI ​​model owner can directly load the updated authorization information into the accelerator card, or encrypt the updated authorization key according to the encryption key and load the encrypted updated authorization information into the accelerator card.

[0078] After receiving the encrypted and updated authorization information, the accelerator card can use the encryption key to obtain the authorization key, and then use the authorization key to decrypt the encrypted and updated authorization information to obtain the updated authorization information, and then verify the legitimacy of the application based on the updated authorization information.

[0079] Through the above method, the owner of the AI ​​model can timely update the authorization information of the AI ​​model to ensure the legitimacy of the AI ​​model.

[0080] In a possible implementation, the first public key and the first private key are generated by an accelerator card, and the first private key is encrypted and stored in the accelerator card.

[0081] Through the above method, the first private key is always stored in the accelerator card, which can ensure the security of the first private key.

[0082] In the fourth aspect, the embodiment of the present application also provides an application publishing device, which can be applied to all parties of the application. The beneficial effects can be found in the description of the first aspect and will not be repeated here. The device has the function of implementing the behavior in the method example of the first aspect mentioned above. The function can be implemented by hardware, or it can be implemented by hardware executing the corresponding software. The hardware or software includes one or more modules corresponding to the above functions. In one possible design, the structure of the device includes an acquisition unit, a verification unit, an encryption unit and a loading unit, which can perform the corresponding functions in the method example of the first aspect mentioned above. Please refer to the detailed description in the method example for details, which will not be repeated here.

[0083] In the fifth aspect, the embodiment of the present application also provides an application use device, which can be applied to an accelerator card. The beneficial effects can be found in the description of the second aspect and will not be repeated here. The device has the function of implementing the behavior in the method example of the second aspect above. The function can be implemented by hardware, or by hardware executing the corresponding software implementation. The hardware or software includes one or more modules corresponding to the above functions. In one possible design, the structure of the device includes an acquisition unit, a decryption unit, and a sending unit, which can perform the corresponding functions in the method example of the second aspect above. Please refer to the detailed description in the method example for details, which will not be repeated here.

[0084] In the sixth aspect, the embodiment of the present application also provides an AI model publishing device, which can be applied to the owner of the AI ​​model to execute the method executed by the owner of the AI ​​model. The beneficial effects can be found in the description of the third aspect and will not be repeated here. The device has the function of implementing the behavior in the method example of the third aspect above. The function can be implemented by hardware or by executing the corresponding software through hardware. The hardware or software includes one or more modules corresponding to the above functions. In one possible design, the structure of the device includes an acquisition unit, an encryption unit, and a loading unit. These units can execute the corresponding functions in the method example of the third aspect above. Please refer to the detailed description in the method example for details, which will not be repeated here.

[0085] In the seventh aspect, the embodiment of the present application also provides an AI model usage device, which can be applied to an accelerator card to execute the method executed by the accelerator card. The beneficial effects can be found in the description of the third aspect and will not be repeated here. The device has the function of implementing the behavior in the method example of the third aspect above. The function can be implemented by hardware or by hardware executing the corresponding software implementation. The hardware or software includes one or more modules corresponding to the above functions. In one possible design, the structure of the device includes an acquisition unit, a decryption unit, and a sending unit, which can execute the corresponding functions in the method example of the third aspect above. Please refer to the detailed description in the method example for details, which will not be repeated here.

[0086] In an eighth aspect, embodiments of the present application further provide a computing device. The beneficial effects of the computing device are described in the first aspect and are not further elaborated here. The computing device includes a processor and a memory. The processor is configured to support the device in performing the corresponding functions of the method of the first aspect. The memory is coupled to the processor and stores the necessary program instructions and data for the device. The device also includes a communication interface for communicating with other devices.

[0087] Ninthly, embodiments of the present application further provide a computing device. The beneficial effects can be found in the description of the second aspect and are not further elaborated here. The computing device comprises a processor and a memory. The processor is configured to support the device in performing the corresponding functions of the method of the second aspect. The memory is coupled to the processor and stores the necessary program instructions and data for the device. The device also comprises a communication interface for communicating with other devices.

[0088] In the tenth aspect, the embodiment of the present application further provides a computing device for executing the method executed by the owner of the AI ​​model. The beneficial effects can be found in the description of the third aspect and will not be repeated here. The structure of the device includes a processor and a memory, and the processor can perform the corresponding functions of the method in the third aspect above. The memory is coupled to the processor and stores the necessary program instructions and data for the device. The structure of the device also includes a communication interface for communicating with other devices.

[0089] In an eleventh aspect, an embodiment of the present application further provides a computing device for executing the method executed by an accelerator card. The beneficial effects can be found in the description of the third aspect and are not further elaborated here. The device structure includes a processor and a memory. The processor and encryption module cooperate to execute the corresponding functions of the method of the third aspect. The memory is coupled to the processor and stores the necessary program instructions and data for the device. The device structure also includes a communication interface for communicating with other devices.

[0090] In a twelfth aspect, the present application also provides a computer-readable storage medium, in which instructions are stored. When the computer-readable storage medium is run on a computer, the computer executes the methods in the above aspects.

[0091] In a thirteenth aspect, the present application also provides a computer program product comprising instructions, which, when executed on a computer, enables the computer to execute the methods in the above aspects.

[0092] In a fourteenth aspect, the present application also provides a computer chip, which is connected to a memory and is used to read and execute software programs stored in the memory to perform the methods in the above aspects. BRIEF DESCRIPTION OF THE DRAWINGS

[0093] Figure 1 A diagram showing the relationship between the application owner, user, and accelerator card manufacturer provided for this application;

[0094] Figure 2 A schematic diagram of the system architecture provided for this application;

[0095] Figure 3 A schematic diagram of an application publishing method provided for this application;

[0096] Figure 4 A schematic diagram of an application publishing method provided for this application;

[0097] Figure 5 A schematic diagram of an application publishing method provided for this application;

[0098] Figure 6 A schematic diagram of an application publishing method provided for this application;

[0099] Figure 7 A schematic diagram of the structure of an application publishing device provided by this application;

[0100] Figure 8 A schematic diagram of the structure of an application device provided in this application;

[0101] Figure 9 A schematic diagram of the structure of an AI model publishing device provided in this application;

[0102] Figure 10 A schematic diagram of the structure of an AI model using device provided in this application;

[0103] Figure 11 A schematic diagram of the structure of a computing device provided in this application. DETAILED DESCRIPTION

[0104] To ensure application security, application owners currently provide users with a hardware encryption device when sending the application. This method is described below:

[0105] First, the application owner can read the server's hardware identification from the user's server and import it into the hardware encryption device. The application owner triggers the hardware encryption device to generate key 1 and save the server's hardware identification. The application owner uses key 1 to encrypt the application and hands over the encrypted application and hardware encryption device to the user. The user imports the encrypted application into the server and connects the hardware encryption device to the server. The hardware encryption device obtains the server's hardware identification from the server and compares it with the stored server's hardware identification. After confirming that they are consistent, the encrypted application is decrypted using key 1 in the hardware encryption device and sent to the server in plain text. The server then transmits the application in plain text to the accelerator card, triggering the accelerator card to run the application.

[0106] In the above method, the application owner needs to provide a hardware encryption device, which increases the cost; after the application is decrypted, there is a process of transmitting it in plain text, which increases the possibility of the application being stolen.

[0107] In order to reduce costs and improve application security, the embodiments of the present application provide an application publishing, usage method, AI model publishing method and device. Before describing the application publishing, usage method and AI model publishing method provided by the embodiments of the present application, the concepts involved in the embodiments of the present application are described.

[0108] (1) Application.

[0109] An application is a collection of programs that can implement one or more functions. The types of applications are not limited in the embodiments of this application. For example, it can be application software installed on a mobile terminal device, program instructions running on a server, or a computational model used for artificial intelligence reasoning, also known as an AI model. The applications in the embodiments of this application can be cloud applications deployed in the cloud or applications running locally on the device.

[0110] (2) Application owners, users, and accelerator card manufacturers.

[0111] See also Figure 1 , which is a diagram of the relationship between application owners, users, and accelerator card manufacturers.

[0112] The app owner is the party that possesses ownership of the app. They decide who can use the app and for how long, effectively determining who has the right to use the app and the validity period. In practice, the app owner can provide app usage rights through sales or leasing.

[0113] The user is the party that needs to use the application. The user can apply for the right to use the application from the application owner. There is no limit to the method of applying for the right to use the application. For example, the user can apply for the right to use the application in advance by email, or apply for the right to use the application from the application owner through offline negotiation, or obtain the right to use the application online by sending a request (such as by sending an application authorization request in the embodiment of the present application).

[0114] An accelerator card manufacturer refers to the party that produces the accelerator card, which is a hardware module capable of loading applications. The accelerator card has independent computing capabilities and can run the loaded applications. The embodiments of this application do not limit the specific form of the accelerator card or the types of applications that can run on the accelerator card. For example, the accelerator card can be a high-speed serial computer expansion bus standard (Peripheral Component Interconnect Express, PCIe) expansion module with the ability to perform AI operations. The accelerator card can also be a hardware module with other interfaces.

[0115] Accelerator card manufacturers can sell or lease the accelerator cards they produce to users who need to use applications, or to application owners who have ownership of the applications.

[0116] In the embodiment of the present application, the following two relationships may exist between the application owner, the user, and the accelerator card manufacturer:

[0117] Relationship 1 Figure 1 As shown by the solid line in the middle, the application owner can obtain (such as purchasing or leasing) an accelerator card from the accelerator card manufacturer and load the encrypted application into the accelerator card. Afterwards, the user obtains the accelerator card loaded with the encrypted application from the application owner and applies to the application owner for the right to use the application. After the user obtains the accelerator card and the right to use the application, the accelerator card can decrypt the encrypted application and run the application.

[0118] It should be noted that in relationship one, when the user applies to the application owner for the right to use the application, he or she may apply to the application owner for the right to use the application in the manner mentioned in the aforementioned content, or he or she may apply for the right to use the application by applying for an accelerator card loaded with the encrypted application. If the application owner gives the user the accelerator card, it indicates that the user obtains the right to use the application; otherwise, the user does not obtain the right to use the application.

[0119] The accelerator card can decrypt an encrypted application by triggering it after the user determines that the application is needed. For example, when the user needs to use the application to implement a certain function, they can send a decryption instruction to the accelerator card. After receiving the decryption instruction, the accelerator card can decrypt the encrypted application and run it. For another example, the accelerator card can be equipped with a button that the user can use to trigger the accelerator card to decrypt the encrypted application. In this way, the user can decrypt the application according to their needs and instruct it to run.

[0120] The accelerator card's decryption of encrypted applications can also be triggered by the application owner. For example, the application owner can verify the user's identity and confirm that the user's identity is secure or that they have permission to use the application. Then, through a command or keystroke, the accelerator card can trigger the decryption of the encrypted application. This allows the user to run the application directly through the accelerator card without having to trigger the decryption operation themselves, saving time and providing a better user experience.

[0121] Relationship 2: Users can obtain an accelerator card from the card manufacturer and apply to the application owner for permission to use the application. After the application owner confirms the user's permission to use the application, they can load the encrypted application onto the accelerator card. The accelerator card then decrypts the encrypted application and performs computations on it.

[0122] The operation of decrypting the encrypted application by the accelerator card may be automatically executed after the accelerator card detects that the encrypted application is loaded into the accelerator card.

[0123] The operation of the accelerator card to decrypt the encrypted application can also be performed under the triggering of the user or application owner. The method in which the user or application owner triggers the accelerator card to decrypt the encrypted application can be found in the above description and will not be repeated here.

[0124] It should be noted that the embodiment of this application does not limit the method by which the application owner loads the encrypted application onto the accelerator card obtained by the user. For example, the application owner can directly load the encrypted application onto the accelerator card obtained by the user without going through a third party. For another example, the application owner can also load the encrypted application onto the accelerator card obtained by the user through the user. In other words, the user obtains the encrypted application from the application owner and then loads the encrypted application onto the accelerator card itself.

[0125] As can be seen from the above description, regardless of the relationship between the application owner, user, and accelerator card manufacturer, the application is encrypted during transmission, ensuring its security. Furthermore, the encrypted application is stored on the accelerator card, and decryption is also performed within the accelerator card. The application never leaves the accelerator card in plain text, further ensuring that the application is not easily stolen.

[0126] It is worth noting that the various operations performed by the application owner, user, and accelerator card manufacturer mentioned in the embodiments of the present application can be performed by the application owner, user, and accelerator card manufacturer themselves, or can be performed by the application owner, user, and accelerator card manufacturer driving the computing device. For example, when the application owner loads the encrypted application into the accelerator card, the application owner can connect the accelerator card to the computing device that stores the application, and copy the encrypted application from the computing device to the accelerator card. The application owner can also send a message carrying the encrypted application to the accelerator card through the computing device so that the accelerator card obtains the encrypted application. The embodiments of the present application do not limit the manner in which the various operations are performed by the application owner, user, and accelerator card manufacturer.

[0127] (3) Key, public key, private key.

[0128] Keys are used to encrypt or decrypt information. They can be categorized as asymmetric or symmetric. Asymmetric keys use different keys for encryption and decryption. Asymmetric keys consist of two types of keys: public and private. Public keys are public and accessible to everyone or relevant parties. Private keys are private and can only be accessed by the owner of the key pair (the public and private keys). Public and private keys correspond to each other. Information encrypted with a public key can be decrypted with the corresponding private key, and similarly, information encrypted with a private key can be decrypted with the corresponding public key.

[0129] In some application scenarios, a private key can be used to sign some information (which is essentially encryption) to generate signature information. The signature information can be securely verified using a public key to determine whether the signature information is generated by signing with a private key, thereby verifying the party providing the signature information and confirming the integrity of the signed information.

[0130] In the embodiments of this application, to distinguish different public keys and private keys, they are referred to as the first public key, the first private key, the second public key, the second private key, the third public key, and the third private key, respectively. The first public key corresponds to the first private key, the second public key corresponds to the second private key, and the third public key corresponds to the third private key.

[0131] A symmetric key means that the key used for encryption and decryption is the same. In the embodiments of this application, the key used to encrypt the application and its authorization information (such as the first encryption key, authorization key, and model encryption key) is a symmetric key. Of course, the key used to encrypt the application and its authorization information can also be an asymmetric key. In this case, the application owner does not send the key used to encrypt the application and its authorization information to the accelerator card, but needs to send the key corresponding to the key to the accelerator card.

[0132] (4) Certificate, root certificate.

[0133] A certificate is used to record a public key. By verifying a certificate, the legitimacy of the public key in the certificate can be determined.

[0134] Taking the example of A needing to publish his own public key and B needing to obtain A's public key, A can use his own public key (optionally, it can also include identity information) to generate a certificate and publish the certificate. In this way, if B can obtain the certificate, he can obtain A's public key from the certificate. If the certificate includes identity information, he can also read A's identity information from the certificate. The type of identity information is not limited here, such as the identity information can be A's address, identification, etc. The certificate can also include signature information, and the source of the public key in the certificate can be verified through the signature information. For example, after obtaining the certificate, B can verify through the signature information to determine whether A's public key recorded in the certificate is truly from A. The embodiment of the present application does not limit the generation method and verification method of the signature information. For details, please refer to the relevant instructions in steps 302, 304 and steps 403, 405.

[0135] In order to increase the fairness of the certificate, A can generate and publish the certificate through a trusted third party, such as a certificate authority (CA). A can send his public key (optionally, it can also include identity information) to the third party, and the third party will apply signature information to A's public key to generate a certificate. B then obtains the certificate from the third party or A. After obtaining the certificate, B can verify the signature information on the certificate and the legitimacy of A's public key in the certificate. After the verification is passed, A's public key can be obtained from the certificate. The root certificate involved in the embodiment of the present application can be generated by a third party. In the embodiment of the present application, the public key recorded in the root certificate can be called the public key of the root certificate, and the private key corresponding to the public key of the root certificate is called the private key of the root certificate.

[0136] In order to distinguish the public keys and signature information recorded in different certificates in the present embodiment, the different certificates and signature information involved are named as the first certificate and the second certificate respectively. The first certificate includes the first public key and the first signature information. The second certificate includes the second public key and the second signature information.

[0137] like Figure 2 As shown, a schematic diagram of a system architecture provided in an embodiment of the present application is provided, wherein the system architecture includes an accelerator card, an application owner (including a computing device used by the application owner), and a user (including a computing device used by the user).

[0138] The application owner may store the application, such as storing the application in a computing device used. The user may establish a connection with the accelerator card. The embodiments of the present application do not limit the manner in which the user establishes a connection with the accelerator card. For example, the user may establish a connection with the accelerator card via a wired or wireless method; for another example, the accelerator card may be inserted into an interface of the computing device used by the user.

[0139] It should be noted that the embodiments of the present application do not limit the types and deployment locations of the computing devices used by the application owner and the computing devices used by the user. For example, the computing devices used by the application owner and the computing devices used by the user can be deployed in a central computing device system (including at least one cloud computing device, such as a server, a desktop computer, etc.), or can be deployed in an edge computing device system (including at least one edge computing device, such as a server, a desktop computer, etc.). The computing devices used by the application owner and the computing devices used by the user can also be devices deployed in other locations, such as on land, including indoors or outdoors, handheld or vehicle-mounted; can also be deployed on the water (such as ships, etc.); can also be deployed in the air (such as airplanes, balloons, and satellites, etc.).

[0140] The computing devices used by the application owner and the computing devices used by the user can be servers, server clusters, or personal devices, such as mobile phones, tablets, computers with wireless transceiver functions, virtual reality (VR) terminals, augmented reality (AR) terminals, wireless terminals in industrial control, wireless terminals in self-driving, wireless terminals in remote medical, wireless terminals in smart grids, wireless terminals in transportation safety, wireless terminals in smart cities, wireless terminals in smart homes, etc.

[0141] In an embodiment of the present application, the application owner can perform security verification based on the application authorization request sent by the user. After the security verification is passed, the encrypted application can be loaded into the accelerator card. After obtaining the encrypted application, the accelerator card can decrypt the application for the user to use. The application owner can send the encrypted application to the accelerator card, and the accelerator card can decrypt the encrypted application and run the application. The application owner does not need to use additional hardware encryption devices, which can greatly reduce costs. And because the accelerator card has a decryption function, the application does not need to be transmitted in plain text during the transmission process, which can ensure the security of the application and reduce the possibility of the application being stolen or misused.

[0142] The following describes the application publishing and usage method provided by the embodiment of the present application in conjunction with the accompanying drawings. Figure 3 , is a method for publishing and using an application provided in an embodiment of the present application. The method includes two parts. The first part is the process in which the application owner performs security verification based on the application authorization request sent by the user, see steps 301 to 305. The second part is the process in which the application owner loads the encrypted application into the accelerator card, and the accelerator card decrypts the application to obtain the application, see steps 306 to 308. The method includes:

[0143] Step 301: The accelerator card first obtains a first public key and a first private key. The first public key corresponds to the first private key, and the accelerator card can save the first private key.

[0144] There are many ways for the accelerator card to obtain the first public key and the first private key. The following are two of them:

[0145] Method 1: Before the accelerator card leaves the factory, the first public key and the first private key may be pre-configured in the accelerator card, or the accelerator card may generate the first public key and the first private key. For example, the accelerator card may contain a chip that can generate the first public key and the first private key.

[0146] Before leaving the factory, the accelerator card can save the first private key. In order to ensure the security of the first private key, the accelerator card can save the first private key in the non-volatile memory of the accelerator card, or the first private key can be encrypted first, and then the encrypted first private key can be saved, such as saving the encrypted first private key in the non-volatile memory of the accelerator card. The key used by the accelerator card to encrypt the first private key is not limited here. For example, it can be a root key, a derived key of the root key, or other keys. Among them, the root key can be randomly generated by the accelerator card, and the root key can only be accessed by the accelerator card in a trusted execution environment, so that the security of the root key can be guaranteed. The derived key of the root key is a key generated by the accelerator card based on the root key.

[0147] Method 2: After the accelerator card leaves the factory, if the user obtains the accelerator card, the user can trigger the accelerator card to generate the first public key and the first private key. The method by which the user triggers the accelerator card to generate the first public key and the first private key is not limited here. For example, the user can send a key generation instruction to the accelerator card. For another example, the accelerator card is provided with a button 1, which is used to trigger the generation of the first public key and the first private key. For example, the button 1 can be a power button. After clicking the power button, the accelerator card can generate the first public key and the first private key. The accelerator card can also save the first private key. The method for saving the first private key can be referred to in the above content and will not be repeated here.

[0148] If the application owner obtains the accelerator card, the application owner can also trigger the accelerator card to generate the first public key and the first private key. The application owner triggers the accelerator card to generate the first public key and the first private key in a similar way to the user triggering the accelerator card to generate the first public key and the first private key. For details, please refer to the above content.

[0149] Step 302: The accelerator card obtains a first certificate, which includes a first public key and first signature information.

[0150] There are many ways for the accelerator card to obtain the first certificate. For example, the accelerator card can generate the first certificate by itself, or obtain the first certificate from other devices.

[0151] (1) The accelerator card generates the first certificate by itself.

[0152] After the accelerator card obtains the first public key and the first private key, it can use the first signature private key to sign the first information to generate first signature information. The first information includes the first public key and may also include device information of the accelerator card, such as the device identification of the accelerator card, the name or number of the accelerator card manufacturer, etc.

[0153] The first signature private key can be a pre-configured private key or a private key obtained from other devices. The first signature private key can be generated by a trusted third party, such as a CA, or generated by other devices. The generation method of the first signature private key is not limited here. Any private key with a secure source can be used as the first signature private key. For example, the first signature private key can be the private key of the root certificate or other private keys. Here, we only use the example of the first signature private key being the private key of the root certificate. The root certificate can be generated by a third party for the accelerator card manufacturer or the accelerator card. The private key of the root certificate can be pre-configured on the accelerator card or obtained by the accelerator card from the accelerator card manufacturer.

[0154] Afterwards, the accelerator card generates a first certificate based on the first public key and the first signature information.

[0155] (2) The accelerator card generates a first certificate when triggered by the user.

[0156] When the user determines that it is necessary to send an application authorization request to the application owner, the user can send a signature generation instruction to the accelerator card. After receiving the signature generation instruction, the accelerator card uses the first signature private key (such as the private key of the root certificate) to sign the first information and generate the first signature information. Afterwards, the accelerator card generates the first certificate based on the first public key and the first signature information. For another example, a button 2 is set on the accelerator card, and the button 2 is used to trigger the generation of the first certificate. For example, the button 2 can also be a power button. After clicking the power button, the accelerator card can generate the first public key and the first private key, and then generate the first certificate.

[0157] Of course, the accelerator card can also generate the first certificate under the triggering of the application owner. For example, if the application owner obtains the accelerator card, the application owner can trigger the accelerator card to generate the first public key and the first private key after triggering the accelerator card to generate the first certificate. The way the application owner triggers the accelerator card to generate the first certificate is similar to the way the user triggers the accelerator card to generate the first certificate. Please refer to the above content for details.

[0158] (3) The accelerator card obtains the first certificate from other devices.

[0159] The first certificate can be configured in the accelerator card by the accelerator card manufacturer. For example, after the accelerator card generates the first public key and the first private key, the accelerator card manufacturer can use the relevant computing device to read the first public key from the accelerator card, and use the first signature private key (the private key of the root key) to encrypt the first information including the first public key to generate the first signature information. The accelerator card manufacturer can use the first public key and the first signature information to generate the first certificate by itself, or request a third party to generate the first certificate based on the first public key and the first signature information. The third party then sends the first certificate to the accelerator card manufacturer, and then loads the first certificate into the accelerator card.

[0160] It should be noted that in step 302, the first signature information is generated by signing the first information using the private key of the root certificate. In actual applications, other methods can also be used to generate the first signature information. For example, the first public key that can be included in the first certificate is the encrypted first public key, and the key required to decrypt the encrypted first public key is key #1. The first signature information can be generated by signing key #1 (optionally, it can also include the device information of the accelerator card) using the private key of the root certificate. When generating the first signature information, the first signature private key can also be other private keys, such as a key generated based on the private key of the root certificate. The key corresponding to the first signature private key, that is, the key used for security verification of the first signature information, can be obtained by the application owner from a trusted party.

[0161] Step 303: The accelerator card issues the first certificate, and the user obtains the first certificate from the accelerator card.

[0162] Step 304: After obtaining the first certificate, the user sends an application authorization request to the application owner, and the application authorization request carries the first certificate.

[0163] In order to obtain the application from the application owner, the user needs to first apply to the application owner for authorization to use the application, that is, to apply for the right to use the application. The user needs to send an application authorization request to the application owner's computing device.

[0164] Step 305: After receiving the application authorization request sent by the user, the application owner performs security verification on the first signature information.

[0165] The way in which the application owner performs security verification on the first signature information is related to the way in which the first signature information is generated. Different ways in which the first signature information is generated result in different verification methods.

[0166] The following describes how the application owner performs security verification on the first signature information based on the first signature information generated in step 302:

[0167] The application owner verifies the first signature information using the public key corresponding to the first signature private key (such as the public key of the root certificate). The public key corresponding to the first signature private key is a public key that the application owner can obtain. For example, when the first signature private key is the private key of the root certificate, the public key corresponding to the first signature private key is the public key of the root certificate. The method for obtaining the public key corresponding to the first signature private key is not limited here. The public key corresponding to the first signature private key can be obtained after the application owner receives the application authorization request, or it can be pre-loaded locally by the application owner so that when the application authorization request is subsequently received, the public key can be used to more quickly verify the first signature information.

[0168] Optionally, after successfully verifying the first signature information, the application owner may send an application authorization success response to the user.

[0169] The application owner performs security verification on the first signature information to determine whether the first signature information comes from the accelerator card, and further determine whether the first public key comes from the accelerator card, rather than a forged first public key provided by the user himself.

[0170] In steps 301 to 305, the accelerator card sends the first certificate to the user as an example. In actual applications, the accelerator card can also directly send the first certificate to the application owner. After that, the application owner performs security verification on the first signature information. In this case, the application owner can determine whether the public key in the first certificate comes from the accelerator card through security verification of the first signature information, and verify the reliability of the first public key.

[0171] If the application owner can directly load the encrypted application into the accelerator card, such as if the accelerator card is obtained by the application owner from the accelerator card manufacturer; or if the application owner trusts the accelerator card manufacturer, steps 301 to 305 may not be performed.

[0172] Afterwards, the encrypted application can be transmitted between the application owner and the accelerator card.

[0173] Step 306: After the security verification is passed, the application owner encrypts the application.

[0174] Step 307: The application owner loads the encrypted application into the acceleration card.

[0175] Step 308: The accelerator card receives the encrypted application and decrypts it to obtain the application.

[0176] In steps 306 to 308 , the encrypted application is transmitted between the application owner and the accelerator card. This embodiment of the present application does not limit the manner in which the encrypted application is transmitted between the application owner and the accelerator card.

[0177] For example, after obtaining the first public key, the application owner can directly use the first public key to encrypt the application and send the encrypted application to the accelerator card. After obtaining the encrypted application, the accelerator card can use the first private key to decrypt the application.

[0178] For another example, the application owner can also generate a key for encrypting the application. For the sake of convenience, this key is called the first encryption key. The application owner uses the first encryption key to encrypt the application, sends the encrypted application to the accelerator card, and passes it and the first encryption key to the accelerator card in a relatively secure manner.

[0179] There are many ways for the application owner to pass the first encryption key to the accelerator card. For example, the application owner can use the first public key to encrypt the first encryption key, and then send the encrypted first encryption key to the accelerator card. For another example, the application owner can also use the second public key obtained from the accelerator card or generated by itself to encrypt the first encryption key, and then send the encrypted first encryption key to the accelerator card.

[0180] For another example, the application can generate a second public key and a second private key by itself, encrypt the application using the second public key, and then send the second private key to the accelerator card in a relatively secure manner.

[0181] There are many ways for the application owner to send the second private key to the accelerator card. For example, the application owner can use the first public key to encrypt the second private key, and then send the encrypted second private key to the accelerator card.

[0182] The following combination Figure 4 , further describes how the application owner transmits the encrypted application to the accelerator card using the first encryption key and the second public key generated by the accelerator card. Figure 4 In the example, the first encryption key is a symmetric key. If the first encryption key is not a symmetric key, the transmission method is similar. The difference is that the application owner needs to encrypt the key corresponding to the first encryption key (that is, the key required to decrypt the encrypted application) and transmit it.

[0183] Step 401: The accelerator card generates a second public key and a second private key.

[0184] The embodiments of the present application do not limit the manner in which the accelerator card generates the second public key and the second private key. For example, the second public key and the second private key may be generated by the accelerator card itself, and the accelerator card may directly generate the second public key and the second private key after sending the first certificate to the user. For another example, the second public key and the second private key may be generated by the accelerator card under the triggering of the application owner or the user. For example, after receiving the authorization request response sent by the application owner or determining that the application owner has passed the security verification, the user may send an instruction to the accelerator card to instruct the accelerator card to generate the second public key and the second private key. For another example, after passing the security verification, the application owner may communicate with the accelerator card and send an instruction to instruct the accelerator card to generate the second public key and the second private key.

[0185] Step 402: The accelerator card generates second signature information, and generates a second certificate according to the second signature information and the second public key.

[0186] When the accelerator card generates the second signature information, it may use the second signature private key to sign the second information. The second information may include the second public key or other information. For example, the second public key in the second certificate is the encrypted second public key, and the key required to decrypt the encrypted second public key is key #2. The second information may also include key #2. The embodiments of the present application do not limit the content included in the second information; the above method is only an example.

[0187] The second signature private key can be a pre-configured private key, such as the first private key, or a private key obtained from another device, such as the first private key, or generated by a trusted third party, such as a CA, or generated by another device. The specific type of the second signature private key is not limited here, and any private key from a trusted organization or device can be used as the second signature private key.

[0188] Step 403: The accelerator card issues the second certificate, and the user obtains the second certificate from the accelerator card.

[0189] Step 404: The user sends the second certificate to the application owner.

[0190] It should be noted that in steps 403 to 404, the accelerator card sends the second certificate to the application owner through the user. If the accelerator card can communicate directly with the application owner, such as the application owner obtains the accelerator card from the accelerator card manufacturer, or if the user hands the accelerator card to the application owner, the application owner can obtain the second certificate directly from the accelerator card.

[0191] Step 405: After obtaining the second certificate, the application owner performs security verification on the second signature information.

[0192] When the application owner performs security verification on the second signature information, the application owner can use the public key corresponding to the second signature private key to verify the second signature information. For example, if the second signature private key is the first private key, the public key corresponding to the second signature private key is the first public key.

[0193] Step 406: After the security verification is passed, the application owner obtains the second public key according to the second certificate.

[0194] Steps 401 to 406 are the process of the application owner obtaining the second public key from the accelerator card. After obtaining the second public key, the application owner can send the encrypted application to the accelerator card, that is, steps 401 to 406 can be executed between steps 305 and 306.

[0195] Step 407: The application owner generates a first encryption key, encrypts the application using the first encryption key, and encrypts the first encryption key using the second public key.

[0196] Step 407 is an implementation of step 306, where the key used to encrypt the application is the first encryption key.

[0197] Optionally, before executing step 407, in order to ensure that the application is not tampered with or damaged and to ensure the integrity and validity of the application, the application owner may first use a pre-generated or stored third private key to sign the application (also referred to as performing signature protection) to generate third signature information. Thereafter, the third signature information may be encrypted using the first encryption key. In this way, when decrypting the encrypted third signature information, the first encryption key may be used for decryption first, and then the third public key may be used for verification. Similarly, in order to ensure the integrity and validity of the first encryption key, the application owner may also use the third private key to sign the first encryption key application to generate first key signature information. Thereafter, the first key signature information may be encrypted using the second public key. The encrypted first key signature information includes the encrypted first encryption key.

[0198] The third private key is a key that can only be obtained by the application owner and cannot be obtained by other devices. The public key corresponding to the third private key is the third public key, which is public and can be obtained by other devices.

[0199] Optionally, after the application owner uses the first encryption key to encrypt the encrypted application (or the third signature information), he or she may also use the third private key to sign the encrypted application (or the encrypted third signature information) to generate fourth signature information, or may use the third private key to sign the encrypted first encryption key (or the encrypted first key signature information) to generate second key signature information.

[0200] The application process is as follows:

[0201] 1. Sign the application using the third private key to generate third signature information. 2. Encrypt the third signature information using the first encryption key. 3. Sign the encrypted third signature information using the third private key to generate fourth signature information.

[0202] The first encryption key is processed as follows:

[0203] 1. Sign the first encryption key using the third private key to generate first key signature information. 2. Encrypt the first key signature information using the second public key. 3. Sign the encrypted first key signature information using the third private key to generate second key signature information.

[0204] It should be noted that here we only use the third private key to sign the application and the first encryption key as an example. In fact, other trusted private keys can also be used for signing, and the private key used for the encrypted third signature information and the private key used for the encrypted first key signature information can also be different. This application does not limit this.

[0205] In addition to sending the encrypted application and the encrypted first encryption key to the accelerator card, the application owner may also send the application's authorization information to the accelerator card. This authorization information indicates the legitimacy of the application. The application's authorization information may include the accelerator card's device information, indicating that only the accelerator card identified by this device information can use the application. Optionally, the application's authorization information also includes application-related information, such as the application's identifier, the application's validity period, and the number of decryption attempts.

[0206] In order to ensure the security of the application's authorization information, the application owner may also encrypt the application's authorization information. For ease of explanation, the key used by the application owner to encrypt the application's authorization information is called an authorization key. For example, the authorization key may be a second public key, a first public key, or a key generated by the application owner's computing device for encrypting the application's authorization information. The authorization key may also be a symmetric key or a non-symmetric key. In the application embodiment, the authorization key is a symmetric key as an example. The way the application owner transmits the authorization key is similar to the way the application owner transmits the first encryption key, that is, the authorization key can be encrypted by the second public key and then sent to the accelerator card. For the case where the authorization key is not a symmetric key, the transmission method is similar. The difference is that the application owner needs to encrypt the key corresponding to the authorization key and import the encrypted key corresponding to the authorization key into the accelerator card.

[0207] Optionally, before the application owner encrypts the application's authorization information, the application owner may also use a third private key to sign the application's authorization information; after the application owner encrypts the application's authorization information (or the signed application's authorization information), the application owner may also use a third private key to sign the encrypted application's authorization information (or the encrypted, signed application's authorization information).

[0208] The process of processing application authorization information is as follows:

[0209] 1. Use the third private key to sign the application's authorization information to generate first-signed authorization information. 2. Use the authorization key to encrypt the first-signed authorization information. 3. Use the third private key to sign the encrypted first-signed authorization information to generate second-signed authorization information.

[0210] Signing the encrypted application (or third signature information), the encrypted first encryption key (or the encrypted first key signature information), and the encrypted application's authorization information (or the encrypted first signature authorization information) is to ensure the integrity of the encrypted application, the encrypted first encryption key, and the encrypted application's authorization information, and to prevent the encrypted application, the encrypted first encryption key, and the encrypted application's authorization information from being damaged or maliciously tampered with during their transmission. In other words, the encrypted application, the encrypted first encryption key, the encrypted application, and the authorization information are verified using the third public key. If the verification fails, it indicates that the encrypted application, the encrypted first encryption key, and the encrypted application's authorization information have been damaged or maliciously tampered with. This allows timely detection of damage or malicious tampering with the encrypted application, the encrypted first encryption key, and the encrypted application's authorization information.

[0211] In addition, the above-mentioned use of the third private key to sign the application authorization information and the encrypted first signature authorization information is only an example. In fact, other trusted private keys can also be used for signing, and the private key used to sign the application authorization information and the private key used to sign the encrypted first signature authorization information can also be different. This application does not limit this.

[0212] Step 408: The application owner loads the encrypted application and the encrypted first encryption key onto the accelerator card. The application owner may also load the application authorization information or the encrypted application authorization information onto the accelerator card. Step 408 is an implementation of step 307.

[0213] If the application owner signs the application, the first encryption key encryption, and the authorization information of the application before encrypting the application and the first encryption key (which can also be called signature protection), the computing device of the application owner can send the encrypted third signature information, the encrypted first key signature information, and the signed first signature authorization information to the accelerator card when executing step 408.

[0214] If the application owner signs the encrypted application, the first encryption key encryption, and the authorization information of the application after encrypting the application and the first encryption key, the computing device of the application owner can send the fourth signature information, the second key signature information, and the second signature authorization information to the accelerator card when executing step 408.

[0215] When the application owner executes step 408, the application owner can send the encrypted application and the encrypted first encryption key to the accelerator card through the user. That is, the application owner can first transmit the encrypted application and the encrypted first encryption key (which can also be the encrypted third signature information and the encrypted first key signature information, or the fourth signature information and the second key signature information) to the user, and then the user loads the encrypted application and the encrypted first encryption key into the accelerator card. The application owner or user can also load the third public key into the accelerator card. The application owner can also directly send the encrypted application and the encrypted first encryption key to the accelerator card.

[0216] Step 409: After receiving the encrypted application and the encrypted first encryption key, the accelerator card can use the second private key to decrypt the encrypted first encryption key to obtain the first encryption key. Then, it can use the first encryption key to decrypt the encrypted application to obtain the application. Step 409 is an implementation of step 308.

[0217] In step 409, the application decryption process is performed inside the accelerator card, and the user cannot obtain the application. That is, the application will not be transmitted in plain text to devices outside the accelerator card, but will only be stored inside the accelerator card to avoid being obtained by the user or other parties, which can effectively ensure the security of the application.

[0218] Optionally, the accelerator card may use the second private key to decrypt the encrypted authorization key to obtain the authorization key, and use the authorization key to decrypt the encrypted authorization information of the application to obtain the authorization information of the application.

[0219] Optionally, if the encrypted application, the encrypted first encryption key, and the encrypted application authorization information are signed and protected by the application owner, the accelerator card can first use the third public key to verify the integrity of the fourth signature information, the second key signature information, and the second signature authorization information. After the verification is passed, step 409 is executed, that is, the first encryption key is obtained based on the second private key and the second key signature information, the application is obtained based on the fourth signature information and the first encryption key, and the application authorization information is obtained based on the second signature authorization information and the second private key.

[0220] If the application owner has signed the application and its authorization information before encryption, after the accelerator card executes step 409, the accelerator card can verify the integrity of the third signature information of the third public key pair and the first signature authorization information.

[0221] After obtaining the authorization information of the application, the accelerator card can also verify the legitimacy of the application based on the authorization information of the application, including but not limited to: comparing the device ID of the accelerator card in the authorization information of the application with the ID of the accelerator card stored in itself, comparing whether the current time is within the validity period, and whether the number of decryption times of the application is less than the number of decryption times in the authorization information of the application. After the legitimacy of the authorization information of the application is verified, the encrypted application is decrypted with the first encryption key to obtain and use the application.

[0222] After acquiring an application, the accelerator card can load and run the application. The accelerator card can allocate memory for the application, store the application in the memory, and run the application and perform calculations using the application. For example, the accelerator card can run the application when triggered by the user.

[0223] The application owner can also update the authorization information of the application, change the application identification, the validity period of the application, and the number of decryptions of the application, etc. After updating the authorization information of the application, the application owner can also load the updated authorization information of the application into the acceleration card. The application owner can directly load the updated authorization information of the application into the acceleration card, or use the processing method of the application authorization information in the aforementioned content to perform similar processing on the updated application authorization information (such as signing and encryption), and then load the updated application authorization information into the acceleration card. The acceleration card can then use corresponding methods (such as integrity verification and decryption) to obtain the authorization information of the updated application, and then verify the legitimacy of the application based on the updated authorization information.

[0224] In such Figure 4In the embodiment shown, the second public key and the second private key are generated by the accelerator card, and the accelerator card needs to pass the second public key to the application owner. As another possible implementation, the second public key and the second private key can also be generated by the application owner. This implementation is described below, see Figure 5 , is an application publishing method provided in an embodiment of the present application, the method comprising:

[0225] Step 501: The application owner generates a second public key and a second private key. The embodiment of the present application does not limit the manner in which the application owner generates the second public key and the second private key.

[0226] Step 502: The application owner encrypts the second private key using the first public key.

[0227] Step 503: The application owner sends the encrypted second private key to the accelerator card.

[0228] The application owner can directly load the encrypted second private key into the accelerator card, or the user can send the encrypted second private key to the accelerator card, that is, first send the encrypted second private key to the user, and then the user loads the encrypted second private key into the accelerator card.

[0229] Step 504: The accelerator card decrypts the encrypted second private key using the first private key to obtain the second private key.

[0230] Steps 501 to 504 are the process of sending the second private key to the accelerator card. After the application owner generates the second public key and imports the second private key into the accelerator card, the application owner can send the encrypted application to the accelerator card. That is, steps 501 to 504 can be executed between steps 305 and 306.

[0231] Step 505: The same as steps 407 to 409. For details, please refer to the above content and will not be repeated here.

[0232] The following uses an AI model as an example to illustrate an AI model publishing method provided in an embodiment of the present application. Figure 6 The method comprises:

[0233] Step 601: The AI ​​model owner obtains a model key and encrypts the AI ​​model using the model key. This encryption of the AI ​​model using the model key is similar to how the AI ​​model owner encrypted the application using the first encryption key in step 407. For details, please refer to the previous section and will not be repeated here.

[0234] Optionally, the AI ​​model owner may also perform signature protection before and after encrypting the AI ​​model according to the model key. The signature protection performed by the AI ​​model owner before and after encrypting the AI ​​model according to the model key is similar to the signature protection performed by the AI ​​model owner before and after encrypting the application using the first encryption key. For details, please refer to the above content and will not be repeated here.

[0235] There is no restriction on how to obtain the model key. The AI ​​model owner can generate the model key themselves or obtain it from other devices.

[0236] Step 602: The AI ​​model owner obtains the encryption key and encrypts the model key according to the encryption key.

[0237] The encryption key type is not limited here. For example, the encryption key can be a key obtained in advance from the accelerator card, such as a first public key and a second public key generated by the accelerator card. The method for the AI ​​model owner to obtain the first public key and the second public key generated by the accelerator card can be found in Figure 3 、 4 The encryption key can also be a second public key generated by the AI ​​model owner. The method for the AI ​​model owner to generate the second public key and send the second private key to the accelerator card can be found in Figure 5 The relevant descriptions in the illustrated embodiments will not be repeated here.

[0238] Step 603: The AI ​​model owner loads the encrypted AI model and the encrypted model key into the accelerator card.

[0239] In addition to loading the encrypted AI model and the encrypted model key into the accelerator card, the AI ​​model owner may also load the AI ​​model authorization information into the accelerator card. The AI ​​model owner loads the AI ​​model authorization information into the accelerator card in the same way as the AI ​​model owner loads the AI ​​model authorization information into the accelerator card. Figure 4 In the embodiment shown, the manner in which the application owner loads the application authorization information into the accelerator card is similar, and details can be found in the above description and will not be repeated here.

[0240] Step 604: The accelerator card decrypts the encrypted model key using the key corresponding to the encryption key to obtain the model key, and then decrypts the encrypted AI model using the model key to obtain the AI ​​model.

[0241] If the encryption key is the first public key, the key corresponding to the encryption key is the first private key; if the encryption key is the second public key, the key corresponding to the encryption key is the second private key.

[0242] Optionally, the accelerator card can also obtain the authorization information of the AI ​​model. The way in which the accelerator card obtains the authorization information of the AI ​​model is the same as that in Figure 4 The method of obtaining the authorization information of the application in the embodiment shown is similar, and the details can be found in the above description and will not be repeated here.

[0243] Based on the same inventive concept as the method embodiment, the embodiment of the present application further provides an application publishing device for executing the method executed by the application owner in the above method embodiment. The relevant features can be found in the above method embodiment and will not be repeated here. Figure 7 As shown, the application publishing device 700 includes a receiving unit 701 , a verification unit 702 , an encryption unit 703 , and a loading unit 704 .

[0244] The receiving unit 701 is configured to receive an application authorization request sent by the user, where the application authorization request carries a first certificate, wherein the first certificate includes a first public key and first signature information from the accelerator card.

[0245] The verification unit 702 is used to perform security verification on the first signature information.

[0246] The encryption unit 703 is configured to encrypt the application after the security verification by the verification unit is passed.

[0247] The loading unit 704 is configured to load the encrypted application into the acceleration card.

[0248] The application publishing device 700 can be used to execute Figures 3-5 The method shown in FIG. 1 is performed by all parties, wherein the receiving unit 701 can perform the following steps: Figure 3 In the embodiment shown in step 304, the application owner receives the application authorization request; the verification unit 702 may perform the following steps: Figure 3 In the embodiment shown in FIG. 305, the encryption unit 703 may perform the following steps: Figure 3 Step 306 in the embodiment shown; the loading unit 704 may execute the following Figure 3 Step 307 in the embodiment shown.

[0249] Based on the same inventive concept as the method embodiment, the embodiment of the present application also provides an application using device for executing the method executed by the accelerator card in the above method embodiment. The relevant features can be found in the above method embodiment and will not be repeated here. Figure 8 As shown, the application using device 800 includes an acquiring unit 801 , a sending unit 802 , and a decrypting unit 803 .

[0250] The acquiring unit 801 is configured to acquire a first certificate, where the first certificate includes a first public key and first signature information, and save a first private key corresponding to the first public key.

[0251] The sending unit 802 is configured to issue the first certificate, so that the application owner can perform security verification on the production side according to the first certificate.

[0252] The acquiring unit 801 is further configured to receive and load the encrypted application sent by the application owner after the security verification is passed;

[0253] The decryption unit 803 is configured to decrypt and obtain the application.

[0254] The application using device 800 can be used to execute Figures 3-5 The method performed by the accelerator card shown in FIG. 8 , wherein the acquisition unit 801 can perform the following steps: Figure 3 In the embodiment shown in FIG. 301 and FIG. 302 , the sending unit 802 may execute the following steps: Figure 3 In the embodiment shown in step 303, the method of accelerating the card to issue the first certificate; the decryption unit 803 can execute the following steps: Figure 3 Step 308 in the embodiment shown.

[0255] Based on the same inventive concept as the method embodiment, the embodiment of the present application also provides an AI model publishing device for executing the method executed by the AI ​​model owner in the above method embodiment. The relevant features can be found in the above method embodiment and will not be repeated here. Figure 9 As shown, the AI ​​model publishing device 900 includes an acquisition unit 901, an encryption unit 902, and a loading unit 903; optionally, it may also include a verification unit 904.

[0256] The acquiring unit 901 is configured to acquire a model key and an encryption key.

[0257] an encryption unit 902, configured to encrypt the AI ​​model according to the model key and encrypt the model key according to the encryption key, wherein the encryption key is generated by the accelerator card and verified by the owner of the AI ​​model;

[0258] The loading unit 903 is used to load the encrypted AI model and the encrypted model key into the accelerator card.

[0259] The AI ​​model publishing device 900 can be used to execute Figure 6 The method performed by the owner of the AI ​​model shown in FIG. 1 , wherein the acquisition unit 901 can perform the following steps: Figure 6In the embodiment shown in FIG. 6 , the AI ​​model owner obtains the model key and the encryption key in steps 601 and 602; the encryption unit 902 may execute the following steps: Figure 6 In the embodiment shown in FIG. 6 , the encryption method performed by the AI ​​model owner in steps 601 and 602 is shown; the loading unit 903 may perform the following steps: Figure 6 In the illustrated embodiment, step 603, the verification unit 904 may further verify the first signature information in the first certificate and the second signature information in the second certificate from the accelerator card.

[0260] Based on the same inventive concept as the method embodiment, the embodiment of the present application also provides an AI model using device for executing the method executed by the accelerator card in the above method embodiment. The relevant features can be found in the above method embodiment and will not be repeated here. Figure 9 As shown, the AI ​​model using device 1000 includes an acquisition unit 1001, a decryption unit 1002, and optionally, a sending unit 1003.

[0261] The acquisition unit 1001 is used to receive the encrypted AI model and the encrypted model key.

[0262] A decryption unit 1002 is configured to decrypt the encrypted model key using the stored key pair corresponding to the encryption key to obtain the model key, and then decrypt the encrypted AI model using the model key to obtain the AI ​​model;

[0263] The AI ​​model using device 1000 can be used to perform Figure 6 The method performed by the accelerator card shown in FIG. 1 , wherein the acquisition unit 1001 can perform the following steps: Figure 6 In the embodiment shown in step 603, the accelerator card obtains the encrypted AI model and the encrypted model key; the decryption unit 1002 can execute the following steps: Figure 6 In the illustrated embodiment, step 604 is shown. The sending unit 1003 may also issue a first certificate and a second certificate.

[0264] It should be noted that the division of units in the embodiments of the present application is schematic and is merely a logical functional division. In actual implementation, other division methods may be used. The functional units in the embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0265] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) or a processor to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0266] In a simple embodiment, those skilled in the art can imagine that the AI ​​model owner, application owner, and accelerator card in the above embodiment can all adopt Figure 11 The form shown.

[0267] like Figure 11 The device 1100 shown includes at least one processor 1110 , a memory 1120 , and optionally, a communication interface 1130 .

[0268] The memory 1120 may be a volatile memory, such as a random access memory (RAM); a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD), or a solid-state drive (SSD); or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but is not limited thereto. The memory 1120 may be a combination of the aforementioned memories.

[0269] The specific connection medium between the processor 1110 and the memory 1120 is not limited in the embodiment of the present application.

[0270] In such Figure 11 The device further includes a communication interface 1130. When the processor 1110 communicates with other devices, data can be transmitted through the communication interface 1130.

[0271] When the application owner adopts Figure 11 When the form shown is Figure 11The processor 1110 in the memory 1120 can call the computer execution instructions stored in the memory 1120 so that the device 1100 can execute the method executed by the application of any of the above method embodiments; for example, the device 1100 can execute Figures 3-5 In the illustrated method embodiment, the method performed by all parties is applied.

[0272] Specifically, Figure 7 The functions / implementation processes of the loading unit, acquisition unit, verification unit and encryption unit can be achieved through Figure 11 The processor 1110 in the memory 1120 calls the computer execution instructions stored in the memory 1120 to implement. Or, Figure 7 The functions / implementation of the verification unit and encryption unit in Figure 11 The processor 1110 in the memory 1120 calls the computer execution instructions stored in the memory 1120 to implement, Figure 7 The functions / implementation of the loading unit and the acquisition unit in Figure 11 This is achieved by the communication interface 1130 in .

[0273] When the accelerator card uses Figure 11 When the form shown is Figure 11 The processor 1110 in the memory 1120 can call the computer execution instruction stored in the memory 1120, so that the device 1100 can execute the method of accelerating the execution of the card in any of the above method embodiments; for example, the device 1100 can execute Figures 3 to 6 The method embodiment shown is a method performed by an accelerator card.

[0274] Specifically, Figure 8 and Figure 10 The functions / implementation processes of the acquisition unit, sending unit and decryption unit can be achieved through Figure 11 The processor 1110 in the memory 1120 calls the computer execution instructions stored in the memory 1120 to implement. Or, Figure 8 and Figure 10 The function / implementation process of the decryption unit in Figure 11 The processor 1110 in the memory 1120 calls the computer execution instructions stored in the memory 1120 to implement, Figure 8 and Figure 10 The functions / implementation of the sending unit and the acquiring unit in the Figure 11 This is achieved by the communication interface 1130 in .

[0275] When AI model owners adopt Figure 11 When the form shown is Figure 11The processor 1110 in the memory 1120 can call the computer execution instructions stored in the memory 1120 so that the device 1100 can execute the method executed by the application of any of the above method embodiments; for example, the device 1100 can execute Figure 6 The method executed by the AI ​​model owner in the method embodiment shown.

[0276] Specifically, Figure 11 The functions / implementation processes of the loading unit, acquisition unit, verification unit and encryption unit can be achieved through Figure 11 The processor 1110 in the memory 1120 calls the computer execution instructions stored in the memory 1120 to implement. Or, Figure 11 The functions / implementation of the verification unit and encryption unit in Figure 11 The processor 1110 in the memory 1120 calls the computer execution instructions stored in the memory 1120 to implement, Figure 11 The functions / implementation of the loading unit and the acquisition unit in Figure 11 This is achieved by the communication interface 1130 in .

[0277] It should be understood that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0278] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the steps in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0279] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0280] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0281] Obviously, those skilled in the art can make various changes and modifications to the embodiments of the present application without departing from the scope of the embodiments of the present application. Thus, if these modifications and variations of the embodiments of the present application fall within the scope of the claims of the present application and their equivalents, the present application also intends to include such modifications and variations.

Claims

1. An application publishing method, characterized in that: The application owner loads the application into the accelerator card to publish it to the user. The method includes: receiving an application authorization request sent by the user, where the application authorization request carries a first certificate, wherein the first certificate includes a first public key and first signature information from the accelerator card; Performing security verification on the first signature information, and after the security verification passes, encrypting the application using the first public key; The encrypted application is loaded into the acceleration card.

2. The method according to claim 1, characterized in that Before encrypting the application, the method further includes: Obtain a second certificate generated by the accelerator card, where the second certificate includes a second public key and second signature information generated by the accelerator card. Performing security verification on the second signature information, and after the security verification is successful, starting an encryption process for the application; The encrypting the application includes: obtaining the second public key in the second certificate, and encrypting the application using the second public key.

3. The method according to claim 2, characterized in that The second signature information is obtained by encrypting the first private key, and then the security verification of the second signature information includes: performing security verification on the second signature information according to the first public key.

4. The method according to claim 1, wherein The encrypting the application comprises: Generate a second public key and a second private key; The application is encrypted using the second public key, and the second private key is sent to the accelerator card.

5. The method according to claim 4, characterized in that The method further includes: encrypting the second private key using the first public key; and then sending the encrypted second private key to the acceleration card.

6. The method according to any one of claims 1 to 5, characterized in that Encrypting the application includes: generating a first encryption key, and encrypting the application according to the first encryption key; Obtain a second encryption key, and encrypt the first encryption key according to the second encryption key, where the second encryption key includes the first public key or the second public key; Then, loading the encrypted application into the acceleration card includes: loading the encrypted application and the encrypted first encryption key into the acceleration card.

7. The method according to any one of claims 1 to 5, characterized in that Before loading the encrypted application into the accelerator card, the process further includes: The encrypted application and the encrypted first encryption key are signed for protection.

8. The method according to any one of claims 1 to 5, characterized in that Before encrypting the application, the method further includes: The application is signed and protected.

9. The method according to any one of claims 1 to 5, characterized in that Also includes: generating authorization information and an authorization key for the application, and encrypting the authorization information according to the authorization key; The authorization key is encrypted according to an encryption key, and the encrypted authorization information is loaded into the acceleration card.

10. The method according to any one of claims 1 to 5, characterized in that The application includes an artificial intelligence (AI) model or a cloud application.

11. A method for using an application, characterized in that: The application owner loads the application into an accelerator card in the cloud system to publish the application to the user. The method includes: The accelerator card obtains a first certificate, where the first certificate includes a first public key and first signature information, and stores a first private key corresponding to the first public key; The accelerator card issues the first certificate, so that the user performs security verification on the application owner according to the first signature information in the first certificate; The accelerator card receives and loads the encrypted application sent by the application owner after the security verification is passed; The acceleration card decrypts and obtains the application.

12. The method according to claim 11, characterized in that The accelerator card decrypts and obtains the application, including: The acceleration card directly uses the first private key to decrypt and obtain the application.

13. The method according to claim 11, characterized in that Also includes: The accelerator card generates a second certificate, the second certificate including a second public key and second signature information, and stores a second private key corresponding to the second public key; The accelerator card issues the second certificate, so that the application owner performs security verification on the second certificate; Then, the accelerator card decrypts and obtains the application, including: The accelerator card uses the second private key associated with the second certificate to decrypt and obtain the application.

14. The method according to claim 13, characterized in that The second signature information is obtained by encrypting the first private key.

15. The method according to claim 11, characterized in that Also includes: The accelerator card receives a second private key generated by the application owner and sent by the application owner; Then, the accelerator card decrypts and obtains the application, including: The acceleration card uses the second private key to decrypt and obtain the application.

16. The method according to claim 15, characterized in that The second private key is encrypted by the first public key associated with the first certificate; The method further includes: the acceleration card decrypting the first private key to obtain the second private key.

17. The method according to any one of claims 11 to 16, characterized in that: Decrypting the accelerator card to obtain the application includes: The accelerator card decrypts the encrypted first encryption key according to a key corresponding to the second encryption key to obtain the first encryption key, where the key corresponding to the second encryption key includes the first private key or the second private key; The acceleration card decrypts the application using the first encryption key.

18. The method according to any one of claims 11 to 16, characterized in that: The method further comprises: The accelerator card decrypts the encrypted authorization key according to a key corresponding to the second encryption key to obtain the authorization key, where the key corresponding to the second encryption key includes the first private key or the second private key; The accelerator card decrypts the obtained authorization information of the application using the authorization key.

19. The method according to any one of claims 11 to 16, characterized in that: Before the accelerator card loads the encrypted application, the method further includes: The accelerator card verifies the integrity of the encrypted application, and loads the encrypted application after the verification is successful.

20. The method according to claim 18, wherein The accelerator card receives an authorization information update request sent by the application owner, wherein the authorization information update request carries the encrypted updated authorization information; The accelerator card updates the authorization information according to the authorization information update request.

21. The method according to any one of claims 11 to 16 and 20, characterized in that: The application includes an artificial intelligence (AI) model or a cloud application.

22. A method for publishing an artificial intelligence (AI) model, characterized in that: The AI ​​model owner loads the AI ​​model into an accelerator card to publish it to a user. The method includes: Obtain a model key, and encrypt the AI ​​model according to the model key; Obtaining an encryption key, and encrypting the model key according to the encryption key, wherein the encryption key is generated by the accelerator card and verified by the owner of the AI ​​model, or the encryption key is generated by the owner of the AI ​​model; The encrypted AI model and the encrypted model key are loaded into the accelerator card.

23. The method according to claim 22, characterized in that The method further comprises: Receiving the AI ​​model authorization request sent by the user, where the model authorization request includes a first certificate, the first certificate is generated and issued by the accelerator card, the first certificate includes a first public key and first signature information, and a first private key corresponding to the first public key is stored by the accelerator card; The first signature information is verified according to the root certificate, and after successful verification, the first public key is saved.

24. The method according to claim 23, wherein The obtaining of the encryption key comprises: The first public key is used as the encryption key.

25. The method according to claim 23, characterized in that The obtaining of the encryption key comprises: Triggering the accelerator card to generate a second certificate, where the second certificate includes a second public key and second signature information generated by the accelerator card, where the second signature information is encrypted using the first private key, and a second private key corresponding to the second public key is stored by the accelerator card; The second signature information is verified according to the stored first public key, and after successful verification, the second public key is used as an encryption key.

26. The method according to claim 23, wherein The obtaining of the encryption key comprises: Generate a second public key and a second private key, and use the second public key as the encryption key; The second private key is encrypted using the first public key, and the encrypted second private key is loaded into the accelerator card.

27. The method according to any one of claims 22 to 26, characterized in that: Before loading the encrypted AI model and the encrypted model key into the accelerator card, the method further includes: The encrypted AI model and the encrypted model key are signed for protection.

28. The method according to any one of claims 22 to 26, characterized in that Before encrypting the AI ​​model according to the model key, the method further includes: The AI ​​model is signed and protected.

29. The method according to any one of claims 22 to 26, characterized in that: Also includes: Generate authorization information and an authorization key for the AI ​​model, and encrypt the authorization information according to the authorization key; The authorization key is encrypted according to the encryption key, and the encrypted authorization information and the encrypted authorization key are loaded into the acceleration card.

30. The method according to claim 29, wherein Before the encrypted authorization information is loaded into the accelerator card, the method further includes: The encrypted authorization information is signed and protected.

31. The method according to claim 29, wherein Also includes: updating the authorization information; The updated authorization information is encrypted according to the encryption key, and the encrypted updated authorization information is loaded into the acceleration card.

32. The method according to any one of claims 23-26, 30, and 31, characterized in that The first public key and the first private key are generated by the accelerator card, and the first private key is encrypted and stored in the accelerator card.

33. An application publishing device, characterized in that: The device is applied to an application producer, which loads the application into an accelerator card for publishing to a user. The device includes: a receiving unit, configured to receive an application authorization request sent by the user, wherein the application authorization request carries a first certificate, wherein the first certificate includes a first public key and first signature information from the accelerator card; a verification unit, configured to perform security verification on the first signature information, an encryption unit, configured to encrypt the application using the first public key after the verification unit passes security verification; A loading unit is used to load the encrypted application into the acceleration card.

34. The device according to claim 33, characterized in that The receiving unit is further configured to obtain a second certificate generated by the accelerator card, wherein the second certificate includes a second public key and second signature information generated by the accelerator card. The verification unit is further configured to perform security verification on the second signature information; The encryption unit is further configured to start an encryption process for the application after the security verification by the verification unit is successful; When encrypting the application, the encryption unit is specifically configured to: obtain the second public key in the second certificate, and use the second public key to encrypt the application.

35. The device according to claim 34, characterized in that The second signature information is obtained by encrypting the first private key, and then the security verification of the second signature information includes: performing security verification on the second signature information according to the first public key.

36. The device according to claim 33, characterized in that The encryption unit is specifically used to: Generate a second public key and a second private key; encrypting the application using the second public key; The loading unit is further configured to send the second private key to the acceleration card.

37. The device according to claim 36, characterized in that The encryption unit is further configured to encrypt the second private key using the first public key; The loading unit is further configured to send the encrypted second private key to the acceleration card.

38. The device according to any one of claims 33 to 37, characterized in that The encryption unit is specifically used to: generating a first encryption key, and encrypting the application according to the first encryption key; Obtain a second encryption key, and encrypt the first encryption key according to the second encryption key, where the second encryption key includes the first public key or the second public key; The loading unit is specifically configured to load the encrypted application and the encrypted first encryption key into the acceleration card.

39. The device according to any one of claims 33 to 37, characterized in that Before loading the encrypted application into the accelerator card, the encryption unit is further configured to: The encrypted application and the encrypted first encryption key are signed for protection.

40. The device according to any one of claims 33 to 37, characterized in that Before encrypting the application, the encryption unit is further configured to: The application is signed and protected.

41. The device according to any one of claims 33 to 37, characterized in that The encryption unit is further configured to: generating authorization information and an authorization key for the application, and encrypting the authorization information according to the authorization key; The authorization key is encrypted according to an encryption key, and the encrypted authorization information is loaded into the acceleration card.

42. The device according to any one of claims 33 to 37, characterized in that The application includes an artificial intelligence (AI) model or a cloud application.

43. An application using device, characterized in that: The application using device is applied to the accelerator card. The application owner loads the application into the accelerator card in the cloud system and publishes it to the user. The device includes: an acquiring unit, configured to acquire a first certificate, the first certificate including a first public key and first signature information, and save a first private key corresponding to the first public key; a sending unit, configured to issue the first certificate, so that the user performs security verification on the application owner according to the first signature information in the first certificate; The acquiring unit is further configured to receive and load the encrypted application sent by the application owner after the security verification is passed; A decryption unit is used for decrypting to obtain the application.

44. The device according to claim 43, characterized in that The decryption unit is specifically used to: The application is obtained by directly decrypting using the first private key.

45. The device according to claim 43, characterized in that The acquisition unit is further configured to: Generate a second certificate, the second certificate including a second public key and second signature information, and save a second private key corresponding to the second public key; The sending unit is configured to issue the second certificate so that the application owner performs security verification on the second certificate; The encryption unit is specifically used to: The application is decrypted using the second private key associated with the second certificate to obtain the application.

46. ​​The device according to claim 45, characterized in that The second signature information is obtained by encrypting the first private key.

47. The device according to claim 43, characterized in that The acquisition unit is further configured to: Receiving a second private key generated by the application owner and sent by the application owner; The encryption unit is specifically used to: The second private key is used to decrypt and obtain the application.

48. The device according to claim 47, characterized in that The second private key is encrypted by the first public key associated with the first certificate; The decryption unit is further configured to decrypt the first private key to obtain the second private key.

49. The device according to any one of claims 43 to 48, characterized in that When decrypting and obtaining the application, the decryption module is specifically used to: decrypting the encrypted first encryption key according to a key corresponding to the second encryption key to obtain the first encryption key, where the key corresponding to the second encryption key includes the first private key or the second private key; The application is decrypted using the first encryption key.

50. The device according to any one of claims 43 to 48, characterized in that Decryption module, also used for: decrypting the encrypted authorization key according to a key corresponding to a second encryption key to obtain the authorization key, wherein the key corresponding to the second encryption key includes the first private key or the second private key; The obtained authorization information of the application is decrypted using the authorization key.

51. The device according to any one of claims 43 to 48, characterized in that Before loading the encrypted application, the acquiring unit is further configured to: The integrity of the encrypted application is verified, and after the verification is successful, the encrypted application is loaded.

52. The device according to claim 51, characterized in that The acquisition unit is further configured to: receive an authorization information update request sent by the application owner, wherein the authorization information update request carries the encrypted updated authorization information; The loading unit is further configured to update the authorization information according to the authorization information update request.

53. The device according to any one of claims 43 to 48 and 52, characterized in that The application includes an artificial intelligence (AI) model or a cloud application.

54. An artificial intelligence (AI) model publishing device, characterized in that: Applicable to the owner of an AI model, the owner of the AI ​​model loads the AI ​​model into an accelerator card to publish it to the user, the device includes: an acquiring unit, configured to acquire a model key and an encryption key, wherein the encryption key is generated by the accelerator card and verified by the owner of the AI ​​model, or the encryption key is generated by the owner of the AI ​​model; an encryption unit, configured to encrypt the AI ​​model according to the model key and encrypt the model key according to the encryption key; A loading unit is used to load the encrypted AI model and the encrypted model key into the accelerator card.

55. The device according to claim 54, characterized in that The device further comprises a verification unit; The acquisition unit is further configured to receive the AI ​​model authorization request sent by the user, where the model authorization request includes a first certificate, the first certificate is generated and issued by the accelerator card, the first certificate includes a first public key and first signature information generated by the accelerator card, and a first private key corresponding to the first public key is stored by the accelerator card; The verification unit is configured to verify the first signature information based on the root certificate, and save the first public key after successful verification.

56. The device according to claim 55, characterized in that When acquiring the encryption key, the acquiring unit is specifically used to: The first public key is used as the encryption key.

57. The device according to claim 55, characterized in that The obtaining unit obtains the encryption key, and is used to: Triggering the accelerator card to generate a second certificate, where the second certificate includes a second public key and second signature information generated by the accelerator card, where the second signature information is encrypted using the first private key, and a second private key corresponding to the second public key is stored by the accelerator card; The verification unit is further configured to verify the second signature information based on the stored first public key; The acquisition unit is further configured to use the second public key as an encryption key after the verification by the verification unit succeeds.

58. The device according to claim 55, characterized in that When acquiring the encryption key, the acquiring unit is specifically used to: Generate a second public key and a second private key, and use the second public key as the encryption key; The second private key is encrypted using the first public key, and the encrypted second private key is loaded into the accelerator card.

59. The device according to any one of claims 54 to 58, characterized in that Before the loading unit loads the encrypted AI model and the encrypted model key into the accelerator card, the encryption unit is further configured to: The encrypted AI model and the encrypted model key are signed for protection.

60. The device according to any one of claims 54 to 58, characterized in that Before encrypting the AI ​​model according to the model key, the encryption unit is further configured to: The AI ​​model is signed and protected.

61. The device according to any one of claims 54 to 58, characterized in that The acquisition unit is further configured to generate authorization information and an authorization key of the AI ​​model, and encrypt the authorization information according to the authorization key; The encryption unit is further configured to encrypt the authorization key according to the encryption key; The loading unit is further configured to load the encrypted authorization information and the encrypted authorization key into the acceleration card.

62. The device according to claim 61, characterized in that Before loading the encrypted authorization information into the accelerator card, the encryption unit is further configured to: The encrypted authorization information is signed and protected.

63. The device according to claim 61, characterized in that The encryption unit is further configured to: update the authorization information; and encrypt the updated authorization key according to the encryption key; The loading unit is further configured to load the encrypted and updated authorization information into the acceleration card.

64. The device according to any one of claims 54-58, 62, and 63, characterized in that The first public key and the first private key are generated by the accelerator card, and the first private key is encrypted and stored in the accelerator card.

65. A computing device, characterized in that The computing device includes a memory and a processor, wherein the memory is used to store computer instructions; the processor calls the computer instructions stored in the memory to execute any one of the methods described in claims 1 to 10.

66. A computing device, characterized in that The computing device includes a memory and a processor, wherein the memory is used to store computer instructions; the processor calls the computer instructions stored in the memory to execute any one of the methods described in claims 11 to 21.

67. A computing device, characterized in that The computing device includes a memory and a processor, wherein the memory is used to store computer instructions; the processor calls the computer instructions stored in the memory to execute any one of the methods described in claims 22 to 32.

68. A computer storage medium, characterized in that The method comprises instructions, which, when executed on a computer, cause the computer to execute the method according to any one of claims 1 to 10.

69. A computer storage medium, characterized in that The method comprises instructions, which, when executed on a computer, cause the computer to execute the method according to any one of claims 11 to 21.

70. A computer storage medium, characterized in that The method comprises instructions which, when executed on a computer, cause the computer to execute the method according to any one of claims 22 to 32.

Images