A method and terminal for protecting a model in a computing stick

Abstract

The present invention discloses a method and a terminal for protecting a model in a computing stick. The method comprises receiving a data inference request sent by a host computer, wherein the data inference request includes data to be processed; reading an encrypted AI model according to the data inference request, and decrypting the encrypted AI model in a trusted execution environment to obtain an AI model; using the AI ​​model to perform inference calculation on the data to be processed to obtain an inference result; sending the inference result to the host computer, deploying the AI ​​model on the computing stick, and decrypting the encrypted AI model in the trusted execution environment when data inference is required. Since the outside world cannot access the trusted execution environment, the outside world cannot access the model decryption process, thereby ensuring that the model data will not be leaked, and the reading, decryption, and inference of the model are all performed in the computing stick, without any interaction of model data with the host computer, thereby improving the security of the model data.

Description

Technical Field

[0001] The present invention relates to the technical field of data security, and in particular to a method and a terminal for protecting a model in a computing stick. Background Art

[0002] For AI (Artificial Intelligence) manufacturers, AI neural network models not only embody the wisdom and efforts of the company's AI engineers, but also consume a huge amount of data to train the model. These data are often paid for or collected with great effort, so AI model data protection is crucial for each AI manufacturer. In terms of computing power, many manufacturers use computing sticks as AI computing power acceleration co-processors to improve the computing power of neural network reasoning and speed up AI reasoning operations. Therefore, in the process of using computing sticks to accelerate AI computing power, how to effectively protect the AI ​​neural network model from being cracked and misused by others is a problem that all companies are very concerned about.

[0003] At present, the general-purpose computing sticks on the market exist as AI computing acceleration co-processing units of the host computer, such as Figure 3 As shown in the figure, the AI ​​program and AI neural network model are on the host PC. The PC first initializes the AI ​​neural network model through the AI ​​program, and transfers the model to the computing stick via USB to complete the model deployment. Then the PC obtains the real-time image data collected by the camera, and sends the image data to the computing stick after pre-processing. The computing stick uses the deployed model to complete the AI ​​reasoning, and then transmits the result of the reasoning calculation back to the PC to complete the entire image recognition processing process.

[0004] In the case of batch application deployment, it is difficult to personalize and encrypt the AI ​​neural network model of each host computer due to the universality of the AI ​​development tools provided by the compute stick manufacturers. Even if the model is encrypted, the model on the host computer must be read, decrypted, and then transferred to the compute stick before AI data inference acceleration can begin. Therefore, there is a risk of being cracked in the storage, loading, and transmission of the model. Summary of the invention

[0005] The technical problem to be solved by the present invention is to provide a method and a terminal for protecting a model in a computing stick, which can improve the security of model data.

[0006] In order to solve the above technical problems, a technical solution adopted by the present invention is:

[0007] A method for protecting a model in a computing stick, comprising:

[0008] Receiving a data inference request sent by a host computer, wherein the data inference request includes data to be processed;

[0009] Reading the encrypted AI model according to the data inference request, and decrypting the encrypted AI model in a trusted execution environment to obtain an AI model;

[0010] Use the AI ​​model to perform inference calculation on the data to be processed to obtain an inference result;

[0011] The inference result is sent to the host computer.

[0012] In order to solve the above technical problems, another technical solution adopted by the present invention is:

[0013] A terminal for protecting a model in a computing stick comprises a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the following steps are implemented:

[0014] Receiving a data inference request sent by a host computer, wherein the data inference request includes data to be processed;

[0015] Reading the encrypted AI model according to the data inference request, and decrypting the encrypted AI model in a trusted execution environment to obtain an AI model;

[0016] Use the AI ​​model to perform inference calculation on the data to be processed to obtain an inference result;

[0017] The inference result is sent to the host computer.

[0018] The beneficial effects of the present invention are: reading the encrypted AI model according to the data inference request sent by the host computer, decrypting the encrypted AI model in the trusted execution environment to obtain the AI ​​model, using the AI ​​model to perform inference calculations on the data to be processed in the request, and finally sending the inference results to the host computer. Unlike the prior art, the AI ​​model is no longer deployed on the host computer, but on the computing stick. When data inference is required, the encrypted AI model is decrypted in the trusted execution environment. Since the outside world cannot access the trusted execution environment, the outside world cannot access the model decryption process, which ensures that the model data will not be leaked. Moreover, the reading, decryption, and inference of the model are all performed in the computing stick, and there is no interaction of model data with the host computer, thereby improving the security of the model data. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 A flowchart of a method for protecting a model in a computing stick according to an embodiment of the present invention;

[0020] Figure 2 It is a structural schematic diagram of a terminal for protecting a model in a computing stick according to an embodiment of the present invention;

[0021] Figure 3This is a schematic diagram of data interaction between a computing stick and a host computer in the prior art;

[0022] Figure 4 A flowchart of encryption and decryption of an AI model on a computing stick in a method for protecting a model on a computing stick according to an embodiment of the present invention;

[0023] Figure 5 A schematic diagram of data interaction between a computing stick and a host computer in a method for protecting a model in a computing stick according to an embodiment of the present invention;

[0024] Figure 6 This is a schematic diagram of data inference calculation performed by a computing stick and a host computer in a method for protecting a model in a computing stick according to an embodiment of the present invention. DETAILED DESCRIPTION

[0025] In order to explain the technical content, achieved objectives and effects of the present invention in detail, the following is an explanation in combination with the implementation modes and the accompanying drawings.

[0026] Please refer to Figure 1 , an embodiment of the present invention provides a method for protecting a model in a computing stick, comprising:

[0027] Receiving a data inference request sent by a host computer, wherein the data inference request includes data to be processed;

[0028] Reading the encrypted AI model according to the data inference request, and decrypting the encrypted AI model in a trusted execution environment to obtain an AI model;

[0029] Use the AI ​​model to perform inference calculation on the data to be processed to obtain an inference result;

[0030] The inference result is sent to the host computer.

[0031] From the above description, it can be seen that the beneficial effects of the present invention are: reading the encrypted AI model according to the data inference request sent by the host computer, and decrypting the encrypted AI model in the trusted execution environment to obtain the AI ​​model, using the AI ​​model to perform inference calculations on the data to be processed in the request, and finally sending the inference results to the host computer. Unlike the prior art, the AI ​​model is no longer deployed on the host computer, but on the computing stick. When data inference is required, the encrypted AI model is decrypted in the trusted execution environment. Since the outside world cannot access the trusted execution environment, the outside world cannot access the model decryption process, which ensures that the model data will not be leaked, and the reading, decryption, and inference of the model are all performed in the computing stick, and there is no interaction of model data with the host computer, thereby improving the security of the model data.

[0032] Furthermore, before receiving the data inference request sent by the host computer, the process includes:

[0033] Receiving a model burning request, wherein the model burning request includes an AI model;

[0034] The AI ​​model is encrypted in a trusted execution environment according to the model burning request to obtain an encrypted AI model.

[0035] From the above description, it can be seen that the AI ​​model is not stored on the host computer, but is solidified on the computing stick. The outside world cannot directly access the model data. The AI ​​model is encrypted in the trusted execution environment on the computing stick, and then the encrypted AI model is obtained. The encryption process is completed inside the computing stick, avoiding model leakage.

[0036] Further, encrypting the AI ​​model in a trusted execution environment according to the model burning request to obtain the encrypted AI model includes:

[0037] Obtaining a hardware unique key in a trusted execution environment according to the model burning request;

[0038] Generate an encryption key corresponding to the AI ​​model according to the hardware unique key, and save the encryption key in the trusted execution environment;

[0039] The AI ​​model is encrypted using the encryption key in the trusted execution environment to obtain an encrypted AI model.

[0040] From the above description, it can be seen that when encrypting the model, the hardware unique key in the trusted execution environment is obtained, and the encryption key corresponding to the AI ​​model is generated according to the hardware unique key. The encryption key is saved in the trusted execution environment, and the AI ​​model is encrypted using the encryption key. The encryption key is used to generate the encryption and decryption key according to the hardware unique key, which ensures the uniqueness of the key. The hardware unique key on each computing stick is different. The encryption key is used for encryption to achieve personalized encryption of the model. The encryption key is stored in the trusted execution environment. Even if the encrypted AI model is copied, there is no need to worry about the risk of the model being cracked due to the leakage of the encryption key, thereby ensuring the security of the model data.

[0041] Furthermore, decrypting the encrypted AI model in a trusted execution environment to obtain the AI ​​model includes:

[0042] The encrypted AI model is decrypted using the encryption key in a trusted execution environment to obtain an AI model.

[0043] From the above description, it can be seen that during decryption, the encrypted AI model is decrypted using an encryption key in a trusted execution environment, that is, the model can only be decrypted on the computing stick, which improves the security of the model.

[0044] Furthermore, the encrypted AI model is stored in the eMMC.

[0045] From the above description, it can be seen that eMMC provides multiple partitions, and the storage partition of the encrypted AI model can be selected according to different needs. In addition, the encrypted AI model is stored in the eMMC, and even if the model is obtained by others, it cannot be cracked, thus ensuring the security of the model data.

[0046] Please refer to Figure 2 , a terminal for protecting a model in a computing stick, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the following steps when executing the computer program:

[0047] Receiving a data inference request sent by a host computer, wherein the data inference request includes data to be processed;

[0048] Reading the encrypted AI model according to the data inference request, and decrypting the encrypted AI model in a trusted execution environment to obtain an AI model;

[0049] Use the AI ​​model to perform inference calculation on the data to be processed to obtain an inference result;

[0050] The inference result is sent to the host computer.

[0051] From the above description, it can be seen that the beneficial effects of the present invention are: reading the encrypted AI model according to the data inference request sent by the host computer, and decrypting the encrypted AI model in the trusted execution environment to obtain the AI ​​model, using the AI ​​model to perform inference calculations on the data to be processed in the request, and finally sending the inference results to the host computer. Unlike the prior art, the AI ​​model is no longer deployed on the host computer, but on the computing stick. When data inference is required, the encrypted AI model is decrypted in the trusted execution environment. Since the outside world cannot access the trusted execution environment, the outside world cannot access the model decryption process, which ensures that the model data will not be leaked, and the reading, decryption, and inference of the model are all performed in the computing stick, and there is no interaction of model data with the host computer, thereby improving the security of the model data.

[0052] Furthermore, before receiving the data inference request sent by the host computer, the process includes:

[0053] Receiving a model burning request, wherein the model burning request includes an AI model;

[0054] The AI ​​model is encrypted in a trusted execution environment according to the model burning request to obtain an encrypted AI model.

[0055] From the above description, it can be seen that the AI ​​model is not stored on the host computer, but is solidified on the computing stick. The outside world cannot directly access the model data. The AI ​​model is encrypted in the trusted execution environment on the computing stick, and then the encrypted AI model is obtained. The encryption process is completed inside the computing stick, avoiding model leakage.

[0056] Further, encrypting the AI ​​model in a trusted execution environment according to the model burning request to obtain the encrypted AI model includes:

[0057] Obtaining a hardware unique key in a trusted execution environment according to the model burning request;

[0058] Generate an encryption key corresponding to the AI ​​model according to the hardware unique key, and save the encryption key in the trusted execution environment;

[0059] The AI ​​model is encrypted using the encryption key in the trusted execution environment to obtain an encrypted AI model.

[0060] From the above description, it can be seen that when encrypting the model, the hardware unique key in the trusted execution environment is obtained, and the encryption key corresponding to the AI ​​model is generated according to the hardware unique key. The encryption key is saved in the trusted execution environment, and the AI ​​model is encrypted using the encryption key. The encryption key is used to generate the encryption and decryption key according to the hardware unique key, which ensures the uniqueness of the key. The hardware unique key on each computing stick is different. The encryption key is used for encryption to achieve personalized encryption of the model. The encryption key is stored in the trusted execution environment. Even if the encrypted AI model is copied, there is no need to worry about the risk of the model being cracked due to the leakage of the encryption key, thereby ensuring the security of the model data.

[0061] Furthermore, decrypting the encrypted AI model in a trusted execution environment to obtain the AI ​​model includes:

[0062] The encrypted AI model is decrypted using the encryption key in a trusted execution environment to obtain an AI model.

[0063] From the above description, it can be seen that during decryption, the encrypted AI model is decrypted using an encryption key in a trusted execution environment, that is, the model can only be decrypted on the computing stick, which improves the security of the model.

[0064] Furthermore, the encrypted AI model is stored in the eMMC.

[0065] From the above description, it can be seen that eMMC provides multiple partitions, and the storage partition of the encrypted AI model can be selected according to different needs. In addition, the encrypted AI model is stored in the eMMC, and even if the model is obtained by others, it cannot be cracked, thus ensuring the security of the model data.

[0066] The method and terminal for protecting the model in the computing stick of the present invention can be applied to computing sticks that need to protect model data, and are described below through specific implementation methods:

[0067] Embodiment 1

[0068] Please refer to Figure 1 , 4 -5. A method for protecting a model in a computing stick according to this embodiment includes:

[0069] S0. Receive a model burning request, where the model burning request includes an AI model;

[0070] Encrypting the AI ​​model in a trusted execution environment according to the model burning request to obtain an encrypted AI model;

[0071] The model burning request also includes an AI program. The AI ​​model and the AI ​​program are burned into the eMMC storage of the computing stick before the computing stick leaves the factory, and encrypted deployment is completed in a trusted execution environment.

[0072] Specifically, Figure 4 As shown, the computing stick initializes the AI ​​program and obtains the hardware unique key (HUK, HardwareUniqueKey) in the trusted execution environment (TEE, Trusted Execution Environment) according to the model burning request;

[0073] Generate an encryption key corresponding to the AI ​​model according to the hardware unique key, and save the encryption key in the trusted execution environment;

[0074] Encrypting the AI ​​model using the encryption key in the trusted execution environment to obtain an encrypted AI model;

[0075] The encrypted AI model is transmitted to a mobile device universal environment (REE, Rich Execution Environment), and the encrypted AI model is stored in an eMMC;

[0076] In an optional implementation, the CPU model of the computing stick is RK1808, which has ARMtrustzone (a system-wide security method) technology; ARMtrustzone is the system operating environment divided into TEE and REE, and all security resources can only be accessed by TEE, but not by REE; the computing stick stores the hardware unique key HUK in the secure world TEE, and the generated encryption key is also stored in the memory of the secure world TEE; ordinary users in REE cannot access the encryption key and the encryption and decryption process, nor the original model file, thereby improving the security of the model data;

[0077] S1. Receive a data inference request sent by a host computer, where the data inference request includes data to be processed;

[0078] Specifically, Figure 5 As shown, the host computer obtains the initial data collected by the camera, and pre-processes the initial data to obtain the data to be processed; generates a data inference request according to the data to be processed, and sends the data inference request to the computing stick via USB;

[0079] The computing stick receives a data inference request sent by a host computer;

[0080] S2. Read the encrypted AI model according to the data inference request, and decrypt the encrypted AI model in a trusted execution environment to obtain an AI model;

[0081] Specifically, Figure 4 As shown, the computing stick uses the encryption key to decrypt the encrypted AI model in the trusted execution environment to obtain the AI ​​model;

[0082] S3. Use the AI ​​model to perform inference calculation on the data to be processed to obtain an inference result;

[0083] Specifically, the AI ​​program calls the AI ​​model to perform inference calculation on the data to be processed to obtain an inference result;

[0084] S4, sending the inference result to the host computer;

[0085] Specifically, Figure 5 As shown, the computing stick sends the inference result to the host computer;

[0086] The host computer processes the inference result (i.e. Figure 5 post-processing the calculation results in the above step to obtain AI reasoning calculation results corresponding to the data to be processed;

[0087] Figure 6It shows how the host computer (PC) and the computing stick perform data inference and calculation. It can be seen that the host computer collects audio and video data, pre-processes the collected audio and video data, and then transmits it to the computing stick. The computing stick performs inference based on the AI ​​model to obtain the inference result, and uploads the inference result to the host computer. The host computer post-processes the inference result to obtain the AI ​​inference calculation result. There is no interaction of model data between the computing stick and the host computer, which improves the security of the model data.

[0088] Embodiment 2

[0089] Please refer to Figure 2 A terminal for protecting a model in a computing stick includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the processor implements the various steps of the method for protecting a model in a computing stick in Embodiment 1.

[0090] In summary, the present invention provides a method and terminal for protecting a model in a computing stick. The method obtains a hardware unique key in a trusted execution environment according to a received model burning request; generates an encryption key corresponding to the AI ​​model according to the hardware unique key, and saves the encryption key in the trusted execution environment; uses the encryption key in the trusted execution environment to encrypt the AI ​​model to obtain an encrypted AI model, thereby ensuring the uniqueness of the key. The hardware unique keys on each computing stick are different from each other. The encryption key is used for encryption to achieve personalized encryption of the model. The encryption key is stored in the trusted execution environment. Even if the encrypted AI model is copied, there is no need to worry about the risk of the model being cracked due to the leakage of the encryption key; the data sent by the host computer is received and pushed. A data reasoning request is made, wherein the data reasoning request includes data to be processed; the encrypted AI model is read according to the data reasoning request, and the encrypted AI model is decrypted using the encryption key in a trusted execution environment to obtain an AI model; the AI ​​model is used to perform reasoning calculations on the data to be processed to obtain a reasoning result; the reasoning result is sent to the host computer, and the AI ​​model is deployed on the computing stick. When data reasoning is required, the encrypted AI model is decrypted in the trusted execution environment. Since the outside world cannot access the trusted execution environment, the outside world cannot access the model decryption process, thereby ensuring that the model data will not be leaked, and the reading, decryption, and reasoning of the model are all performed in the computing stick, and there is no interaction of model data with the host computer, thereby improving the security of the model data.

[0091] The above descriptions are merely embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent transformations made using the contents of the present invention's specification and drawings, or directly or indirectly applied in related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A method for protecting a model in a computing stick, characterized in that: include: Receiving a model burning request, wherein the model burning request includes an AI model; The method comprises: obtaining a hardware unique key in the trusted execution environment according to the model writing request, generating an encryption key corresponding to the AI ​​model according to the hardware unique key and storing the encryption key in the trusted execution environment, and encrypting the AI ​​model using the encryption key in the trusted execution environment to obtain the encrypted AI model; Receiving a data inference request sent by a host computer, wherein the data inference request includes data to be processed; Reading the encrypted AI model according to the data inference request, and decrypting the encrypted AI model in a trusted execution environment to obtain an AI model; Use the AI ​​model to perform inference calculation on the data to be processed to obtain an inference result; Sending the inference result to the host computer, The encryption, reading, decryption and reasoning are all performed in the computing stick.

2. The method for protecting a model in a computing stick according to claim 1, characterized in that: Decrypting the encrypted AI model in a trusted execution environment to obtain the AI ​​model includes: The encrypted AI model is decrypted using the encryption key in a trusted execution environment to obtain an AI model.

3. The method for protecting a model in a computing stick according to claim 1 or 2, characterized in that: The encrypted AI model is stored in the eMMC.

4. A terminal for protecting a model in a computing stick, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the following steps are implemented: Receiving a model burning request, wherein the model burning request includes an AI model; Encrypting the AI ​​model in a trusted execution environment according to the model burning request to obtain an encrypted AI model, including: obtaining a hardware unique key in the trusted execution environment according to the model burning request, generating an encryption key corresponding to the AI ​​model according to the hardware unique key and saving the encryption key in the trusted execution environment, and encrypting the AI ​​model using the encryption key in the trusted execution environment to obtain the encrypted AI model; Receiving a data inference request sent by a host computer, wherein the data inference request includes data to be processed; Reading the encrypted AI model according to the data inference request, and decrypting the encrypted AI model in a trusted execution environment to obtain an AI model; Use the AI ​​model to perform inference calculation on the data to be processed to obtain an inference result; Sending the inference result to the host computer, The encryption, reading, decryption and reasoning are all performed in the computing stick.

5. The terminal for protecting the model in the computing stick according to claim 4, characterized in that: Decrypting the encrypted AI model in a trusted execution environment to obtain the AI ​​model includes: The encrypted AI model is decrypted using the encryption key in a trusted execution environment to obtain an AI model.

6. The terminal for protecting the model in the computing stick according to claim 4 or 5, characterized in that: The encrypted AI model is stored in the eMMC.

Images