A model protection method, a data processing method, an apparatus, a device, and a medium

Abstract

The application discloses a model protection method, a data processing method, an apparatus, a device and a medium, and aims to improve the security protection of a model. In the application, a cloud device can determine a first sub-model in a target model saved to a TEE of a terminal device, and send the first sub-model to the terminal device. The terminal device can save the first sub-model to a trusted execution environment TEE of the terminal device. Since the TEE can ensure data processing in a trusted environment, the model can be effectively protected when the model saved in the TEE of the terminal device is used to process data to be processed, and the security of the model is ensured. In addition, the application can also process the data to be processed in the terminal device without sending the data to be processed to the cloud device through a network for processing, so that the security of the data to be processed can also be ensured, and the security of the data to be processed and the security of the model can be considered.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computers, and in particular to a model protection method, a data processing method, an apparatus, an equipment and a medium. BACKGROUND

[0002] In recent years, artificial intelligence technology has achieved great success in many fields, and many enterprises deploy pre-trained neural network models and other models in products to improve efficiency. Model designers need to spend a lot of labor to train models, and usually need to complete training based on large-scale data sets and huge computing resources.

[0003] However, the security protection problem of the model is a big problem faced by many enterprises at present. For example, if the model security protection is not proper during the model processing data process, the model parameters, model structure and other information of the model may be leaked, or even maliciously tampered with. Therefore, how to improve the security protection of the model is a technical problem that needs to be solved at present. SUMMARY

[0004] The present application provides a model protection method, a data processing method, an apparatus, an equipment and a medium to improve the security protection of the model.

[0005] In a first aspect, the present application provides a model protection method, which comprises:

[0006] If a model dispatch request sent by a terminal device is received, first identification information of a target model, a target size of data to be processed and attribute parameters of a trusted execution environment (TEE) of the terminal device carried in the model dispatch request are obtained, wherein the attribute parameters include at least one of a secure storage space and a secure running memory.

[0007] The target model corresponding to the first identification information is obtained, and a target attribute parameter corresponding to the target size is determined according to a predetermined corresponding relationship between data sizes and attribute parameters of the target model.

[0008] According to the target attribute parameter and the attribute parameters of the TEE of the terminal device, a first sub-model in the target model saved in the TEE of the terminal device is determined.

[0009] The first sub-model is sent to the terminal device, so that the terminal device saves the first sub-model in the TEE of the terminal device.

[0010] In a second aspect, the present application provides a data processing method, which comprises:

[0011] receive a data processing instruction, wherein the data processing instruction carries to-be-processed data and a target data type of the to-be-processed data; determine a target model corresponding to the target data type according to a saved correspondence between data types and models;

[0012] send a model distribution request to a cloud device, wherein the model distribution request carries first identification information of the target model, a target size of the to-be-processed data, and attribute parameters of a trusted execution environment (TEE) of the terminal device; the attribute parameters include at least one of a secure storage space and a secure running memory.

[0013] receive a first sub-model sent by the cloud device, and save the first sub-model in the TEE; the first sub-model is obtained by the cloud device according to the first identification information, and is a target model corresponding to the first identification information; the target model is determined according to a correspondence between a predetermined data size and attribute parameters of the target model; the first sub-model is determined according to the target attribute parameters and the attribute parameters of the TEE of the terminal device.

[0014] process the to-be-processed data based on the first sub-model.

[0015] In a third aspect, the present application provides a model protection device, which comprises:

[0016] a first receiving module, configured to, if a model distribution request sent by a terminal device is received, obtain first identification information of a target model, a target size of to-be-processed data, and attribute parameters of a trusted execution environment (TEE) of the terminal device carried in the model distribution request; the attribute parameters include at least one of a secure storage space and a secure running memory.

[0017] a first determining module, configured to obtain a target model corresponding to the first identification information, and determine target attribute parameters corresponding to the target size according to a correspondence between a predetermined data size and attribute parameters of the target model.

[0018] a second determining module, configured to determine a first sub-model in the target model saved in the TEE of the terminal device according to the target attribute parameters and the attribute parameters of the TEE of the terminal device.

[0019] a sending module, configured to send the first sub-model to the terminal device, so that the terminal device saves the first sub-model in the TEE of the terminal device.

[0020] In a fourth aspect, the present application provides a data processing device, which comprises:

[0021] a second receiving module, configured to receive a data processing instruction, wherein the data processing instruction carries to-be-processed data and a target data type of the to-be-processed data; and determine a target model corresponding to the target data type according to a saved correspondence between data types and models;

[0022] a requesting module, configured to send a model dispatching request to a cloud device, wherein the model dispatching request carries first identification information of a target model, a target size of to-be-processed data, and attribute parameters of a trusted execution environment (TEE) of the terminal device; and the attribute parameters include at least one of a secure storage space and a secure running memory.

[0023] a saving module, configured to receive a first sub-model sent by the cloud device, and save the first sub-model in the TEE; wherein the first sub-model is determined by the cloud device according to the first identification information, the target model corresponding to the first identification information, a predetermined correspondence between data sizes and attribute parameters of the target model, the target size corresponding to the target attribute parameter, the target attribute parameter, and the attribute parameters of the TEE of the terminal device.

[0024] a processing module, configured to process the to-be-processed data based on the first sub-model.

[0025] In a fifth aspect, the present application provides an electronic device, which comprises at least a processor and a memory, and the processor is configured to implement the steps of the model protection method according to any one of the above aspects, or implement the steps of the model protection method according to any one of the above aspects.

[0026] In a sixth aspect, the present application provides a computer readable storage medium, which stores a computer program, and the computer program is configured to implement the steps of the model protection method according to any one of the above aspects, or implement the steps of the model protection method according to any one of the above aspects when executed by a processor.

[0027] In a seventh aspect, the present application provides a computer program product, which comprises computer program code, and the computer program code is configured to make a computer execute the steps of the model protection method according to any one of the above aspects, or implement the steps of the model protection method according to any one of the above aspects when the computer program code is executed on the computer.

[0028] In this embodiment, the cloud device can identify the first sub-model stored in the TEE (Trusted Execution Environment) of the terminal device within the target model, and send the first sub-model to the terminal device. The terminal device can then store the first sub-model in its Trusted Execution Environment (TEE). Since the TEE ensures data processing occurs in a trusted environment, this embodiment effectively protects the model's security when processing data based on the model stored in the terminal device's TEE. Furthermore, this embodiment ensures that data is processed on the terminal device without needing to send it to the cloud device via a network, thus guaranteeing the security of the data being processed. In short, this application balances the security of both the data being processed and the model. Attached Figure Description

[0029] To more clearly illustrate the implementation methods in the embodiments of this application or related technologies, the accompanying drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the accompanying drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings.

[0030] Figure 1 A schematic diagram of a first-model protection process provided by some embodiments is shown;

[0031] Figure 2a A schematic diagram of a target model structure provided by some embodiments is shown;

[0032] Figure 2b A schematic diagram of a first sub-model structure provided by some embodiments is shown;

[0033] Figure 2c A schematic diagram of a second sub-model structure provided by some embodiments is shown;

[0034] Figure 3a A schematic diagram of another target model structure provided by some embodiments is shown;

[0035] Figure 3b A schematic diagram of another first sub-model structure provided by some embodiments is shown;

[0036] Figure 3c A schematic diagram of another second sub-model structure provided by some embodiments is shown;

[0037] Figure 4 A schematic diagram of a first data processing procedure provided by some embodiments is shown;

[0038] Figure 5 A schematic diagram of a second data processing procedure provided in some embodiments is shown;

[0039] Figure 6 A third data processing process schematic diagram provided by some embodiments is shown;

[0040] Figure 7 A fourth data processing process schematic diagram provided by some embodiments is shown;

[0041] Figure 8 A model protection device schematic diagram provided by some embodiments is shown;

[0042] Figure 9 A data processing device schematic diagram provided by some embodiments is shown;

[0043] Figure 10 An electronic device structure schematic diagram provided by some embodiments is shown. DETAILED DESCRIPTION

[0044] In order to improve the security protection of the model, the present application provides a model protection method, a data processing method, a device, equipment and a medium.

[0045] In order to make the purpose and implementation of the present application clearer, the present application will be described clearly and completely below in conjunction with the drawings in the exemplary embodiments of the present application. Obviously, the described exemplary embodiments are only some of the embodiments of the present application, not all of the embodiments.

[0046] It should be noted that the brief description of the terms in the present application is only for the convenience of understanding the subsequently described embodiments, and is not intended to limit the embodiments of the present application. Unless otherwise specified, these terms should be understood according to their ordinary and general meanings.

[0047] The terms "first", "second", "third" and the like in the specification and claims of the present application and the above drawings are used to distinguish similar or similar objects or entities, and do not necessarily mean a specific order or sequence, unless otherwise noted. It should be understood that the terms used in this way can be interchanged under appropriate circumstances.

[0048] The terms "include" and "have" and any variations thereof are intended to cover but not exclusive inclusion, for example, a product or device including a series of components does not necessarily limit to all components clearly listed, but can include other components not clearly listed or inherent to these products or devices.

[0049] The term "module" refers to any known or later developed hardware, software, firmware, artificial intelligence, fuzzy logic or combination of hardware or / and software code capable of performing functions associated with that element.

[0050] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, and not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that they can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement for part or all of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present application.

[0051] For the convenience of explanation, the above description has been made in conjunction with specific embodiments. However, the above exemplary discussion is not intended to exhaust or limit the embodiments to the specific forms disclosed above. Various modifications and variations can be derived according to the above teachings. The selection and description of the above embodiments are to better explain the principles and practical applications, so that those skilled in the art can better use the embodiments and various different modified embodiments suitable for specific use considerations.

[0052] The design idea of the embodiments of the present application will be briefly introduced as follows:

[0053] In one possible embodiment, considering that if the complete model trained is saved in a cloud device such as a cloud server, the cloud service provider of the cloud device can provide services for users by providing only one interface (users can process the to-be-processed data based on the model), thereby ensuring that the user cannot access the model parameters, model structure and other data information of the model, and effectively ensuring the security (privacy) of the model. Therefore, the complete model trained can be saved in the cloud device.

[0054] Since if the complete model is saved in the cloud device, if the user needs to process the to-be-processed data based on the model, the to-be-processed data also needs to be uploaded to the cloud device through the network, etc., so as to process the to-be-processed data based on the model saved in the cloud device. However, the way of uploading the to-be-processed data to the cloud device through the network, etc., to process the to-be-processed data based on the model saved in the cloud device, on the one hand, there is a risk that the to-be-processed data of the user may be leaked; on the other hand, transmitting the to-be-processed data through the network, etc., needs to consume a certain amount of time, and there is a problem of low data processing efficiency.

[0055] In a possible implementation, in order to ensure the security of the data to be processed and improve the data processing efficiency, the model can be stored in a terminal device (such as an edge artificial intelligence device) used by the user. When the model is stored in the terminal device, because the data to be processed and the model are both stored in the same terminal device, it is not necessary to perform network transmission on the data to be processed, and therefore the security of the data to be processed can be effectively ensured, and the data processing efficiency can be improved. However, if the trained model is stored in the terminal device, how to protect the model to ensure that the model parameters and the model structure of the model are not leaked is also a problem.

[0056] In summary, how to balance the security of the data to be processed and the security of the model is a technical problem that needs to be solved at present.

[0057] Therefore, embodiments of the present application provide a model protection method, a data processing method, an apparatus, a device and a medium. The model protection method, the data processing method, the apparatus, the device and the medium provided by the embodiments of the present application are introduced as follows.

[0058] Embodiment 1

[0059] Figure 1 A first model protection process provided by some embodiments is shown, and the process includes the following steps:

[0060] S101: If a model distribution request sent by a terminal device is received, first identification information of a target model, a target size of data to be processed and attribute parameters of a trusted execution environment (TEE) of the terminal device carried in the model distribution request are acquired; wherein the attribute parameters include at least one of a secure storage space and a secure running memory.

[0061] The model protection method provided by the embodiments of the present application is applied to a cloud server or other cloud device.

[0062] In a possible implementation, when the user needs to process the data to be processed, the user can send a model distribution request to the cloud device through the terminal device. In a possible implementation, the model distribution request can carry identification information (for convenience, referred to as first identification information) of a model (for convenience, referred to as a target model) applicable to the data to be processed, a data size (for convenience, referred to as a target size) of the data to be processed and attribute parameters of a trusted execution environment (Trusted Execution Environment, TEE) of the terminal device. Exemplarily, the attribute parameters of the TEE can include at least one of a secure storage space and a secure running memory of the TEE.

[0063] After receiving the model dispatch request sent by the terminal device, the cloud device can obtain the first identification information of the target model, the target size of the data to be processed, and the attribute parameters of the trusted execution environment (TEE) of the terminal device carried in the model dispatch request.

[0064] S102: Obtain the target model corresponding to the first identification information, and determine the target attribute parameters corresponding to the target size according to the correspondence between the data size and the attribute parameters of the target model determined in advance.

[0065] In a possible implementation, the cloud device can obtain the model corresponding to the first identification information (for the convenience of description, referred to as the target model) from the model saved by itself. Considering that the attribute parameters such as the secure storage space and the secure running memory required by the model when running will be different when the data size of the data to be processed is different, the correspondence between each data size and the attribute parameters of the model can be determined in advance and saved. The cloud device can determine the attribute parameters of the target model corresponding to the target size of the data to be processed (for the convenience of description, referred to as the target attribute parameters) according to the correspondence between the data size and the attribute parameters of the target model determined in advance.

[0066] S103: Determine the first sub-model in the target model saved to the TEE of the terminal device according to the target attribute parameters and the attribute parameters of the TEE of the terminal device.

[0067] After determining the target attribute parameters of the target model corresponding to the target size of the data to be processed, the cloud device can determine the sub-model (for the convenience of description, referred to as the first sub-model) in the target model saved to the TEE of the terminal device according to the target attribute parameters and the attribute parameters of the TEE of the terminal device.

[0068] In the determination of the first sub-model in the target model saved to the TEE of the terminal device, all or part of the processing layers of the target model (for the convenience of description, any layer in the model that can be used to process the data to be processed is referred to as a processing layer in the embodiments of the present application) can be included as the processing layers included in the first sub-model.

[0069] In a possible implementation, when the first sub-model saved in the TEE of the terminal device is determined according to the target attribute parameters and the attribute parameters of the TEE of the terminal device, it can be that when each target attribute parameter is not greater than (less than or equal to) the corresponding attribute parameter of the TEE of the terminal device, all processing layers of the target model are included in the first sub-model, that is, the target model is taken as the first sub-model. In addition, when any target attribute parameter is greater than the corresponding attribute parameter of the TEE of the terminal device, part of the processing layers in the target model are included in the first sub-model, that is, part of the target model is taken as the first sub-model.

[0070] For example, taking the attribute parameters of the secure storage space and the secure running memory as examples, it is assumed that the secure storage space of the TEE of the terminal device is 100 M, and the secure running memory is 80 M. When the target size of the data to be processed corresponds to a target model with a secure storage space of 20 M and a secure running memory of 10 M, in a possible implementation, the target model can be taken as the first sub-model.

[0071] When the target size of the data to be processed corresponds to a target model with a secure storage space of 120 M and a secure running memory of 90 M, or a target model with a secure storage space of 50 M and a secure running memory of 90 M, or a target model with a secure storage space of 120 M and a secure running memory of 10 M, part of the target model can be taken as the first sub-model.

[0072] S104: The first sub-model is sent to the terminal device, so that the terminal device saves the first sub-model in the TEE of the terminal device.

[0073] After the first sub-model saved in the TEE of the terminal device is determined, the first sub-model can be sent to the terminal device. Considering that the TEE can ensure data processing in a trusted environment, when data is processed based on the model saved in the TEE, the model can be effectively protected, and therefore, in the embodiment of the present application, after the terminal device receives the first sub-model, the terminal device can save the first sub-model in the TEE of the terminal device.

[0074] In the embodiment of the present application, the cloud device can determine the first sub-model in the target model saved in the TEE of the terminal device and send the first sub-model to the terminal device, and the terminal device can save the first sub-model in the TEE of the terminal device. Since the TEE can ensure data processing in a trusted environment, the embodiment of the present application can effectively protect the model when processing the to-be-processed data based on the model saved in the TEE of the terminal device, and ensure the security of the model. In addition, the embodiment of the present application can also ensure that the to-be-processed data is processed in the terminal device, without the need to send the to-be-processed data to the cloud device for processing through the network, thereby also ensuring the security of the to-be-processed data, that is, the present application can take into account the security of the to-be-processed data and the security of the model.

[0075] Embodiment 2

[0076] In order to take into account the security of the to-be-processed data and the security of the model, on the basis of the above-mentioned embodiments, in the embodiment of the present application, after determining the target attribute parameter corresponding to the target size, before determining the first sub-model in the target model saved in the TEE of the terminal device according to the target attribute parameter and the attribute parameter of the TEE of the terminal device, the method further comprises:

[0077] determining the processing layer of the to-be-sent model sent to the terminal device, wherein the processing layer of the to-be-sent model is all or part of the processing layer of the target model;

[0078] updating the target model by using the to-be-sent model.

[0079] In a possible implementation, after determining the target attribute parameter corresponding to the target size of the to-be-processed data, before determining the first sub-model in the target model saved in the TEE of the terminal device according to the target attribute parameter and the attribute parameter of the TEE of the terminal device, the processing layer of the to-be-sent model sent to the terminal device can also be determined, for example, all processing layers of the target model can be used as the processing layer of the to-be-sent model, or part of the processing layers of the target model can be used as the processing layer of the to-be-sent model.

[0080] Exemplarily, the processing layers included in the target model in the execution order are processing layer 1, processing layer 2, processing layer 3, processing layer 4, …, and processing layer 10, and the processing layer 1, the processing layer 2, the processing layer 3, the processing layer 4, the processing layer 5, and the processing layer 6 can be determined as the processing layers included in the to-be-sent model. Optionally, the processing layer 7, the processing layer 8, the processing layer 9, and the processing layer 10 can be determined as the sub-model (referred to as a third sub-model for convenience of description) stored in the cloud device. In a possible implementation, the processing layer 1, the processing layer 2, the processing layer 3, the processing layer 4, …, and the processing layer 10 can all be used as the processing layer of the to-be-sent model.

[0081] In a possible implementation, after the processing layers of the to-be-sent model are determined, the target model can be updated by using the to-be-sent model, that is, the target model is updated to the to-be-sent model. Then, based on the updated target model, the step of determining the first sub-model stored in the TEE of the terminal device in the target model is performed according to the target attribute parameter corresponding to the target size of the to-be-processed data and the attribute parameter of the TEE of the terminal device.

[0082] Exemplarily, still taking the above example as an example, it is assumed that the processing layers included in the target model are processing layer 1, processing layer 2, processing layer 3, processing layer 4, …, and processing layer 10, and the processing layer 7, the processing layer 8, the processing layer 9, and the processing layer 10 (a set number of processing layers in continuous execution order) are determined as the processing layers included in the sub-model (referred to as a third sub-model for convenience of description) stored in the cloud device, and the processing layer 1, the processing layer 2, the processing layer 3, the processing layer 4, the processing layer 5, and the processing layer 6 (a set number of processing layers in continuous execution order) are determined as the processing layers included in the to-be-sent model. After that, the target model can be updated by using the to-be-sent model, the target model is updated to a model including the processing layer 1, the processing layer 2, the processing layer 3, the processing layer 4, the processing layer 5, and the processing layer 6, and then the first sub-model stored in the TEE of the terminal device in the updated target model including the processing layer 1, the processing layer 2, the processing layer 3, the processing layer 4, the processing layer 5, and the processing layer 6 is determined.

[0083] It can be understood that if all the processing layers of the target model are used as the processing layer of the to-be-sent model, the to-be-sent model is a model to be sent to the terminal device, and the to-be-processed data can be processed based on the target model.

[0084] If the part processing layer of the target model is taken as the processing layer of the to-be-sent module, after the to-be-sent model is sent to the terminal device, the to-be-processed data can be processed based on the part model (the part processing layer of the target model) saved in the terminal device, and then the processing result (the intermediate processing result of the to-be-processed data) is sent to the cloud device. Then, the processing result is processed based on another part model (the third sub-model) saved in the cloud device, so that the to-be-processed data can be completely processed based on the entire model.

[0085] Since the target model can be divided into the to-be-sent module and the third sub-model saved in the cloud device, for the third sub-model saved in the cloud device, the cloud service provider of the cloud device can provide services for users by providing only one interface, and the security of the third sub-model can be ensured. In addition, the first sub-model saved in the terminal device in the to-be-sent model (the updated target model) is saved in the TEE of the terminal device, and the security of the first sub-model can also be ensured, so that the risk of leakage (theft) of the data information of the model can be effectively prevented, and the security of the model is effectively ensured. In addition, since the intermediate processing result of the to-be-processed data is transmitted to the cloud device, the risk of leakage of the to-be-processed data can also be effectively prevented, and the security of the to-be-processed data is effectively ensured. Therefore, the security of the to-be-processed data and the security of the model can also be considered.

[0086] Embodiment 3

[0087] In order to accurately determine the first sub-model, on the basis of the above embodiments, in the embodiment of the present application, the first sub-model saved in the TEE of the terminal device in the target model is determined according to the target attribute parameter and the attribute parameter of the TEE of the terminal device, and includes:

[0088] at least one first target processing layer is selected from the target model; wherein the total value of the attribute parameters of the at least one first target processing layer does not exceed the value of the attribute parameter corresponding to the TEE of the terminal device; and the first sub-model is determined based on the at least one selected first target processing layer.

[0089] In a possible implementation, the first sub-model saved in the TEE of the terminal device in the target model can be determined based on a preset constraint condition. If the processing layer contained in the first sub-model saved in the TEE is referred to as the first target processing layer, the constraint condition can be that the total value of the attribute parameters of the at least one first target processing layer selected from the target model cannot exceed the value of the attribute parameter corresponding to the TEE of the terminal device.

[0090] Exemplarily, taking the attribute parameter as the security storage space as an example, if the target size of the to-be-processed data corresponds to the security storage space of processing layer 1 in the target model as 1 megabyte, the security storage space of processing layer 2 as 2 megabytes, the security storage space of processing layer 3 as 3 megabytes, the security storage space of processing layer 4 as 4 megabytes, and so on, and the security storage space of the TEE of the terminal device is 8 megabytes, the total value of the security storage spaces of the at least one first target processing layer selected from the target model cannot exceed the value of the security storage space of the TEE of the terminal device. Exemplarily, the total value of the security storage spaces of processing layer 1, processing layer 2 and processing layer 3 is 6 megabytes, and the total value of the security storage spaces of processing layer 1, processing layer 2, processing layer 3 and processing layer 4 is 10 megabytes. Therefore, processing layer 1, processing layer 2 and processing layer 3 can be respectively taken as the first target processing layer, and the first sub-model is determined based on processing layer 1, processing layer 2 and processing layer 3. Since the total value of the security storage spaces of processing layer 1, processing layer 2, processing layer 3 and processing layer 4 exceeds the value of the security storage space of the TEE of the terminal device, the first sub-model cannot be determined based on processing layer 1, processing layer 2, processing layer 3 and processing layer 4.

[0091] In a possible implementation, after the at least one first target processing layer is selected from the target model, each other processing layer (for the convenience of description, referred to as a second target processing layer) in the target model except the first target processing layer can be determined, and then a sub-model (for the convenience of description, referred to as a second sub-model) in the target model saved into the Rich Execution Environment (REE) of the terminal device is determined based on each second target processing layer.

[0092] Exemplarily, still taking the above example as an example, taking the processing layers included in the target model (to-be-sent model) sent into the terminal device as processing layer 1, processing layer 2, processing layer 3, processing layer 4, processing layer 5 and processing layer 6, if processing layer 1, processing layer 2 and processing layer 3 are respectively taken as the first target processing layer, and the first sub-model is determined based on processing layer 1, processing layer 2 and processing layer 3, processing layer 4, processing layer 5 and processing layer 6 can be respectively taken as the second sub-model, and the second sub-model is determined based on processing layer 4, processing layer 5 and processing layer 6.

[0093] After the first sub-model and the second sub-model are determined, the first sub-model and the second sub-model can be sent to the terminal device, so that the terminal device saves the first sub-model in the TEE of the terminal device and saves the second sub-model in the REE of the terminal device.

[0094] Embodiment 4:

[0095] In order to accurately determine the first sub-model, on the basis of the above embodiments, in the embodiment of the present application, the at least one first target processing layer selected from the target model comprises:

[0096] According to the execution order of each processing layer of the target model, each processing layer is sorted; the first processing layer ranked first and the last processing layer ranked last in the sorting are determined as the processing layers contained in the first target processing layer.

[0097] In a possible implementation, considering that the TEE of the terminal device can guarantee data processing in a trusted environment and can guarantee the security of the model, when selecting the first target processing layer from the target model, each processing layer can be sorted according to the execution order of each processing layer of the target model; the first processing layer ranked first and the last processing layer ranked last in the sorting are determined as the processing layers contained in the first target processing layer.

[0098] For example, assuming that after each processing layer is sorted according to the execution order of each processing layer of the target model, the processing layers contained in the target model are processing layer 1, processing layer 2, processing layer 3, processing layer 4, processing layer 5, and processing layer 6, at least processing layer 1 and processing layer 6 can be selected (determined) as the processing layers contained in the first target processing layer, so that when the to-be-processed data is processed in the terminal device, the first input processing layer and the last output processing layer are both processing layers in the TEE, and the security of the to-be-processed data can be further guaranteed.

[0099] Embodiment 5:

[0100] In order to accurately determine the first sub-model, on the basis of the above embodiments, in the embodiment of the present application, the at least one first target processing layer selected from the target model comprises:

[0101] If the CPU peak computing performance of the TEE of the terminal device is worse than the CPU peak computing performance of the REE of the terminal device, a first target number of layers is determined according to the preset layer number ratio threshold and the total number of processing layers contained in the target model; from the target model, the first target number of processing layers are selected, and the selected first target number of processing layers are determined as the first target processing layer.

[0102] In a possible implementation, the CPU peak computing performance of the TEE of the terminal device and the CPU peak computing performance of the REE of the terminal device can be compared to determine how to select the first target processing layer from the target model.

[0103] When the CPU peak computing performance of the TEE of the terminal device and the CPU peak computing performance of the REE of the terminal device are also included in the attribute parameters carried in the model dispatch request, and the CPU peak computing performance of the TEE of the terminal device is inferior to the CPU peak computing performance of the REE of the terminal device, a first target layer number can be determined according to the preset layer number ratio threshold and the total number of processing layers included in the target model. Then, from the target model, a first target layer number of processing layers are selected, the selected first target layer number of processing layers are determined as first target processing layers, and a first sub-model is determined based on the selected first target processing layers.

[0104] For example, if the preset layer number ratio threshold (the minimum layer number ratio threshold) is 20%, and the total number of processing layers included in the target model is 10, a first target layer number can be determined according to the product of the preset layer number ratio threshold and the total number of processing layers included in the target model, that is, the first target layer number is 2. Then, from the target model, 2 processing layers are selected, the selected 2 processing layers are determined as first target processing layers, and a first sub-model is determined based on the selected 2 first target processing layers.

[0105] It can be understood that when the first target processing layers are selected, the first target processing layers still need to be selected (determined) based on the preset constraint condition, that is, the total value of the attribute parameters of the selected first target processing layers does not exceed the value of the attribute parameters corresponding to the TEE of the terminal device.

[0106] In a possible implementation, considering that the attribute parameters such as the secure storage space and the secure running memory of the TEE are generally lower than the attribute parameters corresponding to the REE, in order to maximize the guarantee that the total value of the attribute parameters of the first target layer number of processing layers (first target processing layers) selected according to the preset layer number ratio threshold and the total number of processing layers included in the target model does not exceed the value of the attribute parameters corresponding to the TEE of the terminal device, when the first target layer number of processing layers is selected from the target model, each processing layer of the target model can be sorted in the order of the value of the attribute parameters of each processing layer from small to large. Then, from the first processing layer in the sorting, the first target layer number of processing layers are sequentially selected from the sorting.

[0107] For example, still taking the above embodiment as an example, taking the attribute parameter as the security storage space, assuming that the target size of the data to be processed corresponds to the security storage space of processing layer 1 in the target model as 1 megabyte, the security storage space of processing layer 2 as 2 megabytes, the security storage space of processing layer 3 as 3 megabytes, the security storage space of processing layer 4 as 4 megabytes, and the security storage space of processing layer 5 as 5 megabytes, and so on, the processing layers can be sorted in ascending order of the values of the security storage spaces of each processing layer of the target model, and the sorted processing layers are processing layer 1, processing layer 2, processing layer 3, processing layer 4, and processing layer 5, and so on. Assuming that the first target number of layers is 2, the first target processing layers can be determined as processing layer 1 and processing layer 2 by selecting 2 processing layers from the sorted processing layers in order from the first processing layer in the sorted processing layers.

[0108] Since each processing layer can be sorted in ascending order of the values of the attribute parameters of each processing layer of the target model, and then the first target number of processing layers are selected from the sorted processing layers in order from the first processing layer in the sorted processing layers, the total value of the attribute parameters of the selected first target processing layers can be further ensured to be less than or equal to the value of the attribute parameter corresponding to the TEE of the terminal device.

[0109] In a possible implementation, when the attribute parameter carried in the model dispatch request further includes the CPU peak computing performance of the TEE of the terminal device and the CPU peak computing performance of the REE, and the CPU peak computing performance of the TEE of the terminal device is equal to the CPU peak computing performance of the REE of the terminal device, the first target processing layers can be selected from the target model according to the attribute parameter of the TEE of the terminal device as long as the selected first target processing layers satisfy the preset constraint condition, that is, as long as the total value of the attribute parameters of the selected first target processing layers is less than or equal to the value of the attribute parameter corresponding to the TEE of the terminal device. Details are not described herein again.

[0110] In a possible implementation, to accurately determine the first sub-model, multiple constraint conditions can be configured, and the first target processing layers are selected based on a multi-objective optimization algorithm. Specifically, the selecting at least one first target processing layer from the target model includes:

[0111] sorting each processing layer in ascending order of the values of the attribute parameters of each processing layer of the target model;

[0112] Each time, starting from the first ranked processing layer in the ranking, different numbers of processing layers are selected from the ranking in turn, and each time the different numbers of processing layers selected are taken as different candidate processing layer combinations respectively; wherein the total value of the attribute parameters of each processing layer included in each candidate processing layer combination does not exceed the attribute parameter corresponding to the TEE of the terminal device;

[0113] For each candidate processing layer combination, the candidate layer number ratio of the number of layers of the processing layers included in the candidate processing layer combination to the total number of layers of the processing layers included in the model is determined; and the candidate running time corresponding to the candidate processing layer combination is determined according to the pre-saved correspondence between each data size, candidate processing layer combination and running time consumption.

[0114] Based on the multi-objective optimization algorithm, the target processing layer combination corresponding to the optimal layer number ratio and the optimal running time consumption is determined from each of the candidate layer number ratio and the candidate running time consumption.

[0115] Each processing layer included in the target processing layer combination is determined as the at least one first target processing layer.

[0116] In a possible implementation, when the first target processing layer is selected based on the multi-objective optimization algorithm, each processing layer of the target model can be sorted in ascending order of the value of the attribute parameter of each processing layer of the target model. The sorting process is the same as described above, and will not be repeated here.

[0117] Then, starting from the first ranked processing layer in the ranking, different numbers of processing layers are selected from the ranking in turn, and each time the different numbers of processing layers selected are taken as different candidate processing layer combinations respectively; wherein the total value of the attribute parameters of each processing layer included in each candidate processing layer combination does not exceed the attribute parameter corresponding to the TEE of the terminal device.

[0118] For example, assuming that the sorted processing layers are processing layer 1, processing layer 2, processing layer 3, processing layer 4, processing layer 5 and processing layer 6, processing layer 1 can be taken as the first candidate processing layer combination, processing layer 1 and processing layer 2 can be taken as the second candidate processing layer combination, processing layer 1, processing layer 2 and processing layer 3 can be taken as the third candidate processing layer combination, and so on.

[0119] After each candidate processing layer combination is selected, the candidate layer number ratio of the number of layers of the processing layers included in the candidate processing layer combination to the total number of layers of the processing layers included in the target model can be determined for each candidate processing layer combination.

[0120] For example, still taking the above embodiment as an example, assuming that the target model contains a total of 6 processing layers, the candidate layer number ratio of the first candidate processing layer combination is 1 / 6, the candidate layer number ratio of the second candidate processing layer combination is 1 / 3, and the candidate layer number ratio of the third candidate processing layer combination is 1 / 2.

[0121] In a possible implementation, a correspondence relationship between each data size, a candidate processing layer combination, and a running time consumption (a running time consumption of the candidate processing layer combination when processing data of a certain data size) can be determined in advance and saved. The correspondence relationship between each data size, a candidate processing layer combination, and a running time consumption can be determined by using existing technologies, and will not be described herein again. Then, for each candidate processing layer combination, a running time consumption corresponding to the candidate processing layer combination (referred to as a candidate running time consumption for convenience of description) can be determined according to the correspondence relationship between each data size, a candidate processing layer combination, and a running time consumption saved in advance.

[0122] In a possible implementation, both the layer number ratio and the running time consumption can be used as constraint conditions (optimization targets), and a candidate processing layer combination corresponding to an optimal layer number ratio and an optimal running time consumption (referred to as a target processing layer combination for convenience of description) can be determined from each candidate layer number ratio and each candidate running time consumption based on a multi-objective optimization algorithm.

[0123] After the target processing layer combination is determined, each processing layer included in the target processing layer combination can be determined as a first target processing layer in the first sub-model.

[0124] Embodiment 6:

[0125] To accurately determine the first sub-model, on the basis of the above embodiments, in the embodiments of the present application, the selecting at least one first target processing layer from the target model comprises:

[0126] If the target model contains a verification layer, the verification layer is determined as a processing layer included in the first target processing layer; wherein an execution order of a first sub-verification layer in the verification layer is located before an execution order of any processing layer included in the target model, and an execution order of a second sub-verification layer in the verification layer is located after the execution order of any processing layer included in the target model; the verification layer is used to verify whether a processing result of the target model on the to-be-processed data is trustworthy.

[0127] In a possible implementation, a verification layer can be inserted into the target model, and whether a processing result of the target model on the to-be-processed data is trustworthy is verified based on the verification layer, so as to determine whether the target model is currently tampered with and whether the processing result of the target model on the to-be-processed data is trustworthy.

[0128] Specifically, if the target model includes a verification layer, the verification layer can be determined as a processing layer included in the first target processing layer (first sub-model). The verification layer includes a first sub-verification layer (such as a Cb layer) and a second sub-verification layer (such as a Dec layer). The execution order of the first sub-verification layer is before the execution order of any processing layer included in the target model, and the execution order of the second sub-verification layer is after the execution order of any processing layer included in the target model. How to verify whether the processing result of the target model on the to-be-processed data is reliable based on the verification layer can be referred to in the related embodiments below, and will not be described here.

[0129] For the convenience of understanding, the process of selecting the first target processing layer from the target model provided by the embodiments of the present application is exemplified below through a specific embodiment.

[0130] Referring to Figure 2a , Figure 2a a target model structure diagram provided by some embodiments is shown. It is assumed that each processing layer included in the target model M is sorted according to the execution order as A1, B1, C1, D1, A2, B2, C2, E1, A3 and F1. In a possible implementation, B1, D1, B2, E1 and F1 among them can be determined as processing layers included in the first sub-model (the first target processing layer).

[0131] In a possible implementation, the first processing layer A1 ranked first in the sorting and the last processing layer F1 ranked last can also be determined as processing layers included in the first sub-model (the first target processing layer). For example, A1, D1, A2, E1 and F1 can be determined as processing layers included in the first sub-model (the first target processing layer).

[0132] For another example, it is assumed that in addition to the above processing layers, the target model M also includes a verification layer. The first sub-verification layer in the verification layer is a Cb layer, and the second sub-verification layer is a Dec layer. Referring to Figure 2b , Figure 2b a first sub-model structure diagram provided by some embodiments is shown. The Cb layer, B1, D1, B2, E1, F1 and Dec layer can all be determined as processing layers included in the first sub-model (the first target processing layer). Since the execution order of the first sub-verification layer in the verification layer is before the execution order of any processing layer included in the target model, and the execution order of the second sub-verification layer in the verification layer is after the execution order of any processing layer included in the target model, determining the verification layer as a processing layer included in the first target processing layer can also achieve the purpose of determining the first processing layer ranked first in the sorting according to the execution order and the last processing layer ranked last as processing layers included in the first sub-model (the first target processing layer).

[0133] Embodiment 7:

[0134] To accurately determine the first sub-model, based on the above embodiments, in the embodiments of the present application, based on the selected at least one target processing layer, the sub-model is determined as follows:

[0135] For the sub-model saved into any execution environment of TEE or REE, the target processing layer contained in the sub-model is compared with the processing layers contained in the target model, to determine each missing processing layer located in the target model but not in the sub-model; for each missing processing layer, the corresponding link layer of the missing processing layer is configured, and according to the execution order information of each processing layer contained in the target model, the second identification information of the next processing layer with execution order after the link layer is configured in the hierarchical indication information of the link layer; according to the execution order of each processing layer contained in the target model, the execution order of each link layer and target processing layer contained in the sub-model is determined; and based on the execution order and each link layer and target processing layer contained in the sub-model, the sub-model is determined.

[0136] In a possible implementation, based on the selected first target processing layer, when the first sub-model is determined, the first target processing layer contained in the first sub-model can be compared with the processing layers contained in the target model, to determine each missing processing layer located in the target model but not in the first sub-model; then, for each missing processing layer, the corresponding link layer of the missing processing layer is configured, and for each link layer, according to the execution order information of each processing layer contained in the target model, the identification information (for convenience of description, referred to as second identification information) of the next processing layer with execution order after the link layer can be configured in the hierarchical indication information of the link layer, and optionally, the identification information of the previous processing layer with execution order before the link layer can also be configured in the hierarchical indication information of the link layer. Then, according to the execution order of each processing layer contained in the target model, the execution order of each link layer and the first target processing layer contained in the first sub-model is determined; and based on the execution order and each link layer and the first target processing layer contained in the first sub-model, the first sub-model is determined.

[0137] Based on the same technical concept, when determining the second sub-model based on the selected second target processing layer, the second target processing layer included in the second sub-model can be compared with the processing layers included in the target model to determine each missing processing layer located in the target model but not in the second sub-model. Then, for each missing processing layer, a corresponding link layer of the missing processing layer is configured, and for each link layer, the identification information (referred to as second identification information for convenience of description) of the next processing layer with an execution order located after the link layer can be configured in the hierarchical indication information of the link layer according to the execution order information of each processing layer included in the target model. Optionally, the identification information of the previous processing layer with an execution order located before the link layer can also be configured in the hierarchical indication information of the link layer. Then, the execution order of each link layer and the second target processing layer included in the second sub-model is determined according to the execution order of each processing layer included in the target model. Based on the execution order and each link layer and the second target processing layer included in the second sub-model, the second sub-model is determined.

[0138] Each link layer can only be responsible for forwarding data information such as to-be-processed data and a current processing result of the to-be-processed data, and does not process the to-be-processed data.

[0139] Still taking the above embodiment as an example, referring to Figure 2a , it is assumed that the target model M further includes a verification layer in addition to the processing layers (A1, B1, C1, D1, A2, B2, C2, E1, A3, and F1), where a first sub-verification layer in the verification layer is a Cb layer, and a second sub-verification layer is a Dec layer.

[0140] Referring to Figure 2b , according to the above execution order, the first target processing layers included in the first sub-model except the verification layer are B1, D1, B2, E1, and F1 respectively. Referring to Figure 2c , Figure 2c shows a second sub-model structure diagram provided by some embodiments, and the second target processing layers included in the second sub-model are A1, C1, A2, C2, and A3 respectively.

[0141] Each missing processing layer located in the target model but not in the first sub-model can be determined. Then, for each missing processing layer, a corresponding link layer of the missing processing layer is configured, referring to Figure 2b, the configured link layers for the first sub-model are W1, W3, W5, W7, and W9. For each link layer, the identification information of the next processing layer following the link layer in the execution order (referred to as second identification information) and the identification information of the previous processing layer preceding the link layer in the execution order can be configured in the hierarchical indication information of the link layer according to the execution order information of each processing layer included in the target model.

[0142] Similarly, each missing processing layer located in the target model but not in the second sub-model can be determined; then, for each missing processing layer, the link layer corresponding to the missing processing layer is configured, referring to Figure 2c , the configured link layers for the second sub-model are W2, W4, W6, W8, and W10. For each link layer, the second identification information of the next processing layer following the link layer in the execution order and the identification information of the previous processing layer preceding the link layer in the execution order can be configured in the hierarchical indication information of the link layer according to the execution order information of each processing layer included in the target model.

[0143] For example, for the link layer W1, the identification information of the previous processing layer configured in the hierarchical indication information of the link layer W1 can be the Cb layer, and the identification information of the next processing layer can be the A1 layer in the second sub-model m2.

[0144] For the link layer W2, the identification information of the previous processing layer configured in the hierarchical indication information of the link layer W2 can be the A1 layer in the second sub-model m2, and the identification information of the next processing layer can be the B1 layer in the first sub-model m1.

[0145] For the link layer W3, the identification information of the previous processing layer configured in the hierarchical indication information of the link layer W3 can be the B1 layer in the first sub-model m1, and the identification information of the next processing layer can be the C1 layer in the second sub-model m2.

[0146] For the link layer W4, the identification information of the previous processing layer configured in the hierarchical indication information of the link layer W4 can be the C1 layer in the second sub-model m2, and the identification information of the next processing layer can be the D1 layer in the first sub-model m1.

[0147] For the link layer W5, the identification information of the previous processing layer configured in the hierarchical indication information of the link layer W5 can be the D1 layer in the first sub-model m1, and the identification information of the next processing layer can be the A2 layer in the second sub-model m2.

[0148] For the link layer W6, the identification information of the previous processing layer configured in the hierarchical indication information of the link layer W6 can be the A2 layer in the second sub-model m2, and the identification information of the next processing layer can be the B2 layer in the first sub-model m1.

[0149] For the link layer W7, the identification information of the previous processing layer configured in the hierarchical indication information of the link layer W7 can be the B2 layer in the first sub-model m1, and the identification information of the next processing layer can be the C2 layer in the second sub-model m2.

[0150] For the link layer W8, the identification information of the previous processing layer configured in the hierarchical indication information of the link layer W8 can be the C2 layer in the second sub-model m2, and the identification information of the next processing layer can be the E1 layer in the first sub-model m1.

[0151] For the link layer W9, the identification information of the previous processing layer configured in the hierarchical indication information of the link layer W9 can be the E1 layer in the first sub-model m1, and the identification information of the next processing layer can be the A3 layer in the second sub-model m2.

[0152] For the link layer W10, the identification information of the previous processing layer configured in the hierarchical indication information of the link layer W10 can be the A3 layer in the second sub-model m2, and the identification information of the next processing layer can be the F1 layer in the first sub-model m1.

[0153] In a possible implementation, the execution order of each link layer and the first target processing layer included in the first sub-model can be determined according to the execution order of each processing layer included in the target model, and then the first sub-model is determined based on the execution order and each link layer and the first target processing layer included in the first sub-model. For example, refer to Figure 2b , the execution order of each layer included in the first sub-model is Cb-W1-B1-W3-D1-W5-B2-W7-E1-W9-F1-Dec in sequence.

[0154] For example, refer to Figure 2c , the execution order of each layer included in the second sub-model is A1-W2-C1-W4-A2-W6-C2-W8-A3-W10 in sequence.

[0155] The link layer is added in the first sub-model and the second sub-model, so that the first sub-model and the second sub-model respectively restore (own) the same complete network connection structure as the target model, and the terminal device can correctly process the to-be-processed data based on the first sub-model and the second sub-model. In a possible implementation, in order to protect the model, only the layer number information of the corresponding missing processing layer can be retained in the link layer, and the name, type and other information of the corresponding missing processing layer are all deleted.

[0156] In a possible implementation, for the first sub-model or the second sub-model, when at least two missing processing layers in the sub-model are at least two processing layers in execution sequence, one link layer can be configured for the multiple missing processing layers in execution sequence, and the layer number information of the link layer is the layer number information of the corresponding multiple missing processing layers in execution sequence.

[0157] For example, referring to Figure 3a , Figure 3a Another target model structure diagram provided by some embodiments is shown, assuming that the processing layers included in the target model are sorted in execution sequence as A, B, C and D.

[0158] For example, referring to Figure 3b , Figure 3b Another first sub-model structure diagram provided by some embodiments is shown, and the processing layers included in the first sub-model are A and D. For example, referring to Figure 3c , Figure 3c Another second sub-model structure diagram provided by some embodiments is shown, and the processing layers included in the second sub-model are B and C. The missing processing layers B and C in the first sub-model are processing layers in execution sequence, and one link layer W”’ can be configured for the missing processing layer B and the missing processing layer C.

[0159] For example, for the link layer W”’, the identification information of the previous processing layer configured in the layer level indication information of the link layer W”’ can be the A layer, and the identification information of the next processing layer can be the B layer in the second sub-model.

[0160] For the link layer W”, the identification information of the previous processing layer configured in the layer level indication information of the link layer W” can be the C layer, and the identification information of the next processing layer can be the D layer in the first sub-model.

[0161] Optionally, for the link layer W’, the identification information of the next processing layer configured in the layer level indication information of the link layer W’ can be the B layer.

[0162] Embodiment 7

[0163] Based on the same technical concept, the embodiment of the application provides a data processing method.Figure 4 A first data processing process provided by some embodiments is shown in a schematic diagram as shown in Figure 4 The process includes the following steps:

[0164] S401: receiving a data processing instruction, wherein the data processing instruction carries to-be-processed data and a target data type of the to-be-processed data; determining a target model corresponding to the target data type according to a saved correspondence between data types and models.

[0165] The data processing method provided by the embodiments of the present application is applied to a terminal device, which can be a PC, a mobile terminal, or the like, or an edge artificial intelligence (Edge AI) device.

[0166] In a possible implementation, when a user needs to process to-be-processed data, the user can first trigger a data processing instruction in a terminal device, wherein the data processing instruction can carry the to-be-processed data and a data type (referred to as a target data type for convenience) of the to-be-processed data. For example, the data type of the to-be-processed data can be text, voice, picture, or the like.

[0167] In order to accurately determine the model applicable to the to-be-processed data, a correspondence between data types and models can be saved in the terminal device in advance. The terminal device can determine a model (referred to as a target model for convenience) corresponding to the target data type of the to-be-processed data according to the saved correspondence between data types and models.

[0168] S402: sending a model distribution request to a cloud device, wherein the model distribution request carries first identification information of the target model, a target size of the to-be-processed data, and attribute parameters of a trusted execution environment (TEE) of the terminal device; wherein the attribute parameters include at least one of a secure storage space and a secure running memory.

[0169] After the terminal device determines the to-be-processed data and the target model applicable to the to-be-processed data, the terminal device can send a model distribution request to a cloud device, wherein the model distribution request can carry first identification information of the target model, a target size of the to-be-processed data, and attribute parameters of a trusted execution environment (TEE) of the terminal device; optionally, the attribute parameters include at least one of a secure storage space and a secure running memory.

[0170] S403: receiving the first sub-model sent by the cloud device, and saving the first sub-model in the TEE; wherein the first sub-model is: the cloud device acquires a target model corresponding to the first identification information according to the first identification information, determines a target attribute parameter corresponding to the target size according to a pre-determined corresponding relationship between a data size and an attribute parameter of the target model, and determines the first sub-model saved in the TEE of the terminal device in the target model according to the target attribute parameter and an attribute parameter of the TEE of the terminal device.

[0171] After the terminal device sends the model distribution request to the cloud device, the cloud device can acquire a target model corresponding to the first identification information according to the first identification information carried in the model distribution request, determine a target attribute parameter corresponding to the target size according to a pre-determined corresponding relationship between a data size and an attribute parameter of the target model, and determine the first sub-model saved in the TEE of the terminal device in the target model according to the target attribute parameter and an attribute parameter of the TEE of the terminal device, and send the first sub-model to the terminal device. The process of determining the first sub-model by the cloud device is the same as that in the above embodiment, and will not be described herein.

[0172] After the terminal device receives the first sub-model sent by the cloud device, the terminal device can save the first sub-model in the TEE.

[0173] S404: processing the to-be-processed data based on the first sub-model.

[0174] After the terminal device saves the first sub-model in the TEE, the terminal device can process the to-be-processed data based on the first sub-model saved in the TEE. The existing technology can be used to process the to-be-processed data based on the first sub-model, and will not be described herein.

[0175] In the embodiment, the terminal device processes the to-be-processed data based on the first sub-model saved in the TEE of the terminal device, so that the security of the model and the security of the to-be-processed data can be taken into account.

[0176] In a possible implementation, if the cloud device determines the first sub-model saved in the TEE of the terminal device and the second sub-model saved in the REE of the terminal device, the cloud device can send both the first sub-model and the second sub-model to the terminal device, and the terminal device can save the first sub-model in the TEE of the terminal device and save the second sub-model in the REE of the terminal device according to the identification of the first sub-model and the second sub-model. When processing the to-be-processed data, the terminal device can process the to-be-processed data based on the first sub-model saved in the TEE and the second sub-model saved in the REE.

[0177] Embodiment 8:

[0178] To ensure the accuracy of the processing result of the to-be-processed data, on the basis of the above embodiments, in the embodiments of the present application, the processing of the to-be-processed data based on the first sub-model comprises:

[0179] If the target model contains a verification layer, the position information of the preset verification data in the to-be-processed data is determined based on the first sub-verification layer in the verification layer, and the third identification information of the output processing layer of the second sub-verification layer in the verification layer is determined to obtain the verification result of the verification data, and the position information and the third identification information are sent to the second sub-verification layer; based on the second sub-verification layer, the verification processing result output at the output processing layer of the third identification information is obtained, the verification result corresponding to the position information in the verification processing result is obtained, and based on the verification result and the preset verification value, it is determined whether the processing result of the to-be-processed data by the target model is reliable.

[0180] In a possible implementation, when determining whether the processing result of the to-be-processed data by the target model is reliable based on the verification layer, the position information of the preset verification data in the to-be-processed data can be determined based on the first sub-verification layer in the verification layer. The position information of the verification data in the to-be-processed data can be flexibly set according to requirements, which is not limited in the present application. For example, if the to-be-processed data is a text, the verification data can be located before the first sentence, between the first sentence and the second sentence, after the last sentence, etc.

[0181] In addition, the second sub-verification layer in the verification layer can also be determined based on the first sub-verification layer in the verification layer to obtain the verification result of the verification data from which processing layer, for the convenience of description, the processing layer of the second sub-verification layer to obtain the verification result of the verification data is referred to as the output processing layer, and the first sub-verification layer can determine the identification information (referred to as the third identification information for the convenience of description) of the output processing layer. For example, the output processing layer can be any processing layer contained in the first sub-model, referring to FIG. b, the output processing layer can be F1, or any processing layer such as B2, which can be flexibly set according to requirements, and the present application does not make specific limitation thereto.

[0182] The first sub-check layer can send the position information of the preset check data in the to-be-processed data and the third identification information to the second sub-check layer. Based on the second sub-check layer, the current processing result (for convenience of description, referred to as a check processing result) of the to-be-processed data output at the output processing layer of the third identification information can be obtained. It can be understood that the check processing result output at the output processing layer can be the current processing result of the to-be-processed data from the first processing layer to the output processing layer in the order of each processing layer of the target model.

[0183] When the to-be-processed data is processed, the check result corresponding to the position information in the check processing result can be obtained. For example, if the check data is located between the first sentence and the second sentence of the to-be-processed data, the information between the first sentence and the second sentence in the check processing result can be determined as the check result corresponding to the check data.

[0184] In a possible implementation, the ideal check value of the check data from the first processing layer to the output processing layer can be determined in advance, and the ideal check value is determined as the preset check value. By comparing whether the check result and the preset check value are the same, it is determined whether the processing result of the to-be-processed data by the target model is reliable. For example, when the deviation between the check result and the preset check value is less than a set deviation threshold, it is considered that the target model is not tampered with, and the processing result of the to-be-processed data by the target model is reliable. When the deviation between the check result and the preset check value is not less than the set deviation threshold, it is considered that the target model is tampered with, and the processing result of the to-be-processed data by the target model is unreliable. The deviation threshold can be flexibly set according to requirements, which is not limited in the present application.

[0185] In a possible implementation, if it is considered that the processing result of the to-be-processed data by the target model is reliable, the second sub-check layer can obtain the final processing result of the to-be-processed data by the target model, delete the check result corresponding to the position information in the final processing result, and display the processing result after the check result is deleted to the user for viewing.

[0186] Embodiment 9:

[0187] In order to accurately process the to-be-processed data, based on the above embodiments, in the embodiments of the present application, the processing of the to-be-processed data based on the first sub-model and the second sub-model includes:

[0188] For the sub-model saved to either the TEE or the REE, if the sub-model contains a link layer, the second identification information of the next processing layer in the execution order configured in the hierarchical indication information of the link layer is obtained; and the processing result of the sub-model on the to-be-processed data is input to the processing layer corresponding to the second identification information according to the second identification information.

[0189] Specifically, for the first sub-model saved to the TEE, if the first sub-model contains a link layer, the second identification information of the next processing layer in the execution order configured in the hierarchical indication information of the link layer is obtained. Then, the processing result of the first sub-model on the to-be-processed data is input to the processing layer corresponding to the second identification information according to the second identification information.

[0190] For the second sub-model saved to the REE, if the second sub-model contains a link layer, the second identification information of the next processing layer in the execution order configured in the hierarchical indication information of the link layer is obtained. Then, the processing result of the second sub-model on the to-be-processed data is input to the processing layer corresponding to the second identification information according to the second identification information.

[0191] For the convenience of understanding, the embodiments shown in Figure 2a 、 Figure 2b 、 Figure 2c are still taken as examples. Figure 5 A second data processing process provided by some embodiments is shown, which is shown in Figure 2a 、 Figure 2b 、 Figure 2c and Figure 5 . It is assumed that the to-be-processed data contains 5 sentences in total, and the position information of the verification data in the to-be-processed data is that the verification data is between the fourth sentence and the fifth sentence of the to-be-processed data. The third identification information of the output processing layer of the verification result (calculation result) of the verification data obtained by the second sub-verification layer Dec is the F1 processing layer, and the first sub-verification layer Cb can send the position information (p) and the third identification information (F1) of the output processing layer to the second sub-verification layer Dec.

[0192] According to the execution order of each processing layer contained in the target model, the first sub-verification layer Cb can input the to-be-processed data carrying the verification data to the link layer W1 in the first sub-model, and the identification information of the next processing layer configured in the hierarchical indication information of the link layer W1 is the A1 layer in the second sub-model m2. Then, the link layer W1 can forward the to-be-processed data carrying the verification data to the A1 layer in the second sub-model m2. After the A1 processing layer processes the to-be-processed data carrying the verification data, the current processing result (the processing result of the to-be-processed data by the A1 processing layer) can be output to the link layer W2.

[0193] The identification information of the next processing layer configured in the hierarchical indication information of the link layer W2 is B1 layer in the first sub-model m1, and the link layer W2 can forward the current processing result (the processing result of the A1 processing layer on the to-be-processed data) to B1 layer in the first sub-model m1.

[0194] After B1 layer in the first sub-model m1 processes the to-be-processed data carrying the verification data, the current processing result (the processing result of the A1, B1 processing layer on the to-be-processed data) can be output to the link layer W3.

[0195] The identification information of the next processing layer configured in the hierarchical indication information of the link layer W3 is C1 layer in the second sub-model m2, and the link layer W3 can forward the current processing result (the processing result of the A1, B1 processing layer on the to-be-processed data) to C1 layer in the second sub-model m2.

[0196] After C1 layer in the second sub-model m2 processes the to-be-processed data carrying the verification data, the current processing result (the processing result of the A1, B1, C1 processing layer on the to-be-processed data) can be output to the link layer W4.

[0197] The identification information of the next processing layer configured in the hierarchical indication information of the link layer W4 is D1 layer in the first sub-model m1, and the link layer W4 can forward the current processing result (the processing result of the A1, B1, C1 processing layer on the to-be-processed data) to D1 layer in the first sub-model m1.

[0198] After D1 layer in the first sub-model m1 processes the to-be-processed data carrying the verification data, the current processing result (the processing result of the A1, B1, C1, D1 processing layer on the to-be-processed data) can be output to the link layer W5.

[0199] The identification information of the next processing layer configured in the hierarchical indication information of the link layer W5 is A2 layer in the second sub-model m2, and the link layer W5 can forward the current processing result (the processing result of the A1, B1, C1, D1 processing layer on the to-be-processed data) to A2 layer in the second sub-model m2.

[0200] After A2 layer in the second sub-model m2 processes the to-be-processed data carrying the verification data, the current processing result (the processing result of the A1, B1, C1, D1, A2 processing layer on the to-be-processed data) can be output to the link layer W6.

[0201] The identification information of the next processing layer configured in the level indication information of the linking layer W6 is the B2 layer in the first sub-model m1, and the linking layer W6 can forward the current processing result (the processing result of the A1, B1, C1, D1, A2 processing layer on the to-be-processed data) to the B2 layer in the first sub-model m1.

[0202] After the B2 layer in the first sub-model m1 processes the to-be-processed data carrying the verification data, the current processing result (the processing result of the A1, B1, C1, D1, A2, B2 processing layer on the to-be-processed data) can be output to the linking layer W7.

[0203] The identification information of the next processing layer configured in the level indication information of the linking layer W7 is the C2 layer in the second sub-model m2, and the linking layer W7 can forward the current processing result (the processing result of the A1, B1, C1, D1, A2, B2 processing layer on the to-be-processed data) to the C2 layer in the second sub-model m2.

[0204] After the C2 layer in the second sub-model m2 processes the to-be-processed data carrying the verification data, the current processing result (the processing result of the A1, B1, C1, D1, A2, B2, C2 processing layer on the to-be-processed data) can be output to the linking layer W8.

[0205] The identification information of the next processing layer configured in the level indication information of the linking layer W8 is the E1 layer in the first sub-model m1, and the linking layer W8 can forward the current processing result (the processing result of the A1, B1, C1, D1, A2, B2, C2 processing layer on the to-be-processed data) to the E1 layer in the first sub-model m1.

[0206] After the E1 layer in the first sub-model m1 processes the to-be-processed data carrying the verification data, the current processing result (the processing result of the A1, B1, C1, D1, A2, B2, C2, E1 processing layer on the to-be-processed data) can be output to the linking layer W9.

[0207] The identification information of the next processing layer configured in the level indication information of the linking layer W9 is the A3 layer in the second sub-model m2, and the linking layer W9 can forward the current processing result (the processing result of the A1, B1, C1, D1, A2, B2, C2, A3 processing layer on the to-be-processed data) to the A3 layer in the second sub-model m2.

[0208] After the A3 layer in the second sub-model m2 processes the to-be-processed data carrying the verification data, the current processing result (the processing result of the A1, B1, C1, D1, A2, B2, C2, E1, A3 processing layer on the to-be-processed data) can be output to the linking layer W10.

[0209] The identification information of the next processing layer configured in the level indication information of the link layer W10 is the F1 layer in the first sub-model m1, and the link layer W10 can forward the current processing result (the processing result of the A1, B1, C1, D1, A2, B2, C2, A3 processing layer on the to-be-processed data) to the F1 layer in the first sub-model m1.

[0210] After the F1 layer in the first sub-model m1 processes the to-be-processed data carrying the verification data, the current processing result (the final processing result of the A1, B1, C1, D1, A2, B2, C2, E1, A3, F1 processing layer on the to-be-processed data) can be output to the second sub-verification layer Dec.

[0211] In the processing result obtained by the second sub-verification layer Dec, the verification result of the target model on the verification data is obtained at a position between the fourth sentence and the fifth sentence, and then it is judged whether the deviation of the verification result from the preset verification value is less than the set deviation threshold. If the deviation of the verification result from the preset verification value is less than the set deviation threshold, it can be considered that the target model has not been tampered with, and the processing result (the calculation result) of the target model on the to-be-processed data is reliable. If the deviation of the verification result from the preset verification value is not less than the set deviation threshold, it is considered that the target model has been tampered with, and the processing result of the target model on the to-be-processed data is not reliable.

[0212] In a possible implementation, when the deviation of the verification result from the preset verification value is less than the set deviation threshold, it is considered that the processing result of the target model on the to-be-processed data is reliable, the second sub-verification layer can delete the verification result at the position between the fourth sentence and the fifth sentence in the final processing result, encrypt the processing result after the deletion of the verification result by using the symmetric key, and present the encrypted processing result to the user. The user can decrypt the encrypted processing result and view the processing result.

[0213] Based on this, although the target model is divided into the first sub-model and the second sub-model, the to-be-processed data can still be processed based on the complete processing layer and the execution order contained in the target model. Moreover, since the first sub-model is saved in the TEE, even if the second sub-model is saved in the REE, the second sub-model cannot be used alone, so the model data information of the target model can be effectively prevented from being stolen, and the security of the model is ensured.

[0214] In a possible implementation, if the third sub-model is saved in the cloud device, the terminal device can send the encrypted processing result to the cloud device, and the cloud device can further process the to-be-processed data based on the third sub-model after decrypting the encrypted processing result.

[0215] For the convenience of understanding, the data processing process provided by the embodiments of the application will be described below through a specific embodiment. Figure 6 A third data processing process provided by some embodiments is shown in the schematic diagram as shown in the figure. Figure 6 The process includes the following steps:

[0216] S601: The terminal device receives a data processing instruction, wherein the data processing instruction carries to-be-processed data and a target data type of the to-be-processed data; and a target model corresponding to the target data type is determined according to a saved correspondence between data types and models.

[0217] S602: The terminal device sends a model dispatch request to a cloud device, wherein the model dispatch request carries first identification information of the target model, a target size of the to-be-processed data, and attribute parameters of a trusted execution environment (TEE) of the terminal device; and the attribute parameters include at least one of a secure storage space and a secure running memory.

[0218] S603: The cloud device receives the model dispatch request, and obtains the first identification information of the target model, the target size of the to-be-processed data, and the attribute parameters of the TEE of the terminal device carried in the model dispatch request.

[0219] S604: The cloud device obtains the target model corresponding to the first identification information, determines a target attribute parameter corresponding to the target size according to a pre-determined correspondence between data sizes and attribute parameters of the target model, determines a first sub-model in the target model to be saved in the TEE of the terminal device and a second sub-model in the target model to be saved in a REE of the terminal device according to the target attribute parameter and the attribute parameters of the TEE of the terminal device, and sends the first sub-model and the second sub-model to the terminal device.

[0220] The cloud device can generate a unique model serial number (ID) corresponding to the target model M, and generate a set of random check data T. The random check data T is input into the target model to obtain an ideal check value X corresponding to the check data. The cloud device can calculate a hash value H1 corresponding to the second sub-model and a hash value H2 corresponding to the first sub-model based on the SHA-256 algorithm, and generate a pair of symmetric working keys K. Optionally, the cloud device can record the model serial number (ID), the target model M, the ideal check value X, the hash value H2 corresponding to the first sub-model, and other data information in a database.

[0221] Optionally, the cloud device can splice the model serial number (ID), the first sub-model, the second sub-model, the verification data T, the ideal verification value X corresponding to the verification data, the hash value H1 corresponding to the second sub-model, and the symmetric working key K according to a set format to form a data string S. The cloud device encrypts the data string S using the device public key to obtain ciphertext S'. The cloud device transmits the ciphertext S' into the Trusted Execution Environment (TEE) operating system (Trusted OS) of the terminal device through the network.

[0222] S605: The terminal device saves the first sub-model in the TEE of the terminal device, and the terminal device saves the second sub-model in the REE of the terminal device.

[0223] The terminal device can decrypt and restore the data by using the device private key to decrypt the ciphertext S'. The model serial number (ID) and the second sub-model are transmitted to the Rich Environment (REE) operating system (Rich OS). The terminal device stores the first sub-model, the verification data T, the ideal verification value X corresponding to the verification data, the hash value H1 corresponding to the second sub-model, and the like in the Trusted OS secure storage area. The storage of the first sub-model and the processing (calculation) of the to-be-processed data are both in the Trusted OS, and the first sub-model is "available but invisible" to the outside. The second sub-model is "visible" to the outside, but cannot be used independently, and thus the risk of model misuse can be effectively prevented.

[0224] S606: The terminal device processes the to-be-processed data based on the first sub-model and the second sub-model.

[0225] The terminal device can first perform a model initialization process. The model initialization process is as follows:

[0226] The hash value of the second sub-model is calculated, and the hash value H1 corresponding to the second sub-model is compared to confirm whether the hash value is consistent with H1. Then, the parameter data of the second sub-model is loaded into the REE normal memory space, and the parameter data of the first sub-model is loaded into the TEE secure memory space.

[0227] The verification data T is input into the first sub-model and the second sub-model according to the execution order of the processing layers contained in the target model, to obtain the calculation results of the first sub-model and the second sub-model on the verification data T. The calculation results are compared with the ideal verification value X corresponding to the verification data to determine whether the calculation results are consistent with the ideal verification value X.

[0228] The comparison results of whether the calculated hash value of the second sub-model is consistent with H1, whether the calculation results are consistent with the ideal verification value X, and the hash value of the calculated first sub-model are encrypted by the symmetric key and uploaded to the cloud device.

[0229] The cloud device compares the hash value of the first sub-model calculated by the terminal device with H2. If they are consistent, and the hash value of the second sub-model calculated by the terminal device is consistent with H1, and the calculation result of the verification data T calculated by the terminal device is also consistent with the ideal verification value X, it is confirmed that the first sub-model and the second sub-model are safe and have not been tampered with. Otherwise, it is considered that the target model has been tampered with, and the terminal device can be prompted that the first sub-model and the second model have security risks. The first sub-model and the second sub-model are re-assigned and updated.

[0230] If the first sub-model and the second sub-model are safe, the first sub-model and the second sub-model can be used to process the to-be-processed data.

[0231] In a possible implementation, when the to-be-processed data is processed based on the first sub-model and the second sub-model, a certain random noise (the influence of the random noise on the model calculation result can be ignored) can be added to the verification data T, and the verification data T is randomly inserted into the to-be-processed data, and the to-be-processed data carrying the verification data is processed based on the first sub-model and the second sub-model.

[0232] For the convenience of understanding, the data processing process provided by the embodiments of the present application is described below through a specific embodiment. Figure 7 A fourth data processing process provided by some embodiments is shown in a schematic diagram as shown in Figure 7 The process includes the following steps:

[0233] The terminal device can save the first sub-model (m2 parameters) in the TEE of the terminal device, and save the second sub-model (m1 parameters) in the REE of the terminal device. In a possible implementation, the client application (CA) installed in the Rich OS can call the trusted application (TA) installed in the Rich OS. The CA first applies data buffer 1 and data buffer 2 in the normal memory of the Rich OS in advance, wherein the data buffer 1 is used to save the current processing result of the to-be-processed data by any processing layer in the second sub-model (that is, the output data of the corresponding processing layer of the second sub-model), and the data buffer 2 is used to save the current processing result of the to-be-processed data by any processing layer in the first sub-model (that is, the input data of the corresponding processing layer of the second sub-model).

[0234] Referring to Figure 3a , Figure 3b , Figure 3cThe processing layer A in the first sub-model can save the processing result of the to-be-processed data (the final processing result of the to-be-processed data by the processing layer A) in the data cache area 2. Optionally, the processing layer A in the first sub-model can save the intermediate processing result of the to-be-processed data in the secure memory cache area 0.

[0235] The processing layer B in the second sub-model can obtain the to-be-processed data from the data cache area 2, process the to-be-processed data, and transmit the processing result to the processing layer C. The processing layer C can process the to-be-processed data and save the processing result in the data cache area 1. The processing layer D in the first sub-model can obtain the to-be-processed data in the data cache area 1, process the to-be-processed data, and save the final processing result of the to-be-processed data in the secure memory cache area 0.

[0236] Embodiment 10

[0237] Based on the same technical concept, the present application provides a model protection device, Figure 8 A schematic diagram of a model protection device provided by some embodiments is shown in FIG. 1. As shown in FIG. 1, the device includes: Figure 8

[0238] The first receiving module 801 is configured to, if a model distribution request sent by a terminal device is received, obtain first identification information of a target model, a target size of to-be-processed data, and attribute parameters of a trusted execution environment (TEE) of the terminal device carried in the model distribution request. The attribute parameters include at least one of a secure storage space and a secure running memory.

[0239] The first determining module 802 is configured to obtain a target model corresponding to the first identification information, and determine a target attribute parameter corresponding to the target size according to a pre-determined corresponding relationship between data sizes and attribute parameters of the target model.

[0240] The second determining module 803 is configured to determine a first sub-model in the target model to be saved in the TEE of the terminal device according to the target attribute parameter and the attribute parameters of the TEE of the terminal device.

[0241] The sending module 804 is configured to send the first sub-model to the terminal device, so that the terminal device saves the first sub-model in the TEE of the terminal device.

[0242] In a possible implementation, the device further includes:

[0243] ​The updating module is configured to determine a processing layer of a to-be-sent model to be sent to the terminal device, wherein the processing layer of the to-be-sent model is all or part of processing layers of the target model; and the target model is updated by using the to-be-sent model.

[0244] In a possible implementation, the second determining module 803 is specifically configured to select at least one first target processing layer from the target model, wherein a total value of attribute parameters of the at least one first target processing layer does not exceed a value of an attribute parameter corresponding to the TEE of the terminal device; and determine the first sub-model based on the at least one selected first target processing layer.

[0245] In a possible implementation, the second determining module 803 is further configured to determine each second target processing layer in the target model except the first target processing layer, and determine a second sub-model in the target model saved in a common execution environment (REE) of the terminal device based on each second target processing layer.

[0246] The sending module 804 is specifically configured to send the first sub-model and the second sub-model to the terminal device, so that the terminal device saves the second sub-model in the REE of the terminal device.

[0247] In a possible implementation, the second determining module 803 is specifically configured to, for a sub-model saved in any execution environment of the TEE or the REE, compare a target processing layer included in the sub-model with processing layers included in the target model, to determine each missing processing layer located in the target model but not in the sub-model; for each missing processing layer, configure a link layer corresponding to the missing processing layer, and according to execution order information of each processing layer included in the target model, configure second identification information of a next processing layer located after the link layer in level indication information of the link layer; according to the execution order of each processing layer included in the target model, determine the execution order of each link layer and target processing layer included in the sub-model; and based on the execution order and each link layer and target processing layer included in the sub-model, determine the sub-model.

[0248] In a possible implementation, the second determining module 803 is specifically configured to, if the target model includes a verification layer, determine the verification layer as a processing layer included in the first target processing layer; wherein a first sub-verification layer in the verification layer is located before the execution order of any processing layer included in the target model, and a second sub-verification layer in the verification layer is located after the execution order of any processing layer included in the target model; and the verification layer is used to verify whether a processing result of the target model on the to-be-processed data is trustworthy.

[0249] In a possible implementation, the second determining module 803 is specifically configured to sort each processing layer of the target model according to an execution order of each processing layer of the target model; and determine a first processing layer and a last processing layer in the sorting as the processing layers included in the first target processing layer.

[0250] In a possible implementation, the second determining module 803 is specifically configured to: if the attribute parameter further includes a CPU peak calculation performance of a TEE of the terminal device and a CPU peak calculation performance of a REE of the terminal device, and the CPU peak calculation performance of the TEE of the terminal device is inferior to the CPU peak calculation performance of the REE of the terminal device, determine a first target number of layers according to a preset layer number ratio threshold and a total number of processing layers included in the target model; and select a first target number of processing layers from the target model, and determine the first target number of selected processing layers as the first target processing layer.

[0251] In a possible implementation, the second determining module 803 is specifically configured to sort each processing layer of the target model according to an order from small to large of values of attribute parameters of each processing layer of the target model; and select a first target number of processing layers from the sorting in turn, starting from a first processing layer in the sorting.

[0252] In a possible implementation, the second determining module 803 is specifically configured to sort each processing layer of the target model according to an order from small to large of values of attribute parameters of each processing layer of the target model;

[0253] Each time, a different number of processing layers are selected from the sorting in turn, starting from a first processing layer in the sorting, and the different number of selected processing layers each time are respectively taken as a different candidate processing layer combination; wherein a total value of the attribute parameters of each processing layer included in each candidate processing layer combination does not exceed the attribute parameter corresponding to the TEE of the terminal device.

[0254] For each candidate processing layer combination, a candidate layer number ratio is determined, which is a ratio of a number of layers included in the candidate processing layer combination to a total number of processing layers included in the target model; and a candidate running time corresponding to the candidate processing layer combination is determined according to a correspondence between each data size, candidate processing layer combination and running time that is pre-stored.

[0255] Based on a multi-objective optimization algorithm, a target processing layer combination corresponding to an optimal layer number ratio and an optimal running time is determined from each of the candidate layer number ratios and the candidate running times.

[0256] Each processing layer included in the target processing layer combination is determined as the at least one first target processing layer.

[0257] Embodiment 11

[0258] Based on the same technical concept, the present application provides a model protection device, Figure 9 Fig. 1 shows a schematic diagram of a data processing device according to some embodiments, Figure 9 As shown in the figure, the device comprises:

[0259] The second receiving module 901 is configured to receive a data processing instruction, wherein the data processing instruction carries to-be-processed data and a target data type of the to-be-processed data; and determine a target model corresponding to the target data type according to a saved correspondence between data types and models.

[0260] The requesting module 902 is configured to send a model distribution request to a cloud device, wherein the model distribution request carries first identification information of a target model, a target size of to-be-processed data, and attribute parameters of a trusted execution environment (TEE) of the terminal device; and the attribute parameters comprise at least one of a secure storage space and a secure running memory.

[0261] The saving module 903 is configured to receive a first sub-model sent by the cloud device, and save the first sub-model in the TEE; wherein the first sub-model is: the cloud device acquires a target model corresponding to the first identification information according to the first identification information, determines target attribute parameters corresponding to the target size according to a pre-determined correspondence between data sizes and attribute parameters of the target model, and determines a first sub-model saved in the TEE of the terminal device from the target model according to the target attribute parameters and the attribute parameters of the TEE of the terminal device.

[0262] The processing module 904 is configured to process the to-be-processed data based on the first sub-model.

[0263] In a possible implementation, the saving module 903 is specifically configured to receive a first sub-model and a second sub-model sent by the cloud device.

[0264] The first sub-model is saved in the TEE of the terminal device, and the second sub-model is saved in a rich execution environment (REE) of the terminal device.

[0265] The processing module 904 is specifically configured to process the to-be-processed data based on the first sub-model and the second sub-model.

[0266] In a possible implementation, the processing module 904 is specifically configured to, for a sub-model saved into any one of a TEE or a REE execution environment, if the sub-model contains a link layer, acquire second identification information of a next processing layer configured in a layer level indication information of the link layer and located after the link layer in an execution sequence; and input a processing result of the sub-model on the to-be-processed data to a processing layer corresponding to the second identification information according to the second identification information.

[0267] In a possible implementation, the processing module 904 is specifically configured to, if the target model contains a verification layer, determine, based on a first sub-verification layer in the verification layer, position information of preset verification data in the to-be-processed data, and determine third identification information of an output processing layer of a second sub-verification layer in the verification layer for acquiring a verification result of the verification data, and send the position information and the third identification information to the second sub-verification layer; based on the second sub-verification layer, acquire a verification processing result output at the output processing layer of the third identification information, acquire a verification result corresponding to the position information in the verification processing result, and determine, based on the verification result and a preset verification value, whether the processing result of the target model on the to-be-processed data is reliable.

[0268] Embodiment 12

[0269] Based on the same technical concept, the present application also provides an electronic device, Figure 10 An electronic device structure schematic diagram provided by some embodiments is shown in FIG. 1. Figure 10 As shown, the electronic device includes a processor 101, a communication interface 102, a memory 103, and a communication bus 104, wherein the processor 101, the communication interface 102, and the memory 103 complete mutual communication through the communication bus 104.

[0270] The memory 103 stores a computer program, and when the program is executed by the processor 101, the processor 101 executes the steps of the model protection method according to any one of the above embodiments, or implements the steps of the model protection method according to any one of the above embodiments.

[0271] The communication bus mentioned in the above electronic device can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For the convenience of representation, only one thick line is shown in the figure, but it does not mean that there is only one bus or only one type of bus.

[0272] The communication interface 102 is configured to communicate between the electronic device and other devices.

[0273] The memory can include a random access memory (RAM) and can also include a non-volatile memory (NVM), such as at least one disk memory. Optionally, the memory can also be at least one storage device located away from the aforementioned processor.

[0274] The processor can be a general-purpose processor, including a central processing unit, a network processor (NP), etc., and can also be a digital signal processor (DSP), an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic, a discrete hardware component, etc.

[0275] Based on the same technical concept, the embodiments of the present application provide a computer readable storage medium, which stores a computer program executable by an electronic device, and when the program is running on the electronic device, the electronic device is caused to execute the steps of the model protection method as described above, or the steps of the model protection method as described above.

[0276] The computer readable storage medium can be any available medium or data storage device accessible by a processor in the electronic device, including but not limited to a magnetic memory such as a floppy disk, a hard disk, a magnetic tape, a magneto-optical disk (MO), etc., an optical memory such as a CD, a DVD, a BD, a HVD, etc., and a semiconductor memory such as a ROM, an EPROM, an EEPROM, a non-volatile memory (NAND FLASH), a solid state disk (SSD), etc.

[0277] Based on the same technical concept, the present application provides a computer program product, which includes computer program code, and when the computer program code is running on a computer, the computer is caused to execute the steps of the model protection method as described above, or the steps of the model protection method as described above.

[0278] In the above embodiments, all or part of the embodiments can be realized by software, hardware, firmware or any combination thereof, and can be realized in the form of a computer program product in whole or in part. The computer program product includes one or more computer instructions, and when the computer instructions are loaded and executed on a computer, the flow or function described in the embodiments of the present application is generated in whole or in part.

[0279] Those skilled in the art will appreciate that embodiments of the present application can be devised for a method, a system, or a computer program product. Accordingly, the present application can be embodied in the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present application can take the form of a computer program product on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage devices, and the like) embodying computer readable program code.

[0280] The present application is described in reference to the flowchart illustrations and / or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart illustrations and / or block diagrams. Figure One one or more functions specified in the flowchart illustrations and / or block diagrams. Figure One one or more functions specified in the flowchart illustrations and / or block diagrams.

[0281] These computer program instructions can also be stored in a computer- readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instructions which implement the functions specified in the flowchart illustrations and / or block diagrams. Figure One one or more functions specified in the flowchart illustrations and / or block diagrams. Figure One one or more functions specified in the flowchart illustrations and / or block diagrams.

[0282] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart illustrations and / or block diagrams. Figure One one or more functions specified in the flowchart illustrations and / or block diagrams. Figure One one or more functions specified in the flowchart illustrations and / or block diagrams.

[0283] Obviously, numerous modifications and variations of the present application are possible in light of the above teachings. It is therefore to be understood that within the scope of the appended claims and their equivalents, the application can be practiced otherwise than as specifically described.

Claims

1. A model protection method characterized by, The method applied to a cloud device comprises: If a model dispatch request sent by a terminal device is received, first identification information of a target model, a target size of to-be-processed data, and attribute parameters of a trusted execution environment (TEE) of the terminal device carried in the model dispatch request are acquired; the attribute parameters comprise at least one of a secure storage space and a secure running memory; A target model corresponding to the first identification information is acquired, and a target attribute parameter corresponding to the target size is determined according to a predetermined corresponding relationship between data sizes and attribute parameters of the target model; A first sub-model saved in the TEE of the terminal device in the target model is determined according to the target attribute parameter and attribute parameters of the TEE of the terminal device; The first sub-model is sent to the terminal device, so that the terminal device saves the first sub-model in the TEE of the terminal device; The first sub-model is sent to the terminal device, so that the terminal device saves the first sub-model in the TEE of the terminal device; The first sub-model is sent to the terminal device, so that the terminal device saves the first sub-model in the TEE of the terminal device; 2. The method of claim 1, wherein, The first sub-model is sent to the terminal device, so that the terminal device saves the first sub-model in the TEE of the terminal device; The first sub-model is sent to the terminal device, so that the terminal device saves the first sub-model in the TEE of the terminal device; The first sub-model is sent to the terminal device, so that the terminal device saves the first sub-model in the TEE of the terminal device; 3. The method of claim 1, wherein, The first sub-model is sent to the terminal device, so that the terminal device saves the first sub-model in the TEE of the terminal device; The first sub-model is sent to the terminal device, so that the terminal device saves the first sub-model in the TEE of the terminal device; The first sub-model is sent to the terminal device, so that the terminal device saves the first sub-model in the TEE of the terminal device; The first sub-model is sent to the terminal device, so that the terminal device saves the first sub-model in the TEE of the terminal device; 4. The method of claim 3, wherein, The first sub-model is sent to the terminal device, so that the terminal device saves the first sub-model in the TEE of the terminal device; The first sub-model is sent to the terminal device, so that the terminal device saves the first sub-model in the TEE of the terminal device; The first sub-model is sent to the terminal device, so that the terminal device saves the first sub-model in the TEE of the terminal device; The first sub-model is sent to the terminal device, so that the terminal device saves the first sub-model in the TEE of the terminal device; The first sub-model is sent to the terminal device, so that the terminal device saves the first sub-model in the TEE of the terminal device; The first sub-model is sent to the terminal device, so that the terminal device saves the first sub-model in the TEE of the terminal device; The first sub-model is sent to the terminal device, so that the terminal device saves the first sub-model in the TEE of the terminal device; The first sub-model is sent to the terminal device, so that the terminal device saves the first sub-model in the TEE of the terminal device; The first sub-model is sent to the terminal device, so that the terminal device saves the first sub-model in the TEE of the terminal device; The first sub-model is sent to the terminal device, so that the terminal device saves the first sub-model in the TEE of the terminal device; The first sub-model is sent to the terminal device, so that the terminal device saves the first sub-model in the TEE of the terminal device; The first sub-model is sent to the terminal device, so that the terminal device saves the first sub-model in the TEE of the terminal device; The first sub-model is sent to the terminal device, so that the terminal device saves the first sub-model in the TEE of the terminal device; The first sub-model is sent to the terminal device, so that the terminal device saves the first sub-model in the TEE of the terminal device; The first sub-model is sent to the terminal device, so that the terminal device saves the first sub-model in the TEE of the terminal device; The first sub-model is sent to the terminal device, so that the terminal device saves the first sub-model in the TEE of the terminal device; The first sub-model is sent to the terminal device, so that the terminal device saves the first sub-model in the TEE of the terminal device; The first sub-model is sent to the terminal device, so that the terminal device saves the first sub-model in the TEE of the terminal device; The first sub-model is sent to the terminal device, so that the terminal device saves the first sub-model in the TEE of the terminal device; The first sub-model is sent to the terminal device, so that the terminal device saves the first sub-model in the TEE of the terminal device; The first sub-model is sent to the terminal device, so that the terminal device saves the first sub-model in the TEE of the terminal device; The first sub-model is sent to the terminal device, so that the terminal device saves the first sub-model in the TEE of the terminal device; The first sub-model is sent to the terminal device, so that the terminal device saves the first sub-model in the TEE of the terminal device; The first sub-model is sent to the terminal device, so that the terminal device saves the first sub-model in the TEE of the terminal device; The first sub-model is sent to the terminal device, so that the terminal device saves the first sub-model in the TEE of the terminal device; The first sub-model is sent to the terminal device, so that the terminal device saves the first sub-model in the TEE of the terminal device; The first sub-model is sent to the terminal device, so that the terminal device saves the first sub-model in the TEE of the terminal device; The first sub-model is sent to the terminal device, so that the terminal device saves the first sub-model in the TEE of the terminal device; The first sub-model is sent to the terminal device, so that the terminal device saves the first sub-model in the TEE of the terminal device; The first sub-model is sent to the terminal device, so that the terminal device saves the first sub-model in the TEE of the terminal device; The first sub-model is sent to the terminal device, so that the terminal device saves the first sub-model in the TEE of the terminal device; The first sub-model is sent to the terminal device, so that the terminal device saves the first sub-model in the TEE of the terminal device; The first sub-model is sent to the terminal device, so that the terminal device saves the first sub-model in the TEE of the terminal device; The first sub-model is sent to the terminal device, so that the terminal device saves the first sub-model in the TEE of the terminal device; The first sub-model is sent to the terminal device, so that the terminal device saves the first sub-model in the TEE of the terminal device; The first sub-model is sent to the terminal device, so that the terminal device saves the first sub-model in the TEE of the terminal device; The first sub-model is sent to the terminal device, so that the terminal device saves the first sub-model in the TEE of the terminal device; The first sub-model is sent to the terminal device, so that the terminal device saves the first sub-model in the TEE of the terminal device; The first sub-model is sent to the terminal device, so that the terminal device saves the first sub-model in the TEE of the terminal device; The first sub-model is sent to the terminal device, so that the terminal device saves the first sub-model in the TEE of the terminal device; The first sub-model is sent to the terminal device, so that the terminal device saves the first sub-model in the TEE of the terminal device; The first sub-model is sent to the terminal device, so that the terminal device saves the first sub-model in the TEE of the terminal device; The first sub-model is sent to the terminal device, so that the terminal device saves the first sub-model in the TEE of the terminal device; The first sub-model is sent to the terminal device, so that the terminal device saves the first sub-model in the TEE of the terminal device; The first sub-model is sent to the terminal device, so that the terminal device saves the first sub-model in the TEE of the terminal device; The first sub-model is sent to the terminal device, so that the terminal device saves the first sub-model in the TEE of the terminal device; The first sub-model is sent to the terminal device, so that the terminal device saves the first sub-model in the TEE of the terminal device; The first sub-model is sent to the terminal device, so that the terminal device saves the first sub-model in the TEE of the terminal device; The first sub-model is sent to the terminal device, so that the terminal device saves the first sub-model in the TEE of the terminal device; The first sub-model is sent to the terminal device, so that the terminal device saves the first sub-model in the TEE of the terminal device; The first sub-model is sent to the terminal device, so that the terminal device saves the first sub-model in the TEE of the terminal device; The first sub-model is sent to the terminal device, so that the terminal device saves the first sub-model in the TEE of the terminal device; The first sub-model is sent to the terminal device, so that the terminal device saves the first sub-model in the TEE of the terminal For the sub-model saved into any execution environment of TEE or REE, target processing layers contained in the sub-model are compared with processing layers contained in the target model, and each missing processing layer located in the target model but not in the sub-model is determined; for each missing processing layer, a link layer corresponding to the missing processing layer is configured, and according to execution order information of each processing layer contained in the target model, second identification information of a next processing layer with execution order after the link layer is configured in level indication information of the link layer; according to execution order of each processing layer contained in the target model, execution order of each link layer and target processing layer contained in the sub-model is determined; based on the execution order and each link layer and target processing layer contained in the sub-model, the sub-model is determined.

5. The method of claim 1, wherein, The selecting at least one first target processing layer from the target model comprises: If the target model contains a verification layer, the verification layer is determined as a processing layer contained in the first target processing layer; wherein execution order of a first sub-verification layer in the verification layer is before execution order of any processing layer contained in the target model, and execution order of a second sub-verification layer in the verification layer is after execution order of any processing layer contained in the target model; the verification layer is used to verify whether a processing result of the target model on the to-be-processed data is credible.

6. The method of claim 1, wherein, The selecting at least one first target processing layer from the target model comprises: According to execution order of each processing layer of the target model, the each processing layer is sorted; a first processing layer ranked first in the sorting and a last processing layer ranked last are determined as processing layers contained in the first target processing layer.

7. The method of claim 1, wherein, The selecting at least one first target processing layer from the target model comprises: If the attribute parameter further comprises CPU peak calculation performance of TEE of the terminal device and CPU peak calculation performance of REE of the terminal device, and the CPU peak calculation performance of TEE of the terminal device is inferior to the CPU peak calculation performance of REE of the terminal device, a first target layer number is determined according to a preset layer number proportion threshold and a total layer number of processing layers contained in the target model; from the target model, the first target layer number of processing layers are selected, and the selected first target layer number of processing layers are determined as the first target processing layer.

8. The method of claim 7, wherein, The selecting the first target layer number of processing layers from the target model comprises: According to values of attribute parameters of each processing layer of the target model from small to large, the each processing layer is sorted; from a first processing layer ranked first in the sorting, the first target layer number of processing layers are selected from the sorting in turn.

9. The method of claim 1, wherein, The selecting at least one first target processing layer from the target model comprises: According to values of attribute parameters of each processing layer of the target model from small to large, the each processing layer is sorted; Each time, starting from the first ranked processing layer in the ranking, different numbers of processing layers are selected from the ranking in turn, and each time the different numbers of processing layers selected are taken as different candidate processing layer combinations respectively; wherein the total value of the attribute parameters of each processing layer included in each candidate processing layer combination does not exceed the attribute parameter corresponding to the TEE of the terminal device; For each candidate processing layer combination, determine the candidate layer number ratio of the number of layers of the processing layers included in the candidate processing layer combination to the total number of layers of the processing layers included in the target model; and determine the candidate running time corresponding to the candidate processing layer combination according to the pre-saved correspondence between each data size, candidate processing layer combination and running time; Based on the multi-objective optimization algorithm, the optimal layer number ratio and the optimal running time corresponding to the target processing layer combination are determined from each of the candidate layer number ratio and the candidate running time; Each processing layer included in the target processing layer combination is determined as the at least one first target processing layer.

10. A data processing method, characterized by, Applied to a terminal device, the method comprises: Receiving a data processing instruction, wherein the data processing instruction carries to-be-processed data and a target data type of the to-be-processed data; determining a target model corresponding to the target data type according to a saved correspondence between data types and models; Sending a model distribution request to a cloud device, wherein the model distribution request carries first identification information of the target model, a target size of the to-be-processed data, and attribute parameters of a trusted execution environment (TEE) of the terminal device; wherein the attribute parameters include at least one of a secure storage space and a secure running memory; Receiving a first sub-model sent by the cloud device and saving the first sub-model in the TEE; wherein the first sub-model is determined by the cloud device according to the first identification information, the target model corresponding to the first identification information, a correspondence between data sizes and attribute parameters of the target model, the target size corresponding to the target attribute parameter, the target attribute parameter, and the attribute parameters of the TEE of the terminal device; Processing the to-be-processed data based on the first sub-model.

11. The method of claim 10, wherein, The receiving of the first sub-model sent by the cloud device comprises: Receiving the first sub-model and a second sub-model sent by the cloud device; The saving of the first sub-model in the TEE comprises: Saving the first sub-model in the TEE of the terminal device and saving the second sub-model in a runtime environment (REE) of the terminal device; The processing of the to-be-processed data based on the first sub-model comprises: Processing the to-be-processed data based on the first sub-model and the second sub-model.

12. The method of claim 11, wherein, The processing of the to-be-processed data based on the first sub-model and the second sub-model comprises: For the sub-model saved in either the TEE or the REE, if the sub-model includes a link layer, the second identification information of a next processing layer located after the link layer in an execution order configured in level indication information of the link layer is acquired; and a processing result of the sub-model on the to-be-processed data is input into the processing layer corresponding to the second identification information according to the second identification information.

13. The method according to any of claims 10-12, characterized by, The processing of the to-be-processed data based on the first sub-model includes: If the target model includes a verification layer, the position information of preset verification data in the to-be-processed data is determined based on a first sub-verification layer in the verification layer, and the third identification information of an output processing layer of the verification layer in which a second sub-verification layer acquires a verification result of the verification data is determined, and the position information and the third identification information are sent to the second sub-verification layer; based on the second sub-verification layer, the verification processing result output at the output processing layer of the third identification information is acquired, the verification result corresponding to the position information in the verification processing result is acquired, and based on the verification result and a preset verification value, it is determined whether the processing result of the target model on the to-be-processed data is reliable.

14. A model protection apparatus characterized by comprising: The device is applied to a cloud device, and the device includes: The first receiving module is configured to, if a model dispatch request sent by a terminal device is received, acquire first identification information of a target model, a target size of to-be-processed data, and attribute parameters of a trusted execution environment (TEE) of the terminal device carried in the model dispatch request; wherein the attribute parameters include at least one of a secure storage space and a secure running memory; The first determining module is configured to acquire the target model corresponding to the first identification information, and determine target attribute parameters corresponding to the target size according to a predetermined correspondence between data sizes and attribute parameters of the target model; The second determining module is configured to determine a first sub-model saved in the TEE of the terminal device in the target model according to the target attribute parameters and the attribute parameters of the TEE of the terminal device. The sending module is configured to send the first sub-model to the terminal device, so that the terminal device saves the first sub-model in the TEE of the terminal device. The second determining module is specifically configured to select at least one first target processing layer from the target model; wherein a total value of attribute parameters of the at least one first target processing layer does not exceed a value of attribute parameters corresponding to the TEE of the terminal device; and the first sub-model is determined based on the selected at least one first target processing layer.

15. A data processing apparatus, characterized by The device is applied to a terminal device, and the device includes: The second receiving module is configured to receive a data processing instruction, wherein the data processing instruction carries to-be-processed data and a target data type of the to-be-processed data; and a target model corresponding to the target data type is determined according to a saved correspondence between data types and models. The request module is configured to send a model distribution request to a cloud device, the model distribution request carrying first identification information of a target model, a target size of to-be-processed data, and attribute parameters of a trusted execution environment (TEE) of the terminal device; the attribute parameters include at least one of a secure storage space and a secure running memory; The save module is configured to receive a first sub-model sent by the cloud device and save the first sub-model in the TEE; the first sub-model is obtained by the cloud device according to the first identification information, the target model corresponding to the first identification information, a predetermined correspondence between a data size and attribute parameters of the target model, the target attribute parameters corresponding to the target size, and the first sub-model saved in the TEE of the terminal device according to the target attribute parameters and the attribute parameters of the TEE of the terminal device; The processing module is configured to process the to-be-processed data based on the first sub-model.

16. An electronic device, comprising: The electronic device at least includes a processor and a memory, and the processor is configured to implement the steps of the model protection method in any one of claims 1-9 or the steps of the model protection method in any one of claims 10-13 when executing the computer program stored in the memory.

17. A computer-readable storage medium, characterized in that, The electronic device has a computer program stored therein, and the computer program is executed by the processor to implement the steps of the model protection method in any one of claims 1-9 or the steps of the model protection method in any one of claims 10-13.

Images