Data processing method, apparatus and system

Abstract

The application discloses a data processing method, device and system. The method comprises the following steps: splitting a preset data processing module from a machine learning model to generate a security application module, wherein the security application module is used for performing encrypted calculation on data input into the machine learning model; inputting, by a preset operator, an output value of an operation layer in the split machine learning model as an input value of the security application module, and inputting the input value into the security application module; performing subgraph calculation in an isolated operation environment according to the input value by the security application module to obtain a calculation result; and returning the calculation result to the preset operator. The application solves the technical problem of different operation pressures of a TEE model caused by the need to adapt different inference frameworks according to different customer requirements in the related art.

Description

Technical Field

[0001] This invention relates to the field of Internet technology, and more specifically, to a data processing method, apparatus, and system. Background Technology

[0002] Trusted Execution Environments (TEEs), also known as independent operating systems, ensure the storage, processing, and protection of sensitive data in an isolated and trusted environment through hardware isolation. They are widely used in various security applications, such as payment, fingerprinting, and digital rights management (DRM). Artificial intelligence (AI) utilizes large amounts of data for training and then applies the learned results to subsequent data-driven decision-making / prediction. It is currently widely used in various scenarios, such as pattern recognition, computer vision, and autonomous driving. With the widespread application of AI, the AI ​​field faces increasing security challenges, such as model theft, misleading inference results, and leakage of sensitive data.

[0003] In practical AI applications, to ensure security, such as model security and privacy security, it is necessary to encrypt the model, decrypt the model, and perform inference in a trusted execution environment. At the same time, the performance of inference running in the TEE and the impact on the original application on the Rich Execution Environment (REE) side should be considered. Here, REE corresponds to TEE.

[0004] In related technologies, different customers use different inference frameworks, so the REE side obtains the needs of different customers and then adapts different inference frameworks in the TEE, which increases the workload of TEE development.

[0005] To address the issue of high computational pressure on TEE models due to the need to adapt different inference frameworks to meet the needs of different clients, no effective solution has yet been proposed. Summary of the Invention

[0006] This invention provides a data processing method, apparatus, and system to at least solve the technical problem of poor computational pressure in TEE models caused by the need to adapt different inference frameworks according to different customer needs in related technologies.

[0007] According to one aspect of the present invention, a data processing method is provided, comprising: splitting a preset data processing module from a machine learning model to generate a secure application module, wherein the secure application module is used to perform encrypted calculations on data input into the machine learning model; using a preset operator to take the output value of the computational layer in the split machine learning model as the input value to the secure application module, and inputting the input value to the secure application module; performing subgraph calculations in an isolated computational environment based on the input value by the secure application module to obtain a calculation result; and returning the calculation result to the preset operator.

[0008] Optionally, extracting a preset data processing module from the machine learning model to generate a security application module includes: extracting a preset data processing module from the machine learning model using a preset tool; and generating a security application module based on the preset data processing module.

[0009] Further, optionally, generating a security application module based on a preset data processing module includes: optimizing and encrypting the preset data processing module using a heterogeneous acceleration mutant to obtain the security application module.

[0010] Optionally, optimizing and encrypting the preset data processing module using a heterogeneous accelerated mutant to obtain a secure application module includes: configuring the network structure in the machine learning model at a specified location in the secure application module; and encrypting the specified location in the secure application module to obtain an encrypted secure application module.

[0011] Optionally, using a preset operator to take the output value of the computational layer in the split machine learning model as the input value to the security application module and inputting the input value to the security application module includes: if the computational layer includes a first computational layer, obtaining the output value of the first computational layer in the split machine learning model through a preset operator; taking the output value as the input value to the security application module; and inputting the input value to the security application module.

[0012] Further, optionally, the subgraph computation is performed by the security application module in an isolated computing environment based on the input value, and the computation result is obtained by: detecting whether the split machine learning model has a usage license based on the input value; when the split machine learning model has a usage license, or when the split machine learning model does not require a license, the subgraph computation is performed by the security application module in an isolated computing environment based on the input value, and the computation result is obtained; when the split machine learning model does not have a usage license, the computation is stopped.

[0013] Optionally, the security application module performs subgraph calculations in an isolated computing environment based on the input values ​​to obtain the calculation results, including: assigning corresponding application programming interfaces based on the input values, and performing subgraph calculations in an isolated computing environment based on the input values ​​to obtain the calculation results.

[0014] Further, optionally, returning the calculation result to the preset operator includes: if the operation layer also includes a second operation layer, inputting the calculation result into the second operation layer in the split machine learning model through the preset operator; wherein the first operation layer is located before the preset operator and the second operation layer is located after the preset operator.

[0015] According to another aspect of the present invention, a data processing method is provided, applied to an artificial intelligence chip, comprising: the artificial intelligence chip decomposes a preset data processing module from a machine learning model to generate a security application module; the artificial intelligence chip obtains the output value of the operation layer in the decomposed machine learning model as the input value to the security application module through a preset operator, and inputs the input value to the security application module; the artificial intelligence chip performs encrypted calculation on the input value through the security application module to obtain the calculation result, and returns the calculation result to the preset operator.

[0016] According to another aspect of the present invention, a data processing system is provided, comprising: a machine learning model, a preset tool, a first execution environment, and a second execution environment. The machine learning model includes a preset data processing module. The preset data processing module is obtained by splitting the machine learning model using the preset tool. The preset data processing module is configured in the first execution environment to generate a secure application module. The split machine learning model is then configured in the second execution environment. The second execution environment is used to collect data, use the collected data as input values ​​to the secure application module in the first execution environment, input the input values ​​to the secure application module using a preset operator, and receive the calculation results obtained by the secure application module in the first execution environment through encrypted calculation of the input values ​​using the preset operator.

[0017] According to another aspect of the present invention, a data processing apparatus is also provided, comprising: a splitting module, configured to split a preset data processing module from a machine learning model to generate a secure application module, wherein the secure application module is used to perform encrypted calculations on data input into the machine learning model; an input module, configured to use the output values ​​of the computational layers in the split machine learning model as input values ​​to the secure application module through a preset operator, and input the input values ​​to the secure application module; an acquisition module, configured to perform subgraph calculations in an isolated computational environment based on the input values ​​through the secure application module to obtain calculation results; and an interaction module, configured to return the calculation results to the preset operator.

[0018] According to another aspect of the present invention, a non-volatile storage medium is also provided, wherein the non-volatile storage medium includes a stored program, wherein the program controls the device where the non-volatile storage medium is located to execute the above-described method during runtime.

[0019] According to another aspect of the present invention, a processor is also provided, wherein the processor is used to run a program, wherein the program executes the above-described method when it runs.

[0020] In this embodiment of the invention, a secure application module is generated by splitting a preset data processing module from the machine learning model. The secure application module is used to perform encrypted calculations on the data input into the machine learning model. The output values ​​of the computational layers in the split machine learning model are used as input values ​​to the secure application module through a preset operator. The secure application module performs subgraph calculations in an isolated computing environment based on the input values ​​to obtain the calculation results. The calculation results are returned to the preset operator, thereby improving the computing power of the TEE. This achieves the technical effect of no longer integrating various inference frameworks into the TEE, and providing corresponding application calls for TAs that need to run in the TEE. This solves the technical problem of poor computing pressure in the TEE model caused by the need to adapt different inference frameworks according to different customer needs in related technologies. Attached Figure Description

[0021] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this application, illustrate exemplary embodiments of the invention and, together with their description, serve to explain the invention and do not constitute an undue limitation thereof. In the drawings:

[0022] Figure 1 This is a hardware structure block diagram of a computer terminal for a data processing method according to an embodiment of the present invention.

[0023] Figure 2 This is a flowchart of a data processing method according to Embodiment 1 of the present invention;

[0024] Figure 3 This is a schematic diagram of the data processing method for obtaining the security application module according to Embodiment 1 of the present invention;

[0025] Figure 4 This is a schematic diagram illustrating the interaction between the REE system and the TEE system in the data processing method according to Embodiment 1 of the present invention;

[0026] Figure 5 This is a flowchart illustrating the data processing method according to Embodiment 2 of the present invention;

[0027] Figure 6 This is a schematic diagram of a data processing system according to Embodiment 3 of the present invention;

[0028] Figure 7 This is a schematic diagram of a data processing apparatus according to Embodiment 4 of the present invention. Detailed Implementation

[0029] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0030] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0031] Technical terms used in this application:

[0032] TEE (Trusted Execution Environment): A trusted execution environment, an independent operating system, used to store, process, and protect sensitive data;

[0033] TA (Trusted Application): A security application that runs inside the TEE.

[0034] AI (Artificial intelligence): Artificial intelligence;

[0035] API (Application Programming Interface): Application programming interface;

[0036] REE (Rich Execution Environment): The opposite of TEE.

[0037] Example 1

[0038] According to an embodiment of the present invention, a method embodiment of a data processing method is also provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0039] The method embodiment provided in Embodiment 1 of this application can be executed on a mobile terminal, computer terminal, or similar computing device. Taking its operation on a computer terminal as an example, Figure 1 This is a hardware structure block diagram of a computer terminal for a data processing method according to an embodiment of the present invention. Figure 1 As shown, the computer terminal 10 may include one or more (only one is shown in the figure) processors 102 (processors 102 may include, but are not limited to, microprocessors MCUs or programmable logic devices FPGAs), a memory 104 for storing data, and a transmission module 106 for communication functions. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, computer terminal 10 may also include... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0040] The memory 104 can be used to store software programs and modules of application software, such as program instructions / modules corresponding to the data processing method in this embodiment of the invention. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby implementing the data processing method of the aforementioned application. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0041] The transmission module 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the computer terminal 10. In one example, the transmission module 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission module 106 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0042] Under the aforementioned operating environment, this application provides the following: Figure 2 The data processing method shown. Figure 2 This is a flowchart of a data processing method according to Embodiment 1 of the present invention. The specific steps of a data processing method provided in this application are as follows:

[0043] Step S202: Extract the preset data processing module from the machine learning model to generate a security application module, wherein the security application module is used to perform encrypted calculations on the data input into the machine learning model.

[0044] In step S202 of this application, the machine learning model in this embodiment can be an AI model, and the preset data processing module can be the part of the AI ​​model used to calculate confidential / sensitive information. Figure 3 This is a schematic diagram of the security application module obtained in the data processing method according to Embodiment 1 of the present invention; as shown Figure 3 As shown, the tool is used to isolate the confidential / sensitive parts of the AI ​​model to generate a security application module (TA). The AI ​​model is divided into two parts, with the security application module being separated from the AI ​​model and applied to the TEE system (i.e., Figure 3 The AI ​​module, which does not include a security application module, is applied to the REE system (i.e., the IR subgraph generates a TEE subgraph). Figure 3 Neutron graph replacement (generating REE model files) is used to save on the overhead of the TEE's internal inference framework. The layers to be separated are configured based on a comprehensive consideration of security and performance requirements.

[0045] Optionally, step S202, which involves extracting a preset data processing module from the machine learning model to generate a security application module, includes: extracting the preset data processing module from the machine learning model using a preset tool; and generating a security application module based on the preset data processing module.

[0046] The preset tool is denoted as tool, in conjunction with the above. Figure 3As shown, the tool breaks down the AI ​​model, directly compiling the model that needs to run on the TEE side into a TA (i.e., the security application module in this embodiment), and encrypting the text, rodata, and data segments of the TA or the configuration file. The encryption key is related to the vendor's public key, ensuring that different vendors have different encryption keys.

[0047] Specifically, the AI ​​model used for calculating confidential / sensitive information (i.e., the preset data processing module in this application embodiment) is split into parts using a preset tool, and a TA is generated based on the parts used for calculating confidential / sensitive information.

[0048] Further, optionally, generating a security application module based on a preset data processing module includes: optimizing and encrypting the preset data processing module using a heterogeneous acceleration mutant to obtain the security application module.

[0049] Specifically, such as Figure 3 As shown in the embodiment of this application, the part of the AI ​​model used for calculating confidential / sensitive information is optimized by a heterogeneous accelerated compiler, and finally compiled into binary instructions. The encrypted TA is then generated by the tool.

[0050] It should be noted that, unlike existing technologies, the TEE in this embodiment no longer integrates various inference frameworks. The models that need to run within the TEE are compiled into a unified format TA by an AI compiler. The TEE internally implements unified graph construction and operator logic, and provides extended APIs for TA to call.

[0051] Optionally, optimizing and encrypting the preset data processing module using a heterogeneous accelerated mutant to obtain a secure application module includes: configuring the network structure in the machine learning model at a specified location in the secure application module; and encrypting the specified location in the secure application module to obtain an encrypted secure application module.

[0052] Specifically, after the decomposed AI model is compiled into a TA (Technical Analysis Module), the AI ​​model parameters can be used as the TA's roddata or data segment, or as a separate configuration file. The network structure is reflected in the TA's text segment. The TA's text and roddata segments are encrypted, and the data segment or configuration file is also encrypted. The encrypted TA, or the TA and configuration file, is deployed on the device. The encryption key is guaranteed to be unique for each vendor. The encrypted TA is signed by the vendor.

[0053] The text segment, or code segment, stores program code and is determined before execution (at compile time), and is usually read-only.

[0054] The rodata segment is for read-only data, and the rodata segment is for constant data.

[0055] The data segment stores initialized global variables.

[0056] Step S204: The output value of the operation layer in the split machine learning model is used as the input value of the security application module by a preset operator, and the input value is input to the security application module.

[0057] In step S204 of this application, since a separate TA is generated and runs on the TEE system in this embodiment, a custom operator (i.e., the preset operator in this embodiment) is configured in the REE system. The REE interacts with the TA through this custom operator. During the interaction, all parts involving inference, confidentiality, or sensitivity run on the TEE system (i.e., in a secure environment), while the custom operator runs on the REE. The computation layer in the split machine model, i.e., as shown... Figure 3 As shown, in the REE model, the operation layer uses a custom operator to take the output value of the REE operation layer as the input value of the security application module TA.

[0058] Optionally, step S204, which uses a preset operator to take the output value of the operation layer in the split machine learning model as the input value to the security application module and inputs the input value to the security application module, includes: if the operation layer includes a first operation layer, obtaining the output value of the first operation layer in the split machine learning model through a preset operator; taking the output value as the input value to the security application module; and inputting the input value to the security application module.

[0059] Specifically, based on Figure 3 The AI ​​model is broken down into two parts: one running on the TEE system and the other running on the REE system. Within the REE system... Figure 4 This is a schematic diagram illustrating the interaction between the REE system and the TEE system in the data processing method according to Embodiment 1 of the present invention, as shown below. Figure 4 As shown, by inserting (configuring) custom operators (denoted as Sec Op0, Sec Op1) into the REE system, the custom operators are responsible for taking the output values ​​of the previous layer (i.e., the first operation layer in this embodiment) of the model custom operators in the REE system as the input values ​​of the TEE and inputting them into the TA in the TEE.

[0060] In this embodiment, a custom operator is used to replace the model that was removed from the REE side. This custom operator is responsible for interacting with the TEE. For REE application developers, this shields the differences brought about by the introduction of hardware security and does not require changes to the original REE side application.

[0061] Step S206: The security application module performs subgraph calculations in an isolated computing environment based on the input values ​​to obtain the calculation results.

[0062] In step S206 of this application, based on the input of the output value into TA in step S204, the inference part of the REE system is run in the TEE system, and the TEE system generates the final calculation result.

[0063] Optionally, in step S206, the subgraph calculation is performed by the security application module in an isolated computing environment based on the input value to obtain the calculation result, including: detecting whether the split machine learning model has a usage license based on the input value; when the split machine learning model has a usage license, or when the split machine learning model does not require a license, the subgraph calculation is performed by the security application module in an isolated computing environment based on the input value to obtain the calculation result; when the split machine learning model does not have a usage license, the calculation is stopped.

[0064] Specifically, such as Figure 4 As shown, for models requiring authorization, the TEE checks the authorization when calculating the first extracted model portion to determine if the device has permission to use the model. This prevents attackers from bypassing the authorization check logic on the REE side. If the model can be used without authorization, the license check in the TEE system (i.e., detecting whether the extracted machine learning model has authorization in this embodiment) can be ignored.

[0065] Further, optionally, the security application module performs subgraph calculations in an isolated computing environment based on the input values ​​to obtain the calculation results. Obtaining the calculation results includes: assigning the corresponding application programming interface based on the input values, and performing subgraph calculations in an isolated computing environment based on the input values ​​to obtain the calculation results.

[0066] Specifically, such as Figure 4 As shown, sec op0 in the REE (i.e., the preset operator in this embodiment) takes the output of part 0 (the first operation layer in this embodiment) as the input of Op00 (operator) in TA in TEE. TEE calculates the result of operator op0n through operator op00-op0n and outputs it as part 2 (such as...). Figure 4 As shown, the second computation layer is the input. Specifically, when user input data is protected, the first layer is split into the TEE system for computation, and the first custom operator uses the inference part input as the TEE input.

[0067] In the model initialization section, during the initialization of the first custom operator, the TEE loads and decrypts the TA, or decrypts both the TA and the configuration file. The TEE implements graph construction and the basic logic of the operators, serving as a general module and providing extended API calls to the TA. The inference part of the model split from the REE system is computed in the TEE, receiving the output from the REE side as input for TEE computation. The final result output by the TEE serves as input for subsequent network layers on the REE side; the computation results of intermediate layers are not exposed externally.

[0068] In this embodiment, a unified AI graph and operator interface are defined within the TEE to facilitate connection with AI hardware acceleration chips.

[0069] Step S208: Return the calculation result to the preset operator.

[0070] Optionally, returning the calculation result to the preset operator in step S208 includes: if the operation layer also includes a second operation layer, inputting the calculation result into the second operation layer in the split machine learning model; wherein the first operation layer is located before the preset operator and the second operation layer is located after the preset operator.

[0071] Specifically, since the REE system has multiple layers (Part0, Part2, Part4, ...), and the output of the first layer serves as the input to the TEE system, and a large amount of computation is concentrated on the TA side of the TEE system, after obtaining the computation result from the TEE system, the computation result is used as the input to the subsequent computation layer until the TA computation is called again. The part to be computed is then input into the TA in the TEE system, and the TA performs the computation again. The computation result of the TA is then input into the next computation layer of the REE system as the input of that computation layer to continue the computation.

[0072] For example, when Part2 (i.e., the second operation layer in this application embodiment) needs to call TA, the inference part of Part2 is input into the operators Op10-Op1n of TA through the operator SecOp1. When the operator Op1n returns the calculation result to the REE system, the calculation result is used as the input of Part4 (the third operation layer) for calculation again.

[0073] It should be noted that, in this embodiment, updating the AI ​​model only requires updating the model file on the REE side and the corresponding binary file or configuration file of the TA. Furthermore, the solution provided in this embodiment is applicable to different hardware carriers, such as Intel SGX and ARM TrustZone. Model splitting is universal; however, the interaction method between the REE and TEE for custom operators, the TA format, and the implementation of graphing and operator logic in the TEE are hardware carrier-dependent.

[0074] In this embodiment of the invention, a secure application module is generated by splitting a preset data processing module from the machine learning model. The secure application module is used to perform encrypted calculations on the data input into the machine learning model. The output values ​​of the computational layers in the split machine learning model are used as input values ​​to the secure application module through a preset operator. The secure application module performs subgraph calculations in an isolated computing environment based on the input values ​​to obtain the calculation results. The calculation results are returned to the preset operator, thereby improving the computing power of the TEE. This achieves the technical effect of no longer integrating various inference frameworks into the TEE, and providing corresponding application calls for TAs that need to run in the TEE. This solves the technical problem of poor computing pressure in the TEE model caused by the need to adapt different inference frameworks according to different customer needs in related technologies.

[0075] Example 2

[0076] According to another aspect of the present invention, a data processing method is provided, applied to an artificial intelligence chip. Figure 5 This is a flowchart illustrating the data processing method according to Embodiment 2 of the present invention, as shown below. Figure 5 As shown, it includes:

[0077] In step S502, the artificial intelligence chip extracts a preset data processing module from the machine learning model to generate a security application module;

[0078] In step S504, the artificial intelligence chip obtains the output value of the operation layer in the split machine learning model through a preset operator as the input value to the security application module, and inputs the input value to the security application module.

[0079] In step S506, the artificial intelligence chip performs encrypted calculations on the input value through the security application module, obtains the calculation result, and returns the calculation result to the preset operator.

[0080] In summary, combining steps S502 to S506, the data processing method provided in this application embodiment can be applied to artificial intelligence chips, i.e., AI chips. In this application embodiment, the machine learning model can be an AI model, and the preset data processing module can be the part of the AI ​​model used to calculate confidential / sensitive information. A tool is used to isolate the part of the AI ​​model used to calculate confidential / sensitive information, generating a security application module (TA). The AI ​​model is divided into two parts: the security application module is separated from the AI ​​model and applied to the TEE system, while the AI ​​module without the security application module is applied to the REE system, thus saving the overhead of the TEE's internal inference framework. The layers to be separated are configured based on a comprehensive consideration of security and performance requirements.

[0081] Specifically, a heterogeneous accelerated compiler optimizes the parts of the AI ​​model used for calculating confidential / sensitive information, and finally compiles them into binary instructions. The tool is then used to further generate encrypted TA from the parts used for calculating confidential / sensitive information.

[0082] It should be noted that, unlike existing technologies, the TEE in this embodiment no longer integrates various inference frameworks. The models that need to run within the TEE are compiled into a unified format TA by an AI compiler. The TEE internally implements unified graph construction and operator logic, and provides extended APIs for TA to call.

[0083] Specifically, after the decomposed AI model is compiled into a TA (Technical Analysis Module), the AI ​​model parameters can be used as the TA's roddata or data segment, or as a separate configuration file. The network structure is reflected in the TA's text segment. The TA's text and roddata segments are encrypted, and the data segment or configuration file is also encrypted. The encrypted TA, or the TA and configuration file, is deployed on the device. The encryption key is guaranteed to be unique for each vendor. The encrypted TA is signed by the vendor.

[0084] In addition, in the REE system, by inserting (configuring) custom operators (denoted as Sec Op0, Sec Op1) into the REE system, the custom operators are responsible for taking the output values ​​of the previous layer of the model custom operators in the REE system as the input values ​​of the TEE and inputting them into the TA in the TEE.

[0085] In this embodiment, a custom operator is used to replace the model that was removed from the REE side. This custom operator is responsible for interacting with the TEE. For REE application developers, this shields the differences brought about by the introduction of hardware security and does not require changes to the original REE side application.

[0086] Finally, the inference part of the REE system is run in the TEE system, and the TEE system generates the final calculation results.

[0087] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that the present invention is not limited to the described order of actions, because according to the present invention, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to the present invention.

[0088] Through the above description of the embodiments, those skilled in the art can clearly understand that the data processing method according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platform. Of course, it can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of the present invention.

[0089] Example 3

[0090] According to another aspect of the present invention, a data processing system is provided. Figure 6 This is a schematic diagram of a data processing system according to Embodiment 3 of the present invention, as shown below. Figure 6 As shown, the system includes: a machine learning model 61, a preset tool 62, a first execution environment 63, and a second execution environment 64. The machine learning model 64 includes a preset data processing module. The preset data processing module is obtained by splitting the machine learning model using the preset tool 62. The preset data processing module is configured in the first execution environment 63 to generate a security application module. The split machine learning model is then configured in the second execution environment 64. The second execution environment 64 is used to collect data. The collected data is used as the input value to the security application module in the first execution environment 63. The input value is input to the security application module through a preset operator 62. The preset operator 62 also receives the calculation result obtained by the security application module in the first execution environment 63 through encrypted calculation of the input value.

[0091] Specifically, such as Figure 6 As shown, in the data processing system provided in this application embodiment, the machine model 61 is labeled AI, the preset tool is labeled tool, the first execution environment 63 is labeled TEE, the second execution environment 64 is labeled REE, the security application module is labeled TA, and the preset operators in REE are labeled SecOp0, SecOp1, ...;

[0092] In this embodiment, the AI ​​model is divided into two parts using a tool. The part that performs confidential / sensitive computations is configured in the TEE to generate the TA. The remaining AI model part is configured in the REE. Data is collected through the REE and used as confidential data. The collected data is input into the operators Op00...Op0n and Op10...Op1n in the TA of the TEE through preset operators SecOp0, SecOp1.... During the specific computation process, the output value of the first operation layer Part0 of the REE (i.e., the confidential data in this embodiment) is input into the operators Op00...Op0n in the TA of the TEE through the preset operator SecOp0. After Op0n outputs the computation result, the computation result is fed back to SecOp0 as the input value of Part2. The output value of Part2 is input into the operators Op10...Op1n in the TA of the TEE through SecOp1. After Op1n outputs the computation result, the computation result is fed back to SecOp1 as the input value of Part4, and so on, and the computation is repeated.

[0093] Example 4

[0094] According to embodiments of the present invention, an apparatus for implementing the above-described data processing method is also provided. Figure 7 This is a schematic diagram of a data processing apparatus according to Embodiment 4 of the present invention, as shown below. Figure 7 As shown, the data processing apparatus provided in this application embodiment includes: a splitting module 72, used to split a preset data processing module from a machine learning model to generate a secure application module, wherein the secure application module is used to perform encrypted calculations on the data input into the machine learning model; an input module 74, used to use the output value of the operation layer in the split machine learning model as the input value to the secure application module through a preset operator, and input the input value to the secure application module; an acquisition module 76, used to perform subgraph calculations in an isolated operation environment based on the input value through the secure application module to obtain the calculation result; and an interaction module 78, used to return the calculation result to the preset operator.

[0095] Example 5

[0096] According to another aspect of the present invention, a non-volatile storage medium is also provided, wherein the non-volatile storage medium includes a stored program, wherein the program controls the device where the non-volatile storage medium is located to execute the method in embodiment 1 or 2 above during runtime.

[0097] Example 6

[0098] According to another aspect of the present invention, a processor is also provided, wherein the processor is used to run a program, wherein the program executes the method in embodiment 1 or 2 above when it runs.

[0099] Example 7

[0100] Embodiments of the present invention also provide a storage medium. Optionally, in this embodiment, the storage medium can be used to store the program code executed by the data processing method provided in Embodiment 1.

[0101] Optionally, in this embodiment, the storage medium may be located in any computer terminal in a group of computer terminals in a computer network, or in any mobile terminal in a group of mobile terminals.

[0102] Optionally, in this embodiment, the storage medium is configured to store program code for performing the following steps: splitting a preset data processing module from the machine learning model to generate a secure application module, wherein the secure application module is used to perform encrypted calculations on the data input to the machine learning model; using a preset operator to take the output value of the computation layer in the split machine learning model as the input value to the secure application module, and inputting the input value to the secure application module; using the secure application module to perform subgraph calculations in an isolated computation environment based on the input value to obtain the calculation result; and returning the calculation result to the preset operator.

[0103] Optionally, in this embodiment, the storage medium is configured to store program code for performing the following steps: extracting a preset data processing module from a machine learning model and generating a security application module, including: extracting the preset data processing module from the machine learning model using a preset tool; and generating a security application module based on the preset data processing module.

[0104] Further, optionally, in this embodiment, the storage medium is configured to store program code for performing the following steps: generating a security application module based on a preset data processing module includes: optimizing and encrypting the preset data processing module through a heterogeneous acceleration mutant to obtain the security application module.

[0105] Optionally, in this embodiment, the storage medium is configured to store program code for performing the following steps: optimizing and encrypting a preset data processing module through a heterogeneous accelerated mutant to obtain a secure application module includes: configuring the network structure in the machine learning model at a specified location in the secure application module; encrypting the specified location of the secure application module to obtain an encrypted secure application module.

[0106] Optionally, in this embodiment, the storage medium is configured to store program code for performing the following steps: using the output value of the operation layer in the split machine learning model as the input value to the security application module through a preset operator, and inputting the input value to the security application module includes: when the operation layer includes a first operation layer, obtaining the output value of the first operation layer in the split machine learning model through a preset operator; using the output value as the input value to the security application module; and inputting the input value to the security application module.

[0107] Further, optionally, in this embodiment, the storage medium is configured to store program code for performing the following steps: the subgraph calculation is performed by the security application module in an isolated computing environment based on the input value to obtain the calculation result, including: detecting whether the split machine learning model has a usage license based on the input value; when the split machine learning model has a usage license, or when the split machine learning model does not require a license, the subgraph calculation is performed by the security application module in an isolated computing environment based on the input value to obtain the calculation result; when the split machine learning model does not have a usage license, the calculation is stopped.

[0108] Optionally, in this embodiment, the storage medium is configured to store program code for performing the following steps: performing subgraph calculations in an isolated computing environment based on input values ​​through a secure application module to obtain calculation results, including: allocating corresponding application programming interfaces based on input values, and performing subgraph calculations in an isolated computing environment based on input values ​​to obtain calculation results.

[0109] Further, optionally, in this embodiment, the storage medium is configured to store program code for performing the following steps: returning the calculation result to the preset operator includes: if the operation layer further includes a second operation layer, inputting the calculation result into the second operation layer in the split machine learning model through the preset operator; wherein, the first operation layer is located before the preset operator, and the second operation layer is located after the preset operator.

[0110] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0111] In the above embodiments of the present invention, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0112] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0113] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0114] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0115] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0116] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A data processing method, comprising: A preset data processing module is extracted from the machine learning model to generate a security application module. The preset data processing module is used to represent the part of the machine learning model used to calculate confidential or sensitive information, and the security application module is used to perform encrypted calculations on the data input to the machine learning model. The output values ​​of the computational layers in the split machine learning model are used as input values ​​to the security application module by using preset operators, and the input values ​​are input to the security application module. The preset operators are used to represent custom operators configured in the rich execution environment. The security application module performs subgraph calculations in an isolated computing environment based on the input values ​​to obtain the calculation results; The calculation result is returned to the preset operator.

2. The method according to claim 1, wherein, The step of extracting a pre-defined data processing module from the machine learning model to generate a security application module includes: The preset data processing module is extracted from the machine learning model using preset tools; The security application module is generated based on the preset data processing module.

3. The method according to claim 2, wherein, The step of generating the security application module based on the preset data processing module includes: The preset data processing module is optimized and encrypted by a heterogeneous accelerated mutant to obtain the security application module.

4. The method according to claim 3, wherein, The process of optimizing and encrypting the preset data processing module using a heterogeneous accelerated mutant to obtain the secure application module includes: Configure the network structure in the machine learning model at a specified location in the security application module; Encrypt a specified location of the security application module to obtain the encrypted security application module.

5. The method according to claim 1, wherein, The step of using a preset operator to take the output value of the decomposed computational layer in the machine learning model as the input value to the security application module, and inputting the input value to the security application module, includes: When the computation layer includes a first computation layer, the output value of the first computation layer in the split machine learning model is obtained through the preset operator; The output value is used as the input value to the security application module; The input value is input into the security application module.

6. The method according to claim 5, wherein, The subgraph calculation, performed by the secure application module based on the input value in an isolated computing environment, yields the following results: Based on the input value, detect whether the split machine learning model has an authorization to use; When the decomposed machine learning model is found to have the required authorization, or when the decomposed machine learning model is found to be free of authorization, the security application module performs subgraph computation in an isolated computing environment based on the input value to obtain the computation result. The computation stops when the split machine learning model is found to lack the required usage authorization.

7. The method according to claim 6, wherein, The step of performing subgraph calculations in an isolated computing environment based on the input values ​​through the secure application module to obtain the calculation results includes: The corresponding application programming interface is assigned based on the input value, and subgraph calculation is performed in an isolated computing environment based on the input value to obtain the calculation result.

8. The method according to claim 7, wherein, Returning the calculation result to the preset operator includes: If the computation layer further includes a second computation layer, the calculation result is input into the second computation layer of the split machine learning model through the preset operator; wherein the first computation layer is located before the preset operator and the second computation layer is located after the preset operator.

9. A data processing method applied to an artificial intelligence chip, comprising: The artificial intelligence chip extracts a preset data processing module from the machine learning model to generate a security application module, wherein the preset data processing module is used to represent the part of the machine learning model used to calculate confidential or sensitive information. The artificial intelligence chip obtains the output value of the operation layer in the split machine learning model through a preset operator as the input value to the security application module, and inputs the input value to the security application module. The preset operator is used to represent a custom operator configured in a rich execution environment. The artificial intelligence chip performs encrypted calculations on the input value through the security application module, obtains the calculation result, and returns the calculation result to the preset operator.

10. A data processing system, comprising: Machine learning model, preset tools, first execution environment, and second execution environment, among which, The machine learning model includes a preset data processing module. The preset data processing module is obtained by splitting the machine learning model using the preset tool. The preset data processing module is configured in the first execution environment to generate a security application module. The split machine learning model is then configured in the second execution environment. The preset data processing module is used to represent the part of the machine learning model used to calculate confidential or sensitive information. The second execution environment is used to collect data, use the collected data as input values ​​to the security application module in the first execution environment, input the input values ​​to the security application module through a preset operator, and receive the calculation result obtained by the security application module in the first execution environment through the preset operator to perform encrypted calculation on the input values. The preset operator is used to represent a custom operator configured in the second execution environment.

11. A data processing apparatus, comprising: A splitting module is used to split a preset data processing module from a machine learning model to generate a security application module. The preset data processing module is used to represent the part of the machine learning model used to calculate confidential or sensitive information, and the security application module is used to perform encrypted calculations on the data input to the machine learning model. An input module is used to take the output value of the operation layer in the split machine learning model as the input value to the security application module through a preset operator, and input the input value to the security application module. The preset operator is used to represent a custom operator configured in a rich execution environment. The acquisition module is used to perform subgraph calculations in an isolated computing environment based on the input values ​​through the security application module, and obtain the calculation results; An interaction module is used to return the calculation result to the preset operator.

12. A non-volatile storage medium, wherein, The non-volatile storage medium includes a stored program, wherein, when the program is executed, it controls the device containing the non-volatile storage medium to perform the method of claim 1.

13. A processor, wherein, The processor is used to run a program, wherein the program executes the method of claim 1 when it runs.

Images