A method, apparatus, device, and storage medium for model data processing

Abstract

This application provides a model data processing method, apparatus, device, and storage medium, which are executed by a trusted computing sandbox on a first user's server. The method obtains the first user's initial model and the second user's encrypted training data; decrypts the second user's encrypted training data using a key to obtain the second user's training data; and trains the first user's initial model in the trusted computing sandbox based on the second user's training data to obtain a trained model. This application can effectively achieve secure isolation between the first user's model data and the second user's model data, preventing each party from knowing the other's model data. This effectively improves the security of the model data while enabling model training.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a model data processing method, apparatus, device and storage medium. Background Art

[0002] In today's era of rapid development of artificial intelligence (AI), various deep learning models are rapidly emerging and being applied. However, the development and use of these models also bring with them a series of security risks, such as data leakage, data misuse, and model attacks.

[0003] Typically, deep learning models require a large amount of training data to train the initial model. However, if the first user who owns the initial model and the second user who owns the training data are different, the first user needs to obtain the second user's training data to obtain the trained model. Similarly, if the second user wants to obtain the trained model, they need to obtain the first user's initial model. In other words, to complete the training of the initial model and obtain the trained model, the exchange of model-related data is usually required.

[0004] Since the risk of model data leakage increases during the interaction of model-related data, and it is difficult to avoid the first user who owns the initial model obtaining the training data owned by the second user, or the second user who owns the training data obtaining the initial model owned by the first user, the current model data processing method has the problem of poor model data security. Summary of the Invention

[0005] The present application provides a model data processing method, apparatus, device and storage medium, which aim to solve the problem of poor model data security.

[0006] To achieve the above objectives, this application adopts the following technical solutions:

[0007] In a first aspect, the present application provides a model data processing method, which is executed by a trusted computing sandbox in a server of a first user, comprising:

[0008] Obtaining an initial model of the first user and encrypted training data of a second user, where the encrypted training data is obtained by encrypting the training data of the second user on a server of the second user based on a key generated by the trusted computing sandbox;

[0009] decrypting the encrypted training data of the second user based on the key to obtain the training data of the second user;

[0010] In the trusted computing sandbox, the initial model of the first user is trained based on the training data of the second user to obtain a trained model.

[0011] In a possible implementation, obtaining the initial model of the first user and the encrypted training data of the second user includes:

[0012] Obtaining signature verification information of the second user;

[0013] Verifying the signature verification information of the second user to obtain a verification result;

[0014] When it is determined based on the verification result that a contractual relationship exists between the second user and the first user, an initial model of the first user and encrypted training data of the second user are obtained.

[0015] In a possible implementation, before decrypting the encrypted training data of the second user based on the key to obtain the training data of the second user, the method further includes:

[0016] Obtaining a storage information identifier of the key sent by the second user;

[0017] According to the storage information identifier of the key, the key corresponding to the storage information identifier of the key is searched from the trusted computing sandbox.

[0018] In a possible implementation, before obtaining the initial model of the first user and the encrypted training data of the second user, the method further includes:

[0019] Obtaining the public key sent by the second user;

[0020] An encrypted key is sent to the second user, where the encrypted key is obtained by encrypting a key generated by the trusted computing sandbox based on the public key.

[0021] In a possible implementation, in the trusted computing sandbox, after training the initial model of the first user based on the training data of the second user and obtaining the trained model, the method further includes:

[0022] Encrypting the trained model based on the key to obtain an encrypted model;

[0023] The encrypted model is stored in the server of the first user.

[0024] In one possible implementation, the trained model is used to query information. In the trusted computing sandbox, the initial model of the first user is trained based on the training data of the second user. After obtaining the trained model, the method further includes:

[0025] Obtaining a query request sent by the second user;

[0026] Inputting the query request into the trained model to obtain information corresponding to the query request;

[0027] Sending encrypted information to the second user, where the encrypted information is obtained by the trusted computing sandbox encrypting the information based on a key generated by the trusted computing sandbox.

[0028] In a possible implementation, obtaining the query request sent by the second user includes:

[0029] Obtaining an encrypted query request sent by the second user, where the encrypted query request is obtained by encrypting the query request of the second user based on a key generated by the trusted computing sandbox;

[0030] Inputting the query request into the trained model to obtain information corresponding to the query request includes:

[0031] In the trusted computing sandbox, decrypting the query request based on the key to obtain the query request;

[0032] The query request is input into the trained model to obtain information corresponding to the query request.

[0033] In a second aspect, the present application provides a model data processing device, which is executed by a trusted computing sandbox unit in a server of a first user, and includes: an acquisition unit, a decryption unit, and a training unit;

[0034] The acquiring unit is configured to acquire the initial model of the first user and the encrypted training data of the second user, where the encrypted training data is obtained by encrypting the training data of the second user on the server of the second user based on the key generated by the trusted computing sandbox;

[0035] The decryption unit is configured to decrypt the encrypted training data of the second user based on the key to obtain the training data of the second user;

[0036] The training unit is used to train the initial model of the first user based on the training data of the second user in the trusted computing sandbox to obtain a trained model.

[0037] In a possible implementation, the acquisition unit includes: a first acquisition subunit, a verification unit, and a second acquisition subunit;

[0038] The first acquiring subunit is configured to acquire signature verification information of the second user;

[0039] The verification unit is configured to verify the signature verification information of the second user and obtain a verification result;

[0040] The second acquisition subunit is configured to acquire the initial model of the first user and the encrypted training data of the second user when it is determined based on the verification result that a contractual relationship exists between the second user and the first user.

[0041] In a possible implementation, the apparatus further includes: an identification obtaining unit and a searching unit;

[0042] The identification acquisition unit is used to acquire the storage information identification of the key sent by the second user;

[0043] The searching unit is configured to search the trusted computing sandbox for the key corresponding to the storage information identifier of the key according to the storage information identifier of the key.

[0044] In a possible implementation, the apparatus further includes: a public key acquisition unit and a first sending unit;

[0045] The public key obtaining unit is configured to obtain the public key sent by the second user;

[0046] The first sending unit is configured to send an encrypted key to the second user, where the encrypted key is obtained by encrypting a key generated by the trusted computing sandbox based on the public key.

[0047] In a possible implementation, the device further includes: an encryption unit and a storage unit;

[0048] The encryption unit is used to encrypt the trained model based on the key to obtain an encrypted model;

[0049] The storing unit is configured to store the encrypted model in the server of the first user.

[0050] In a possible implementation, the trained model is used to query information, and the device further includes: a query request acquisition unit, an input unit, and a second sending unit;

[0051] The query request acquiring unit is configured to acquire the query request sent by the second user;

[0052] The input unit is configured to input the query request into the trained model to obtain information corresponding to the query request;

[0053] The second sending unit is configured to send encrypted information to the second user, where the encrypted information is obtained by encrypting the information by the trusted computing sandbox based on a key generated by the trusted computing sandbox.

[0054] In a possible implementation, the query request obtaining unit is specifically configured to:

[0055] Obtaining an encrypted query request sent by the second user, where the encrypted query request is obtained by encrypting the query request of the second user based on a key generated by the trusted computing sandbox;

[0056] The obtaining unit includes: a decryption subunit and an obtaining subunit;

[0057] The decryption subunit is configured to decrypt the query request based on the key in the trusted computing sandbox to obtain the query request;

[0058] The obtaining subunit is used to input the query request into the trained model to obtain information corresponding to the query request.

[0059] A third aspect: The present application provides a computer device, comprising: a processor and a memory;

[0060] The memory is used to store program code and transmit the program code to the processor;

[0061] The processor is configured to execute the steps of the above-mentioned model data processing method according to the instructions in the program code.

[0062] Fourth aspect: The present application provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of a model data processing method as described above are implemented.

[0063] Compared with the existing technology, this application has the following beneficial effects:

[0064] The present application provides a model data processing method, apparatus, device, and storage medium, which are executed by a trusted computing sandbox on a first user's server. The trusted computing sandbox obtains the first user's initial model and the second user's encrypted training data; decrypts the second user's encrypted training data based on a key to obtain the second user's training data; and trains the first user's initial model based on the second user's training data in the trusted computing sandbox to obtain a trained model. The encrypted training data is obtained by encrypting the second user's training data on the second user's server using a key generated by the trusted computing sandbox. The key in this application is generated by the trusted computing sandbox and sent to the second user so that the second user can encrypt the training data. In the trusted computing sandbox, the encrypted training data can be decrypted and the initial model can be trained based on the training data to obtain a trained model. Because the first user of the initial model cannot operate the trusted computing sandbox, the first user cannot obtain the key and, consequently, the training data owned by the second user. Furthermore, because the trusted computing sandbox is installed on the first user's server, the second user cannot obtain the first user's initial model. This application is based on a trusted computing sandbox, which can effectively improve the security of model data while implementing model training. BRIEF DESCRIPTION OF THE DRAWINGS

[0065] Figure 1 A schematic diagram of a model training process provided in an embodiment of the present application;

[0066] Figure 2 A schematic diagram of the model reasoning process provided in the embodiment of the present application;

[0067] Figure 3 A flowchart of a model data processing method provided in an embodiment of the present application;

[0068] Figure 4 A structural diagram of a model data processing device is provided for an embodiment of the present application. DETAILED DESCRIPTION

[0069] The terms "first", "second" and "third" in the specification, claims and drawings of this application are used to distinguish different objects rather than to limit a specific order.

[0070] In the embodiments of this application, words such as "exemplary" or "for example" are used to indicate examples, illustrations, or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of this application should not be interpreted as being preferred or advantageous over other embodiments or designs. Rather, the use of words such as "exemplary" or "for example" is intended to present the relevant concepts in a concrete manner.

[0071] To make the description of the following embodiments clear and concise, a brief introduction to the related technologies is first given:

[0072] Trusted computing sandbox, that is, a distributed sandbox (trusted computing) based on the trusted execution environment (TEE), adopts the method of logically centralized confidential computing of physically dispersed data to ensure that multi-party data can achieve logically centralized and secure computing under the "zero trust" mechanism. To a certain extent, it solves the problem of data integration and circulation that the data supply parties "dare not share, cannot share, and are unwilling to share", and helps to further break the "data island".

[0073] Trusted Execution Environment (TEE) is a secure execution environment created based on the combination of software and hardware, which can better ensure the confidentiality and integrity of computing and data processing. Specifically, it can be achieved through three aspects: secure isolation, secure verification, and secure execution environment. Among them, secure isolation refers to the isolation of data and other applications through hardware isolation technologies such as hardware confidentiality and memory isolation; secure verification refers to the need for authentication and integrity checks to prevent malware and unauthorized access; secure execution environment refers to an execution environment that provides protection functions such as confidential algorithms, security protocols and key management, which can encrypt and protect sensitive data and key algorithms.

[0074] Typically, deep learning models require a large amount of training data to train the initial model. However, if the first user who owns the initial model and the second user who owns the training data are different, the first user needs to obtain the second user's training data to obtain the trained model. Similarly, if the second user wants to obtain the trained model, they need to obtain the first user's initial model. In other words, to complete the training of the initial model and obtain the trained model, the exchange of model-related data is usually required.

[0075] Since the risk of model data leakage increases during the interaction of model-related data, and it is difficult to avoid the first user who owns the initial model obtaining the training data owned by the second user, or the second user who owns the training data obtaining the initial model owned by the first user, the current model data processing method has the problem of poor model data security.

[0076] Based on this, the present application provides a model data processing method, apparatus, device, and storage medium, which are executed by a trusted computing sandbox on a first user's server. The trusted computing sandbox obtains the first user's initial model and the second user's encrypted training data; decrypts the second user's encrypted training data based on a key to obtain the second user's training data; and trains the first user's initial model based on the second user's training data in the trusted computing sandbox to obtain a trained model. The encrypted training data is obtained by encrypting the second user's training data on the second user's server using a key generated by the trusted computing sandbox. The key in this application is generated by the trusted computing sandbox and sent to the second user so that the second user can encrypt the training data. In the trusted computing sandbox, the encrypted training data can be decrypted and the initial model can be trained based on the training data to obtain a trained model. Because the first user of the initial model cannot operate the trusted computing sandbox, the first user cannot obtain the key and, consequently, cannot obtain the second user's training data. Furthermore, because the trusted computing sandbox is installed on the first user's server, the second user cannot obtain the first user's initial model. This application is based on a trusted computing sandbox, which can effectively improve the security of model data while implementing model training.

[0077] The following combination Figure 1-Figure 2 , the application scenarios of the model data processing method provided in the embodiment of the present application are introduced. Figure 1 As shown, this figure is a schematic diagram of a model training process provided in an embodiment of the present application.

[0078] Specifically, the first user owns the initial model, and the second user owns the training data. The second user wants to use their own training data to train a new model using the first user's original model and algorithm. For example, this model can be an incremental model. However, the second user does not want to share their own training data with the first user. Furthermore, the first user does not want to expose the first user's initial model and algorithm during the training process or when training results are returned.

[0079] Since neither the first user who owns the initial model nor the second user who owns the training data wants to expose their own model data and information to each other during model training, or have them stolen by other malware, in order to protect the first user's initial model and the second user's training data from being leaked and improve the security of the model data, in the embodiment of the present application, based on a trusted execution environment, the first user's initial model is trained using the second user's training data in a trusted computing sandbox to obtain a trained model.

[0080] Specifically, at the beginning of the training process, the second user provides the first user with their public key. The first user can then use this public key to encrypt data when transmitting it to the second user. Because the second user possesses the private key corresponding to this public key, the second user can then use the private key corresponding to this public key to decrypt data encrypted with the public key, thereby ensuring the security of data transmitted between the first and second users.

[0081] The first user has at least one trusted computing sandbox. Specifically, this trusted computing sandbox is independent of the first user, meaning the first user cannot operate or view the data within it. Therefore, a training algorithm can be run in this trusted computing sandbox to train the first user's initial model based on the second user's training data, resulting in a trained model.

[0082] The security module in the trusted sandbox can generate a key and encrypt and store the key using the second user's public key. For example, when there are multiple second users, the security module can generate multiple keys and storage information identifiers (IDs) for each key, where there is a one-to-one correspondence between the key and the key storage ID, with each key corresponding to a second user. The key storage ID is used to locate the key's storage location, i.e., based on the key storage ID, the key corresponding to the key storage ID can be found.

[0083] The key and its corresponding storage ID are encrypted using the second user's public key to obtain the encrypted key and its storage ID. These encrypted key and its storage ID are returned to the second user through the interactive interface between the second and first users. During this process, the first user cannot operate or view the trusted computing sandbox, and therefore cannot obtain the key and its corresponding storage ID, thus ensuring key security.

[0084] After receiving the encrypted key and its storage ID, the second user can decrypt them using their own private key to obtain the key and its storage ID. The private key corresponds to the public key, ensuring the integrity and correctness of the key received from the first user.

[0085] After the second user obtains the key, he can use the key to encrypt the training data to obtain the encrypted training data. Since the key is only owned by the second user and the trusted computing sandbox of the first user, it ensures that the second user's training data cannot be leaked to any third party, including the first user.

[0086] Since the first user and the second user are in a securely isolated state, in a possible implementation, the first user and the second user can perform data interaction based on a data interaction policy, so that the transmitted data is controllable and manageable.

[0087] For example, the first user and the second user can agree on the number of times and time of use of the initial model or training data. To further ensure the security of the model data, a data interaction policy between the first user and the second user can be set based on a trusted data connector.

[0088] The first user sends the initial model and the encrypted training data obtained from the second user to the trusted computing sandbox. The trusted computing sandbox can decrypt the encrypted training data within the trusted computing sandbox using the previously generated key to obtain the decrypted training data. The trusted computing sandbox can then train the first user's initial model based on the training data to obtain a trained model. To ensure the security of the trained model, the trained model can be encrypted using the key and sent to the first user.

[0089] In one possible implementation, an audit log system may be used to record an audit log containing relevant process information during the training process, and the second user may view the audit log through an interface provided by the first user.

[0090] In this embodiment of the present application, a key is generated through a trusted computing sandbox. During the entire model training process, only the second user and the trusted computing sandbox can access the key, ensuring the security of the second user's training data throughout the training process. Furthermore, because the initial model and related training algorithms are also stored on the first user's server and in the trusted computing sandbox within that server, they are securely isolated from the second user, thus ensuring the security of the first user's initial model and algorithm.

[0091] At the same time, since the keys of different second users can be stored in the trusted sandbox and storage IDs corresponding to each key can be generated, different second users can encrypt and transmit the storage IDs of their respective keys to the trusted computing sandbox, so that the trusted computing sandbox can find the keys corresponding to each second user based on the storage IDs of the keys, thereby realizing a one-to-many key storage mode.

[0092] like Figure 2 As shown, this figure is a schematic diagram of the model reasoning usage process provided by an embodiment of the present application. The second user sends the storage ID of the key to the first user so that the first user can search for the corresponding key based on the storage ID of the key.

[0093] In one possible implementation, to further ensure the security of model data, the second user can also send relevant signature verification information to the first user. The security module in the first user's trusted computing sandbox will verify the legitimacy of this signature verification information to confirm the second user's identity, that is, to determine whether a contractual relationship exists between the second user and the first user. Because the first and second users are securely isolated, the interactive data between the two parties can be signed in advance using a trusted data connector. During the contract, relevant data transmission policies can be specified to ensure the security of the relevant data and make the transmitted data controllable.

[0094] It should be noted that the user-related information involved in this application is obtained with the user's knowledge and permission, that is, the user-related information involved in this application is obtained and used in a legal and compliant manner.

[0095] The trained model is taken as a Large Language Model (LLM) as an example for introduction.

[0096] When the second user uses the trained model in actual reasoning, he or she may input a query request to the interactive page provided by the first user. For example, the query request may be a question. The first user inputs a question on the interactive page in the hope of obtaining an answer to the question through the trained model.

[0097] In order to prevent the specific content of the question from being disclosed, the query request, that is, the question, may be encrypted during transmission. Specifically, the query request is encrypted using a key previously generated by the trusted computing sandbox to obtain an encrypted query request.

[0098] After receiving the encrypted query request, the trusted computing sandbox decrypts it using the corresponding key to obtain the query. This query request is then fed into the trained model to obtain the information question corresponding to the query request. After receiving the question, the trusted computing sandbox uses the trained model to obtain the answer to the question. To prevent the answer from being disclosed to third parties, the trusted computing sandbox encrypts the answer using the key and returns it to the second user.

[0099] Specifically, if Figure 2As shown, when the trained model is a large language model, the knowledge base data owned by the second user can be used as training data. After the second user sends a question encrypted by a key through the interactive interface, the trusted computing sandbox can use the key to decrypt the encrypted question to obtain the decrypted question. After obtaining the decrypted question, the trusted computing sandbox can input the question into the trained model. The trained model will send a question request to the second user's knowledge base data based on the question through the trained algorithm model. The knowledge base data can extract the question based on the question request and obtain the answer corresponding to the question. After obtaining the answer corresponding to the question, in order to prevent the answer from being leaked to a third party, the answer can be encrypted using the key and sent to the second user.

[0100] In this application, when the model is used for inference, the corresponding key is obtained through the storage ID of the key. On the one hand, it ensures that even if the first user changes the trusted computing sandbox, the corresponding key can be obtained through the shared security module based on the storage ID of the key; on the other hand, when there are multiple second users, each second user corresponds to a key, and based on the storage ID of the key, the key corresponding to each second user can be obtained.

[0101] The second user's training data and trained model are encrypted with a key throughout the model's inference process, with decryption performed only within the sandbox, ensuring the security of the model data. Furthermore, the initial model is stored within the first user's server and its corresponding trusted computing sandbox, securely isolated from the second user, ensuring the security of the model data for both users.

[0102] The following combination Figure 3 , the method provided in the embodiment of this application is introduced.

[0103] like Figure 1 As shown, the figure is a flowchart of a model data processing method provided in an embodiment of the present application. The model data processing method is executed by a trusted computing sandbox in the server of the first user, including S101-S103.

[0104] S101. Obtain the initial model of the first user and the encrypted training data of the second user.

[0105] The first user is the owner of the initial model, and the second user is the owner of the training data. The encrypted training data is obtained by encrypting the second user's training data on the second user's server based on the key generated by the trusted computing sandbox.

[0106] In one possible implementation, before obtaining the initial model of the first user and the encrypted training data of the second user, the trusted computing sandbox may obtain the public key sent by the second user; and send an encrypted key to the second user, where the encrypted key is obtained by encrypting the key generated by the trusted computing sandbox based on the public key.

[0107] Specifically, data encrypted with the public key can be decrypted using the private key corresponding to the public key. This private key is stored only by the second user, meaning only the second user can use the private key to decrypt and obtain the decrypted data. In this embodiment of the present application, the second user sends the public key to the trusted computing sandbox, allowing the trusted computing sandbox to use the public key to encrypt data to be transmitted to the second user, thereby preventing data leakage.

[0108] The trusted computing sandbox can generate a key, encrypt the key using the public key sent by the second user, obtain the encrypted key, and send the key to the second user. Since the second user has the private key corresponding to the public key, the second user can then use the private key to decrypt the encrypted key and obtain the key.

[0109] The key is used to encrypt the second user's training data. That is, after obtaining the key, the second user uses the key to encrypt the training data to obtain the encrypted training data, and then sends the encrypted training data to the first user's trusted computing sandbox.

[0110] Since the key is only stored by the second user and the trusted computing sandbox, the training data encrypted by the key can only be obtained by the second user and the trusted computing sandbox, thereby avoiding the leakage of the training data and improving the security of the training data.

[0111] In one possible implementation, obtaining the initial model of the first user and the encrypted training data of the second user includes: obtaining signature verification information of the second user; verifying the signature verification information of the second user to obtain a verification result; and when it is determined based on the verification result that there is a contractual relationship between the second user and the first user, obtaining the initial model of the first user and the encrypted training data of the second user.

[0112] Specifically, in order to improve the security of model data, the existence of a contractual relationship between the second user and the first user can be determined by verifying the signature verification information. When it is determined that there is a contractual relationship between the second user and the first user, the initial model of the first user and the encrypted training data of the second user are obtained so that model training can be performed in a trusted computing sandbox based on the initial model and training data.

[0113] In a possible implementation, since the first user and the second user are in a securely isolated state, the first user and the second user can interact with each other based on a data interaction policy, so that the transmitted data is controllable and manageable.

[0114] For example, the first user and the second user can agree on the number of times and time of use of the initial model or training data. To further ensure the security of the model data, a data interaction policy between the first user and the second user can be set based on a trusted data connector.

[0115] S102: Decrypt the encrypted training data of the second user based on the key to obtain the training data of the second user.

[0116] Specifically, the trusted computing sandbox stores a generated key corresponding to the second user. After receiving the encrypted training data sent by the second user, the trusted computing sandbox can use the key stored in itself to decrypt the encrypted training data to obtain the second user's training data.

[0117] In one possible implementation, the encrypted training data of the second user is decrypted based on the key. Before obtaining the training data of the second user, the storage information identifier of the key sent by the second user can also be obtained; according to the storage information identifier of the key, the key corresponding to the storage information identifier of the key is searched from the trusted computing sandbox.

[0118] Specifically, when there are multiple second users, the security module in the trusted computing sandbox can generate multiple keys and multiple key storage information identifiers (IDs), where a key corresponds to a key storage ID, and each key corresponds to a second user. The key storage ID is used to locate the key storage location, that is, based on the key storage ID, the key corresponding to the key storage ID can be found.

[0119] In an embodiment of the present application, the first user can correspond to multiple trusted computing sandboxes, and the multiple trusted computing sandboxes share a security module. The key can be stored in the security module, and the key can be sent to the corresponding trusted computing sandbox based on the storage ID of the key, thereby avoiding the loss of the key when the first user changes the trusted computing sandbox.

[0120] S103: In the trusted computing sandbox, train the initial model of the first user based on the training data of the second user to obtain a trained model.

[0121] Specifically, the trusted computing sandbox is independent of the first user, meaning the first user cannot operate or view the data within it. This allows the first user to run a training algorithm within the trusted computing sandbox, training the first user's initial model based on the second user's training data, and obtaining a trained model, effectively ensuring the security of the model data.

[0122] In one possible implementation, in the trusted computing sandbox, the initial model of the first user is trained based on the training data of the second user. After obtaining the trained model, the trained model can also be encrypted based on the key to obtain an encrypted model; and the encrypted model is saved in the server of the first user.

[0123] Specifically, to further enhance the security of model data in this embodiment, the trained model can be encrypted using the second user's key and stored on the first user's server. Because the first user cannot actually operate or view data in the trusted computing sandbox, they cannot obtain the key generated by the trusted computing sandbox and, consequently, cannot decrypt the encrypted model. This prevents the trained model from being leaked to third parties, including the first user, and enhances the security of the model data.

[0124] In one possible implementation, the trained model is used to query information. Exemplarily, the trained model can be a large language model. In the trusted computing sandbox, the initial model of the first user is trained based on the training data of the second user. After obtaining the trained model, the process further includes: obtaining a query request sent by the second user; inputting the query request into the trained model to obtain information corresponding to the query request; and sending encrypted information to the second user, where the encrypted information is encrypted by the trusted computing sandbox using a key generated by the trusted computing sandbox.

[0125] Specifically, after obtaining the trained model, when using the trained model, the query request sent by the second user can be input into the trained model to obtain the information corresponding to the query request. To prevent leakage of the information corresponding to the query request, the information corresponding to the query request can be encrypted using a key before being sent to the second user.

[0126] In a possible implementation, to further improve the security of the model data, the query request may be encrypted and then sent to the trusted computing sandbox of the first user.

[0127] Specifically, the trusted computing sandbox obtains an encrypted query request sent by the second user. The encrypted query request is obtained by encrypting the second user's query request using a key generated by the trusted computing sandbox. Within the trusted computing sandbox, the query request is decrypted using the key to obtain the query request. The query request is then input into the trained model to obtain information corresponding to the query request.

[0128] For example, after a second user sends a query request encrypted with a key through the interactive interface, the trusted computing sandbox can use the key to decrypt the encrypted query request to obtain the query request. After obtaining the decrypted query request, the trusted computing sandbox can input the query request into the trained model. The trained model then sends the query request to the second user's knowledge base data based on the query request. Based on the query request, the knowledge base data can obtain information corresponding to the query request. After obtaining the information corresponding to the query request, in order to prevent the information corresponding to the query request from being leaked to a third party, the information corresponding to the query request can be encrypted using the key and returned to the second user.

[0129] In summary, the present application provides a model data processing method, which is executed by a trusted computing sandbox on a first user's server. The trusted computing sandbox obtains the first user's initial model and the second user's encrypted training data; decrypts the second user's encrypted training data based on a key to obtain the second user's training data; and trains the first user's initial model based on the second user's training data in the trusted computing sandbox to obtain a trained model. The encrypted training data is obtained by encrypting the second user's training data on the second user's server using a key generated by the trusted computing sandbox. The key in this application is generated by the trusted computing sandbox and sent to the second user so that the second user can encrypt the training data. In the trusted computing sandbox, the encrypted training data can be decrypted, and the initial model can be trained based on the training data to obtain a trained model. Because the first user of the initial model cannot operate the trusted computing sandbox, the first user cannot obtain the key and, consequently, cannot obtain the training data owned by the second user. Furthermore, because the trusted computing sandbox is installed on the first user's server, the second user cannot obtain the first user's initial model. This application is based on a trusted computing sandbox, which can effectively improve the security of model data while implementing model training.

[0130] This application provides a model data processing device, see Figure 4This figure is a structural diagram of a model data processing device provided in an embodiment of the present application. Its specific implementation method is consistent with the implementation method and the technical effect achieved in the embodiment of the above method, and some contents will not be repeated here.

[0131] The present application provides a model data processing device 1100, which is executed by a trusted computing sandbox unit in a first user's server, and includes: an acquisition unit 1101, a decryption unit 1102, and a training unit 1103;

[0132] The acquiring unit 1101 is configured to acquire the initial model of the first user and the encrypted training data of the second user, where the encrypted training data is obtained by encrypting the training data of the second user on the server of the second user based on the key generated by the trusted computing sandbox;

[0133] The decryption unit 1102 is configured to decrypt the encrypted training data of the second user based on the key to obtain the training data of the second user;

[0134] The training unit 1103 is configured to train the initial model of the first user based on the training data of the second user in the trusted computing sandbox to obtain a trained model.

[0135] In a possible implementation, the acquisition unit includes: a first acquisition subunit, a verification unit, and a second acquisition subunit;

[0136] The first acquiring subunit is configured to acquire signature verification information of the second user;

[0137] The verification unit is configured to verify the signature verification information of the second user and obtain a verification result;

[0138] The second acquisition subunit is configured to acquire the initial model of the first user and the encrypted training data of the second user when it is determined based on the verification result that a contractual relationship exists between the second user and the first user.

[0139] In a possible implementation, the apparatus further includes: an identification obtaining unit and a searching unit;

[0140] The identification acquisition unit is used to acquire the storage information identification of the key sent by the second user;

[0141] The searching unit is configured to search the trusted computing sandbox for the key corresponding to the storage information identifier of the key according to the storage information identifier of the key.

[0142] In a possible implementation, the apparatus further includes: a public key acquisition unit and a first sending unit;

[0143] The public key obtaining unit is configured to obtain the public key sent by the second user;

[0144] The first sending unit is configured to send an encrypted key to the second user, where the encrypted key is obtained by encrypting a key generated by the trusted computing sandbox based on the public key.

[0145] In a possible implementation, the device further includes: an encryption unit and a storage unit;

[0146] The encryption unit is used to encrypt the trained model based on the key to obtain an encrypted model;

[0147] The storing unit is configured to store the encrypted model in the server of the first user.

[0148] In a possible implementation, the trained model is used to query information, and the device further includes: a query request acquisition unit, an input unit, and a second sending unit;

[0149] The query request acquiring unit is configured to acquire the query request sent by the second user;

[0150] The input unit is configured to input the query request into the trained model to obtain information corresponding to the query request;

[0151] The second sending unit is configured to send encrypted information to the second user, where the encrypted information is obtained by encrypting the information by the trusted computing sandbox based on a key generated by the trusted computing sandbox.

[0152] In a possible implementation, the query request obtaining unit is specifically configured to:

[0153] Obtaining an encrypted query request sent by the second user, where the encrypted query request is obtained by encrypting the query request of the second user based on a key generated by the trusted computing sandbox;

[0154] The obtaining unit includes: a decryption subunit and an obtaining subunit;

[0155] The decryption subunit is configured to decrypt the query request based on the key in the trusted computing sandbox to obtain the query request;

[0156] The obtaining subunit is used to input the query request into the trained model to obtain information corresponding to the query request.

[0157] In summary, this application provides a model data processing device that can effectively achieve secure isolation between the model data of a first user and the model data of a second user, preventing either party from knowing the other's model data. This application is based on a trusted computing sandbox and can effectively improve the security of model data while implementing model training.

[0158] The present application provides a computer device, the computer device comprising: a processor and a memory;

[0159] The memory is used to store program code and transmit the program code to the processor;

[0160] The processor is configured to execute the steps of the above-mentioned model data processing method according to the instructions in the program code.

[0161] The present application provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the steps of the model data processing method described above are implemented.

[0162] The above is only a specific embodiment of the present application, but the scope of protection of this application is not limited to this. Any changes or substitutions within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. A model data processing method, characterized in that: Executed by a trusted computing sandbox in a server of the first user, wherein a training algorithm is run in the trusted computing sandbox, including: Obtaining an initial model of the first user and encrypted training data of a second user, where the encrypted training data is obtained by encrypting the training data of the second user on a server of the second user based on a key generated by the trusted computing sandbox; decrypting the encrypted training data of the second user based on the key to obtain the training data of the second user; In the trusted computing sandbox, based on the training data of the second user and the training algorithm running in the trusted computing sandbox, the initial model of the first user is trained to obtain a trained model; Before decrypting the encrypted training data of the second user based on the key to obtain the training data of the second user, the method further includes: Obtaining a storage information identifier of the key sent by the second user; According to the storage information identifier of the key, the key corresponding to the storage information identifier of the key is searched from the trusted computing sandbox.

2. The method according to claim 1, characterized in that The obtaining of the initial model of the first user and the encrypted training data of the second user includes: Obtaining signature verification information of the second user; Verifying the signature verification information of the second user to obtain a verification result; When it is determined based on the verification result that a contractual relationship exists between the second user and the first user, an initial model of the first user and encrypted training data of the second user are obtained.

3. The method according to claim 1, characterized in that Before obtaining the initial model of the first user and the encrypted training data of the second user, the method further includes: Obtaining the public key sent by the second user; An encrypted key is sent to the second user, where the encrypted key is obtained by encrypting a key generated by the trusted computing sandbox based on the public key.

4. The method according to claim 1, wherein The method further comprises: training the initial model of the first user based on the training data of the second user in the trusted computing sandbox, and obtaining the trained model; Encrypting the trained model based on the key to obtain an encrypted model; The encrypted model is stored in the server of the first user.

5. The method according to claim 1, wherein The trained model is used for querying information. In the trusted computing sandbox, the initial model of the first user is trained based on the training data of the second user. After obtaining the trained model, the method further includes: Obtaining a query request sent by the second user; Inputting the query request into the trained model to obtain information corresponding to the query request; Sending encrypted information to the second user, where the encrypted information is obtained by the trusted computing sandbox encrypting the information based on a key generated by the trusted computing sandbox.

6. The method according to claim 5, characterized in that The obtaining the query request sent by the second user includes: Obtaining an encrypted query request sent by the second user, where the encrypted query request is obtained by encrypting the query request of the second user based on a key generated by the trusted computing sandbox; Inputting the query request into the trained model to obtain information corresponding to the query request includes: In the trusted computing sandbox, decrypting the query request based on the key to obtain the query request; The query request is input into the trained model to obtain information corresponding to the query request.

7. A model data processing device, characterized in that: The trusted computing sandbox unit in the server of the first user is used to execute the training algorithm, which includes an acquisition unit, a decryption unit, and a training unit. The acquiring unit is configured to acquire the initial model of the first user and the encrypted training data of the second user, where the encrypted training data is obtained by encrypting the training data of the second user on the server of the second user based on the key generated by the trusted computing sandbox; The decryption unit is configured to decrypt the encrypted training data of the second user based on the key to obtain the training data of the second user; The training unit is configured to train the initial model of the first user based on the training data of the second user in the trusted computing sandbox to obtain a trained model; The device further comprises: an identification obtaining unit and a searching unit; The identification acquisition unit is used to acquire the storage information identification of the key sent by the second user; The searching unit is configured to search the trusted computing sandbox for the key corresponding to the storage information identifier of the key according to the storage information identifier of the key.

8. A computer device, characterized in that: The computer device includes: a processor and a memory; The memory is used to store program code and transmit the program code to the processor; The processor is configured to execute the steps of a model data processing method according to any one of claims 1 to 6 according to the instructions in the program code.

9. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the model data processing method according to any one of claims 1 to 6 are implemented.

Images