Computing systems and methods for improving artificial intelligence code and data security

Abstract

The application provides a computing system and method for improving the security of artificial intelligence code and data, belonging to the technical field of information security. The system comprises a user computer and a service computer connected through the Internet; one or more secret chamber computing security devices are arranged on the host of the service computer; the user computer is used to initiate artificial intelligence computing, and provides the encrypted artificial intelligence computing code and the corresponding digital signature, and the encrypted user data required for computing and the corresponding digital signature to the service computer through the Internet; the service computer decrypts the artificial intelligence computing code and the user data by using the secret chamber computing security device, verifies the digital signature, completes the corresponding computation, digitally signs and encrypts the computation result, and returns the computation result to the user computer through the Internet. The application has high security, high efficiency, high universality and high compatibility, and can effectively protect the artificial intelligence computing code and the computation result.

Description

TECHNICAL FIELD

[0001] The present application belongs to the technical field of information security, and particularly relates to a computing system and method for improving the security of artificial intelligence code and data. BACKGROUND

[0002] With the vigorous development of big data and artificial intelligence, the importance and security of data have also been increasingly concerned and valued by people. How to fully exert the value of existing data and ensure the security and privacy of data, that is, how to truly realize "data usability and invisibility", is still an important challenge faced by the current information security technical field. Existing user data privacy protection computing technical solutions can be divided into software-based solutions and hardware isolation-based solutions. Software-based solutions protect the security and privacy of data by using different software mechanisms and algorithms, mainly including secure multi-party computation (Secure Multi-party Computation) technology, homomorphic encryption (Homomorphic Encryption) and differential privacy (Differential Privacy) based technology, and federated learning mechanism and technology for artificial intelligence. Hardware isolation-based technology mainly includes confidential computing technology based on trusted computing execution environment (Trusted Execution Environment, TEE) (mainly including Intel SGX and ARM TrustZone), and other CPU-independent on-chip computing systems and other technologies.

[0003] The security of the secure multi-party computation technology is based on cryptography, which can be proved by cryptography theory. However, due to the complex cryptographic operations, the computing overhead is large, and the communication time is long. In the application scenarios of key management, simple statistics and some linear machine learning models, the secure multi-party computation technology is applicable. However, for complex scenarios such as deep neural networks, performance and network will become the bottleneck of the application. The technical solution based on homomorphic encryption has high privacy protection because all the calculations are in ciphertext. However, the calculation types supported by some homomorphic encryption algorithms are limited, and the application range is narrow. The computing overhead of full homomorphic encryption is very large, which limits its performance and application occasions. The target protected by the computing technology based on differential privacy is the calculation result rather than the calculation process. At the same time, differential privacy introduces noise into the data, which reduces the accuracy of the calculation result. Therefore, the computing technology based on differential privacy is not applicable to applications with high calculation accuracy requirements such as face recognition. Although local differential privacy also protects the calculation process, the error introduced by the local differential privacy is larger, so the application scenario is more limited. Although the federated learning does not move the data, the current federated learning mechanism still has a certain degree of privacy leakage risk in the model updating process. Moreover, the model aggregation process of the federated learning is restricted by network bandwidth and delay, and there is a network bottleneck. In addition, the software-based technical solution lacks protection of the software or code itself involved in the calculation process, and its security still depends on the security of the running environment. Compared with the software-based technical solution, the confidential computing technical solution based on hardware isolation has the advantages of security, universality and high efficiency. However, the trusted execution environment and untrusted execution environment in the current technical solution still need to share computing and memory resources, which leads to security risks such as side channel attacks. The existing technical solution based on hardware isolation protects the calculation code to a certain extent in the data calculation process, but lacks protection of the calculation result. At the same time, the existing technical solution based on hardware isolation introduces new computing architecture and computing instructions, which changes the programming mode of the application and causes compatibility problems. SUMMARY

[0004] The purpose of the present application is to overcome the shortcomings of the hardware isolation-based security technology solution, and to provide a computing system and method for improving the security of artificial intelligence code and data. The present application has high security, high efficiency, high universality and high compatibility, and can effectively protect the artificial intelligence calculation code and calculation result, and further solve the problem of "data can be calculated but cannot be seen".

[0005] The embodiment of the present application provides a computing system for improving the security of artificial intelligence code and data, which comprises a user computer and a service computer connected through the Internet; one or more secret chamber computing security devices are arranged on the host of the service computer; the user computer is used for initiating artificial intelligence computing, and provides the service computer with encrypted artificial intelligence computing code and corresponding digital signature and encrypted user data required for computing and corresponding digital signature through the Internet; the service computer is used for receiving the encrypted artificial intelligence computing code and corresponding digital signature and the encrypted user data and corresponding digital signature, decrypting the artificial intelligence computing code and the user data by using the secret chamber computing security device, performing digital signature verification, completing corresponding computing, performing digital signature and encryption on the computing result, and returning the computing result to the user computer through the Internet.

[0006] In one specific embodiment of the present application, the service computer sequentially schedules each secret chamber computing security device in a round-robin manner.

[0007] In one specific embodiment of the present application, a user password processing unit is arranged on the user computer, which is used for managing a key, encrypting and digitally signing the artificial intelligence computing code and the user data of the user computer, and decrypting and digitally signing verification on the computing result returned from the service computer.

[0008] In one specific embodiment of the present application, the secret chamber computing security device comprises a computing unit, a volatile storage unit, a non-volatile storage unit, an application and data processing unit, an artificial intelligence coprocessing unit, a password processing unit and a host communication interface unit; wherein the application and data processing unit is connected with the computing unit, the non-volatile storage unit, the password processing unit and the host communication interface unit through physical lines respectively, the volatile storage unit is connected with the computing unit and the non-volatile storage unit through physical lines respectively, and the computing unit is further connected with the artificial intelligence coprocessing unit through a physical line.

[0009] The application and data processing unit receives the encrypted artificial intelligence computing code and the user data sent by the user computer to the service computer through the host communication interface unit, stores the artificial intelligence computing code and the user data in the non-volatile storage unit after decryption and verification by the password processing unit, and sends the computing result after artificial intelligence computing of the computing unit to the service computer host after encryption and signature by the password processing unit through the host communication interface unit;

[0010] The non-volatile storage unit is configured to store the artificial intelligence computing code and the user data processed by the application and data processing unit, and store the computing result of the artificial intelligence computing performed by the computing unit.

[0011] The volatile storage unit is configured to load the artificial intelligence computing code and the user data stored in the non-volatile storage unit according to the requirement of the computing unit.

[0012] The computing unit is configured to load the artificial intelligence computing code and the user data stored in the volatile storage unit and perform computation, and then store the computing result in the non-volatile storage unit through the volatile storage unit.

[0013] The password processing unit is configured to perform key management in cooperation with the user password processing unit, decrypt the artificial intelligence code and the user data in the application and data processing unit, and perform digital signature verification, and encrypt the computing result in the application and data processing unit and perform digital signature.

[0014] The artificial intelligence coprocessor unit is configured to assist the computing unit to complete artificial intelligence computation, so as to accelerate the data computation process.

[0015] The host communication interface unit is configured to communicate with the service computer through a private dedicated channel.

[0016] In one specific embodiment of the present application, the password processing unit comprises a first key management and distribution module, a first encryption and decryption module, and a first digital signature and verification module which are connected with each other through physical lines.

[0017] The first key management and distribution module is configured to complete generation, storage, management and distribution of encryption keys and signature keys; the first encryption and decryption module is configured to perform encryption and decryption algorithms to decrypt the artificial intelligence code and the user data in the application and data processing unit, and encrypt the computing result in the application and data processing unit; and the first digital signature and verification module is configured to perform digital signature verification on the artificial intelligence code and the user data in the application and data processing unit, and perform digital signature on the computing result in the application and data processing unit.

[0018] In one specific embodiment of the present application, the user password processing unit comprises a second key management and distribution module, a second encryption and decryption module, and a second digital signature and verification module which are connected with each other through physical lines.

[0019] The second key management and distribution module cooperates with the first key management and distribution module to jointly complete generation, storage, management and distribution of encryption keys and signature keys; the second encryption and decryption module is configured to execute the encryption and decryption algorithm to encrypt the artificial intelligence code and the user data in the user computer and decrypt the calculation result from the service computer; and the second digital signature and verification module is configured to digitally sign the artificial intelligence code and the user data in the user computer and perform digital signature verification on the calculation result from the service computer.

[0020] In a specific embodiment of the present application, the user password processing unit and the password processing unit construct online key generation and exchange based on a SecKMS key management system.

[0021] The present application also provides a computing method based on the above system, comprising the following steps:

[0022] 1) The user prepares user data and corresponding artificial intelligence calculation code on the user computer;

[0023] 2) The user password processing unit of the user computer and the password processing unit in the selected secret chamber computing security device on the service computer communicate to complete password generation and exchange; including:

[0024] The service computer host selects a secret chamber computing security device;

[0025] The user password processing unit of the user computer generates an encryption key: first key, generates a pair of signature keys for signature: user public key and user private key, and communicates with the first key management and distribution module in the password processing unit in the selected secret chamber computing security device on the service computer to complete key distribution;

[0026] The password processing unit in the selected secret chamber computing security device on the service computer generates an encryption key: second key, generates a pair of signature keys for signature: service public key and service private key, and communicates with the second key management and distribution module in the user password processing unit of the user computer to complete key distribution;

[0027] 3) The user computer signs and encrypts the artificial intelligence calculation code and the user data to obtain encrypted calculation code and corresponding encrypted signature and encrypted user data and corresponding encrypted signature; including:

[0028] The user computer uses the user private key to sign the artificial intelligence computing code using a pre-selected digital signature algorithm in the second digital signature and verification module of the user password processing unit, to obtain a computing code signature; and signs the user data to obtain a user data signature;

[0029] The user computer uses the first key and a pre-selected symmetric encryption algorithm in the second encryption and decryption module of the user password processing unit to encrypt the combination of the computing code, the computing code signature, the user data, and the user data signature, to obtain encrypted computing code and a corresponding encrypted signature, and encrypted user data and a corresponding encrypted signature;

[0030] 4) The user computer host sends the encrypted computing code and the corresponding encrypted signature, and the encrypted user data and the corresponding encrypted signature to the service computer; the service computer host sends the encrypted computing code and the corresponding encrypted signature, and the encrypted user data and the corresponding encrypted signature to the selected secret chamber computing security device in step 2) through a private dedicated channel;

[0031] 5) The secret chamber computing security device of the service computer decrypts the received encrypted computing code and the corresponding encrypted signature, and the encrypted user data and the corresponding encrypted signature; including:

[0032] The application and data processing unit of the secret chamber computing security device receives the encrypted computing code and the corresponding encrypted signature, and the encrypted user data and the corresponding encrypted signature sent by the service computer host through the host communication interface unit and the private dedicated channel, and stores them in the non-volatile storage unit;

[0033] The application and data processing unit uses the first encryption and decryption module in the password processing unit to decrypt the encrypted computing code and the encrypted user data using the first key and a pre-selected symmetric encryption algorithm, and decrypts the computing code signature and the encrypted user data signature to obtain decrypted computing code, decrypted user data, decrypted computing code signature, and decrypted user data signature, and stores them in the non-volatile storage unit;

[0034] The password processing unit uses the digital signature and verification module to verify the decrypted computing code signature and the decrypted user data signature using the user public key and a pre-selected digital signature algorithm: if both are verified, step 6) is executed;

[0035] 6) The secret chamber computing security device processes the decrypted computing code and the decrypted user data to obtain the final computing result; including:

[0036] The application and data processing unit of the secret chamber computing security device loads the running environment code of the computing code stored in the non-volatile storage unit into the volatile storage unit for running according to the computing requirements of the computing code using the computing unit;

[0037] The application and data processing unit runs the calculation code stored in the volatile storage unit by using the calculation unit and the volatile storage unit and the artificial intelligence coprocessor unit, processes the user data stored in the non-volatile storage unit, obtains a calculation result, and stores the calculation result in the non-volatile storage unit;

[0038] 7) The secret chamber calculation security device signs and encrypts the calculation result to obtain an encrypted calculation result and an encrypted calculation result signature; comprising:

[0039] The password processing unit of the secret chamber calculation security device uses the service private key, uses the first digital signature and verification module in the user password processing unit, and uses a preselected digital signature algorithm to sign the calculation result to obtain a calculation result signature;

[0040] The password processing unit uses the second key and the first encryption and decryption module in the user password processing unit to preselect a symmetric password algorithm to encrypt the calculation result and the calculation result signature stored in the non-volatile storage unit to obtain an encrypted calculation result and an encrypted calculation result signature;

[0041] 8) The service computer host sends the encrypted calculation result and the encrypted calculation result signature to the user computer;

[0042] 9) The second encryption and decryption module of the user password processing unit on the user computer uses the second key and a preselected symmetric encryption algorithm to decrypt the encrypted calculation result and the encrypted calculation result signature to obtain a decrypted calculation result and a decrypted calculation result signature;

[0043] The user password processing unit uses the second digital signature and verification module, uses the service public key and a preselected digital signature algorithm to verify the decrypted calculation result signature; if the verification is successful, the user computer presents the decrypted calculation result to the user.

[0044] In one specific embodiment of the application, the verification of the decrypted calculation code signature and the decrypted user data signature further comprises:

[0045] If any verification fails, a verification failure message is output as the calculation result.

[0046] In one specific embodiment of the application, the verification of the decrypted calculation result signature further comprises:

[0047] If the decrypted calculation result signature verification fails, the user computer reports the calculation result transmission error to the user.

[0048] The characteristics and advantages of the application are that:

[0049] The application avoids the side channel attack risk of the trusted execution environment in the existing confidential computing technology due to the shared computing and memory resources with the user's ordinary computing, so that the service computer can avoid the security risk of the artificial intelligence computing code and data even if it is attacked, avoid the privacy leakage of the code and data, and has better security and compatibility than the existing hardware isolation based mode. At the same time, by using encryption technology and digital signature technology to encrypt and digitally sign the computing code (including software, program or script code, etc.) participating in the artificial intelligence computing process, the data to be processed and the data computing result, the confidentiality and integrity of the data in the data transmission and computing result return process are guaranteed, and the confidentiality and integrity of the code participating in the computing process are also guaranteed, and the encryption and decryption time can be reduced. In the independent secret room computing environment based on hardware isolation, the decrypted computing code and data are calculated in plaintext by using independent computing and storage resources, which improves the computing efficiency and provides the compatibility of the computing process. The application can also be used in other data processing processes except artificial intelligence computing, such as data processing in Internet of Things or industrial Internet of Things, and is also applicable to financial, medical and other application fields requiring data privacy protection computing. BRIEF DESCRIPTION OF DRAWINGS

[0050] Figure 1 is a structural schematic diagram of a computing system for improving the security of artificial intelligence code and data in an embodiment of the application.

[0051] Figure 2 is a structural schematic diagram of a secret room computing security device in one specific embodiment of the application.

[0052] Figure 3 is a whole flowchart of a computing method based on the computing system for improving the security of artificial intelligence code and data in an embodiment of the application. DETAILED DESCRIPTION

[0053] The application proposes a computing system and method for improving the security of artificial intelligence code and data, which is described in detail as follows in combination with the drawings and specific embodiments.

[0054] An embodiment of the application proposes a computing system for improving the security of artificial intelligence code and data, which has the structure as shown in Figure 1 The user computer and the service computer are connected through the Internet. One or more secret room computing security devices are arranged on the host (including an ordinary computer host or a server host) of the service computer. The secret room computing security device has the structure as shown in Figure 1As shown, the host of the service computer is provided with n secret chamber computing security devices. The user computer is used to initiate artificial intelligence computing, and provides the service computer with encrypted artificial intelligence computing code and corresponding digital signature, and encrypted user data required for computing and corresponding digital signature through the Internet. The service computer is used to receive the encrypted computing code and user data and digital signature, decrypt the computing code and user data by using the secret chamber computing security device, and perform signature verification, complete the corresponding computing process, and return the computing result to the user computer through the Internet after encryption and digital signature.

[0055] The embodiment of the present application has no special requirements for the user computer and the service computer. The user computer can be a common user desktop or portable PC, and in a specific embodiment of the present application, it is a common desktop PC (Dell OptiPlex 7010MT Plus). The user password processing unit is an encryption and decryption chip or a computer mainboard card; in a specific embodiment of the present application, it is a mainboard card on the user computer. The service computer can be a common server or a cloud server, and in a specific embodiment of the present application, it is a common Dell server (Dell T150). The secret chamber computing security device can be a separate computer or a computer mainboard card, and in a specific embodiment of the present application, it is a mainboard card on the server computer.

[0056] Further, the user computer is provided with a user password processing unit for managing the secret key, encrypting and digitally signing the artificial intelligence computing code and user data of the user computer, and decrypting and digitally signing the verification of the computing result returned from the service computer. In this embodiment, when there are multiple secret chamber computing security devices, the service computer manages the multiple secret chamber computing security devices, and determines the computing task scheduling among the security computing devices according to the current running state of the system. In a specific embodiment of the present application, the service computer schedules each secret chamber computing security device in turn in a round robin manner.

[0057] Further, the secret chamber computing security device has independent computing and storage resources, and the structure is as shown in Figure 2 As shown, it includes a computing unit, a volatile storage unit, a non-volatile storage unit, an application and data processing unit, an artificial intelligence coprocessing unit, a password processing unit, and a host communication interface unit. The application and data processing unit is connected to the computing unit, the non-volatile storage unit, the password processing unit, and the host communication interface unit, respectively. The volatile storage unit is connected to the computing unit and the non-volatile storage unit, respectively. The computing unit is also connected to the artificial intelligence coprocessing unit. All the above units are connected through physical lines.

[0058] Further, the application and data processing unit receives the encrypted artificial intelligence computing code and user data sent by the user computer to the service computer through the host communication interface unit, stores the artificial intelligence computing code and user data in the non-volatile storage unit after decryption and verification by the password processing unit, and can send the calculation result of the artificial intelligence calculation of the calculation unit to the service computer host through the host communication interface unit after encryption and signature by the password processing unit, and then the service computer returns the result to the user computer. In an embodiment of the application, the application and data processing unit can be a SOC chip or an FPGA chip. In a specific embodiment of the application, the application and data processing unit is an FPGA chip.

[0059] The non-volatile storage unit is used to store the artificial intelligence computing code and user data processed by the application and data processing unit, and the calculation result of the artificial intelligence calculation of the calculation unit.

[0060] The volatile storage unit is used to load the artificial intelligence computing code and user data stored in the non-volatile storage unit according to the requirements of the calculation unit.

[0061] The calculation unit is used to load the artificial intelligence computing code and user data stored in the volatile storage unit and perform calculation, and then store the calculation result in the non-volatile storage unit through the volatile storage unit.

[0062] In this embodiment, the calculation unit can be implemented as a CPU chip, the volatile storage unit is a memory, and the non-volatile storage unit is a flash memory. In a specific embodiment of the application, the calculation unit is an ARM Cortex-A75, the volatile storage unit is a DDR SDRAM chip, and the non-volatile storage unit is a flash memory.

[0063] The password processing unit is used to cooperate with the user password processing unit to manage the key, decrypt and verify the digital signature of the artificial intelligence code and user data in the application and data processing unit, and encrypt and digitally sign the calculation result in the application and data processing unit.

[0064] In the embodiment, the password processing unit is composed of three modules, including a first key management and distribution module, a first encryption and decryption module, and a first digital signature and verification module, which are connected with each other through physical lines. The first key management and distribution module is used to complete the generation, storage, management and distribution of encryption keys and signature keys; the first encryption and decryption module is used to perform a preset encryption and decryption algorithm to decrypt the artificial intelligence code and user data in the application and data processing unit, and to encrypt the calculation results in the application and data processing unit; and the first digital signature and verification module is used to perform digital signature verification on the artificial intelligence code and user data in the application and data processing unit, and to perform digital signature on the calculation results in the application and data processing unit. In the embodiment, the password processing unit can be implemented as an encryption and decryption chip. In a specific embodiment of the application, the password processing unit is an encryption chip ATSHA204A-SSHDA-TMICROCHIP (U.S. Microchip) plus an FPGA chip.

[0065] The artificial intelligence coprocessing unit can assist the computing unit to complete the calculation processing required by artificial intelligence applications; when an artificial intelligence application needs a large amount of complex artificial intelligence calculation operation, the computing unit can request the artificial intelligence coprocessing unit to complete certain complex artificial intelligence calculation operation (such as matrix calculation) to accelerate the data calculation process. In the embodiment, the artificial intelligence coprocessing unit can be a GPU processor of different functions and types. In a specific embodiment of the application, the artificial intelligence coprocessing unit is an ARM Mali-G72 GPU.

[0066] The host communication interface unit is used to communicate with the service computer host through a private dedicated channel. The host communication interface unit can communicate with the service computer host through a hardware interface such as a PCI Express (PCIe) or a USB interface. In a specific embodiment of the application, the host communication interface unit communicates with the service computer host through a PCIe 3.0 interface.

[0067] Further, the user password processing unit also consists of three modules, including: a second key management and distribution module, a second encryption and decryption module, a second digital signature and verification module, the three modules are connected with each other through physical lines. The second key management and distribution module cooperates with the first key management and distribution module to jointly complete the generation, storage, management and distribution of encryption keys and signature keys; the second encryption and decryption module is used to execute encryption and decryption algorithms to encrypt the artificial intelligence code and user data in the user computer, and decrypt the calculation results from the service computer, wherein the encryption and decryption algorithms executed by the second encryption and decryption module are consistent with the encryption and decryption algorithms executed by the first encryption and decryption module; the second digital signature and verification module is used to digitally sign the artificial intelligence code and user data in the user computer, and perform digital signature verification on the calculation results from the service computer. In an embodiment of the present application, the user password processing unit is an encryption chip T680 (square centimeter microelectronics) plus an FPGA chip; the encryption chip T680 completes the functions of the encryption and decryption module and the digital signature and verification module, and the FPGA chip completes the key management and distribution module. The user password processing unit and the password processing unit of the secret room computing security device on the service computer perform key generation and exchange based on online or offline. In an embodiment of the present application, the online key generation and exchange can be constructed based on the SecKMS key management system.

[0068] Further, the present application also proposes a computing method based on the above-mentioned system, the overall flow is as shown in Figure 3 The steps are as follows:

[0069] Step 1) The user prepares user data and its corresponding calculation code, i.e. artificial intelligence calculation code, on the user computer; in an embodiment of the present application, the user data is a data file D; and its corresponding calculation code is a PyTorch program code file P.

[0070] Step 2) The user password processing unit of the user computer and the password processing unit of the selected secret room computing security device on the service computer communicate to complete password generation and exchange; the specific steps are as follows:

[0071] Step 2.1) The service computer host selects a secret room computing security device according to the current system running state. In an embodiment of the present application, according to the load minimum priority principle, the secret room computing security device 1 is selected.

[0072] Step 2.2) The user password processing unit of the user computer generates an encryption key: first key, generates a pair of signature keys for signature: user public key and user private key, and communicates with the first key management and distribution module in the password processing unit of the selected secret chamber computing security device on the service computer to complete key distribution.

[0073] In a specific embodiment of the present application, the first key is represented as ksu, the user public key is PUK, and the user private key is Puk; the Puk is secretly stored by the second key management and distribution module in the user computer password processing unit, and the ksu and PUK are distributed to the first key management and distribution module in the password processing unit of the selected secret chamber computing security device on the service computer.

[0074] Step 2.3) The password processing unit of the selected secret chamber computing security device on the service computer generates an encryption key: second key, generates a pair of signature keys for signature: service public key and service private key, and communicates with the second key management and distribution module in the user password processing unit of the user computer to complete key distribution.

[0075] In a specific embodiment of the present application, the second key is represented as kss, the service public key is PSK, and the service private key is Psk; the Psk is secretly stored by the first key management and distribution module in the password processing unit of the secret chamber computing security device on the service computer, and the kss and PSK are distributed to the second key management and distribution module in the password processing unit of the user computer.

[0076] Step 3) The user computer signs and encrypts the artificial intelligence computing code and user data to obtain encrypted computing code and corresponding encrypted signature, and encrypted user data and corresponding encrypted signature; the specific steps are as follows:

[0077] Step 3.1) The user computer uses the user private key obtained in step 2.1) to sign the artificial intelligence computing code using a preselected digital signature algorithm in the second digital signature and verification module of the user password processing unit, to obtain a computing code signature; and signs the user data to obtain a user data signature. In a specific embodiment of the present application, the user private key Pku and a preselected digital signature algorithm such as RSA or ECC are used to obtain a computing code signature Sign(P); and a user data signature Sign(D).

[0078] Step 3.2) The user computer encrypts the combination of the calculation code, the calculation code signature, the user data and the user data signature using the first key and the pre-selected symmetric encryption algorithm in the second encryption and decryption module of the user computer processing unit, to obtain the encrypted calculation code and the corresponding encrypted signature and the encrypted user data and the corresponding encrypted signature.

[0079] In one embodiment of the present application, the combination of the calculation code, the calculation code signature, the user data and the user data signature is encrypted using the first key ksu and a pre-selected symmetric encryption algorithm, such as AES, to obtain ES{ksu, P, Sign(P), D, Sign(D)}.

[0080] Step 4) The user computer host sends the encrypted calculation code and the corresponding encrypted signature and the encrypted user data and the corresponding encrypted signature to the service computer; the specific steps are as follows:

[0081] Step 4.1) The user computer host sends the encrypted calculation code and the corresponding encrypted signature and the encrypted user data and the corresponding encrypted signature to the service computer host through the Internet. In one embodiment of the present application, ES{ksu, P, Sign(P), D, Sign(D)} is sent to the service computer host.

[0082] Step 4.2) The service computer host sends the encrypted calculation code and the corresponding encrypted signature and the encrypted user data and the corresponding encrypted signature to the selected secret chamber computing security device in step 2) through a private dedicated channel. In one embodiment of the present application, ES{ksu, P, Sign(P), D, Sign(D)} is sent to the secret chamber computing security device 1.

[0083] Step 5) The secret chamber computing security device decrypts the received encrypted calculation code and the corresponding encrypted signature and the encrypted user data and the corresponding encrypted signature; the specific steps are as follows:

[0084] Step 5.1) The application and data processing unit of the secret chamber computing security device receives the encrypted calculation code and the corresponding encrypted signature and the encrypted user data and the corresponding encrypted signature sent by the service computer host through the host communication interface unit and the private dedicated channel, and stores them in the non-volatile storage unit. In one embodiment of the present application, the encrypted calculation code and the user data ES{ksu, P, Sign(P), D, Sign(D)} are stored in the non-volatile storage unit.

[0085] Step 5.2) The application and data processing unit of the secure device decrypts the encrypted computation code and encrypted user data using the first key and the pre-selected symmetric encryption algorithm, and decrypts the computation code signature and the user data signature, to obtain the decrypted computation code, the decrypted user data, the decrypted computation code signature and the decrypted user data signature, and stores them in the non-volatile storage unit.

[0086] In a specific embodiment of the present application, the encrypted computation code and user data ES{ksu, P, Sign(P), D, Sign(D)} are decrypted using the first key ksu and the pre-selected symmetric encryption algorithm, such as AES, to obtain the decrypted computation code P*, the decrypted computation code signature Sign(P)*, the decrypted user data D*, and the decrypted user data signature Sign(D)*.

[0087] Step 5.3) The cryptographic processing unit uses the digital signature and verification module to verify the decrypted computation code signature and the decrypted user data signature using the user public key and the pre-selected digital signature algorithm: if both are verified, step 6) is executed; otherwise, step 5.4) is executed.

[0088] In a specific embodiment of the present application, the decrypted computation code signature Sign(P)* and the decrypted user data signature Sign(D)* are verified using the user public key PUK and the pre-selected digital signature algorithm, such as RSA or ECC, to determine whether they are the digital signatures of the decrypted computation code P* and the decrypted user data D*, respectively.

[0089] Step 5.4) Outputs "verification failed" as the computation result, and then goes to step 7).

[0090] Step 6) The secure device for secret computation processes the decrypted computation code and the decrypted user data to obtain the final computation result; the specific steps are as follows:

[0091] Step 6.1) The application and data processing unit of the secure device for secret computation loads the runtime environment code of the computation code stored in the non-volatile storage unit into the volatile storage unit for execution according to the computation requirements of the computation code using the computation unit. In a specific embodiment of the present application, the PyTorch execution environment is loaded.

[0092] Step 6.2) The application and data processing unit runs the computation code stored in the volatile storage unit using the computation unit and the volatile storage unit and the artificial intelligence co-processing unit, processes the user data stored in the non-volatile storage unit, obtains the computation result, and stores it in the non-volatile storage unit. In a specific embodiment of the present application, the PyTorch program code P is run to process the data file D to obtain the computation result file F.

[0093] Step 7) The secret chamber computing security device signs and respectively encrypts the computing result to obtain an encrypted computing result and an encrypted computing result signature; the specific steps are as follows:

[0094] Step 7.1) The password processing unit of the secret chamber computing security device uses the service private key obtained in step 2.2) to sign the computing result by using the digital signature algorithm preselected by the first digital signature and verification module in the user password processing unit, to obtain a computing result signature.

[0095] In a specific embodiment of the present application, the computing result F is signed by using the service private key Psk and the preselected digital signature algorithm, such as RSA or ECC, to obtain a computing result signature as Sign(F).

[0096] Step 7.2) The password processing unit uses the second key and the preselected symmetric password algorithm in the first encryption and decryption module of the user password processing unit to encrypt the computing result and the computing result signature stored in the non-volatile storage unit, to obtain an encrypted computing result and an encrypted computing result signature.

[0097] In a specific embodiment of the present application, the computing result and the computing result signature are combined into a file by using the second key kss and the preselected symmetric encryption algorithm, such as AES, and the file is encrypted to obtain ES{kss, F, Sign(F)}.

[0098] It should be noted that if the computing result is "verification failure" obtained in step 5.4), the message of "verification failure" as the computing result also needs to be signed and encrypted to form an encrypted computing result and an encrypted computing result, and then transmitted.

[0099] Step 8) The service computer host sends the encrypted computing result and the encrypted computing result signature to the user computer; the specific steps are as follows:

[0100] Step 8.1) The application and data processing unit of the secret chamber computing security device transmits the encrypted computing result and the encrypted computing result signature to the service computer host through the host communication interface unit and the private dedicated channel. In a specific embodiment of the present application, the encrypted computing result and the signature are ES{kss, F, Sign(F)}.

[0101] Step 8.2) The service computer host sends the encrypted computing result and the encrypted computing result signature to the user computer host through the Internet.

[0102] Step 9) The user computer receives and displays the computing result; the specific steps are as follows:

[0103] Step 9.1) The user computer host receives the encrypted computation result and the encrypted computation result signature over the Internet. In one embodiment of the present application, the user computer host receives the encrypted computation result and the encrypted computation result signature ES{kss, F, Sign(F)}.

[0104] Step 9.2) The second encryption and decryption module of the user password processing unit on the user computer decrypts the encrypted computation result and the encrypted computation result signature using the second key obtained in step 2.2) and a pre-selected symmetric encryption algorithm to obtain a decrypted computation result and a decrypted computation result signature.

[0105] In one embodiment of the present application, the encrypted computation result and signature ES{kss, F, Sign(F)} are decrypted using the second key kss and a pre-selected symmetric encryption algorithm, such as AES, to obtain a decrypted computation result F* and a decrypted computation result signature Sign(F)*.

[0106] Step 9.3) The user password processing unit uses the second digital signature and verification module to verify the decrypted computation result signature using the service public key and a pre-selected digital signature algorithm: if the verification is passed, step 9.4) is executed; otherwise, step 9.5) is executed.

[0107] In one embodiment of the present application, the decrypted computation result signature Sign(F)* is verified using the PSK and a pre-selected digital signature algorithm, such as RSA or ECC, to determine whether it is the digital signature of the decrypted computation result F*.

[0108] Step 9.4) The user computer presents the decrypted computation result to the user. In one embodiment of the present application, the decrypted computation result F* is presented to the user.

[0109] Step 9.5) The user computer reports the computation result transmission error to the user.

Claims

1. A computing system for improving artificial intelligence code and data security, characterized in that, The application relates to a user computer and a service computer connected through the Internet; one or more secret chamber computing security devices are arranged on the host of the service computer; the user computer is used for initiating artificial intelligence computing, providing encrypted artificial intelligence computing code and corresponding digital signatures and encrypted user data required for computing and corresponding digital signatures for the service computer through the Internet; the service computer is used for receiving the encrypted artificial intelligence computing code and corresponding digital signatures and the encrypted user data and corresponding digital signatures, decrypting the artificial intelligence computing code and the user data by using the secret chamber computing security device, performing digital signature verification, completing corresponding computing, performing digital signature and encryption on the computing result, and returning the computing result to the user computer through the Internet; A user password processing unit is arranged on the user computer and is used for managing keys, encrypting and digitally signing the artificial intelligence computing code and the user data of the user computer, and decrypting and digitally signing the computing result returned from the service computer; The secret chamber computing security device comprises a computing unit, a volatile storage unit, a non-volatile storage unit, an application and data processing unit, an artificial intelligence coprocessing unit, a password processing unit and a host communication interface unit; the application and data processing unit is connected with the computing unit, the non-volatile storage unit, the password processing unit and the host communication interface unit through physical lines; the volatile storage unit is connected with the computing unit and the non-volatile storage unit through physical lines; and the computing unit is connected with the artificial intelligence coprocessing unit through a physical line; The application and data processing unit receives the encrypted artificial intelligence computing code and user data sent by the user computer to the service computer through the host communication interface unit, stores the artificial intelligence computing code and the user data in the non-volatile storage unit after decryption and verification by the password processing unit, acquires the computing result of the artificial intelligence computing of the computing unit, and then sends the computing result to the service computer host after encryption and signature by the password processing unit through the host communication interface unit; The non-volatile storage unit is used for storing the artificial intelligence computing code and the user data processed by the application and data processing unit and storing the computing result of the artificial intelligence computing of the computing unit; The volatile storage unit is used for loading the artificial intelligence computing code and the user data stored in the non-volatile storage unit according to the requirement of the computing unit; The computing unit is used for loading the artificial intelligence computing code and the user data stored in the volatile storage unit and performing computing, and then storing the computing result in the non-volatile storage unit through the volatile storage unit; The password processing unit is used for key management in cooperation with the user password processing unit, decryption and digital signature verification of the artificial intelligence code and the user data in the application and data processing unit, and encryption and digital signature of the calculation result in the application and data processing unit. The artificial intelligence coprocessor unit is used for assisting the calculation unit to complete artificial intelligence calculation, so as to accelerate the data calculation process. The host communication interface unit is used for communicating with the service computer through a private dedicated channel.

2. The system of claim 1, wherein, The service computer sequentially schedules each of the secret room calculation security devices in turn in a round-robin manner.

3. The system of claim 1, wherein, The password processing unit includes a first key management and distribution module, a first encryption and decryption module, and a first digital signature and verification module connected with each other through physical lines. The first key management and distribution module is used for generating, storing, managing and distributing encryption keys and signature keys; the first encryption and decryption module is used for executing encryption and decryption algorithms to decrypt the artificial intelligence code and the user data in the application and data processing unit, and to encrypt the calculation result in the application and data processing unit; and the first digital signature and verification module is used for performing digital signature verification on the artificial intelligence code and the user data in the application and data processing unit, and digitally signing the calculation result in the application and data processing unit.

4. The system of claim 3, wherein, The user password processing unit includes a second key management and distribution module, a second encryption and decryption module, and a second digital signature and verification module connected with each other through physical lines. The second key management and distribution module cooperates with the first key management and distribution module to jointly generate, store, manage and distribute encryption keys and signature keys; the second encryption and decryption module is used for executing the encryption and decryption algorithms to encrypt the artificial intelligence code and the user data in the user computer, and to decrypt the calculation result from the service computer; The second digital signature and verification module is used for digitally signing the artificial intelligence code and the user data in the user computer, and performing digital signature verification on the calculation result from the service computer.

5. The system of claim 4, wherein, The user password processing unit and the password processing unit construct online key generation and exchange based on a SecKMS key management system.

6. A computing method based on the system of claim 4, characterized by, The method comprises the following steps: 1) The user prepares user data and corresponding artificial intelligence calculation code on the user computer; 2) The user password processing unit of the user computer and the password processing unit of the selected secret room calculation security device on the service computer communicate to complete password generation and exchange; The method comprises: The service computer host selects a secret room calculation security device; The user password processing unit of the user computer generates an encryption key: a first key, and a pair of signature keys: a user public key and a user private key, through the second key management and distribution module, and communicates with the first key management and distribution module of the password processing unit of the selected secret room calculation security device on the service computer to complete key distribution; The password processing unit in the selected secret chamber computing security device on the service computer generates an encryption key: the second key, generates a pair of signature keys for signing: the service public key and the service private key, and communicates with the second key management and distribution module in the user password processing unit of the user computer to complete key distribution; 3) The user computer signs and encrypts the artificial intelligence computing code and the user data to obtain encrypted computing code and corresponding encrypted signature and encrypted user data and corresponding encrypted signature; including: The user computer uses the user private key to sign the artificial intelligence computing code using a pre-selected digital signature algorithm in the second digital signature and verification module of the user password processing unit to obtain the computing code signature; and signs the user data to obtain the user data signature; The user computer uses the first key and a pre-selected symmetric encryption algorithm in the second encryption and decryption module of the user password processing unit to encrypt the combination of the computing code, the computing code signature, the user data, and the user data signature to obtain encrypted computing code and corresponding encrypted signature and encrypted user data and corresponding encrypted signature; 4) The user computer host sends the encrypted computing code and corresponding encrypted signature and the encrypted user data and corresponding encrypted signature to the service computer; the service computer host sends the encrypted computing code and corresponding encrypted signature and the encrypted user data and corresponding encrypted signature to the selected secret chamber computing security device in step 2) through a private dedicated channel; 5) The secret chamber computing security device of the service computer decrypts the received encrypted computing code and corresponding encrypted signature and the encrypted user data and corresponding encrypted signature; including: The application and data processing unit of the secret chamber computing security device receives the encrypted computing code and corresponding encrypted signature and the encrypted user data and corresponding encrypted signature sent by the service computer host through the host communication interface unit and the private dedicated channel, and stores them in the non-volatile storage unit; The application and data processing unit decrypts the encrypted computing code and the encrypted user data using the first key and a pre-selected symmetric encryption algorithm in the first encryption and decryption module of the password processing unit, and decrypts the computing code signature and the encrypted user data signature to obtain decrypted computing code, decrypted user data, decrypted computing code signature, and decrypted user data signature, and stores them in the non-volatile storage unit; The password processing unit uses the digital signature and verification module to verify the decrypted computing code signature and the decrypted user data signature using the user public key and a pre-selected digital signature algorithm: if both are verified, step 6) is executed; 6) The secret chamber computing security device processes the decrypted computing code and the decrypted user data to obtain the final computing result; including: The application and data processing unit of the secret chamber computing security device loads the running environment code of the computing code stored in the non-volatile storage unit into the volatile storage unit for running according to the computing requirements of the computing code using the computing unit. The application and data processing unit runs the computing code stored in the volatile storage unit by using the computing unit and the volatile storage unit and the artificial intelligence coprocessing unit, processes the user data stored in the non-volatile storage unit, obtains a computing result, and stores the computing result in the non-volatile storage unit; 7) The secret chamber computing security device signs and encrypts the computing result to obtain an encrypted computing result and an encrypted computing result signature; including: The password processing unit of the secret chamber computing security device uses the service private key, uses a digital signature algorithm preselected by the first digital signature and verification module in the password processing unit, and signs the computing result to obtain a computing result signature; The password processing unit uses the second key and a symmetric encryption algorithm preselected by the first encryption and decryption module of the password processing unit to encrypt the computing result and the computing result signature stored in the non-volatile storage unit to obtain an encrypted computing result and an encrypted computing result signature; 8) The service computer host sends the encrypted computing result and the encrypted computing result signature to the user computer; 9) The second encryption and decryption module of the user password processing unit on the user computer uses the obtained second key and the preselected symmetric encryption algorithm to decrypt the encrypted computing result and the encrypted computing result signature to obtain a decrypted computing result and a decrypted computing result signature; The user password processing unit uses the second digital signature and verification module, uses the service public key and a preselected digital signature algorithm to verify the decrypted computing result signature; if the verification is successful, the user computer presents the decrypted computing result to the user.

7. The computational method of claim 6, wherein, The verification of the decrypted computing code signature and the decrypted user data signature further includes: If any verification fails, a verification failure message is output as the computing result.

8. The computational method of claim 6, wherein, The verification of the decrypted computing result signature further includes: If the verification of the decrypted computing result signature fails, the user computer reports the computing result transmission error to the user.

Images