Method and device for protecting large model

Abstract

The invention provides a large model protection method and device, and relates to the technical field of data processing, in particular to the technical fields of artificial intelligence, natural language processing and the like. The method comprises the following steps: acquiring a public key and a model encryption tool of a target large model, and sending the model encryption tool and the public key to a third-party large model platform; obtaining decryption related information of the ciphertext large model and the target large model sent by the third-party large model platform; obtaining a transparent file encryption and decryption agent of a user space file system FUSE corresponding to the third-party large model platform; and deploying the ciphertext large model, the decryption related information and a transparent file encryption and decryption agent of the FUSE in the cluster, and decrypting the ciphertext large model through the transparent file encryption and decryption agent of the FUSE according to the decryption related information to obtain a plaintext of the target large model. According to the method and the device, the large model with rich scenes and high capacity can be provided, the safety of the model file is comprehensively ensured, the large model is ensured to meet scene requirements, and high efficiency, safety and reliability are kept.

Description

Technical Field

[0001] The present disclosure relates to the field of data processing technology, and in particular to technical fields such as natural language processing and artificial intelligence. Background Art

[0002] Big models generally include open source big models and closed source big models. Since the training data of different big models vary greatly, the effects of different big models in different fields are also different.

[0003] In the related art, when protecting the model file, a symmetric or asymmetric encryption algorithm is used for the model file, that is, a password or key is used to encrypt the model file. When running the model's inference service, a fixed password is used or a key management platform (Key Management Service, KMS) is used to obtain the key and decrypt the encrypted model file in the memory. This can ensure the security of the model file when it is stored in the running container, but may not prevent the leakage of the model file during deployment and transmission. In addition, after the encryption password or key is leaked, the security protection measures for the model file may also become invalid, resulting in security risks for the model file.

[0004] Therefore, how to meet the needs of users in various industries and fields, provide large models with rich scenarios and high-quality capabilities, and fully ensure the security of model files has become one of the important research directions. Summary of the invention

[0005] The present invention provides a large model protection method and device.

[0006] According to one aspect of the present disclosure, a large model protection method is provided, comprising:

[0007] Obtain the public key and model encryption tool of the target large model, and send the model encryption tool and public key to the third-party large model platform;

[0008] Obtain decryption related information of the ciphertext big model and the target big model sent by the third-party big model platform;

[0009] Obtain the transparent file encryption and decryption agent of the user space file system FUSE corresponding to the third-party large model platform;

[0010] Deploy the ciphertext large model, decryption-related information, and FUSE's transparent file encryption and decryption agent to the cluster, and use FUSE's transparent file encryption and decryption agent to decrypt the ciphertext large model based on the decryption-related information to obtain the plaintext of the target large model.

[0011] The present disclosure can provide a large model with rich scenarios and high-quality capabilities, and fully guarantee the security of the model files, ensuring that the large model remains efficient, safe and reliable while meeting scenario requirements.

[0012] According to another aspect of the present disclosure, there is provided a large-scale protective device, comprising:

[0013] The first acquisition module is used to obtain the public key and model encryption tool of the target large model, and send the model encryption tool and public key to the third-party large model platform;

[0014] The second acquisition module is used to obtain decryption related information of the ciphertext big model and the target big model sent by the third-party big model platform;

[0015] The third acquisition module is used to obtain the transparent file encryption and decryption agent of the user space file system FUSE corresponding to the third-party large model platform;

[0016] The processing module is used to deploy the ciphertext large model, decryption related information and FUSE's transparent file encryption and decryption agent to the cluster, and decrypt the ciphertext large model according to the decryption related information through the FUSE's transparent file encryption and decryption agent to obtain the plaintext of the target large model.

[0017] According to another aspect of the present disclosure, there is provided an electronic device, including at least one processor, and

[0018] a memory communicatively connected to at least one processor; wherein,

[0019] The memory stores instructions that can be executed by at least one processor, and the instructions are executed by at least one processor to enable the at least one processor to execute the large model protection method of the embodiment of the first aspect of the present disclosure.

[0020] According to another aspect of the present disclosure, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to cause a computer to execute the large model protection method according to the embodiment of the first aspect of the present disclosure.

[0021] According to another aspect of the present disclosure, a computer program product is provided, including a computer program, which implements the steps of the large model protection method of the first aspect of the present disclosure when executed by a processor.

[0022] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present disclosure, nor is it intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] The accompanying drawings are used to better understand the present solution and do not constitute a limitation of the present disclosure.

[0024] Figure 1 is a flow chart of a method for protecting a large model according to an embodiment of the present disclosure;

[0025] Figure 2 is a flow chart of a method for protecting a large model according to an embodiment of the present disclosure;

[0026] Figure 3 is a flow chart of a method for protecting a large model according to an embodiment of the present disclosure;

[0027] Figure 4 is a schematic diagram of a method for protecting a large model according to an embodiment of the present disclosure;

[0028] Figure 5 is a structural diagram of a large-scale protection device according to an embodiment of the present disclosure;

[0029] Figure 6 The block diagram is a block diagram of an electronic device for implementing the method of the embodiment of the present disclosure. DETAILED DESCRIPTION

[0030] The following is a description of exemplary embodiments of the present disclosure in conjunction with the accompanying drawings, including various details of the embodiments of the present disclosure to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present disclosure. Similarly, for the sake of clarity and conciseness, descriptions of well-known functions and structures are omitted in the following description.

[0031] The embodiments of the present disclosure relate to technical fields such as data processing and artificial intelligence.

[0032] Data processing: Data is a form of expression of facts, concepts or instructions, which can be processed by manual or automated devices. After data is interpreted and given a certain meaning, it becomes information. Data processing is the collection, storage, retrieval, processing, transformation and transmission of data. The basic purpose of data processing is to extract and derive valuable and meaningful data for certain specific people from a large amount of data that may be chaotic and difficult to understand. Data processing is a basic link in system engineering and automatic control. Data processing runs through all areas of social production and social life. The development of data processing technology and the breadth and depth of its application have greatly affected the process of human social development.

[0033] Artificial Intelligence (AI) is a new technical science that studies and develops theories, methods, technologies and application systems for simulating, extending and expanding human intelligence.

[0034] Natural Language Processing (NLP) is an important direction in the fields of computer science and artificial intelligence. It studies various theories and methods that can achieve effective communication between people and computers using natural language. Natural language processing is a science that integrates linguistics, computer science, and mathematics. Therefore, research in this field will involve natural language, that is, the language used by people in daily life, so it is closely related to the study of linguistics, but there are important differences. Natural language processing is not a general study of natural language, but the development of computer systems that can effectively realize natural language communication, especially the software systems therein. Therefore, it is a part of computer science. Natural language processing is mainly used in machine translation, public opinion monitoring, automatic summarization, opinion extraction, text classification, question answering, text semantic comparison, speech recognition, Chinese optical character recognition OCR, etc.

[0035] The following are explanations of the terms used in this disclosure:

[0036] Filesystem in Userspace (FUSE) is a module in the operating system kernel used to mount certain network spaces to the local file system.

[0037] The protection method and device of the large model disclosed in the present invention are described below with reference to the accompanying drawings.

[0038] Figure 1 is a flow chart of a method for protecting a large model according to an embodiment of the present disclosure, such as Figure 1 As shown, the method comprises the following steps:

[0039] S101, obtaining the public key and model encryption tool of the target large model, and sending the model encryption tool and public key to the third-party large model platform.

[0040] In some implementations, an application program API interface may be used to request a model encryption tool and a public key. Optionally, a preset data management platform key management interface may be called to request a model encryption tool and a public key. The data management platform complies with relevant laws and regulations and has the ability to provide large model authentication audit records.

[0041] In some implementations, in order to improve data security, a model object may be created for the target large model according to the model information of the target large model, and a key library may be accessed through a key management interface to obtain a public key matching the model object from the key library. Optionally, the model information may include one or more of a model architecture, a usage scenario, training data, version information, and usage restriction conditions.

[0042] In some implementations, a model identifier of the target large model is obtained, and based on the model identifier, a model encryption tool for encrypting the target large model is obtained from a pre-built encryption tool library.

[0043] In some implementations, a platform identifier of a third-party large model platform is obtained, and based on the platform identifier, a model encryption tool for encrypting the target large model is obtained from a pre-built encryption tool library.

[0044] In some implementations, a platform identifier of a third-party large model platform and a model identifier of a target large model are obtained, and based on the platform identifier and the model identifier, a model encryption tool for encrypting the target large model is obtained from a pre-built encryption tool library.

[0045] S102, obtaining decryption related information of the ciphertext big model and the target big model sent by the third-party big model platform.

[0046] Optionally, in the disclosed embodiment, the ciphertext large model refers to a machine learning model protected by encryption technology, whose structure and parameters are stored and transmitted in ciphertext form. Such a model can enhance data privacy and security and prevent sensitive information leakage.

[0047] In the disclosed embodiment, the ciphertext model is obtained by encrypting the model in a private environment by a third-party large model platform using a model encryption tool and a public key. The private environment refers to the environment of the third-party large model platform itself, such as the manufacturer's own development machine, etc., which means that other model platforms do not participate in the encryption process of the ciphertext model.

[0048] In some implementations, the decryption-related information of the ciphertext large model and the target large model may include one or more of the following information: encryption algorithm, decryption process information, operating environment information, error handling strategy, and application characteristics.

[0049] The third-party large model platform provides encrypted models and AI applications / images. In other words, the third-party model platform is not limited to providing encrypted models in any way. For example, it can be sent over the network using a container image.

[0050] S103, obtaining a transparent file encryption and decryption agent of the user space file system FUSE corresponding to the third-party large model platform.

[0051] The transparent file encryption and decryption agent can provide zero-modification file encryption and decryption capabilities for the artificial intelligence AI application (big model) of the third largest model platform. The big model platform uses the encrypted big model in circulation to protect its confidentiality.

[0052] Among them, the transparent encryption and decryption agent itself uses a zero-trust (keyless) authentication mechanism, and there is no need to manually configure static passwords or credentials during operation, further reducing the risk of data leakage.

[0053] S104, deploying the ciphertext large model, decryption related information and FUSE's transparent file encryption and decryption agent to the cluster, and decrypting the ciphertext large model according to the decryption related information through the FUSE's transparent file encryption and decryption agent to obtain the plaintext of the target large model.

[0054] The ciphertext big model, decryption related information, and FUSE's transparent file encryption and decryption agent are deployed in the preset cluster. After startup, the ciphertext big model is decrypted through FUSE's transparent file encryption and decryption agent according to the decryption related information, such as application characteristics, operating environment, etc., to obtain the plaintext of the target big model. Therefore, business services can be provided based on the target big model.

[0055] For example, the preset cluster may be a preset container cluster.

[0056] In the disclosed embodiment, the public key and model encryption tool of the target large model are obtained, and the model encryption tool and the public key are sent to the third-party large model platform, the ciphertext large model and the decryption related information of the target large model sent by the third-party large model platform are obtained, the transparent file encryption and decryption agent of the user space file system FUSE corresponding to the third-party large model platform is obtained, the ciphertext large model, the decryption related information and the transparent file encryption and decryption agent of FUSE are deployed in the cluster, and the ciphertext large model is decrypted according to the decryption related information through the transparent file encryption and decryption agent of FUSE to obtain the plaintext of the target large model, so as to provide a large model with rich scenarios and high-quality capabilities, and fully guarantee the security of the model file, so as to ensure that the large model can meet the scenario requirements while maintaining efficiency, security and reliability.

[0057] Figure 2 is a flow chart of a method for protecting a large model according to an embodiment of the present disclosure, such as Figure 2 As shown, the method comprises the following steps:

[0058] S201, obtain the public key and model encryption tool of the target large model, and send the model encryption tool and public key to the third-party large model platform.

[0059] S202, obtaining decryption related information of the ciphertext big model and the target big model sent by the third-party big model platform.

[0060] S203, obtaining a transparent file encryption and decryption agent of the user space file system FUSE corresponding to the third-party large model platform.

[0061] For the introduction of steps S201 to S203, reference may be made to the relevant contents in the above embodiments, which will not be repeated here.

[0062] S204, obtaining the first application feature of the target large model and the container cluster engine CCE operating environment from the decryption related information.

[0063] In some implementations, the decryption-related information includes the first application feature of the target large model and the container cluster engine CCE operating environment.

[0064] In some implementations, the uniqueness of the file may be confirmed by a uniqueness verification method such as a file hash.

[0065] Optionally, the first application feature of the target large model may include performance and functional features of the target large model in certain tasks or fields. In other embodiments, the first application feature may also include other features, which is not limited in the present disclosure.

[0066] S205: Register an authentication account of the target large model according to the first application feature and the CCE operating environment.

[0067] In some implementations, authentication verification information is determined based on the first application feature and the CCE operating environment; an input authentication account is obtained. Optionally, the authentication account is registered by the user on the data management platform through the authentication verification information. In the embodiment of the present disclosure, the authentication account can be authenticated based on the authentication verification information to obtain an authentication result of the authentication account.

[0068] For example, the first application feature can be matched with the original application feature of the target large model, and the CCE operating environment can be matched with the environment list. In response to the first application feature matching the original application feature and the CCE operating environment being the operating environment in the environment list, an authentication result is obtained that the authentication account has passed the authentication, and the authentication check of the authentication account is completed. The authentication result indicates that the authentication account has passed the authentication. Therefore, it can be determined whether the target large model is in an authorized environment.

[0069] In some implementations, if the first application feature does not match the original application feature, or the CCE operating environment is not the operating environment in the environment list, an authentication result is obtained that the authentication account has passed the authentication, and the authentication result indicates that the authentication account has not passed the authentication. Therefore, it can be determined that the target large model is not in an authorized environment, and transparent decryption capabilities will no longer be provided, and the entire tool chain will be unusable.

[0070] S206: In response to the authentication result indicating that the authentication account has passed the authentication, the authentication account is configured with read and write permissions of the target large model.

[0071] In the disclosed embodiment, different authentication accounts are assigned permissions to read and write specified model objects, and the read and write permissions limit the permissions of the authentication accounts to perform read and write operations on the target large model.

[0072] In some embodiments, a read / write request for a target large model is received, the read / write request includes an authentication account and read / write operations on the target large model, and permissions corresponding to the read / write operations are obtained. If the permissions for the read / write operations do not belong to the read / write permissions configured for the authentication account, feedback of read / write failure is provided to the read / write request.

[0073] S207, deploy the ciphertext large model, decryption related information and FUSE transparent file encryption and decryption agent to the cluster, and decrypt the ciphertext large model according to the decryption related information through the FUSE transparent file encryption and decryption agent to obtain the plaintext of the target large model.

[0074] For the introduction of step S207, please refer to the relevant content in the above embodiment, which will not be repeated here.

[0075] In the disclosed embodiment, combined with the authentication capability of the data management platform, the FUSE transparent file encryption and decryption agent can also provide access control functions for ciphertext models. It is limited to an authorized environment and can transparently decrypt the original closed-source model, thereby protecting the digital copyright of the third-party AI model. In an unauthorized environment, transparent decryption capabilities will not be provided, thereby protecting the security and reliability of the model file, avoiding security risks of large models, and reducing the risk of data leakage.

[0076] Figure 3 is a flow chart of a method for protecting a large model according to an embodiment of the present disclosure, such as Figure 3 As shown, the method comprises the following steps:

[0077] S301, obtain the public key and model encryption tool of the target large model, and send the model encryption tool and public key to the third-party large model platform.

[0078] S302, obtaining decryption related information of the ciphertext big model and the target big model sent by the third-party big model platform.

[0079] S303, obtaining a transparent file encryption and decryption agent of the user space file system FUSE corresponding to the third-party large model platform.

[0080] S304, deploy the ciphertext large model, decryption related information and FUSE transparent file encryption and decryption agent to the cluster, and decrypt the ciphertext large model according to the decryption related information through the FUSE transparent file encryption and decryption agent to obtain the plaintext of the target large model.

[0081] For the introduction of steps S301 to S304, reference may be made to the relevant contents in the above embodiments, which will not be repeated here.

[0082] S305: Receive an access request of the target large model.

[0083] In some implementations, an access call request for a target big model sent by a third-party big model platform is received.

[0084] In some implementations, an access call request from a designated server or a large model platform may also be received.

[0085] Optionally, the access call request also carries a second application feature to assist in determining whether the access call request is a safe access call request.

[0086] S306, determining whether the access call request is a safe access call request.

[0087] In some implementations, the target operating environment in which the sending device of the access call request is currently located and the source cluster of the access call request can be obtained based on a system command or a program interface, and then the access call request can be parsed to obtain the second application feature carried in the access call request. Based on the target operating environment, the source cluster, and the second application feature, it can be determined whether the access call request is a safe access call request.

[0088] Optionally, in response to the target operating environment being the authorized environment of the target large model, the source cluster is associated with the target cloud server, and the second application feature matches the original application feature of the target large model, and it is determined that the access call request is a secure access call request.

[0089] In other embodiments, the target operating environment is not an authorized environment of the target large model, or the source cluster is not associated with the target cloud server, or the second application feature does not match the original application feature of the target large model, and the access call request is determined to be a non-secure access call request.

[0090] S307 , in response to the access call request being a secure access call request, access the target large model through the transparent file encryption and decryption agent of FUSE.

[0091] For the introduction of step S307, please refer to the relevant content in the above embodiment, which will not be repeated here.

[0092] In the disclosed embodiment, while providing the FUSE standard interface, a series of security functions including transparent encryption, zero-trust authentication, process identity recognition, dynamic credentials, behavioral auditing, etc. are added, and the encrypted big model is used in use and circulation to protect the confidentiality of the big model.

[0093] Figure 4 is a schematic diagram of a method for protecting a large model according to an embodiment of the present disclosure, such as Figure 4 As shown, in the disclosed embodiment, a set of dedicated file systems can be implemented based on the FUSE interface protocol. While providing the FUSE standard interface, a series of security functions including transparent encryption, zero-trust authentication, process identity recognition, dynamic credentials, and behavior auditing are added. The transparent file encryption and decryption agent can provide zero-modification file encryption and decryption capabilities for AI applications for third-party objects. The large model platform (Docker is a set of platform-as-a-service products. It is based on virtualization technology at the operating system level and packages software and its dependencies into containers) uses encrypted target large models in daily use and circulation to protect the confidentiality of the large models. Combined with the authentication capabilities of the data management platform, the FUSE transparent file encryption and decryption agent can also provide access control functions for ciphertext models. It is limited that only the original factory program can transparently decrypt the original closed-source model in the specified cluster, obtain the plaintext (Data) of the target large model, and store it in a preset node (such as an empty dir directory file), protecting the digital copyright of the large model. The transparent encryption and decryption agent has an environment verification mechanism. In an unauthorized environment, it will not provide transparent decryption capabilities. If in an authorized environment, an attacker attempts to use a non-original AI service to access a third-party large model, that is, the target large model, through the transparent encryption and decryption agent, the transparent encryption and decryption agent has the ability to verify the program characteristics of the access model subject. If it does not match the AI ​​application characteristics registered on the data management platform, the entire tool chain will also be unusable. The transparent encryption and decryption agent itself uses a keyless zero-trust authentication mechanism. There is no need to manually configure static passwords or credentials during operation, which further reduces the risk of data leakage.

[0094] Figure 5 is a structural diagram of a large-scale protection device according to an embodiment of the present disclosure, such as Figure 5 As shown, the large model protection device 500 includes:

[0095] The first acquisition module 510 is used to acquire the public key and model encryption tool of the target large model, and send the model encryption tool and public key to the third-party large model platform;

[0096] The second acquisition module 520 is used to obtain decryption related information of the ciphertext big model and the target big model sent by the third-party big model platform;

[0097] The third acquisition module 530 is used to obtain the transparent file encryption and decryption agent of the user space file system FUSE corresponding to the third-party large model platform;

[0098] Processing module 540 is used to deploy the ciphertext large model, decryption related information and FUSE transparent file encryption and decryption agent to the cluster, and decrypt the ciphertext large model according to the decryption related information through the FUSE transparent file encryption and decryption agent to obtain the plaintext of the target large model.

[0099] In some implementations, the first acquisition module 510 is further configured to:

[0100] Creating a model object for the target large model according to the model information of the target large model;

[0101] Access the key store through the key management interface and obtain the public key that matches the model object from the key store.

[0102] In some implementations, the first acquisition module 510 is further configured to:

[0103] Obtaining a platform identifier of a third-party large model platform and / or a model identifier of a target large model;

[0104] According to the platform identifier and / or the model identifier, a model encryption tool for encrypting the target large model is obtained from a pre-built encryption tool library.

[0105] In some implementations, the processing module 540 is further configured to:

[0106] Obtain the first application feature of the target large model and the container cluster engine CCE operating environment from the decryption related information;

[0107] The authentication account of the target large model is registered according to the first application feature and the CCE operating environment.

[0108] In some implementations, the processing module 540 is further configured to:

[0109] Determine authentication verification information based on the first application feature and the CCE operating environment;

[0110] Get the input authentication account;

[0111] The authentication account is authenticated based on the authentication verification information to obtain an authentication result of the authentication account.

[0112] In some implementations, the processing module 540 is further configured to:

[0113] Matching the first application feature with the original application feature of the target large model;

[0114] Match the CCE operating environment with the environment list;

[0115] In response to the first application feature matching the original application feature and the CCE operating environment being the operating environment in the environment list, an authentication result is obtained indicating that the authentication account has passed the authentication.

[0116] In some implementations, the processing module 540 is further configured to:

[0117] In response to the authentication result indicating that the authentication account has passed the authentication, a ciphertext large model, decryption related information, and a FUSE transparent file encryption and decryption agent are deployed to the cluster.

[0118] In some implementations, the processing module 540 is further configured to:

[0119] In response to the authentication result indicating that the authentication account has passed the authentication, the authentication account is configured with read and write permissions of the target large model.

[0120] In some implementations, the processing module 540 is further configured to:

[0121] Receive a read / write request for a target large model, where the read / write request includes an authentication account and read / write operations on the target large model;

[0122] Get the permissions corresponding to read and write operations;

[0123] If the read / write operation permissions do not belong to the read / write permissions configured for the authentication account, a read / write failure feedback is given to the read / write request.

[0124] In some implementations, the processing module 540 is further configured to:

[0125] Receive access call request of target large model;

[0126] Determine whether the access call request is a safe access call request;

[0127] In response to the access call request being a secure access call request, the target large model is accessed through the transparent file encryption and decryption agent of FUSE.

[0128] In some implementations, the processing module 540 is further configured to:

[0129] Determine the target operating environment in which the sending device of the access call request is currently located;

[0130] Determine the source cluster of the access call request;

[0131] Obtaining the second application feature carried in the access call request;

[0132] Determine whether the access call request is a safe access call request based on the target operating environment, source cluster, and second application characteristics.

[0133] In some implementations, the processing module 540 is further configured to:

[0134] In response to the target operating environment being the authorized environment of the target large model, the source cluster is associated with the target cloud server, and the second application feature matches the original application feature of the target large model, and it is determined that the access call request is a secure access call request.

[0135] The present disclosure can provide a large model with rich scenarios and high-quality capabilities, and fully guarantee the security of the model files, ensuring that the large model remains efficient, safe and reliable while meeting scenario requirements.

[0136] The acquisition, transmission, storage, use, and processing of data in the technical solution disclosed in this disclosure are in compliance with the relevant provisions of national laws and regulations and do not violate public order and good morals. It should be noted that in the embodiments of this disclosure, some existing solutions in the industry such as certain software, components, and models may be mentioned, which should be considered as exemplary, and their purpose is only to illustrate the feasibility of implementing the technical solution of this application, but it does not mean that the applicant has or will necessarily use the solution.

[0137] According to an embodiment of the present disclosure, the present disclosure also provides an electronic device, a readable storage medium and a computer program product.

[0138] Figure 6 It is a block diagram of an electronic device for implementing an embodiment of the present disclosure. The electronic device can implement the protection method of the large model of the embodiment of the present disclosure, and the electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workbenches, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or required herein.

[0139] like Figure 6 As shown, the device 600 includes a computing unit 601, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 602 or a computer program loaded from a storage unit 608 into a random access memory (RAM) 603. In the RAM 603, various programs and data required for the operation of the device 600 can also be stored. The computing unit 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0140] A number of components in the device 600 are connected to the I / O interface 605, including: an input unit 606, such as a keyboard, a mouse, etc.; an output unit 607, such as various types of displays, speakers, etc.; a storage unit 608, such as a disk, an optical disk, etc.; and a communication unit 609, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 609 allows the device 600 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0141] The computing unit 601 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 601 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 601 performs the various methods and processes described above, such as the protection method of the large model. For example, in some embodiments, the protection method of the large model may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit 608. In some embodiments, part or all of the computer program may be loaded and / or installed on the device 600 via the ROM 602 and / or the communication unit 609. When the computer program is loaded into the RAM 603 and executed by the computing unit 601, one or more steps of the protection method of the large model described above may be performed. Alternatively, in other embodiments, the computing unit 601 may be configured to perform the protection method of the large model in any other appropriate manner (e.g., by means of firmware).

[0142] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0143] The program code for implementing the method of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0144] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0145] To provide interaction with a target object, the systems and techniques described herein may be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the target object; and a keyboard and pointing device (e.g., a mouse or trackball) through which the target object can provide input to the computer. Other types of devices may also be used to provide interaction with the target object; for example, the feedback provided to the target object may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the target object may be received in any form (including acoustic input, voice input, or tactile input).

[0146] The systems and techniques described herein can be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a target object computer with a graphical target object interface or a web browser through which the target object can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0147] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship of client and server is generated by computer programs running on respective computers and having a client-server relationship with each other. The server may be a cloud server, a server of a distributed system, or a server combined with a blockchain.

[0148] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this disclosure can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved, and this document does not limit this.

[0149] The above specific implementations do not constitute a limitation on the protection scope of the present disclosure. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

1. A method for protecting a large model, wherein: The method comprises: Obtaining the public key and model encryption tool of the target large model, and sending the model encryption tool and public key to the third-party large model platform; Obtaining decryption related information of the ciphertext big model and the target big model sent by the third-party big model platform; Obtain a transparent file encryption and decryption agent of the user space file system FUSE corresponding to the third-party large model platform; The ciphertext large model, the decryption related information and the FUSE transparent file encryption and decryption agent are deployed in the cluster, and the ciphertext large model is decrypted according to the decryption related information by the FUSE transparent file encryption and decryption agent to obtain the plaintext of the target large model.

2. The method according to claim 1, wherein: The process of obtaining the public key of the target large model includes: Creating a model object for the target large model according to the model information of the target large model; The key library is accessed through the key management interface, and a public key matching the model object is obtained from the key library.

3. The method according to claim 1, wherein: The process of obtaining the model encryption tool of the target large model includes: Obtaining a platform identifier of the third-party large model platform and / or a model identifier of the target large model; According to the platform identifier and / or the model identifier, a model encryption tool for encrypting the target large model is obtained from a pre-built encryption tool library.

4. The method according to claim 1, wherein: Before deploying the ciphertext large model, the decryption related information and the FUSE transparent file encryption and decryption agent in the cluster, the method further includes: Acquire the first application feature of the target large model and the container cluster engine CCE operating environment from the decryption related information; The authentication account of the target large model is registered according to the first application feature and the CCE operating environment.

5. The method according to claim 4, wherein: The registering of the authentication account of the target large model according to the application characteristics and the CCE operating environment includes: Determine authentication verification information based on the first application feature and the CCE operating environment; Get the input authentication account; The authentication account is authenticated based on the authentication verification information to obtain an authentication result of the authentication account.

6. The method according to claim 4, wherein: The authenticating the authentication account based on the authentication verification information to obtain an authentication result of the authentication account includes: Matching the first application feature with the original application feature of the target large model; Matching the CCE operating environment with the environment list; In response to the first application feature matching the original application feature, and the CCE operating environment being an operating environment in the environment list, an authentication result is obtained that the authentication account passes the authentication.

7. The method according to claim 5, wherein: The deploying the ciphertext large model, the decryption related information and the FUSE transparent file encryption and decryption agent into the cluster includes: In response to the authentication result indicating that the authentication account has passed the authentication, the ciphertext large model, the decryption-related information and the FUSE transparent file encryption and decryption agent are deployed to the cluster.

8. The method according to claim 5, wherein: After receiving the authentication result fed back by the data management platform based on the authentication registration request, the method further includes: In response to the authentication result indicating that the authentication account has passed the authentication, the authentication account is configured with read and write permissions for the target large model.

9. The method according to claim 8, wherein: After configuring the read and write permissions of the target large model for the authentication account, the method further includes: Receiving a read / write request for the target large model, the read / write request including the authentication account and the read / write operation for the target large model; Obtaining permissions corresponding to the read and write operations; If the permission of the read / write operation does not belong to the read / write permission configured for the authentication account, a feedback indicating read / write failure is given to the read / write request.

10. The method according to any one of claims 1 to 9, wherein: After obtaining the plain text of the target large model, the method further includes: Receiving an access call request of the target large model; Determining whether the access call request is a safe access call request; In response to the access call request being a secure access call request, the target large model is accessed through the transparent file encryption and decryption agent of the FUSE.

11. The method according to claim 10, wherein: The determining whether the access call request is a safe access call request includes: Determine the target operating environment in which the sending device of the access call request is currently located; Determining a source cluster of the access call request; Obtaining a second application feature carried in the access call request; Whether the access call request is a safe access call request is determined according to the target operating environment, the source cluster and the second application characteristics.

12. The method according to claim 11, wherein: The determining, based on the target operating environment, the source cluster, and the second application feature, whether the access call request is a safe access call request includes: In response to the target operating environment being the authorized environment of the target large model, the source cluster is associated with the target cloud server, and the second application feature matches the original application feature of the target large model, and it is determined that the access call request is a secure access call request.

13. A protective device for a large model, wherein: The device comprises: A first acquisition module is used to acquire the public key and model encryption tool of the target large model, and send the model encryption tool and public key to the third-party large model platform; The second acquisition module is used to obtain decryption related information of the ciphertext large model and the target large model sent by the third-party large model platform; A third acquisition module is used to obtain a transparent file encryption and decryption agent of the user space file system FUSE corresponding to the third-party large model platform; A processing module is used to deploy the ciphertext large model, the decryption related information and the FUSE transparent file encryption and decryption agent in the cluster, and decrypt the ciphertext large model according to the decryption related information through the FUSE transparent file encryption and decryption agent to obtain the plaintext of the target large model.

14. The device according to claim 13, wherein: The first acquisition module is further used for: Creating a model object for the target large model according to the model information of the target large model; The key library is accessed through the key management interface, and a public key matching the model object is obtained from the key library.

15. The device according to claim 13, wherein: The first acquisition module is further used for: Obtaining a platform identifier of the third-party large model platform and / or a model identifier of the target large model; According to the platform identifier and / or the model identifier, a model encryption tool for encrypting the target large model is obtained from a pre-built encryption tool library.

16. The device according to claim 13, wherein: The processing module is further used for: Acquire the first application feature of the target large model and the container cluster engine CCE operating environment from the decryption related information; The authentication account of the target large model is registered according to the first application feature and the CCE operating environment.

17. The device according to claim 16, wherein: The processing module is further used for: Determine authentication verification information based on the first application feature and the CCE operating environment; Get the input authentication account; The authentication account is authenticated based on the authentication verification information to obtain an authentication result of the authentication account.

18. The device according to claim 16, wherein: The processing module is further used for: Matching the first application feature with the original application feature of the target large model; Matching the CCE operating environment with the environment list; In response to the first application feature matching the original application feature, and the CCE operating environment being an operating environment in the environment list, an authentication result is obtained that the authentication account passes the authentication.

19. The device according to claim 17, wherein: The processing module is further used for: In response to the authentication result indicating that the authentication account has passed the authentication, the ciphertext large model, the decryption-related information and the FUSE transparent file encryption and decryption agent are deployed to the cluster.

20. The device according to claim 17, wherein: The processing module is further used for: In response to the authentication result indicating that the authentication account has passed the authentication, the authentication account is configured with read and write permissions for the target large model.

21. The device according to claim 20, wherein: The processing module is further used for: Receiving a read / write request for the target large model, the read / write request including the authentication account and the read / write operation for the target large model; Obtaining permissions corresponding to the read and write operations; If the permission of the read / write operation does not belong to the read / write permission configured for the authentication account, a feedback indicating read / write failure is given to the read / write request.

22. The device according to any one of claims 13 to 21, wherein: The processing module is further used for: Receiving an access call request of the target large model; Determining whether the access call request is a safe access call request; In response to the access call request being a secure access call request, the target large model is accessed through the transparent file encryption and decryption agent of the FUSE.

23. The device according to claim 22, wherein: The processing module is further used for: Determine the target operating environment in which the sending device of the access call request is currently located; Determining a source cluster of the access call request; Obtaining a second application feature carried in the access call request; Whether the access call request is a safe access call request is determined according to the target operating environment, the source cluster and the second application characteristics.

24. The device according to claim 23, wherein: The processing module is further used for: In response to the target operating environment being the authorized environment of the target large model, the source cluster is associated with the target cloud server, and the second application feature matches the original application feature of the target large model, and it is determined that the access call request is a secure access call request.

25. An electronic device comprising: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the method according to any one of claims 1 to 12.

26. A non-transitory computer-readable storage medium storing computer instructions, wherein: The computer instructions are used to cause the computer to execute the method according to any one of claims 1-12.

27. A computer program product comprising a computer program, which, when executed by a processor, implements the steps of the method according to any one of claims 1 to 12.

Images