Method and apparatus for protecting large models

Abstract

The present disclosure provides a large model protection method and device thereof, relates to the technical field of data processing, and particularly relates to the technical field of artificial intelligence, natural language processing and the like. The method comprises the following steps: obtaining a public key and a model encryption tool of a target large model, sending the model encryption tool and the public key to a third-party large model platform; obtaining a ciphertext large model sent by the third-party large model platform and decryption related information of the target large model; obtaining a transparent file encryption and decryption agent of a user space file system (FUSE) corresponding to the third-party large model platform; deploying the ciphertext large model, the decryption related information and the transparent file encryption and decryption agent of the FUSE in a cluster, decrypting the ciphertext large model according to the decryption related information through the transparent file encryption and decryption agent of the FUSE, and obtaining plaintext of the target large model. The present disclosure can provide a large model with rich scenarios and excellent capabilities, comprehensively guarantee the security of the model file, and ensure that the large model meets the scene requirements and is efficient, safe and reliable.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of data processing, and in particular to the technical field of natural language processing, artificial intelligence, etc. BACKGROUND

[0002] A large model generally includes an open-source large model and a closed-source large model. Due to the different training data of different large models, the effects of different large models in different fields are also different.

[0003] In the related art, when a model file is protected, a symmetric or asymmetric encryption algorithm of the model file is used, that is, the model file is encrypted by using a password or a key. When an inference service of the model is run, a fixed password or a key is used to obtain a key from a Key Management Service (KMS) and decrypt the encrypted model file in the memory. The security of the model file can be ensured when the model file is stored in a running container. However, the model file may be leaked during deployment and transmission. In addition, after the encryption password or key is leaked, the security protection measures for the model file may fail, resulting in a security risk of the model file.

[0004] Therefore, how to meet the needs of users in various industries and fields, provide large models with rich scenarios and high-quality capabilities, and comprehensively ensure the security of the model file has become one of the important research directions. SUMMARY

[0005] The present disclosure provides a protection method of a large model and an apparatus thereof.

[0006] According to an aspect of the present disclosure, a protection method of a large model is provided, comprising:

[0007] obtaining a public key of a target large model and a model encryption tool, and sending the model encryption tool and the public key to a third-party large model platform;

[0008] obtaining a ciphertext large model sent by the third-party large model platform and decryption-related information of the target large model;

[0009] obtaining a transparent file encryption and decryption agent of a user space file system (FUSE) corresponding to the third-party large model platform;

[0010] deploying the ciphertext large model, the decryption-related information, and the transparent file encryption and decryption agent of the FUSE in a cluster, and decrypting the ciphertext large model according to the decryption-related information through the transparent file encryption and decryption agent of the FUSE to obtain a plaintext of the target large model.

[0011] The present disclosure can realize a large model that provides rich scenes and high-quality capabilities, and comprehensively guarantees the security of the model file, ensuring that the large model meets the scene requirements while maintaining high efficiency, security and reliability.

[0012] According to another aspect of the present disclosure, a protection device of a large model is provided, comprising:

[0013] A first obtaining module is configured to obtain a public key and a model encryption tool of a target large model, and send the model encryption tool and the public key to a third-party large model platform;

[0014] A second obtaining module is configured to obtain a ciphertext large model sent by the third-party large model platform and decryption-related information of the target large model;

[0015] A third obtaining module is configured to obtain a transparent file encryption and decryption agent of a user space file system (FUSE) corresponding to the third-party large model platform;

[0016] A processing module is configured to deploy the ciphertext large model, the decryption-related information and the transparent file encryption and decryption agent of the FUSE in a cluster, and decrypt the ciphertext large model according to the decryption-related information through the transparent file encryption and decryption agent of the FUSE to obtain a plaintext of the target large model.

[0017] According to another aspect of the present disclosure, an electronic device is provided, comprising at least one processor, and

[0018] A memory in communication connection with the at least one processor; wherein

[0019] The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the protection method of the large model according to the first aspect of the present disclosure.

[0020] According to another aspect of the present disclosure, a non-transitory computer readable storage medium storing computer instructions is provided, wherein the computer instructions are used to enable a computer to perform the protection method of the large model according to the first aspect of the present disclosure.

[0021] According to another aspect of the present disclosure, a computer program product is provided, comprising a computer program, which, when executed by a processor, implements the steps of the protection method of the large model according to the first aspect of the present disclosure.

[0022] It should be understood that the contents described in this part are not intended to identify key or important features of the embodiments of the present disclosure, nor are they used to limit the scope of the present disclosure. Other features of the present disclosure will become apparent through the following description. BRIEF DESCRIPTION OF DRAWINGS

[0023] The accompanying drawings are used to better understand the present scheme and do not constitute a limitation on the present disclosure. Among them:

[0024] Figure 1 is a flow chart of a protection method of a large model according to an embodiment of the present disclosure;

[0025] Figure 2 is a flow chart of a protection method of a large model according to an embodiment of the present disclosure;

[0026] Figure 3 is a flow chart of a protection method of a large model according to an embodiment of the present disclosure;

[0027] Figure 4 is a schematic diagram of a protection method of a large model according to an embodiment of the present disclosure;

[0028] Figure 5 is a structural diagram of a protection device of a large model according to an embodiment of the present disclosure;

[0029] Figure 6 is a block diagram of an electronic device for implementing the method of the present disclosure. DETAILED DESCRIPTION

[0030] Exemplary embodiments of the present disclosure are described below with reference to the accompanying drawings, which include various details of the embodiments of the present disclosure to help understanding, and should be considered as merely exemplary. Therefore, those of ordinary skill in the art should recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of the present disclosure. Also, for the sake of clarity and conciseness, descriptions of well-known functions and structures are omitted in the following description.

[0031] Embodiments of the present disclosure relate to the technical field of data processing, artificial intelligence, etc.

[0032] Data processing: data is a form of expression of facts, concepts or instructions, which can be processed by artificial or automatic devices. After data is interpreted and given certain meaning, it becomes information. Data processing is the collection, storage, retrieval, processing, transformation and transmission of data. The basic purpose of data processing is to extract and deduce data that is valuable and meaningful to certain people from a large amount of data that may be chaotic and difficult to understand. Data processing is a basic link of system engineering and automatic control. Data processing runs through various fields of social production and social life. The development of data processing technology and its application breadth and depth greatly influence the process of human social development.

[0033] Artificial Intelligence, abbreviated as AI. It is a new technical science that studies, develops theories, methods, technologies and application systems for simulating, extending and expanding human intelligence.

[0034] Natural Language Processing (NLP) is an important direction in the field of computer science and artificial intelligence. It studies various theories and methods that can realize effective communication between people and computers using natural language. Natural Language Processing is a science that integrates linguistics, computer science and mathematics. Therefore, the research in this field will involve natural language, i.e. the language used in daily life, so it is closely related to the study of linguistics, but also has important differences. Natural Language Processing is not generally studying natural language, but developing computer systems, especially software systems, that can effectively implement natural language communication. Thus it is part of computer science. Natural Language Processing is mainly applied to machine translation, public opinion monitoring, automatic abstract, opinion extraction, text classification, question answering, text semantic comparison, speech recognition, Chinese optical character recognition OCR, etc.

[0035] The terms in the present disclosure are explained as follows:

[0036] Filesystem in Userspace (FUSE) is a module in the operating system kernel used to mount certain network spaces to the local file system.

[0037] The protection method of the large model and the device thereof of the present disclosure will be described below in conjunction with the accompanying drawings.

[0038] Figure 1 is a flowchart of the protection method of the large model according to an embodiment of the present disclosure, as Figure 1 shown, the method comprises the following steps:

[0039] S101, obtaining the public key and model encryption tool of the target large model, and sending the model encryption tool and the public key to the third-party large model platform.

[0040] In some embodiments, the model encryption tool and the public key can be requested using an application program API interface. Optionally, a preset number management platform key management interface can be called to request the model encryption tool and the public key. The number management platform complies with relevant laws and regulations and has the ability to provide large model authentication audit records.

[0041] In some embodiments, in order to improve data security, a model object can be created for the target large model according to model information of the target large model, a key library can be accessed through a key management interface, and a public key matched with the model object can be obtained from the key library. Optionally, the model information can include one or more of a model architecture, a use scenario, training data, version information, and usage restrictions.

[0042] In some embodiments, a model identifier of the target large model is obtained, and a model encryption tool used for encrypting the target large model is obtained from a pre-constructed encryption tool library according to the model identifier.

[0043] In some embodiments, a platform identifier of the third-party large model platform is obtained, and a model encryption tool used for encrypting the target large model is obtained from a pre-constructed encryption tool library according to the platform identifier.

[0044] In some embodiments, a platform identifier of the third-party large model platform and a model identifier of the target large model are obtained, and a model encryption tool used for encrypting the target large model is obtained from a pre-constructed encryption tool library according to the platform identifier and the model identifier.

[0045] S102, obtaining the ciphertext large model sent by the third-party large model platform and the decryption-related information of the target large model.

[0046] Optionally, in the embodiments of the present disclosure, the ciphertext large model refers to a machine learning model protected by encryption technology, the structure and parameters of which are stored and transmitted in the form of ciphertext. Such a model can enhance data privacy and security and prevent sensitive information from being leaked.

[0047] In the embodiments of the present disclosure, the ciphertext model is a ciphertext model obtained by encrypting a model in a private environment using a model encryption tool and a public key by a third-party large model platform. The private environment refers to the environment of the third-party large model platform itself, such as the development machine of the manufacturer, etc., which means that other model platforms do not participate in the encryption process of the ciphertext model.

[0048] In some embodiments, the decryption-related information of the ciphertext large model and the target large model can include one or more of an encryption algorithm, decryption process information, running environment information, error handling strategy, and application features.

[0049] The third-party large model platform provides the encrypted model and the AI application / image, that is, the third-party model platform provides the encrypted model in a manner not limited to, for example, a container image manner for sending through a network.

[0050] S103, obtaining a transparent file encryption and decryption agent of a user space file system FUSE corresponding to the third-party large model platform.

[0051] The transparent file encryption and decryption agent can provide zero-reform file encryption and decryption capabilities for artificial intelligence (AI) applications (large models) of a third large model platform. The large model platform uses an encrypted large model in circulation to protect its confidentiality.

[0052] The transparent encryption and decryption agent itself uses a keyless authentication mechanism, and does not require manual configuration of static passwords or credentials during operation, further reducing the risk of data leakage.

[0053] S104, deploying the ciphertext large model, decryption related information and transparent file encryption and decryption agent of FUSE in the cluster, and decrypting the ciphertext large model according to the decryption related information through the transparent file encryption and decryption agent of FUSE to obtain the plaintext of the target large model.

[0054] The ciphertext large model, decryption related information and transparent file encryption and decryption agent of FUSE are deployed in the preset cluster. After starting, the transparent file encryption and decryption agent of FUSE is used to decrypt the ciphertext large model according to the decryption related information such as application characteristics and running environment to obtain the plaintext of the target large model. Thus, business services can be provided based on the target large model.

[0055] For example, the preset cluster can be a preset container cluster.

[0056] In the embodiments of the present disclosure, the public key of the target large model and the model encryption tool are obtained, and the model encryption tool and the public key are sent to the third-party large model platform. The ciphertext large model and the decryption related information of the target large model sent by the third-party large model platform are obtained, the transparent file encryption and decryption agent of the user space file system (FUSE) corresponding to the third-party large model platform is obtained, the ciphertext large model, the decryption related information and the transparent file encryption and decryption agent of FUSE are deployed in the cluster, and the ciphertext large model is decrypted according to the decryption related information through the transparent file encryption and decryption agent of FUSE to obtain the plaintext of the target large model. This can provide a large model with rich scenarios and excellent capabilities, and comprehensively ensure the security of the model file, ensuring that the large model meets the scene requirements while maintaining high efficiency, security and reliability.

[0057] Figure 2 is a flowchart of a protection method of a large model according to an embodiment of the present disclosure, as shown in Figure 2 The method comprises the following steps:

[0058] S201, obtaining the public key of the target large model and the model encryption tool, and sending the model encryption tool and the public key to the third-party large model platform.

[0059] S202, obtaining the ciphertext large model and the decryption related information of the target large model sent by the third-party large model platform.

[0060] S203, obtaining a transparent file encryption and decryption agent of a user space file system FUSE corresponding to the third-party large model platform.

[0061] For the introduction of steps S201-S203, please refer to the related content in the above embodiments, which will not be repeated here.

[0062] S204, obtaining the first application feature of the target large model and the container cluster engine CCE running environment from the decryption related information.

[0063] In some embodiments, the decryption related information includes the first application feature of the target large model and the container cluster engine CCE running environment.

[0064] In some embodiments, the uniqueness of the file can be confirmed by a unique verification method such as file hash.

[0065] Optionally, the first application feature of the target large model can include the performance and functional characteristics of the target large model in certain tasks or fields, and in other embodiments, the first application feature can also include other characteristics, which are not limited by the present disclosure.

[0066] S205, registering the authentication account of the target large model according to the first application feature and the CCE running environment.

[0067] In some embodiments, based on the first application feature and the CCE running environment, determine the authentication verification information; obtain the input authentication account, and optionally, the authentication account is registered by the user on the number management platform through the authentication verification information, and in the embodiments of the present disclosure, the authentication account can be authenticated based on the authentication verification information to obtain the authentication result of the authentication account.

[0068] For example, the first application feature and the original factory application feature of the target large model can be matched, and the CCE running environment and the environment list can be matched, and in response to the first application feature matching the original factory application feature and the CCE running environment being the running environment in the environment list, the authentication result of the authentication account passing the authentication is obtained, the authentication check of the authentication account is completed, and the authentication result indicates that the authentication account passes the authentication, thereby it can be judged whether the target large model is in the authorized environment.

[0069] In some embodiments, if the first application feature does not match the original factory application feature, or the CCE running environment is not the running environment in the environment list, the authentication result of the authentication account passing the authentication is obtained, and the authentication result indicates that the authentication account does not pass the authentication, thereby it can be judged that the target large model is not in the authorized environment, and the transparent decryption capability will not be continued to be provided, and the whole tool chain will not be able to be used.

[0070] S206, in response to the authentication result indicating that the authentication account passes the authentication, configuring read-write permissions of the target large model for the authentication account.

[0071] In the embodiments of the present disclosure, different authentication accounts are assigned permissions to read and write specified model objects, and the read-write permissions limit the read-write operation permissions of the authentication account on the target large model.

[0072] In some embodiments, a read-write request for the target large model is received, the read-write request including an authentication account and a read-write operation on the target large model, the permission corresponding to the read-write operation is obtained, and if the permission of the read-write operation does not belong to the read-write permission configured for the authentication account, the read-write request is fed back with a read-write failure.

[0073] S207, deploying the ciphertext large model, the decryption related information and the transparent file encryption and decryption agent of the user space file system FUSE in the cluster, and decrypting the ciphertext large model according to the decryption related information through the transparent file encryption and decryption agent of the user space file system FUSE to obtain the plaintext of the target large model.

[0074] For the introduction of step S207, please refer to the related content in the above embodiments, which will not be repeated here.

[0075] In the embodiments of the present disclosure, in combination with the authentication capability of the data management platform, the FUSE transparent file encryption and decryption agent can also provide access control function of the ciphertext model, limit the transparent decryption of the original closed-source model in the authorized environment, protect the digital copyright of the third-party AI model, and in the unauthorized environment, the transparent decryption capability will not be provided, thereby protecting the security and reliability of the model file, avoiding the security risk of the large model, and reducing the risk of data leakage.

[0076] Figure 3 is a flowchart of a large model protection method according to an embodiment of the present disclosure, as shown in Figure 3 The method comprises the following steps:

[0077] S301, obtaining the public key of the target large model and the model encryption tool, and sending the model encryption tool and the public key to the third-party large model platform.

[0078] S302, obtaining the ciphertext large model and the decryption related information of the target large model sent by the third-party large model platform.

[0079] S303, obtaining the transparent file encryption and decryption agent of the user space file system FUSE corresponding to the third-party large model platform.

[0080] S304, deploying the ciphertext large model, the decryption related information, and the transparent file encryption and decryption agent of the FUSE in the cluster, and performing decryption on the ciphertext large model according to the decryption related information through the transparent file encryption and decryption agent of the FUSE to obtain the plaintext of the target large model.

[0081] The description of steps S301-S304 can refer to the related content in the above embodiments, which will not be repeated here.

[0082] S305, receiving an access call request of the target large model.

[0083] In some embodiments, the access call request of the target large model sent by the third-party large model platform is received.

[0084] In some embodiments, the access call request of the target large model sent by the third-party large model platform is received.

[0085] Optionally, the access call request also carries a second application feature for assisting in judging whether the access call request is a safe access call request.

[0086] S306, judging whether the access call request is a safe access call request.

[0087] In some embodiments, the target running environment of the sending device of the access call request, the source cluster of the access call request can be obtained based on the system command or the program interface, and then the access call request is parsed to obtain the second application feature carried in the access call request, and the target running environment, the source cluster, and the second application feature are used to judge whether the access call request is a safe access call request.

[0088] Optionally, in response to the target running environment being an authorized environment of the target large model, the source cluster being associated with the target cloud server, and the second application feature matching the original factory application feature of the target large model, it is determined that the access call request is a safe access call request.

[0089] In other embodiments, the target running environment is not an authorized environment of the target large model, or the source cluster is not associated with the target cloud server, or the second application feature does not match the original factory application feature of the target large model, it is determined that the access call request is not a safe access call request.

[0090] S307, in response to the access call request being a safe access call request, accessing the target large model through the transparent file encryption and decryption agent of the FUSE.

[0091] The description of step S307 can refer to the related content in the above embodiments, which will not be repeated here.

[0092] In the embodiments of the present disclosure, a series of security functions including transparent encryption, zero-trust authentication, process identity recognition, dynamic credentials, and behavior audit are added while providing the FUSE standard interface. The confidentiality of the large model is protected by using the encrypted large model in daily use and circulation.

[0093] Figure 4 FIG. 1 is a schematic diagram of a protection method for a large model according to an embodiment of the present disclosure, as shown in Figure 4 In the embodiments of the present disclosure, a set of special file systems can be implemented based on the FUSE interface protocol. A series of security functions including transparent encryption, zero-trust authentication, process identity recognition, dynamic credentials, and behavior audit are added while providing the FUSE standard interface. The transparent file encryption and decryption proxy can provide zero-reconstruction file encryption and decryption capabilities for AI applications of third-party objects. The large model platform (Docker is a set of platform as a service products. It packages software and its dependencies into containers based on operating system-level virtualization technology) uses the encrypted target large model in daily use and circulation, protects the confidentiality of the large model, and combines the authentication capability of the data management platform. The FUSE transparent file encryption and decryption proxy can also provide access control functions for the ciphertext model. Only the original factory program can transparently decrypt the original factory closed-source model in the specified cluster to obtain the plaintext (Data) of the target large model and store it in the preset node (such as the empty dir directory file), thereby protecting the digital copyright of the large model. The transparent encryption and decryption proxy has an environment verification mechanism. In an unauthorized environment, it will not provide transparent decryption capabilities. If in an authorized environment, an attacker attempts to use a non-original factory AI service to access a third-party large model, i.e., a target large model, through the transparent encryption and decryption proxy, the transparent encryption and decryption proxy has the capability to verify the characteristics of the access model subject program. If the AI application characteristics do not match those registered in the data management platform, the entire tool chain will also be unable to use. The transparent encryption and decryption proxy uses a keyless zero-trust authentication mechanism and does not need to manually configure static passwords or credentials during operation, further reducing the risk of data leakage.

[0094] Figure 5 FIG. 2 is a structural diagram of a large model protection device according to an embodiment of the present disclosure, as shown in Figure 5 The large model protection device 500 includes:

[0095] A first acquisition module 510 is configured to acquire a public key of a target large model and a model encryption tool, and send the model encryption tool and the public key to a third-party large model platform.

[0096] A second acquisition module 520 is configured to acquire a ciphertext large model sent by the third-party large model platform and decryption-related information of the target large model.

[0097] The third obtaining module 530 is configured to obtain a transparent file encryption and decryption agent of a user space file system (FUSE) corresponding to the third-party large model platform.

[0098] The processing module 540 is configured to deploy the ciphertext large model, the decryption-related information, and the transparent file encryption and decryption agent of the FUSE in the cluster, and perform decryption on the ciphertext large model according to the decryption-related information through the transparent file encryption and decryption agent of the FUSE to obtain the plaintext of the target large model.

[0099] In some embodiments, the first obtaining module 510 is further configured to:

[0100] create a model object for the target large model according to the model information of the target large model;

[0101] access the key library through the key management interface, and obtain the public key matched with the model object from the key library.

[0102] In some embodiments, the first obtaining module 510 is further configured to:

[0103] obtain the platform identifier of the third-party large model platform and / or the model identifier of the target large model;

[0104] obtain, from the pre-constructed encryption tool library, a model encryption tool used for encrypting the target large model according to the platform identifier and / or the model identifier.

[0105] In some embodiments, the processing module 540 is further configured to:

[0106] obtain the first application feature of the target large model and the container cluster engine (CCE) running environment from the decryption-related information;

[0107] register the authentication account of the target large model according to the first application feature and the CCE running environment.

[0108] In some embodiments, the processing module 540 is further configured to:

[0109] determine the authentication verification information based on the first application feature and the CCE running environment;

[0110] obtain the input authentication account;

[0111] authenticate the authentication account based on the authentication verification information to obtain an authentication result of the authentication account.

[0112] In some embodiments, the processing module 540 is further configured to:

[0113] match the first application feature with the original factory application feature of the target large model;

[0114] matching the CCE running environment and the environment list;

[0115] In response to the first application feature matching the original application feature and the CCE running environment being a running environment in the environment list, obtaining an authentication result that the authentication account passes authentication.

[0116] In some embodiments, the processing module 540 is further configured to:

[0117] In response to the authentication result indicating that the authentication account passes authentication, deploying the ciphertext large model, the decryption related information, and the transparent file encryption and decryption agent of the FUSE in the cluster.

[0118] In some embodiments, the processing module 540 is further configured to:

[0119] In response to the authentication result indicating that the authentication account passes authentication, configuring read-write permissions of the target large model for the authentication account.

[0120] In some embodiments, the processing module 540 is further configured to:

[0121] Receiving a read-write request for the target large model, the read-write request including an authentication account and a read-write operation on the target large model;

[0122] Obtaining permissions corresponding to the read-write operation;

[0123] If the permissions of the read-write operation do not belong to the read-write permissions configured for the authentication account, feeding back a read-write failure to the read-write request.

[0124] In some embodiments, the processing module 540 is further configured to:

[0125] Receiving an access call request for the target large model;

[0126] Determining whether the access call request is a secure access call request;

[0127] In response to the access call request being a secure access call request, accessing the target large model through the transparent file encryption and decryption agent of the FUSE.

[0128] In some embodiments, the processing module 540 is further configured to:

[0129] Determining a target running environment in which a sending device of the access call request is currently located;

[0130] Determining a source cluster of the access call request;

[0131] Obtaining a second application feature carried in the access call request;

[0132] According to the target running environment, the source cluster, and the second application feature, determining whether the access call request is a secure access call request.

[0133] In some embodiments, the processing module 540 is further configured to:

[0134] In response to the target running environment being an authorized environment of the target large model, the source cluster being associated with the target cloud server, and the second application feature matching an original factory application feature of the target large model, it is determined that the access call request is a secure access call request.

[0135] The present disclosure can provide a large model with rich scenarios and high-quality capabilities, and comprehensively ensure the security of the model file, so as to ensure that the large model meets the scenario requirements while maintaining high efficiency, security and reliability.

[0136] In the technical solutions of the present disclosure, the acquisition, transmission, storage, use, processing, etc. of data comply with relevant provisions of national laws and regulations, and do not violate public order and good customs. It should be noted that in the embodiments of the present disclosure, some existing industry solutions may be mentioned, such as software, components, models, etc. They should be considered as exemplary, and the purpose is only to illustrate the feasibility of the technical solution implementation of the present application, but it does not mean that the applicant has or will necessarily use the solution.

[0137] According to the embodiments of the present disclosure, the present disclosure further provides an electronic device, a readable storage medium and a computer program product.

[0138] Figure 6 is a block diagram of an electronic device for implementing the embodiments of the present disclosure. The electronic device can implement the large model protection method of the embodiments of the present disclosure, and the electronic device is intended to represent various forms of digital computers, such as laptops, desktops, workstations, personal digital assistants, servers, blade servers, mainframes, and other appropriate computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular telephones, smart phones, wearable devices, and other similar computing devices. The components, their connections, and their functions as shown in the figures, and their functions, are merely examples and are not intended to limit implementations of the present disclosure described and / or claimed herein.

[0139] As shown in Figure 6 The device 600 includes a computing unit 601 that can perform various appropriate actions and processes in accordance with a computer program stored in a read-only memory (ROM) 602 or a computer program loaded from a storage unit 608 into a random access memory (RAM) 603. In the RAM 603, various programs and data required for the operation of the device 600 can also be stored. The computing unit 601, the ROM 602, and the RAM 603 are connected to each other through a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0140] A plurality of components in the device 600 are connected to the I / O interface 605, including: an input unit 606, such as a keyboard, a mouse, etc.; an output unit 607, such as various types of displays, speakers, etc.; a storage unit 608, such as a magnetic disk, an optical disk, etc.; and a communication unit 609, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 609 allows the device 600 to exchange information / data with other devices through a computer network, such as the Internet, and / or various telecommunication networks.

[0141] The computing unit 601 can be various general and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 601 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The computing unit 601 performs various methods and processes described above, such as the protection method of a large model. For example, in some embodiments, the protection method of a large model can be implemented as a computer software program, which is tangibly embodied in a machine-readable medium, such as the storage unit 608. In some embodiments, part or all of the computer program can be loaded and / or installed on the device 600 via the ROM 602 and / or the communication unit 609. When the computer program is loaded into the RAM 603 and executed by the computing unit 601, one or more steps of the protection method of a large model described above can be performed. Alternatively, in other embodiments, the computing unit 601 can be configured to perform the protection method of a large model by any other appropriate means, such as by means of firmware.

[0142] Various implementations of the systems and techniques described above herein can be realized in digital electronic circuitry, integrated circuitry, a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), a system on a chip (SOC), a programmable logic device (CPLD), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include implementation in one or more computer programs that are executable and / or interpretable on a programmable system including at least one programmable processor, which can be special or general purpose, coupled to receive data and instructions from, and to transmit data and instructions to, a storage system, at least one input device, and at least one output device.

[0143] Program code for carrying out methods of the present disclosure can be written in any combination of one or more programming languages. The program code can be provided to a processor or controller of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the program code, when executed by the processor or controller, produces the functions / operations specified in the flowcharts and / or block diagrams. The program code can be executed entirely on a machine, partially on a machine, partially on a machine and partially on a remote machine or entirely on a remote machine or server.

[0144] In the context of the present disclosure, a machine-readable medium can be a tangible medium that contains or stores a program for use by or in connection with an instruction execution system, apparatus, or device. The machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can include but is not limited to an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of the machine-readable storage medium will include one or more lines of electrical connections, portable computer disks, hard disk drives, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or Flash memory), optical fibers, portable compact disc read-only memories (CD-ROMs), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0145] To provide for interaction with a target object, the systems and techniques described here can be implemented on a computer having a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the target object and a keyboard and a pointing device (e.g., a mouse or a trackball) by which the target object can provide input to the computer. Other kinds of devices can be used to provide for interaction with a target object; for example, feedback provided to the target object can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the target object can be received in any form, including acoustic, speech, or tactile input.

[0146] The systems and techniques described here can be implemented in a computing system that includes a back end component (e.g., as a data server), or that includes a middleware component (e.g., an application server), or that includes a front end component (e.g., a client computer having a graphical user interface or a Web browser through which a user can interact with an implementation of the systems and techniques described here), or any combination of such back end, middleware, or front end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network (LAN), a wide area network (WAN), and the Internet.

[0147] The computer system can include clients and servers. This relationship can be. The servers are typically remote from the clients with the interactions between them occurring over a communication network. The relationship between a client and a server is one of client-server. The server can be a cloud server, a server of a distributed system, or a server incorporating a blockchain.

[0148] It should be understood that the various forms of flow shown above can be re-ordered, added to, or deleted from without departing from the scope of the present disclosure. For example, the steps recited in the present disclosure can be performed in parallel, in series, or in a different order, as long as the desired results of the technology disclosed in the present disclosure are achieved, and the present disclosure is not limited herein.

[0149] The specific embodiments described above are not intended to be limiting, and persons skilled in the art will appreciate that various modifications, combinations, sub-combinations and alternatives can be made to the specific embodiments without departing from the spirit and principles of the present disclosure. Accordingly, the disclosure is not limited to the specific embodiments described above.

Claims

1. A method of protecting a large model, wherein, The method comprises: obtaining the public key of the target large model and the model encryption tool, and sending the model encryption tool and the public key to the third-party large model platform; obtaining the ciphertext large model sent by the third-party large model platform and the decryption related information of the target large model; obtaining the transparent file encryption and decryption agent of the user space file system FUSE corresponding to the third-party large model platform; deploying the ciphertext large model, the decryption related information and the transparent file encryption and decryption agent of the FUSE in the cluster, and decrypting the ciphertext large model according to the decryption related information through the transparent file encryption and decryption agent of the FUSE to obtain the plaintext of the target large model; Before deploying the ciphertext large model, the decryption related information and the transparent file encryption and decryption agent of the FUSE in the cluster, the method further comprises: obtaining the first application feature and the container cluster engine CCE running environment of the target large model from the decryption related information; registering the authentication account of the target large model according to the first application feature and the CCE running environment.

2. The method of claim 1, wherein, The process of obtaining the public key of the target large model comprises: creating a model object for the target large model according to the model information of the target large model; accessing the key library through the key management interface, and obtaining the public key matched with the model object from the key library.

3. The method of claim 1, wherein, The process of obtaining the model encryption tool of the target large model comprises: obtaining the platform identifier of the third-party large model platform and / or the model identifier of the target large model; obtaining the model encryption tool for encrypting the target large model from the pre-constructed encryption tool library according to the platform identifier and / or the model identifier.

4. The method of claim 1, wherein, The registration of the authentication account of the target large model according to the application feature and the CCE running environment comprises: determining the authentication verification information based on the first application feature and the CCE running environment; obtaining the input authentication account; authenticating the authentication account based on the authentication verification information to obtain the authentication result of the authentication account.

5. The method of claim 1, wherein, The authentication of the authentication account based on the authentication verification information to obtain the authentication result of the authentication account comprises: matching the first application feature with the original factory application feature of the target large model; matching the CCE running environment with the environment list; in response to the first application feature matching the original factory application feature and the CCE running environment being the running environment in the environment list, obtaining the authentication result that the authentication account passes the authentication.

6. The method of claim 4, wherein, Deploying the ciphertext large model, the decryption related information and the transparent file encryption and decryption agent of the FUSE in the cluster comprises: in response to the authentication result indicating that the authentication account passes the authentication, deploying the ciphertext large model, the decryption related information and the transparent file encryption and decryption agent of the FUSE in the cluster.

7. The method of claim 4, wherein, After receiving the authentication result fed back by the data management platform based on the authentication registration request, the method further comprises: in response to the authentication result indicating that the authentication account passes the authentication, configuring the read-write permission of the target large model for the authentication account.

8. The method of claim 7, wherein, The method further includes, after configuring the target large model with read-write permissions of the authentication account: receiving a read-write request for the target large model, the read-write request including the authentication account and a read-write operation for the target large model; obtaining a permission corresponding to the read-write operation; if the permission of the read-write operation does not belong to the read-write permission configured for the authentication account, feeding back a read-write failure to the read-write request.

9. The method of any one of claims 1-8, wherein, The method further includes, after obtaining the plaintext of the target large model: receiving an access call request for the target large model; determining whether the access call request is a secure access call request; in response to the access call request being a secure access call request, accessing the target large model through a transparent file encryption and decryption agent of the FUSE.

10. The method of claim 9, wherein, The method further includes: determining a target running environment in which a sending device of the access call request currently locates; determining a source cluster of the access call request; obtaining a second application feature carried in the access call request; determining whether the access call request is a secure access call request according to the target running environment, the source cluster and the second application feature.

11. The method of claim 10, wherein, The method further includes: in response to the target running environment being an authorized environment of the target large model, the source cluster being associated with a target cloud server, and the second application feature matching an original factory application feature of the target large model, determining that the access call request is a secure access call request.

12. A protection apparatus of a large model, wherein, The apparatus includes: a first obtaining module configured to obtain a public key of a target large model and a model encryption tool, and send the model encryption tool and the public key to a third-party large model platform; a second obtaining module configured to obtain a ciphertext large model and decryption-related information of the target large model sent by the third-party large model platform; a third obtaining module configured to obtain a transparent file encryption and decryption agent of a user space file system (FUSE) corresponding to the third-party large model platform; a processing module configured to deploy the ciphertext large model, the decryption-related information and the transparent file encryption and decryption agent of the FUSE in a cluster, and decrypt the ciphertext large model according to the decryption-related information through the transparent file encryption and decryption agent of the FUSE to obtain a plaintext of the target large model; the processing module is further configured to: obtain a first application feature and a container cluster engine (CCE) running environment of the target large model from the decryption-related information; and register an authentication account of the target large model according to the first application feature and the CCE running environment.

13. The apparatus of claim 12, wherein, The first obtaining module is further configured to: create a model object for the target large model according to model information of the target large model; and access a key library through a key management interface, and obtain a public key matched with the model object from the key library.

14. The apparatus of claim 12, wherein, The first obtaining module is further configured to: obtain a platform identifier of the third-party large model platform and / or a model identifier of the target large model. According to the platform identifier and / or the model identifier, a model encryption tool for encrypting the target large model is obtained from a pre-constructed encryption tool library.

15. The apparatus of claim 12, wherein, The processing module is further configured to: determine authentication verification information based on the first application feature and the CCE running environment; obtain an input authentication account; authenticate the authentication account based on the authentication verification information to obtain an authentication result of the authentication account.

16. The apparatus of claim 12, wherein, The processing module is further configured to: match the first application feature with a factory application feature of the target large model; match the CCE running environment with an environment list; in response to the first application feature matching the factory application feature and the CCE running environment being a running environment in the environment list, obtain an authentication result indicating that the authentication account passes authentication.

17. The apparatus of claim 15, wherein, The processing module is further configured to: in response to the authentication result indicating that the authentication account passes authentication, deploy the ciphertext large model, the decryption-related information, and the transparent file encryption and decryption proxy of the FUSE in a cluster.

18. The apparatus of claim 15, wherein, The processing module is further configured to: in response to the authentication result indicating that the authentication account passes authentication, configure read-write permissions of the target large model for the authentication account.

19. The apparatus of claim 18, wherein, The processing module is further configured to: receive a read-write request for the target large model, the read-write request including the authentication account and a read-write operation on the target large model; obtain a permission corresponding to the read-write operation; if the permission of the read-write operation does not belong to the read-write permissions configured for the authentication account, feed back a read-write failure to the read-write request.

20. The apparatus of any one of claims 12-19, wherein, The processing module is further configured to: receive an access call request for the target large model; determine whether the access call request is a secure access call request; in response to the access call request being a secure access call request, access the target large model through the transparent file encryption and decryption proxy of the FUSE.

21. The apparatus of claim 20, wherein, The processing module is further configured to: determine a target running environment in which a sending device of the access call request currently resides; determine a source cluster of the access call request; obtain a second application feature carried in the access call request; determine whether the access call request is a secure access call request according to the target running environment, the source cluster, and the second application feature.

22. The apparatus of claim 21, wherein, The processing module is further configured to: in response to the target running environment being an authorized environment of the target large model, the source cluster being associated with a target cloud server, and the second application feature matching a factory application feature of the target large model, determine that the access call request is a secure access call request.

23. An electronic device, comprising: at least one processor; and a memory connected to the at least one processor in communication; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method of any one of claims 1-11.

24. A non-transitory computer readable storage medium having stored thereon computer instructions, wherein, The computer instructions are used to enable the computer to perform the method of any one of claims 1-11. The computer instructions are used to enable the computer to perform the method of any one of claims 1-11.

25. A computer program product comprising a computer program which, when executed by a processor, implements the steps of the method according to any one of claims 1-11.

Images