Model encryption method, model decryption method, model encryption device, model decryption device and electronic equipment

Abstract

The invention provides a model encryption method and device, a model decryption method and device and electronic equipment, and relates to the technical field of data security, and the method comprises the steps: obtaining a target to-be-protected layer of a target model and model parameters of the target model, and obtaining a root private key of a target trusted execution environment; generating a target public key of the target to-be-protected layer based on the root private key and the model parameters; and encrypting the target to-be-protected layer based on the target public key. Therefore, the target public key for encrypting the target to-be-protected layer is generated through the root private key of the target trusted execution environment, and it can be ensured that the encrypted model can only run in the target trusted execution environment, so that privacy protection of the model is achieved, and the purpose of the out-of-domain model is controllable; and the model cannot be restored in an unsafe plaintext environment.

Description

Technical Field

[0001] The present disclosure relates to the field of data security technology, and in particular to a model encryption and model decryption method, device and electronic device. Background Art

[0002] With the continuous development of artificial intelligence, models based on deep learning training are becoming more and more widely used. Once the model is leaked, the core technology will be exposed. Therefore, how to encrypt the model has received more and more attention. Summary of the invention

[0003] The present disclosure aims to solve one of the technical problems in the related art at least to some extent.

[0004] To this end, the first objective of the present disclosure is to propose a model encryption method.

[0005] The second objective of the present disclosure is to propose a model decryption method.

[0006] The third objective of the present disclosure is to provide a model encryption device.

[0007] The fourth objective of the present disclosure is to provide a model decryption device.

[0008] A fifth objective of the present disclosure is to provide an electronic device.

[0009] A sixth object of the present disclosure is to provide a non-transitory computer-readable storage medium.

[0010] A seventh objective of the present disclosure is to provide a computer program product.

[0011] To achieve the above-mentioned purpose, the first aspect of the present disclosure proposes a model encryption method, including: obtaining a target layer to be protected of a target model and model parameters of the target model, and obtaining a root private key of a target trusted execution environment; generating a target public key of the target layer to be protected based on the root private key and the model parameters; and encrypting the target layer to be protected based on the target public key.

[0012] According to one embodiment of the present disclosure, generating the target public key of the target layer to be protected based on the root private key and the model parameters includes: generating the target private key of the target layer to be protected based on the root private key and the model parameters; generating the target public key based on the target private key.

[0013] According to one embodiment of the present disclosure, generating the target private key of the target layer to be protected based on the root private key and the model parameters includes: generating a model fingerprint based on the model parameters; generating the target private key based on the model fingerprint, the root private key and a random number.

[0014] According to one embodiment of the present disclosure, the method further includes: generating a signature of the target public key based on the target public key, the root private key and the model fingerprint.

[0015] To achieve the above-mentioned purpose, the second aspect embodiment of the present disclosure proposes a model decryption method, comprising: obtaining a target to-be-protected layer of the target model that has been encrypted, wherein the target to-be-protected layer is encrypted by the model encryption method as described in the first aspect embodiment; placing the target to-be-protected layer into a target trusted execution environment; and decrypting the target to-be-protected layer by using a target private key in the target trusted execution environment.

[0016] According to one embodiment of the present disclosure, before decrypting the target layer to be protected by the target private key in the target trusted execution environment, it includes: obtaining the signature of the target public key of the target layer to be protected and the root private key of the target trusted execution environment; performing identification and verification based on the signature of the target public key, the model parameters of the target model and the root public key; and the identification and verification is successful.

[0017] According to an embodiment of the present disclosure, the method further includes: in response to identification verification failure; stopping decryption of the target layer to be protected.

[0018] To achieve the above-mentioned purpose, the third aspect of the present disclosure proposes a model encryption device, including: an acquisition module, used to obtain the target layer to be protected of the target model and the model parameters of the target model, and obtain the root private key of the target trusted execution environment; a generation module, used to generate the target public key of the target layer to be protected based on the root private key and the model parameters; an encryption module, used to encrypt the target layer to be protected based on the target public key.

[0019] To achieve the above-mentioned purpose, the fourth aspect of the present disclosure proposes a model encryption device, including: a receiving module, used to obtain a target to-be-protected layer of the target model that has been encrypted, wherein the target to-be-protected layer is encrypted by the model encryption method as described in the first aspect of the embodiment; an placement module, used to place the target to-be-protected layer into a target trusted execution environment; and a decryption module, used to decrypt the target to-be-protected layer by using a target private key in the target trusted execution environment.

[0020] To achieve the above-mentioned purpose, the fifth aspect embodiment of the present disclosure proposes an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to implement the model encryption method as described in the first aspect embodiment of the present disclosure, or the model decryption method as described in the second aspect embodiment.

[0021] To achieve the above-mentioned purpose, the sixth aspect embodiment of the present disclosure proposes a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to implement the model encryption method as described in the first aspect embodiment of the present disclosure, or the model decryption method as described in the second aspect embodiment.

[0022] To achieve the above-mentioned purpose, the seventh aspect embodiment of the present disclosure proposes a computer program product, including a computer program, which, when executed by a processor, is used to implement the model encryption method as described in the first aspect embodiment of the present disclosure, or the model decryption method as described in the second aspect embodiment.

[0023] Therefore, by generating the target public key for encrypting the target protected layer through the root private key of the target trusted execution environment, it can be ensured that the encrypted model can only be run in the target trusted execution environment, thereby achieving privacy protection of the model, making the use of the out-of-domain model controllable, and ensuring that the model cannot be restored in an insecure plaintext environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 is a schematic diagram of a model encryption method according to an embodiment of the present disclosure;

[0025] Figure 2 is a schematic diagram of a model structure of one embodiment of the present disclosure;

[0026] Figure 3 is a schematic diagram of another model encryption method according to an embodiment of the present disclosure;

[0027] Figure 4 is a schematic diagram of a model decryption method according to an embodiment of the present disclosure;

[0028] Figure 5 is a schematic diagram of a model encryption device according to one embodiment of the present disclosure;

[0029] Figure 6 is a schematic diagram of a model decryption device according to one embodiment of the present disclosure;

[0030] Figure 7 is a schematic diagram of an electronic device according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0031] Embodiments of the present disclosure are described in detail below, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present disclosure, and should not be construed as limiting the present disclosure.

[0032] The acquisition, storage, use, and processing of data in the technical solution disclosed in this disclosure are in compliance with the relevant provisions of relevant laws and regulations.

[0033] It should be noted that in the embodiments of the present application, certain software, components, models and other existing solutions in the industry may be mentioned, and they should be considered as exemplary. Their purpose is only to illustrate the feasibility of implementing the technical solution of the present application, but it does not mean that the applicant has or will necessarily use the solution.

[0034] Figure 1 is a schematic diagram of a model encryption method according to an embodiment of the present disclosure. Figure 1 As shown, the model encryption method includes the following steps:

[0035] S101, obtaining a target to-be-protected layer of a target model and model parameters of the target model, and obtaining a root private key of a target trusted execution environment.

[0036] It should be noted that the target model in the embodiment of the present disclosure can be multiple, and no limitation is made here. For example, the target model can be a pre-trained mathematical model, or a communication model, for example, a long range (LongRange, LoRa) module.

[0037] The model encryption method of the embodiment of the present application can be applied to the scenario of encrypting the developed model. The executor of the model encryption of the embodiment of the present application can be the model encryption device of the embodiment of the present application, and the model encryption device can be set on an electronic device.

[0038] It should be noted that Trusted Execution Environment (TEE) is a technology used in modern computing devices to provide a secure environment that allows trusted applications to run securely on the device. TEE protects key security functions such as encryption key storage, secure boot process, execution of secure code, and processing of sensitive data through hardware isolation. This environment can resist attacks from the operating system or user space software, ensuring that the data and behavior of applications or services running in it cannot be snooped or manipulated by outsiders.

[0039] It should be noted that there can be many types of TEE, without any limitation here. For example, it can be ARM's TrustZone, Intel's Software Guard Extensions (SGX), AMD's Secure Encrypted Virtualization (SEV), etc.

[0040] It should be noted that the root private key is a key generated and strictly protected inside the TEE. It should never leave the secure area, usually part of the TEE, such as the sealed feature of Intel SGX or the secure world of ARM TrustZone. This private key is the root of trust of the TEE and is used to create signatures and encrypt data. Due to its importance, the root private key has a very high level of protection to prevent leakage and abuse.

[0041] In the embodiments of the present disclosure, the model parameters may include a variety of data, which are not limited herein. In order to subsequently authenticate the model, the model parameters at least include data that can identify the model, for example, the model's identification, number or interface.

[0042] It should be noted that the layers of a model refer to the basic components that make up a neural network. Each layer performs a specific computing task, and the structure of a deep neural network is formed through the connection between layers. The inventors have found that only the specified layers need to be encrypted to achieve the purpose of protecting the entire model.

[0043] It should be noted that the target to-be-protected layers may be multiple or one, and the specific encrypted layers and the number of encrypted layers may be set according to actual design requirements, and are not limited here.

[0044] S102, generating a target public key of a target layer to be protected based on a root private key and model parameters.

[0045] In the disclosed embodiment, since the root private key is part of the TEE, the target public key generated by the root private key and the model parameters cannot be decrypted outside the TEE after the target layer to be protected is encrypted. In this way, it can be ensured that the target layer to be protected can only have normal functions in the TEE environment.

[0046] S103: Encrypt the target layer to be protected based on the target public key.

[0047] It should be noted that if Figure 2 As shown, after the target to-be-protected layer is encrypted based on the target public key, the target to-be-protected layer can only realize the original function in the target trusted execution environment. The other layers of the target model can be placed in a plaintext computing environment. The plaintext computing environment can be multiple, and no limitation is made here. For example, the plaintext computing environment can be a graphics processing unit (GPU), a tensor processing unit (TPU), and a neural network processor (NPU).

[0048] In the disclosed embodiment, the target to-be-protected layer of the target model and the model parameters of the target model are first obtained, and the root private key of the target trusted execution environment is obtained. Then, the target public key of the target to-be-protected layer is generated based on the root private key and the model parameters, and finally, the target to-be-protected layer is encrypted based on the target public key. Thus, by generating the target public key for encrypting the target to-be-protected layer through the root private key of the target trusted execution environment, it can be ensured that the encrypted model can only be run in the target trusted execution environment, thereby realizing the privacy protection of the model, making the use of the out-of-domain model controllable, and ensuring that the model cannot be restored in an insecure plaintext environment.

[0049] It should be noted that high-speed networks such as InfiniBand (IB) and RDMA over Converged Ethernet (RoCE) are generally used between plaintext and ciphertext environments. Ordinary Ethernet can also be used. Since model iteration requires continuous transmission of a large number of intermediate states between plaintext and ciphertext environments, the performance of Ethernet is slightly affected.

[0050] In the above embodiment, the target public key of the target layer to be protected is generated based on the root private key and the model parameters, and the target public key of the target layer to be protected can also be generated by Figure 3 Explaining further, the method includes:

[0051] S301, generating a target private key of a target layer to be protected based on a root private key and model parameters.

[0052] In the disclosed embodiment, a model fingerprint may be first generated based on the model parameters, and then a target private key may be generated based on the model fingerprint, the root private key and a random number.

[0053] It should be noted that the model fingerprint is an identifier that can identify whether the model is a specified model. Different models have different model fingerprints.

[0054] In the embodiments of the present disclosure, there may be multiple methods for generating model fingerprints based on model parameters, which are not limited here.

[0055] Optionally, the model parameters can be calculated by a model fingerprint algorithm to generate a model fingerprint. The model fingerprint algorithm is designed in advance and can be changed according to actual design needs, and no limitation is made here. For example, the model fingerprint algorithm can be a hash algorithm SM3:

[0056] Mode l Hash=SM3(Mode l L l ama2-7B-Crypt)

[0057] Among them, Mode l Hash is the model fingerprint, and Mode l L l ama2-7B-Crypt is the model parameter.

[0058] Optionally, the model parameters may be input into a model fingerprint generation model to generate a model fingerprint. The model fingerprint generation model is trained in advance and stored in a storage space of the electronic device to facilitate retrieval and use when needed.

[0059] In the disclosed embodiment, the model fingerprint, the root private key and the random number may be calculated by a hash algorithm to obtain the generated target private key:

[0060] Mode l SK=SM3(Mode l Hash,RSK,Nonce)

[0061] Among them, Mode l SK is the target private key, Mode l Hash is the model fingerprint, and Nonce is a random number.

[0062] S302, generating a target public key based on the target private key.

[0063] In the embodiment of the present disclosure, the target private key may be calculated by a hash algorithm to generate a target public key. For example, the hash algorithm may be as follows:

[0064] Mode l PK=SM2_GetPK (Mode l SK)

[0065] Among them, Mode l PK is the target public key, and Mode l SK is the target public key.

[0066] In one possible implementation, when generating a target private key, the operation time, number of cycles, etc. of the model can also be added according to actual operation requirements. Therefore, when the model is decrypted by the target private key, the operating parameters such as the running time and number of cycles of the target model can also be controlled. When the running time and number of cycles of the target model reach the set value, the operation of the target model is stopped.

[0067] Figure 4 is a schematic diagram of a model encryption method according to an embodiment of the present disclosure. Figure 1 As shown, the model encryption method includes the following steps:

[0068] S401, obtaining the encrypted target layer to be protected of the target model.

[0069] It should be noted that the target layer to be protected in the embodiment of the present disclosure is obtained by Figure 1-Figure 3 The model encryption method shown is encrypted.

[0070] S402, placing the target layer to be protected into the target trusted execution environment.

[0071] It should be noted that the target trusted execution environment in the embodiment of the present disclosure is as follows: Figure 1-Figure 3 The target trusted execution environment shown in the model encryption method shown.

[0072] S403: Decrypt the target to-be-protected layer using the target private key in the target trusted execution environment.

[0073] It should be noted that before decryption, the credibility of the target public key needs to be verified.

[0074] In the embodiment of the present disclosure, before decrypting the target layer to be protected by using the target private key in the target trusted execution environment, it is also necessary to obtain the signature of the target public key of the target layer to be protected and the root private key of the target trusted execution environment, and then perform identification and verification based on the signature of the target public key, the model parameters of the target model and the root public key. The target layer to be protected can only be decrypted if the identification and verification is successful.

[0075] In another possible implementation, if the identification verification fails, decryption of the target layer to be protected is stopped, thereby further improving the security of model decryption.

[0076] It should be noted that there are many methods for identification and verification, which are not limited here. In one possible implementation, the signature of the target public key, the model parameters of the target model, and the root public key can be processed by an identification and verification algorithm to perform identification and verification. For example, the identification and verification algorithm can be as follows:

[0077] Si gnature=SM2_Si gn(Mode l Hash|Mode l PK,RSK)

[0078] Among them, Signature is the identification verification value, SM2_Sign is the hash algorithm, Mode l Hash is the model fingerprint, Mode l PK is the target public key, and RSK is the root private key.

[0079] In the disclosed embodiment, the target to-be-protected layer of the target model that has been encrypted is first obtained, and then the target to-be-protected layer is placed in the target trusted execution environment, and finally the target to-be-protected layer is decrypted by the target private key in the target trusted execution environment. Figure 1-Figure 3 The target model encrypted by the model encryption method shown is decrypted in the target trusted execution environment, which can ensure that the encrypted model can only be run in the target trusted execution environment, thereby achieving privacy protection of the model, making the use of the out-of-domain model controllable, and ensuring that the model cannot be restored in an insecure plaintext environment.

[0080] Corresponding to the model encryption methods provided in the above-mentioned embodiments, an embodiment of the present disclosure further provides a model encryption device. Since the model encryption device provided in the embodiment of the present disclosure corresponds to the model encryption methods provided in the above-mentioned embodiments, the implementation methods of the above-mentioned model encryption methods are also applicable to the model encryption device provided in the embodiment of the present disclosure and will not be described in detail in the following embodiments.

[0081] Figure 5 is a schematic diagram of a model encryption device according to an embodiment of the present disclosure. Figure 5 As shown, the model encryption device 500 includes: an acquisition module 510, a generation module 520 and an encryption module 530.

[0082] The acquisition module 510 is used to acquire the target to-be-protected layer of the target model and the model parameters of the target model, and to acquire the root private key of the target trusted execution environment.

[0083] The generation module 520 is used to generate a target public key of a target layer to be protected based on a root private key and model parameters.

[0084] The encryption module 530 is used to encrypt the target to-be-protected layer based on the target public key.

[0085] In the disclosed embodiment, the generation module 520 is further used to: generate a target private key of a target layer to be protected based on a root private key and model parameters; and generate a target public key based on the target private key.

[0086] In the disclosed embodiment, the generation module 520 is further used to: generate a model fingerprint based on the model parameters; and generate a target private key based on the model fingerprint, the root private key and the random number.

[0087] In the disclosed embodiment, the generation module 520 is further used to generate a signature of the target public key based on the target public key, the root private key and the model fingerprint.

[0088] Therefore, by generating the target public key for encrypting the target protected layer through the root private key of the target trusted execution environment, it can be ensured that the encrypted model can only be run in the target trusted execution environment, thereby achieving privacy protection of the model, making the use of the out-of-domain model controllable, and ensuring that the model cannot be restored in an insecure plaintext environment.

[0089] Corresponding to the model decryption methods provided in the above-mentioned embodiments, an embodiment of the present disclosure further provides a model decryption device. Since the model decryption device provided in the embodiment of the present disclosure corresponds to the model decryption methods provided in the above-mentioned embodiments, the implementation methods of the above-mentioned model decryption methods are also applicable to the model decryption device provided in the embodiment of the present disclosure, and will not be described in detail in the following embodiments.

[0090] Figure 6 is a schematic diagram of a model decryption device according to an embodiment of the present disclosure. Figure 6 As shown, the model decryption device 600 includes: a receiving module 610, an inserting module 620 and a decryption module 630.

[0091] The receiving module 610 is used to obtain the encrypted target layer to be protected of the target model.

[0092] It should be noted that the target layer to be protected in the embodiment of the present disclosure is obtained by Figure 1-Figure 3 The model encryption method shown is encrypted.

[0093] An embedding module 620, used to embed the target layer to be protected into the target trusted execution environment;

[0094] The decryption module 630 is used to decrypt the target to-be-protected layer using the target private key in the target trusted execution environment.

[0095] In the disclosed embodiment, the decryption module 630 is also used to: obtain the signature of the target public key of the target layer to be protected and the root private key of the target trusted execution environment; perform identification verification based on the signature of the target public key, the model parameters of the target model and the root public key; and the identification verification is successful.

[0096] In an embodiment of the present disclosure, in response to the identification verification failure, decryption of the target to-be-protected layer is stopped.

[0097] In order to implement the above embodiment, the present disclosure further provides an electronic device 700, Figure 7 is a schematic diagram of an electronic device according to an embodiment of the present disclosure, such as Figure 7 As shown, the electronic device 700 includes: a processor 701 and a memory 702 that is communicatively connected to the processor, the memory 702 stores instructions that can be executed by at least one processor, and the instructions are executed by at least one processor 701 to implement the present disclosure. Figure 1-Figure 3 The model encryption method of the embodiment, or Figure 4 A model decryption method according to an embodiment.

[0098] In order to implement the above embodiments, the present disclosure also provides a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to enable the computer to implement the above embodiments. Figure 1-Figure 3 The model encryption method of the embodiment, or Figure 4 A model decryption method according to an embodiment.

[0099] In order to implement the above embodiments, the present disclosure also provides a computer program product, including a computer program. When the computer program is executed by a processor, the computer program implements the above embodiments. Figure 1-Figure 3 The model encryption method of the embodiment, or Figure 4 A model decryption method according to an embodiment.

[0100] It should be noted that personal information from users should be collected for legitimate and reasonable purposes and should not be shared or sold outside of these legitimate uses. In addition, such collection / sharing should be carried out after receiving the user's informed consent, including but not limited to notifying the user to read the user agreement / user notice and sign the agreement / authorization including authorization of relevant user information before the user uses the function. In addition, any necessary steps should be taken to protect and safeguard access to such personal information data and ensure that others who have access to personal information data comply with its privacy policy and procedures.

[0101] The present application is expected to provide an implementation scheme for users to selectively block the use or access of personal information data. That is, the present disclosure is expected to provide hardware and / or software to prevent or block access to such personal information data. Once the personal information data is no longer needed, the risk can be minimized by limiting data collection and deleting the data. In addition, when applicable, such personal information is de-identified to protect the privacy of the user.

[0102] In the description of the aforementioned embodiments, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradiction.

[0103] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In the description of this application, the meaning of "plurality" is at least two, such as two, three, etc., unless otherwise clearly and specifically defined.

[0104] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, fragment or portion of code comprising one or more executable instructions for implementing the steps of a custom logical function or process, and the scope of the preferred embodiments of the present application includes alternative implementations in which functions may not be performed in the order shown or discussed, including performing functions in a substantially simultaneous manner or in the reverse order depending on the functions involved, which should be understood by technicians in the technical field to which the embodiments of the present application belong.

[0105] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in combination with these instruction execution systems, devices or apparatuses. For the purpose of this specification, "computer-readable medium" can be any device that contains, stores, communicates, propagates or transmits a program for use by an instruction execution system, device or apparatus, or in combination with these instruction execution systems, devices or apparatuses. More specific examples (non-exhaustive list) of computer-readable media include the following: an electrical connection with one or more wires (electronic device), a portable computer disk box (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), a fiber optic device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium and then editing, interpreting or processing in other suitable ways if necessary, and then stored in a computer memory.

[0106] It should be understood that the various parts of the present application can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0107] A person skilled in the art may understand that all or part of the steps in the method for implementing the above-mentioned embodiment may be completed by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, which, when executed, includes one or a combination of the steps of the method embodiment.

[0108] In addition, each functional unit in each embodiment of the present application may be integrated into a processing module, or each unit may exist physically separately, or two or more units may be integrated into one module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of a software functional module. If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a computer-readable storage medium.

[0109] The storage medium mentioned above may be a read-only memory, a magnetic disk or an optical disk, etc. Although the embodiments of the present application have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be understood as limiting the present application. A person of ordinary skill in the art may change, modify, replace and modify the above embodiments within the scope of the present application.

Claims

1. A model encryption method, characterized in that: include: Obtaining a target to-be-protected layer of a target model and model parameters of the target model, and obtaining a root private key of a target trusted execution environment; Generate a target public key of the target layer to be protected based on the root private key and the model parameters; The target layer to be protected is encrypted based on the target public key.

2. The method according to claim 1, characterized in that The generating the target public key of the target layer to be protected based on the root private key and the model parameter includes: Generate a target private key of the target layer to be protected based on the root private key and the model parameters; The target public key is generated based on the target private key.

3. The method according to claim 2, characterized in that The generating the target private key of the target to-be-protected layer based on the root private key and the model parameter includes: generating a model fingerprint based on the model parameters; The target private key is generated based on the model fingerprint, the root private key and a random number.

4. The method according to any one of claims 1 to 3, characterized in that The method further comprises: A signature of the target public key is generated based on the target public key, the root private key, and a model fingerprint.

5. A model decryption method, characterized in that: include: Acquire a target to-be-protected layer of a target model that has been encrypted, wherein the target to-be-protected layer is encrypted by the model encryption method according to any one of claims 1 to 4; Placing the target layer to be protected into a target trusted execution environment; The target layer to be protected is decrypted using the target private key in the target trusted execution environment.

6. The method according to claim 5, characterized in that Before decrypting the target to-be-protected layer by using the target private key in the target trusted execution environment, the method includes: Obtaining the signature of the target public key of the target layer to be protected and the root private key of the target trusted execution environment; Performing identification verification based on the signature of the target public key, the model parameters of the target model and the root public key; Identification verification successful.

7. The method according to claim 6, characterized in that The method further comprises: In response to an identification verification failure; Stop decrypting the target layer to be protected.

8. A model encryption device, characterized in that: include: An acquisition module, used to acquire a target to-be-protected layer of a target model and model parameters of the target model, and to acquire a root private key of a target trusted execution environment; A generation module, used to generate a target public key of the target layer to be protected based on the root private key and the model parameters; An encryption module is used to encrypt the target layer to be protected based on the target public key.

9. A model decryption device, characterized in that: include: A receiving module, used for acquiring a target layer to be protected which has been encrypted in a target model, wherein the target layer to be protected is encrypted by the model encryption method according to any one of claims 1 to 4; An embedding module, used for embedding the target layer to be protected into a target trusted execution environment; The decryption module is used to decrypt the target to-be-protected layer by using the target private key in the target trusted execution environment.

10. An electronic device, characterized in that: Including memory and processor; The processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, so as to implement the encryption method as described in any one of claims 1 to 4, or the decryption method as described in any one of claims 5 to 7.

Images