Model weight encryption and decryption method, server, client, medium and product

Abstract

The invention discloses a model weight encryption and decryption method, a server, a client, a medium and a product, and relates to the technical field of artificial intelligence and data security. The model weight of a target model is acquired, and the model weight is encrypted by using a Hash algorithm; during decryption, the encrypted hash table is obtained and decrypted, the model weight is obtained, the hash value is recalculated according to the model weight, whether the recalculated hash value is consistent with the hash value of the encryption weight or not is verified, and if the recalculated hash value is consistent with the hash value of the encryption weight, the model weight of the target model obtained by the encryption weight is decrypted. The problems of high complexity, high calculation cost, influence on model loading speed, low adaptability and the like in related technologies are solved, and the technical effects of high-efficiency and low-cost weight encryption and integrity verification, easiness in integrated use and wide adaptability are achieved.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence and data security technology, and in particular to a model weight encryption and decryption method, server, client, medium and product. Background Art

[0002] With the rapid development of artificial intelligence, deep learning models have been widely used in many fields such as image recognition and natural language processing. The model weights obtained by training these models with a large amount of data and computing resources contain a large amount of parameter information and have significant commercial value and technical importance. However, in the process of model distribution and use, model weights face multiple security threats, and model developers need to ensure that the model weights they develop are not stolen or illegally copied.

[0003] In the related art, the model weight file is encrypted to protect the model weight. However, the encryption methods in the related art, such as symmetric encryption and asymmetric encryption, are highly complex and computationally expensive, which not only affects the model loading speed, but also faces many inconveniences in practical applications. Summary of the invention

[0004] The present invention provides a method, server, client, medium and product for encrypting and decrypting model weights, so as to at least solve the problems of high encryption complexity and high cost of model weights in related technologies.

[0005] The present invention provides an encryption method for model weights, which is applied to a server and includes: obtaining the model weights of a target model, encrypting the model weights to obtain encrypted weights; calculating a hash value of the encrypted weights based on a hash algorithm, binding the hash value to a target index of the model weights, and storing the hash value and the target index in a hash table; and encrypting the hash table to obtain an encrypted hash table.

[0006] The present invention also provides a decryption method for model weights, which is applied to a client and includes: obtaining an encrypted hash table and decrypting the encrypted hash table; determining the hash value of the encrypted weight and the target index of the model weight based on the decrypted hash table; obtaining the model weight based on the target index and recalculating the hash value according to the model weight; verifying whether the recalculated hash value is consistent with the hash value of the encrypted weight; if the recalculated hash value is consistent with the hash value of the encrypted weight, decrypting the encrypted weight to obtain the model weight of the target model.

[0007] The present invention also provides a server, comprising: a memory for storing a computer program; and a processor for implementing the steps of the above-mentioned model weight encryption method when executing the computer program.

[0008] The present invention also provides a client, comprising: a memory for storing a computer program; and a processor for implementing the steps of the above-mentioned model weight decryption method when executing the computer program.

[0009] The present invention also provides a computer-readable storage medium, in which a computer program is stored, wherein when the computer program is executed by a processor, the steps of the above-mentioned model weight encryption method or model weight decryption method are implemented.

[0010] The present invention also provides a computer program product, including a computer program, which implements the steps of the above-mentioned model weight encryption method or model weight decryption method when the computer program is executed by a processor.

[0011] Through the present invention, the embodiment of the present invention can effectively improve the security of the model weights by multiple encryption of the model weights. The encryption process does not use an encryption algorithm with high complexity and high computational cost, which can effectively reduce the encryption complexity and cost of the model weights and improve the model loading speed; the hash algorithm is used in the entire encryption process, and the hash algorithm has the function of data integrity verification, so the integrity of the model weights can be protected; in addition, the embodiment of the present invention does not encrypt the model structure and the model weights together, realizes the separate storage of the model weights and the model structure, and encrypts the hash table to prevent the model weights from being tampered with or reverse cracked, further improving the security of the model weights. Therefore, the technical problems of high encryption complexity and high cost of the model weights can be solved, and efficient and low-cost weight encryption and integrity verification can be achieved, which prevents the open source abuse of the model weights or weight tampering, and at the same time ensures the technical effect that the authorized users can legally use the model. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] In order to more clearly illustrate the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0013] Figure 1 A schematic diagram of a flow chart of a method for encrypting model weights provided in an embodiment of the present invention; Figure 2 A schematic diagram of a flow chart of a method for decrypting model weights provided in an embodiment of the present invention; Figure 3 A flow chart of a weighted encryption method based on the MD5 algorithm provided by an embodiment of the present invention; Figure 4 A schematic diagram of the structure of a device for encrypting model weights provided by an embodiment of the present invention; Figure 5 A schematic diagram of the structure of a decryption device for model weights provided by an embodiment of the present invention; Figure 6 A schematic diagram of the structure of a server provided in an embodiment of the present invention; Figure 7 A schematic diagram of the structure of a client provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0014] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0015] It should be noted that, in the description of the present invention, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. The terms "first", "second", etc. in the present invention are used to distinguish similar objects, and are not used to describe a specific order or sequence.

[0016] In related technologies, deep learning model protection methods mainly include encrypted storage of model weights, access control, code obfuscation and other technical means, which can prevent the model from being illegally accessed, copied or tampered with to a certain extent, thereby protecting the developer's intellectual property rights and the commercial value of the model. However, these traditional protection schemes also have significant defects and usually need to rely on complex key management mechanisms, which not only increase the implementation cost and complexity of the system, but may also impose greater restrictions on application scenarios.

[0017] For this, hash algorithms such as MD5 (Message Digest Algorithm 5) algorithm is a widely used cryptographic hash function, which converts input data (regardless of its length) into a fixed-length output string, namely "hash value" or "message digest" through a specific mathematical function. It has the characteristics of simplicity, efficiency and irreversibility, which means that even a slight change in the input data will lead to a huge change in the output hash value, which makes it very suitable for digital signatures and integrity verification. Therefore, it is widely used in the field of digital signatures and integrity verification, but its characteristics have not yet been fully utilized in the weight protection of deep learning models.

[0018] Based on this, the embodiments of the present invention propose a model weight encryption and decryption method, server, client, medium and product. By combining the characteristics of the hash algorithm with the weight protection requirements of the deep learning model, the model weight data can be effectively processed, making it impossible for unauthorized users to directly use or restore the model content, thereby achieving protection of the model.

[0019] In order to enable those skilled in the art to better understand the scheme of the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0020] The following will describe a method for encrypting model weights with reference to the accompanying drawings. The method is applied to a server. Specifically, Figure 1 A method for encrypting model weights provided in an embodiment of the present invention comprises the following steps: In step S101, the model weight of the target model is obtained, and the model weight is encrypted to obtain the encrypted weight.

[0021] Among them, model weights refer to parameter values ​​optimized through the training process in machine learning and deep learning models. These weights are the core part of the model and determine how the model makes predictions or decisions based on the input data. Since they are usually trained with a large amount of data and computing resources, they have extremely high commercial and technical value; encrypted weights are obtained by processing the original model weights with an encryption algorithm. The encryption method will be described in detail below and will not be repeated here.

[0022] It can be understood that the embodiment of the present invention can obtain the model weights of the trained target model, and obtain the encrypted weights after processing the original model weights. By encrypting the original weights and then converting them into a format that cannot be used directly, it is possible to effectively prevent unauthorized use and ensure the security of the model during distribution and use.

[0023] In some embodiments, encrypting the model weight to obtain the encrypted weight includes: obtaining a hardware identifier of the target device; generating an encryption key based on the hardware identifier of the target device; and encrypting the model weight using the encryption key to obtain the encrypted weight.

[0024] Among them, hardware identifiers include CPU (Central Processing Unit) ID, GPU (Graphics Processing Unit) ID and motherboard serial number, which are usually unique marks at the device hardware level and can ensure the uniqueness and unpredictability of the key.

[0025] It can be understood that the embodiment of the present invention obtains hardware identifiers unique to the target device, such as CPU ID, GPUID and motherboard serial number, generates an encryption key based on these hardware identifiers, and uses this encryption key to encrypt the original weights of the acquired target model, thereby obtaining the encrypted weights.

[0026] Furthermore, generating an encryption key according to the target hardware identifier includes: using the target hardware identifier as a seed of a key derivation function; and generating the encryption key through the key derivation function.

[0027] Among them, the key derivation mechanism is an algorithm for generating encryption keys from raw data, which is used to ensure that the generated keys are sufficiently random and secure to prevent unauthorized access and attacks; commonly used key derivation functions include HKDF (HMAC-based Key Derivation Function), PBKDF2 (Password-Based Key Derivation Function 2), etc. Among them, HKDF is more suitable for situations where high-quality random key materials are already available, such as key negotiation between devices or key generation used in the certificate signing process; PBKDF2 can effectively resist brute force cracking attacks against weak passwords, so it is more suitable for processing passwords provided by users, especially in the fields of identity authentication and data protection.

[0028] It can be understood that the embodiments of the present invention can obtain the hardware identifier of the target device and input the hardware identifier as a seed into the key derivation function to ensure the uniqueness of the key, and use a key derivation function, such as HKDF, to process the seed data to generate the encryption key ultimately used. Since the generation of the key depends on unique information specific to the device, even if the attacker obtains the encrypted weight file of the model, the original weight cannot be easily restored without the hardware identifier of the target device, thereby ensuring the integrity and security of the model during distribution and use.

[0029] In step S102, a hash value of the encrypted weight is calculated based on a hash algorithm, the hash value is bound to a target index of the model weight, and the hash value and the target index are stored in a hash table.

[0030] Among them, the hash algorithm is an algorithm that converts data of arbitrary length into fixed-length output. Common hash algorithms include MD5, SHA (Secure Hash Algorithm) series, etc.; the target index is the position or identifier pointing to the model weight in the original model structure, which helps to locate and manage each weight block; the hash table is a data structure used to store hash values ​​and their corresponding target indexes for quick search and verification.

[0031] It can be understood that in an embodiment of the present invention, in order to ensure the security and integrity of the model weights after encryption, a hash algorithm, such as MD5, is first used to calculate the hash value of each encrypted weight. The calculation method will be described in detail below and will not be repeated here; then, these hash values ​​are bound to the target index of the corresponding model weights in the original model structure, and the hash values ​​and their corresponding target indexes are stored in a hash table for quick search and verification.

[0032] In some embodiments, calculating a hash value of an encryption weight based on a hash algorithm includes: obtaining a file of the encryption weight; identifying the file size of the encryption weight; calculating a target number of blocks based on the file size and block size of the encryption weight; performing block processing on the encryption weight file based on the target number of blocks to obtain a plurality of weight data blocks; calculating a hash value of each weight data block in the plurality of weight data blocks based on a hash algorithm, and generating a hash value of the encryption weight based on the hash value of each weight data block.

[0033] Among them, assuming that the weight file size is , the block size is , block size According to the actual needs, the specific settings are not limited here, and the target number of blocks is ; Calculate the hash value of each weight data block in multiple weight data blocks based on the hash algorithm, specifically: ,in Indicates data blocks, Indicates the MD5 hash value of the data block.

[0034] It is understandable that in order to ensure the security and integrity of the encrypted weight file, the embodiment of the present invention first needs to obtain the encrypted weight file and identify the weight file size. , according to the set block size With weight file size , through the formula Calculate how many data blocks the file needs to be split into and get the target number of blocks, that is, Based on the target number of blocks, the encrypted weight file is divided into blocks to obtain multiple independent weight data blocks. For each weight data block, the selected hash algorithm, such as MD5, is applied to calculate its hash value. Through this process, a hash value that can verify its integrity is generated for each data block. Finally, the hash values ​​of all weight data blocks are aggregated to form a hash value set of the entire encrypted weight file, which is used as the standard for verifying the entire encrypted weight file, ensuring that during the decryption process, it can be identified whether the file has been tampered with during transmission or storage. The verification method will be described in detail below and will not be repeated here. Thus, an efficient and reliable integrity verification mechanism is provided.

[0035] In some embodiments, before generating the hash value of the encrypted weight according to the hash value of each weight data block, it also includes: obtaining a random salt value for each weight data block; and updating the hash value of each weight data block according to the random salt value of each weight data block.

[0036] The random salt value is a random string or data block generated separately for each weight data block. Combining the salt value with the original data and performing hash calculation can significantly increase the difficulty for attackers to crack the hash value, thereby improving security. Add it to the calculation and update the hash value of each weight data block: It should be noted that the salt value Need and Stored together for subsequent decryption and verification.

[0037] It can be understood that before generating the hash value of the encrypted weight based on the hash value of each weight data block, the embodiment of the present invention also needs to generate a random salt value for each weight data block, and add it to the calculation to update the hash value of each weight data block, thereby significantly increasing the difficulty for attackers to crack the hash value and improving security.

[0038] In step S103, the hash table is encrypted to obtain an encrypted hash table.

[0039] It can be understood that after the embodiment of the present invention stores the hash value and its corresponding target index in a hash table, in order to further enhance the security of the encrypted weight file, the hash table must also be encrypted to prevent the content of the hash table from being tampered with by unauthorized third parties. At the same time, it also increases the difficulty of reverse cracking to ensure that even if an attacker obtains the hash table, he cannot easily interpret or modify the data therein.

[0040] In some embodiments, encrypting the hash table to obtain the encrypted hash table includes: encrypting the hash table using a symmetric encryption algorithm.

[0041] Among them, the symmetric encryption algorithm is a technology that uses the same key to encrypt and decrypt data, and AES (Advanced Encryption Standard) can be used.

[0042] It can be understood that the embodiment of the present invention uses a symmetric encryption algorithm to encrypt the hash table. Specifically, AES can be used to encrypt the hash table to prevent the hash table from being tampered with or reversely cracked, thereby further enhancing security.

[0043] According to the encryption method of model weights proposed in the embodiment of the present invention, the security of model weights can be effectively improved by multiple encryption of model weights. No encryption algorithm with high complexity and high computational cost is used in the encryption process, which can effectively reduce the encryption complexity and cost of model weights and improve the model loading speed. The hash algorithm is used in the entire encryption process. The hash algorithm has the function of data integrity verification, so the integrity of model weights can be protected. In addition, the embodiment of the present invention does not encrypt the model structure and model weights together, realizes the separate storage of model weights and model structure, and encrypts the hash table to prevent the model weights from being tampered with or reverse cracked, further improving the security of model weights. Therefore, the technical problems of high encryption complexity and high cost of model weights can be solved, and efficient and low-cost weight encryption and integrity verification can be achieved, which prevents the open source abuse or weight tampering of model weights, and at the same time ensures the technical effect that authorized users can legally use the model.

[0044] Next, a decryption method of a model weight proposed according to an embodiment of the present invention is described with reference to the accompanying drawings, where the method is applied to a client.

[0045] Figure 2 is a flow chart of a method for decrypting model weights according to an embodiment of the present invention, and the method is applied to a client. Figure 2 As shown, the method comprises the following steps: In step S201, the encrypted hash table is obtained and the encrypted hash table is decrypted.

[0046] It is understandable that when the embodiment of the present invention needs to decrypt the model weights, it is necessary to first obtain the encrypted hash table and then decrypt the hash table.

[0047] In some embodiments, decrypting the encrypted hash table includes: obtaining a decryption algorithm corresponding to the symmetric encryption algorithm; and decrypting the encrypted hash table using the decryption algorithm corresponding to the symmetric encryption algorithm.

[0048] Among them, the decryption algorithm corresponding to the symmetric encryption algorithm is a set of rules corresponding to the encryption algorithm, which is used to restore the encrypted data to its original form.

[0049] It can be understood that the embodiment of the present invention decrypts the encrypted hash table by first obtaining a decryption algorithm corresponding to the symmetric encryption algorithm previously used to encrypt the hash table, and using the decryption algorithm to decrypt the encrypted hash table, thereby restoring the original hash table.

[0050] In step S202, the hash value of the encrypted weight and the target index of the model weight are determined based on the decrypted hash table.

[0051] It can be understood that the embodiment of the present invention decrypts the encrypted hash table, from which the hash value of the encrypted weight and the target index of the model weight can be obtained. According to the target index provided in the decrypted hash table, the corresponding model weight part can be accurately located.

[0052] In step S203, the model weight is obtained based on the target index, and the hash value is recalculated according to the model weight.

[0053] It can be understood that after the embodiment of the present invention completes decryption of the encrypted hash table, it uses the target index to accurately locate the corresponding model weight part and recalculate the corresponding hash value.

[0054] In some embodiments, recalculating a hash value based on a model weight includes: encrypting the model weight to obtain an encrypted weight; obtaining a file of the encrypted weight and identifying the file size of the encrypted weight; calculating a target number of blocks based on the file size and block size of the encrypted weight; performing block processing on the encrypted weight file based on the target number of blocks to obtain a weight data block; calculating a hash value for each weight data block in a plurality of weight data blocks based on a hash algorithm, and generating a recalculated hash value based on the hash value of each weight data block.

[0055] Among them, the hash value of each weight data block in multiple weight data blocks is calculated based on the hash algorithm, which can be calculated by the formula: ,in, The recalculated hash value.

[0056] It can be understood that the embodiment of the present invention recalculates the hash value according to the model weight, first obtains the encrypted weight file and identifies its file size, calculates how many data blocks the file needs to be divided into according to the preset block size, obtains the target number of blocks, and performs block processing on the encrypted weight file based on the target number of blocks to obtain multiple independent weight data blocks. For each weight data block, a selected hash algorithm, such as MD5, is applied to calculate its hash value, and a recalculated hash value set is generated based on the newly calculated hash value of each weight data block.

[0057] In some embodiments, a recalculated hash value is generated based on the hash value of each weight data block, including: identifying whether a salt value is stored in the decrypted hash table; if the decrypted hash table does not store the salt value, calculating the hash value of each weight data block in the multiple weight data blocks based on the hash algorithm; if the decrypted hash table stores the salt value, calculating the hash value of each weight data block in the multiple weight data blocks based on the hash algorithm and the salt value; generating a recalculated hash value based on the hash value of each weight data block.

[0058] It is understandable that when the embodiment of the present invention generates a recalculated hash value based on the hash value of each weight data block, it is necessary to check whether the decrypted hash table has a salt value stored. If the salt value is not stored in the hash table, the selected hash algorithm, such as MD5, is directly applied to each weight data block to calculate its hash value, that is, On the contrary, if the salt value is stored in the hash table, each weight data block needs to be combined with its corresponding salt value, and then the hash value is calculated using the same hash algorithm, that is, In this way, we can determine whether the salt value is used in the encryption process, so as to perform correct decryption and ensure the accuracy of the decryption result.

[0059] In step S204, it is verified whether the recalculated hash value is consistent with the hash value of the encrypted weight; if the recalculated hash value is consistent with the hash value of the encrypted weight, the encrypted weight is decrypted to obtain the model weight of the target model.

[0060] It can be understood that the embodiment of the present invention uses whether the recalculated hash value is consistent with the hash value of the encrypted weight as a verification process. If any recalculated hash value does not match the hash value of the encrypted weight, it means that the weight has been tampered with and the decryption needs to be terminated; otherwise, the encrypted weight is decrypted to obtain the model weight of the target model.

[0061] In some embodiments, verifying whether the recalculated hash value is consistent with the hash value of the encrypted weight includes: identifying the recalculated hash value and multiple weight data blocks in the hash value of the encrypted weight; if the hash value of each weight data block of the recalculated hash value matches the hash value of each weight data block in the hash value of the encrypted weight, it is determined that the recalculated hash value is consistent with the hash value of the encrypted weight.

[0062] It can be understood that the embodiment of the present invention verifies whether the recalculated hash value is consistent with the hash value of the encrypted weight. First, the weight data block obtained from the decrypted hash table and the hash value of its corresponding encrypted weight are identified. For each weight data block, the hash value of each recalculated weight data block is compared one by one with the hash value of the encrypted weight of the corresponding weight data block in the decrypted hash table. If the recalculated hash values ​​of all weight data blocks match the hash values ​​of their corresponding encrypted weights, it can be determined that the recalculated hash value is consistent with the hash value of the encrypted weight, indicating that the weight data block has not been tampered with or damaged during the entire process, thereby ensuring the integrity and security of the model weights.

[0063] In some embodiments, decrypting the encrypted weight to obtain the model weight of the target model includes: obtaining a hardware identifier of the current device; generating a decryption key based on the hardware identifier of the current device; and decrypting the encrypted weight using the decryption key to obtain the model weight of the target model.

[0064] Among them, the key derivation function used to generate the decryption key based on the hardware identifier of the current device needs to be consistent with the key derivation function used in the encryption process to ensure the continuity and consistency of the entire process and achieve seamless connection from encryption to decryption.

[0065] It can be understood that in order to decrypt the encrypted weights to obtain the model weights of the target model, the embodiment of the present invention needs to obtain the hardware identifier unique to the current device, and input this hardware identifier as a seed into the same key derivation function as in the encryption process to generate a decryption key. Finally, the encrypted weight file is decrypted using this decryption key. Only on a device with the correct hardware identifier can the correct decryption key be generated, thereby successfully decrypting and restoring the model weights, ensuring that even if the encrypted weight file falls into the hands of others, it cannot be easily decrypted, thereby ensuring the accuracy and security of the decryption.

[0066] According to the decryption method of model weights proposed in an embodiment of the present invention, during decryption, the encrypted hash table is decrypted to obtain the model weight, the hash value is recalculated, and it is verified whether the recalculated hash value is consistent with the hash value of the encrypted weight. If they are consistent, it indicates that the weight data block has not been tampered with or damaged during the whole process. At the same time, the hardware identifier is finally used to decrypt the encrypted weight file. The correct decryption key can only be generated on a device with the correct hardware identifier, ensuring that even if the encrypted weight file falls into the hands of others, it cannot be easily decrypted, ensuring the accuracy and security of the decryption, and achieving efficient, low-cost weight encryption and integrity verification, and easy integration and use, and wide adaptability. Technical effect.

[0067] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method.

[0068] The following further describes the encryption method of the model weight and the decryption method of the model weight through a specific embodiment.

[0069] This embodiment converts the model weights into a form that cannot be used directly after processing, thereby protecting the security of the model weights. Only in a specific authorized environment can the legitimacy of these weights be verified and dynamically restored to usable weights at runtime. Figure 3 As shown, the whole program is divided into the following stages: Phase 1: training to obtain weights.

[0070] First, the model is trained, and the core parameters of the model, namely the model weights, are obtained through the training process.

[0071] The second stage: dynamic key generation, which is bound to the weights obtained through training to obtain encryption weights.

[0072] First, at the end of model training, the trained model weight is bound to the dynamic key to generate an encrypted weight. Specifically, this process can be expressed as:

[0073] in, It is a key-based function used to encrypt weights. The generation of dynamic keys depends on specific hardware identifiers (such as CPU ID, GPU ID, motherboard serial number, etc.), which are usually unique identifiers at the device hardware level, ensuring the uniqueness and unpredictability of the key. The generation process of dynamic keys can be implemented through a secure key derivation mechanism. For example, the unique hardware identifier of the device (obtained through the operating system or hardware interface) is used as a seed or input to generate the encryption key used in the end through a key derivation function (such as HKDF). The advantage of this method is that even if the attacker obtains the encrypted weight file of the model, the original weight cannot be easily restored without the hardware identifier of the target device, because the generation of the key depends on the unique information unique to the device. The core idea of ​​this binding mechanism is to bind the decryption and use of the model weights to a specific device. Only on the target hardware device, using its unique hardware identifier to generate the correct dynamic key, can the encrypted weights be decrypted and the model used. This method not only improves the security of the model, but also effectively prevents the model from being copied, distributed or run by unauthorized users, thereby providing a technical guarantee for the intellectual property protection of the model.

[0074] Secondly, after obtaining the encrypted weights, the weight file is divided into blocks of fixed size (such as 256KB or 1MB) to generate multiple small weight data blocks. The main purpose of block division is to support encryption and verification operations of large files while improving flexibility and efficiency. Assume that the weight file size is , the block size is , then the weight file is split into data blocks.

[0075] Phase 3: MD5 calculates the hash value, saves it to the hash table, and encrypts the hash table.

[0076] Then, the MD5 hash value is calculated for each weight data block to generate a unique hash summary. ,in Indicates data blocks, Indicates the MD5 hash value of the data block. The generated MD5 hash value is used to verify the integrity of the data block to ensure that the data has not been tampered with during storage or transmission. At this time, an optional enhancement measure is to dynamically generate a random salt value for each data block when calculating the MD5 hash value. And add calculation: , salt value Need and Stored together for subsequent decryption and verification.

[0077] Finally, the hash value of each weight is stored in a hash table, the MD5 hash value is bound to the index of the original weight, stored separately from the model structure, and further encrypted to prevent tampering or reverse cracking. Here, a symmetric encryption algorithm (such as AES) can be used to encrypt the generated hash table.

[0078] Phase 4: Hash table decryption and weight integrity verification.

[0079] In the operating environment, the integrity of the weight is verified through a specific verification module, and only the weight that passes the authorization verification can be dynamically unlocked in the next stage. The verification process is as follows: 1. Load the encrypted hash table and decrypt it.

[0080] 2. Load the encrypted storage file and parse the block data structure. Extract the content of each data block, the corresponding MD5 hash value and other auxiliary information (such as index, salt value).

[0081] 3. Verify the integrity of the weights. When the model is loaded, the MD5 value of the loaded weights is recalculated and compared with the decrypted hash table. If the hash value of any weight does not match, it means that the weight has been tampered with and the loading process will terminate. If a salt value was used during storage in the first stage, the stored salt value Recalculate the data block: ; If no salt is used, it is calculated directly: . The calculated hash value And the decrypted hash value For comparison: If , indicating that the data block has not been tampered with; if , the data block will be refused to be loaded and an error will be prompted.

[0082] Phase 4: Weight decryption and recovery in a legitimate environment.

[0083] Under the premise of ensuring the integrity of the weights in the previous stage, the dynamic key is used to decrypt and restore the weights obtained from the original training. In a legal environment, the software running code that reads the model will obtain the identifier of the current hardware device and regenerate the decryption key using the same key derivation function as used during encryption to complete the restoration:

[0084] In summary, this embodiment effectively prevents the open source abuse or weight tampering of model weights through the above process, while ensuring that authorized users can legally use the model, and is suitable for intellectual property protection of model weights.

[0085] In addition, an embodiment of the present invention also provides a device for encrypting model weights, such as Figure 4 As shown, the model weight encryption device 10 includes: a first acquisition module 301, a first calculation module 302 and an encryption module 303.

[0086] Among them, the first acquisition module 301 is used to obtain the model weight of the target model, and encrypt the model weight to obtain the encrypted weight; the first calculation module 302 is used to calculate the hash value of the encrypted weight based on the hash algorithm, bind the hash value and the target index of the model weight, and store the hash value and the target index in the hash table; the encryption module 303 is used to encrypt the hash table to obtain an encrypted hash table.

[0087] In one embodiment of the present invention, the first calculation module 302 is further used to obtain the file of the encryption weight; identify the file size of the encryption weight; calculate the target number of blocks based on the file size and block size of the encryption weight; block the file of the encryption weight based on the target number of blocks to obtain multiple weight data blocks; calculate the hash value of each weight data block in the multiple weight data blocks based on the hash algorithm, and generate the hash value of the encryption weight according to the hash value of each weight data block.

[0088] In one embodiment of the present invention, the encryption device 10 for model weights also includes: an update module, which is used to obtain the random salt value of each weight data block before generating the hash value of the encrypted weight based on the hash value of each weight data block; and update the hash value of each weight data block based on the random salt value of each weight data block.

[0089] In one embodiment of the present invention, the first acquisition module 301 is further used to obtain a hardware identifier of a target device; generate an encryption key according to the hardware identifier of the target device; and obtain an encrypted weight after encrypting the model weight using the encryption key.

[0090] In one embodiment of the present invention, the first acquisition module 301 is further configured to use the target hardware identifier as a seed of a key derivation function; and generate the encryption key through the key derivation function.

[0091] In one embodiment of the present invention, the encryption module 303 is further configured to encrypt the hash table using a symmetric encryption algorithm.

[0092] It should be noted that the description of the features in the above-mentioned embodiment corresponding to the encryption device of the model weights can be found in the relevant description of the embodiment corresponding to the encryption method of the model weights, and will not be repeated here.

[0093] Figure 5 The model weight decryption device 20 provided in the embodiment of the present invention is applied to the client and includes: a second acquisition module 401, a determination module 402, a second calculation module 403 and a decryption module 404.

[0094] Among them, the second acquisition module 401 is used to obtain the encrypted hash table and decrypt the encrypted hash table; the determination module 402 is used to determine the hash value of the encrypted weight and the target index of the model weight based on the decrypted hash table; the second calculation module 403 is used to obtain the model weight based on the target index, and recalculate the hash value according to the model weight; the decryption module 404 is used to verify whether the recalculated hash value is consistent with the hash value of the encrypted weight; if the recalculated hash value is consistent with the hash value of the encrypted weight, the encrypted weight is decrypted to obtain the model weight of the target model.

[0095] In one embodiment of the present invention, the second calculation module 403 is further used to obtain the file of the encryption weight and identify the file size of the encryption weight; calculate the target number of blocks based on the file size and block size of the encryption weight; block the file of the encryption weight based on the target number of blocks to obtain multiple weight data blocks; calculate the hash value of each weight data block in the multiple weight data blocks based on the hash algorithm, and generate the recalculated hash value based on the hash value of each weight data block.

[0096] In one embodiment of the present invention, the decryption module 404 is further used to identify multiple weight data blocks in the recalculated hash value and the hash value of the encrypted weight; if the hash value of each weight data block of the recalculated hash value matches the hash value of each weight data block in the hash value of the encrypted weight, it is determined that the recalculated hash value is consistent with the hash value of the encrypted weight.

[0097] In one embodiment of the present invention, the decryption module 404 is further used to obtain a hardware identifier of the current device; generate a decryption key according to the hardware identifier of the current device; and use the decryption key to decrypt the encrypted weight to obtain the model weight of the target model.

[0098] In one embodiment of the present invention, the second acquisition module 401 is further used to acquire a decryption algorithm corresponding to the symmetric encryption algorithm; and decrypt the encrypted hash table using the decryption algorithm corresponding to the symmetric encryption algorithm.

[0099] It should be noted that the description of the features in the above-mentioned embodiment corresponding to the decryption device of the model weights can be found in the relevant description of the embodiment corresponding to the decryption method of the model weights, which will not be repeated here.

[0100] The embodiment of the present invention further provides a server, such as Figure 6 As shown, it includes a first memory 501 and a first processor 502, the first memory 501 stores a computer program, and the first processor 502 is configured to run the computer program to execute the steps in any of the above-mentioned model weight encryption method embodiments.

[0101] The embodiment of the present invention also provides a client, such as Figure 7 As shown, it includes a second memory 601 and a second processor 602, the second memory 601 stores a computer program, and the second processor 602 is configured to run the computer program to execute the steps in any of the above-mentioned model weight decryption method embodiments.

[0102] An embodiment of the present invention also provides a computer-readable storage medium, in which a computer program is stored, wherein the computer program is configured to execute the steps of any of the above-mentioned model weight encryption method and model weight decryption method embodiments when running.

[0103] In an exemplary embodiment, the computer-readable storage medium may include, but is not limited to, various media that can store computer programs, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk.

[0104] An embodiment of the present invention further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the computer program implements the steps in any of the above-mentioned model weight encryption method and model weight decryption method embodiments.

[0105] An embodiment of the present invention also provides another computer program product, including a non-volatile computer-readable storage medium, the non-volatile computer-readable storage medium storing a computer program, and when the computer program is executed by a processor, implementing the steps in any of the above-mentioned model weight encryption method and model weight decryption method embodiments.

[0106] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0107] The above is a detailed introduction to the encryption method, decryption method, server and client of a model weight provided by the present invention. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. It should be pointed out that for ordinary technicians in this technical field, without departing from the principles of the present invention, several improvements and modifications can be made to the present invention, and these improvements and modifications also fall within the scope of protection of the claims of the present invention.

Claims

1. A method for encrypting model weights, characterized in that: The method is applied to a server, wherein the method comprises: Obtaining a model weight of a target model, and encrypting the model weight to obtain an encrypted weight; Calculate a hash value of the encrypted weight based on a hash algorithm, bind the hash value to a target index of the model weight, and store the hash value and the target index in a hash table; The hash table is encrypted to obtain an encrypted hash table.

2. The encryption method of model weights according to claim 1, characterized in that: The calculating the hash value of the encryption weight based on the hash algorithm includes: Obtain the encryption weight file; Identify the file size of the encryption weight; Calculate the target number of blocks according to the file size and block size of the encryption weight; Based on the target number of blocks, the encrypted weight file is processed into blocks to obtain a plurality of weight data blocks; A hash value of each weight data block in the plurality of weight data blocks is calculated based on the hash algorithm, and a hash value of the encrypted weight is generated according to the hash value of each weight data block.

3. The encryption method of model weights according to claim 2, characterized in that: Before generating the hash value of the encrypted weight according to the hash value of each weight data block, the method further includes: Obtaining a random salt value for each weight data block; The hash value of each weight data block is updated according to the random salt value of each weight data block.

4. The encryption method of model weights according to claim 1, characterized in that: The step of encrypting the model weight to obtain the encrypted weight includes: Get the hardware identifier of the target device; generating an encryption key based on a hardware identifier of the target device; The model weight is encrypted using the encryption key to obtain the encrypted weight.

5. The encryption method of model weights according to claim 4, characterized in that: The generating an encryption key according to the hardware identifier of the target device comprises: using a hardware identifier of the target device as a seed for a key derivation function; The encryption key is generated by the key derivation function.

6. The encryption method of model weights according to claim 1, characterized in that: The encrypted hash table obtained by encrypting the hash table includes: The hash table is encrypted using a symmetric encryption algorithm.

7. A method for decrypting model weights, characterized in that: The method is applied to a client, wherein the method comprises: Obtaining an encrypted hash table, and decrypting the encrypted hash table; Determine the hash value of the encrypted weight and the target index of the model weight based on the decrypted hash table; Acquire a model weight based on the target index, and recalculate a hash value according to the model weight; Verify whether the recalculated hash value is consistent with the hash value of the encrypted weight; if the recalculated hash value is consistent with the hash value of the encrypted weight, decrypt the encrypted weight to obtain the model weight of the target model.

8. The method for decrypting model weights according to claim 7, characterized in that: The recalculating the hash value according to the model weight includes: Encrypting the model weight to obtain an encrypted weight; Obtaining a file of the encryption weights, and identifying a file size of the encryption weights; Calculate the target number of blocks according to the file size and block size of the encryption weight; Based on the target number of blocks, the encrypted weight file is processed into blocks to obtain a plurality of weight data blocks; A hash value of each weight data block in the plurality of weight data blocks is calculated based on a hash algorithm, and the recalculated hash value is generated according to the hash value of each weight data block.

9. The method for decrypting model weights according to claim 7, characterized in that: The verifying whether the recalculated hash value is consistent with the hash value of the encryption weight includes: identifying a plurality of weight data blocks in the recalculated hash value and the hash value of the encrypted weight; If the hash value of each weight data block of the recalculated hash value matches the hash value of each weight data block in the hash value of the encrypted weight, it is determined that the recalculated hash value is consistent with the hash value of the encrypted weight.

10. The method for decrypting model weights according to claim 7, characterized in that: The decrypting the encrypted weight to obtain the model weight of the target model includes: Get the hardware identifier of the current device; Generate a decryption key according to the hardware identifier of the current device; The encrypted weights are decrypted using the decryption key to obtain the model weights of the target model.

11. The method for decrypting model weights according to claim 7, characterized in that: The decrypting the encrypted hash table comprises: Get the decryption algorithm corresponding to the symmetric encryption algorithm; The encrypted hash table is decrypted using a decryption algorithm corresponding to the symmetric encryption algorithm.

12. A server, characterized in that: include: Memory for storing computer programs; A processor, configured to implement the steps of the method for encrypting model weights as described in any one of claims 1 to 6 when executing the computer program.

13. A client, characterized in that: include: Memory for storing computer programs; A processor, configured to implement the steps of the method for decrypting the model weights as described in any one of claims 7 to 11 when executing the computer program.

14. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein when the computer program is executed by a processor, the computer program implements the steps of the encryption method of the model weights described in any one of claims 1 to 6, or the steps of the decryption method of the model weights described in any one of claims 7 to 11.

15. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the encryption method of the model weights described in any one of claims 1 to 6 are implemented, or the steps of the decryption method of the model weights described in any one of claims 7 to 11 are implemented.

Images