Large model security reasoning method based on trusted execution environment, medium and equipment

Abstract

The invention relates to a large model security reasoning method based on a trusted execution environment, a medium and equipment, and the method comprises the following steps: generating a trusted public and private key pair corresponding to a large model service provider through the trusted execution environment, in the public and private key pair, sending a public key to a user side, and sending the public key to the user side; the private key is persistently stored in a trusted execution environment through data sealing; receiving encrypted data and a digital envelope sent by a user side, the encrypted data being cue word data encrypted by a symmetric key, and the digital envelope being a symmetric key encrypted by the public key; obtaining an original cue word based on the encrypted data and the digital envelope through the trusted execution environment; and in the trusted execution environment, performing large model reasoning based on the original cue word, and sending a reasoning result encrypted by the symmetric key and a trusted execution environment signature to a user side. Compared with the prior art, the method has the advantages of being safer, more universal, more efficient and the like.

Description

Technical Field

[0001] The present invention relates to the field of large model technology, and in particular to a large model security reasoning method, medium and device based on a trusted execution environment. Background Art

[0002] The widespread use of big models is considered a major revolution in artificial intelligence. However, big model operators may illegally collect data from users' questions to obtain sensitive information, spy on users' personal preferences, and restore user characteristics in combination with open space high-dimensional information to achieve precision marketing, or even sell the analyzed user data to other marketing agencies. These incidents have caused widespread public concern when asking big models about privacy issues.

[0003] Therefore, how to ensure user privacy while enabling large models to accurately and efficiently use the private data of user questions and infer the correct results has become an important research direction and a technical problem that needs to be solved in this field. The realization of this balance has a far-reaching impact on the sustainable development of artificial intelligence technology, the establishment of user trust, the protection of data security, and the compliance with laws and regulations. Summary of the invention

[0004] The purpose of the present invention is to overcome the defects of the above-mentioned prior art and provide a safer, more universal and more efficient large-model security reasoning method, medium and device based on a trusted execution environment.

[0005] The purpose of the present invention can be achieved by the following technical solutions:

[0006] A large model security reasoning method based on a trusted execution environment includes the following steps:

[0007] Generate a trusted public-private key pair corresponding to the large model service provider through a trusted execution environment, wherein the public key is sent to the user end, and the private key is persistently stored in the trusted execution environment through data sealing;

[0008] Receiving encrypted data and a digital envelope sent by a user terminal, wherein the encrypted data is prompt word data encrypted by a symmetric key, and the digital envelope is the symmetric key encrypted by the public key;

[0009] Obtaining, through the trusted execution environment, an original prompt word based on the encrypted data and the digital envelope;

[0010] In the trusted execution environment, large model reasoning is performed based on the original prompt word, and the reasoning result encrypted by the symmetric key and the trusted execution environment signature are sent to the user end.

[0011] Furthermore, the process of generating the trusted public-private key pair includes:

[0012] Loading a public-private key generation program in the trusted execution environment to randomly generate a public-private key pair;

[0013] Generate an authentication report in the trusted execution environment based on the correctness of the use of the public and private key generation program, relevant information within the trusted execution environment, and the public key hash value, and send it to the user end;

[0014] Determine whether the remote authentication pass information fed back by the user end is received. If so, use the current public-private key pair as a trusted public-private key pair. If not, regenerate the public-private key pair through the public-private key generation program.

[0015] Furthermore, after receiving the authentication report, the user terminal parses the report in the trusted execution environment and determines whether the remote authentication is passed based on the correctness and completeness of the authentication report.

[0016] Furthermore, when the user terminal receives the public key, it verifies the correctness of the public key based on the public key hash value in the authentication report, and saves the public key if the verification is successful.

[0017] Furthermore, the public and private key generation program is an audited program.

[0018] Furthermore, when generating the authentication report, if the security zone measurement value of the current public-private key generation program is the same as that of the specified program, it is determined that the public-private key generation program is used correctly.

[0019] Furthermore, the process of obtaining the original prompt word based on the encrypted data and the digital envelope includes:

[0020] In the trusted execution environment, decrypting the digital envelope using the decrypted private key to obtain a symmetric key;

[0021] The encrypted data is decrypted based on the symmetric key to obtain the original prompt word.

[0022] Furthermore, the user terminal verifies the validity of the trusted execution environment signature, and after the verification is passed, uses the symmetric key to decrypt the encrypted reasoning result to obtain the final reasoning result.

[0023] The present invention also provides a computer-readable storage medium, comprising one or more programs for execution by one or more processors of an electronic device, wherein the one or more programs include instructions for executing the large model security reasoning method based on a trusted execution environment as described above.

[0024] The present invention also provides an electronic device, comprising one or more processors, a memory and one or more programs stored in the memory, wherein the one or more programs include instructions for executing the large model security reasoning method based on a trusted execution environment as described above.

[0025] The present invention provides a large model security reasoning method based on a trusted execution environment, which can ensure user privacy and enable the large model to accurately and efficiently use the privacy data provided by the user and reason to obtain correct results. Such a secure reasoning technology can not only enhance the user's trust in the large model, but also meet regulatory compliance requirements and better protect the business development of the large model service provider. Specifically, compared with the prior art, the present invention has the following advantages:

[0026] Beneficial effects:

[0027] 1. Security

[0028] (1) Security of Inference Node Identity

[0029] The present invention is implemented based on a trusted execution environment. The security environment of the trusted execution environment ensures that the large model service provider runs a trusted and audited program, so the node can generate a secure public-private key pair through the program inside the trusted execution environment. The data sealing technology bound to the hardware information ensures that the sealed private key will not be maliciously stolen, and the remote authentication technology ensures that the key transfer process will not be subject to man-in-the-middle attacks, and the public key generated inside the trusted execution environment can be correctly and completely transferred to the remote recipient. These two core security mechanisms are based on the security protection of the trusted execution environment, so the present invention can ensure the security of the node identity.

[0030] (2) Confidentiality of prompt word data transmission

[0031] Since the large model service provider has credible identity information, its public key is stored in a public and credible database, and the private key is stored in a data-sealed manner and can only be decrypted by the same trusted execution environment, so its private key information cannot be obtained by attackers. The present invention uses a digital envelope to transmit privacy prompt words. Since the digital envelope can only be decrypted by the private key owner, the encryption key of the private data is only known to the user and the trusted execution environment. During the transmission of encrypted data, even if the attacker eavesdrops on the relevant information of the encrypted data, due to the lack of symmetric encryption keys or relevant information of the private key inside the trusted execution environment, the attacker still cannot obtain the relevant information of the original data. Therefore, the present invention can ensure the confidentiality of the data transmission process.

[0032] (3) Security of the reasoning process

[0033] For the large model reasoning process, the large model service provider loads the encrypted prompt word and the digital envelope into the trusted execution environment, and finally returns the encrypted reasoning result. During the whole process, although the large model service provider has a sealed private key file, the security characteristics of the trusted execution environment ensure that only the trusted execution environment that generates the private key can restore the private key information, and the application in the external untrusted area cannot obtain the private key information inside the file, so it is impossible to unlock the digital envelope and obtain the original prompt word data related information. Due to the memory encryption characteristics of the trusted execution environment, during the reasoning process of the large model, the external untrusted application cannot obtain the relevant information of the internal trusted execution environment, so there will be no privacy leakage related problems in the reasoning process. After the reasoning is completed, the reasoning result is encrypted by the symmetric key and returned to the untrusted area with the signature of the trusted execution environment. Since the symmetric encryption key is only known by the user and the trusted execution environment, the encrypted result cannot be obtained and cracked by the untrusted program, and the signature inside the trusted execution environment cannot be forged and tampered. Therefore, the reasoning result and signature can be safely transmitted back to the user, and the user finally uses the symmetric key to decrypt the reasoning result. Therefore, the present invention can ensure the security of the privacy prompt word during the reasoning process.

[0034] 2. Versatility and efficiency

[0035] Since the prompt word is transmitted and inferred in a directly encrypted manner, the present invention can be applied to any prompt word scenario. According to the GPU trusted execution environment test data, the secure operation will only cause 10%-20% performance loss compared with the plaintext operation. Therefore, the present invention can meet the efficiency requirements in actual application scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 It is a schematic diagram of the overall process of the present invention;

[0037] Figure 2 This is a schematic diagram of the identity authentication process of the present invention;

[0038] Figure 3 This is a schematic diagram of the encrypted prompt word transmission process of the present invention;

[0039] Figure 4 Schematic diagram of the security reasoning process of the present invention. DETAILED DESCRIPTION

[0040] The present invention is described in detail below in conjunction with the accompanying drawings and specific embodiments. This embodiment is implemented based on the technical solution of the present invention, and provides a detailed implementation method and specific operation process, but the protection scope of the present invention is not limited to the following embodiments.

[0041] Privacy computing refers to a series of information technologies that analyze and calculate data on the premise that the data provider does not leak the original data, ensuring that the data is "available but invisible" during the circulation and integration process. Privacy computing mainly includes solutions based on cryptographic protocols (such as homomorphic encryption and multi-party secure computing) and hardware security solutions based on trusted execution environments. Homomorphic encryption and secure multi-party computing solutions bring large performance overhead, making them difficult to deploy on a large scale and only applicable to relatively simple and limited use cases. In recent years, trusted execution environment technologies with higher performance and versatility have emerged in privacy protection solutions. Trusted execution environment refers to an isolated execution environment on a device that is independent of the operating system, which can ensure that data is stored, processed and protected in a secure environment. The security of trusted execution environment technology is usually guaranteed by hardware-related mechanisms. Common trusted execution environment technologies include Intel SGX, ARM TrustZone and Intel TDX. The present invention improves the existing large model reasoning process based on the above-mentioned trusted execution environment technology to effectively improve the reasoning security while ensuring the reasoning efficiency, including identity security, data transmission confidentiality and reasoning process security.

[0042] refer to Figure 1 As shown, this embodiment provides a large model security reasoning method based on a trusted execution environment. The method makes improvements in three aspects: identity authentication, data transmission, and security reasoning, thereby achieving security reasoning of large models.

[0043] 1. Identity Authentication

[0044] In order to pass the encrypted user prompt words to the trusted execution environment, the overall process needs to first identify the identity of each trusted execution environment. In the traditional system architecture, the certificate authority is responsible for issuing digital certificates to indicate the identity of each node. However, in this system, the model service provider may forge an identity to steal user information, so this system first needs a secure identity authentication solution.

[0045] Relying on the trusted execution environment as a carrier, we can design a secure key generation method. Since the code and data loaded into the trusted execution environment are audited, and when the trusted execution environment is created, the memory protection mechanism protects the security of the data inside the trusted execution environment, and external untrusted entities cannot know the internal data of the trusted execution environment, we can load the audited public-private key generation program into the trusted execution environment, generate a public-private key pair inside the trusted execution environment, and store the private key inside the trusted execution environment, and return the public key to the untrusted area to indicate the identity of the trusted execution environment.

[0046] In order to prevent the man-in-the-middle attack that may occur during the transmission of the public key, we consider using the remote authentication technology of the trusted execution environment to resist the man-in-the-middle attack. In remote authentication, the application can generate a report through the trusted execution environment and send the report to the internal authentication service to generate a certificate. The certificate reflects the information of the trusted execution environment and the entire platform. The complete identity authentication solution is as follows: Figure 2 shown.

[0047] refer to Figure 2 As shown in the figure, the overall authentication process is as follows:

[0048] (1) The large model service provider first loads the audited public-private key generation program into the trusted execution environment and runs the program to obtain the public-private key pair (SK TEE ,PK TEE ), the trusted execution environment stores the private key persistently through data sealing for future use in decrypting data;

[0049] (2) The large model service provider initiates remote authentication to the user and generates an authentication report within the trusted execution environment. The authentication content includes whether the large model service provider uses the correct public and private key generation program (the security zone measurement value of the current public and private key generation program is the same as the specified program) and related information within the trusted execution environment. At the same time, the report is accompanied by the public key hash value (PK TEE ) in order to verify the correctness of the public key later;

[0050] (3) After receiving the authentication report, the user forwards the report to the trusted execution environment authentication service to parse the report content;

[0051] (4) The user receives the report result analyzed by the authentication service;

[0052] (5) The user verifies the correctness and integrity of the trusted execution environment of the large model service provider according to the rules and report content specified by the user, thereby determining whether the remote authentication is successful;

[0053] (6) If the remote authentication is successful, the large model service provider sends its own public key PK to the user TEE ;

[0054] (7) After receiving the public key, the user verifies the correctness of the public key based on the public key hash value attached to the remote authentication report. If the two match, the verification is successful, and the user saves the trusted execution environment identity information of the large model service provider for subsequent use.

[0055] (II) Data transmission of encrypted prompt words

[0056] The identity authentication scheme provides identity identification for large model service providers. Each model inference node has a trusted public-private key pair after initializing the identity authentication. However, considering the efficiency of use in actual scenarios, symmetric encryption is several orders of magnitude faster than asymmetric encryption. Therefore, this scheme uses digital envelopes to transmit privacy prompts. Digital envelopes are a technology that encrypts symmetric encryption keys using asymmetric encryption and then transmits them. Digital envelopes not only take advantage of the fast speed and good security of symmetric encryption, but also take advantage of the more convenient key management in asymmetric encryption, effectively combining the advantages of symmetric encryption and asymmetric encryption. Encrypted prompt word transmission scheme such as Figure 3 shown.

[0057] refer to Figure 3 As shown, the overall data transmission solution process is as follows:

[0058] (1) The user retrieves the public key of the large model service provider and obtains PK TEE ;

[0059] (2) The user generates a random symmetric key k prompt And use k prompt Encrypt the prompt data you wish to transmit to the big model service provider;

[0060] (3) The user uses the public key PK obtained in the first step TEE , encrypt k prompt , forming a digital envelope;

[0061] (4) The user passes the encrypted data and digital envelope obtained in the second and third steps to the trusted execution environment of the large model service provider.

[0062] (III) Security Reasoning

[0063] The goal of the secure reasoning solution is to ensure that large model service providers can only operate on the ciphertext prompt words in the process of providing model services, and cannot know the relevant content of the inscription. After the reasoning is completed, the inference results are still presented in the form of ciphertext and sent to the user. Only the user can parse the ciphertext and obtain the final reasoning results. Figure 4 shown.

[0064] refer to Figure 4 As shown, the overall security reasoning solution process is as follows:

[0065] (1) The large model service provider loads the received encrypted data and digital envelope into the trusted execution environment;

[0066] (2) The large model service provider unseals the private key SK previously saved by the data sealing operation in the same trusted execution environmentTEE ;

[0067] (3) After the unblocking is successful, the large model service provider uses the private key SK in the trusted execution environment TEE Unlock the digital envelope and get the symmetric key k prompt ;

[0068] (4) Obtain the symmetric key k prompt Afterwards, the big model service provider decrypts the symmetrically encrypted data and obtains the original prompt;

[0069] (5) After obtaining the original prompt word, the large model service provider can perform model reasoning within the trusted execution environment and finally obtain the reasoning result result;

[0070] (6) The large model service provider uses the symmetric key k prompt Symmetrically encrypt the inference result generated in the fifth step;

[0071] (7) After obtaining the encrypted reasoning result, the large model service provider sends the encrypted reasoning result and the trusted execution environment's signature on the correctness of the encrypted reasoning result to the user;

[0072] (8) After the user obtains the encrypted inference result and the correctness signature, he first verifies the validity of the signature. If the verification passes, the user uses the symmetric key k prompt Decrypt and get the inference result.

[0073] Through the secure reasoning solution, the large model service provider decrypted and reasoned the ciphertext prompt word data, and finally returned the encrypted reasoning result and correctness signature. During the entire secure reasoning process, due to the relevant security features of the trusted execution environment, the service provider cannot know the relevant content of the plaintext prompt word, and after the reasoning is completed, the result is still presented in the form of ciphertext, and the service provider cannot parse the reasoning result and obtain relevant information.

[0074] Based on the improvements in the above three aspects, this embodiment can provide a large model security reasoning method based on a trusted execution environment. The method runs on a large model service provider server, and the large model service provider server is connected to a trusted execution environment, including the following steps:

[0075] Generate a trusted public-private key pair corresponding to the large model service provider through the trusted execution environment. In the public-private key pair, the public key is sent to the user end, and the private key is persistently stored in the trusted execution environment through data sealing;

[0076] Receiving encrypted data and digital envelope sent by the user end, wherein the encrypted data is prompt word data encrypted by a symmetric key, and the digital envelope is the symmetric key encrypted by a public key;

[0077] Obtain the original prompt word based on the encrypted data and the digital envelope through the trusted execution environment;

[0078] In the trusted execution environment, large model reasoning is performed based on the original prompt word, and the reasoning result encrypted by the symmetric key and the trusted execution environment signature are sent to the user end.

[0079] The above trusted public and private key pairs are Figure 2 The identity authentication process shown is obtained.

[0080] In another embodiment, a large model security reasoning method based on a trusted execution environment running on a large model service user client may be provided, comprising the following steps:

[0081] Retrieve the public key of the large model service provider, where the public key belongs to a trusted public-private key pair, where the private key is persistently stored in the trusted execution environment through data sealing;

[0082] Generate encrypted data and a digital envelope and send them to the large model service provider, wherein the encrypted data is the prompt word data encrypted by the symmetric key, and the digital envelope is the symmetric key encrypted by the public key;

[0083] Receiving the inference result encrypted by the symmetric key and the trusted execution environment signature, wherein the generation process of the inference result encrypted by the symmetric key includes: obtaining the original prompt word based on the encrypted data and the digital envelope through the trusted execution environment, performing large model inference based on the original prompt word in the trusted execution environment, obtaining the inference result and encrypting it;

[0084] The validity of the trusted execution environment signature is verified, and after the verification is passed, the encrypted reasoning result is decrypted using the symmetric key to obtain the final reasoning result.

[0085] The above trusted public and private key pairs are Figure 2 The identity authentication process shown is obtained.

[0086] If the above method is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0087] In another embodiment, a big model security reasoning system based on a trusted execution environment is also provided, including a big model service provider server, a big model service user client and a trusted execution environment, which jointly execute the big model security reasoning method based on the trusted execution environment as described above.

[0088] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0089] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0090] Although the preferred embodiments of the present invention have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0091] The preferred specific embodiments of the present invention are described in detail above. It should be understood that a person skilled in the art can make many modifications and changes based on the concept of the present invention without creative work. Therefore, any technical solution that can be obtained by a person skilled in the art through logical analysis, reasoning or limited experiments based on the concept of the present invention on the basis of the prior art should be within the scope of protection determined by the claims.

Claims

1. A large model security reasoning method based on a trusted execution environment, characterized in that: The following steps are involved: Generate a trusted public-private key pair corresponding to the large model service provider through a trusted execution environment, wherein the public key is sent to the user end, and the private key is persistently stored in the trusted execution environment through data sealing; Receiving encrypted data and a digital envelope sent by a user terminal, wherein the encrypted data is prompt word data encrypted by a symmetric key, and the digital envelope is the symmetric key encrypted by the public key; Obtaining, through the trusted execution environment, an original prompt word based on the encrypted data and the digital envelope; In the trusted execution environment, large model reasoning is performed based on the original prompt word, and the reasoning result encrypted by the symmetric key and the trusted execution environment signature are sent to the user end.

2. The large model security reasoning method based on a trusted execution environment according to claim 1 is characterized in that: The process of generating the trusted public-private key pair includes: Loading a public-private key generation program in the trusted execution environment to randomly generate a public-private key pair; Generate an authentication report in the trusted execution environment based on the correctness of the use of the public and private key generation program, relevant information within the trusted execution environment, and the public key hash value, and send it to the user end; Determine whether the remote authentication pass information fed back by the user end is received. If so, use the current public-private key pair as a trusted public-private key pair. If not, regenerate the public-private key pair through the public-private key generation program.

3. The large model security reasoning method based on a trusted execution environment according to claim 2 is characterized in that: After receiving the authentication report, the user terminal parses the report in the trusted execution environment and determines whether the remote authentication is passed based on the correctness and completeness of the authentication report.

4. The large model security reasoning method based on a trusted execution environment according to claim 2 is characterized in that: When the user terminal receives the public key, it verifies the correctness of the public key based on the public key hash value in the authentication report, and saves the public key if the verification is successful.

5. The large model security reasoning method based on a trusted execution environment according to claim 2 is characterized in that: The public and private key generation procedure is an audited procedure.

6. The large model security reasoning method based on a trusted execution environment according to claim 2 is characterized in that: When generating the authentication report, if the security zone measurement value of the current public-private key generation program is the same as the specified program, it is determined that the public-private key generation program is used correctly.

7. The large model security reasoning method based on a trusted execution environment according to claim 1 is characterized in that: The process of obtaining the original prompt word based on the encrypted data and the digital envelope includes: In the trusted execution environment, decrypting the digital envelope using the decrypted private key to obtain a symmetric key; The encrypted data is decrypted based on the symmetric key to obtain the original prompt word.

8. The large model security reasoning method based on a trusted execution environment according to claim 1 is characterized in that: The user end verifies the validity of the trusted execution environment signature, and after the verification is passed, uses the symmetric key to decrypt the encrypted reasoning result to obtain the final reasoning result.

9. A computer-readable storage medium, characterized in that: It includes one or more programs for execution by one or more processors of an electronic device, and the one or more programs include instructions for executing the large model security reasoning method based on a trusted execution environment as described in any one of claims 1-8.

10. An electronic device, characterized in that: It includes one or more processors, a memory and one or more programs stored in the memory, and the one or more programs include instructions for executing the large model security reasoning method based on a trusted execution environment as described in any one of claims 1-8.

Images