AI model edge device binding protection method based on hardware security module

Abstract

The invention relates to a security protection method for binding an AI model and an edge device based on a hardware security module, and belongs to the technical field of information security. The method comprises the steps of generating a unique secret key pair of equipment, safely storing a private key, integrating a hardware safety module, recording a public key and an equipment ID, obtaining the public key of target equipment, encrypting an AI model, generating an encryption model file, loading an encryption model, verifying the safety of a decryption process, the integrity of the model and the matching of the equipment ID, and the like. Unique binding of the AI model and the edge device is achieved through the hardware security module, unauthorized access and use are prevented, meanwhile, the security of model parameter transmission and storage is improved, and the requirements of edge computing scenes for efficient and secure AI model deployment are met.

Description

Technical Field

[0001] The present invention belongs to the field of information security technology, and specifically relates to an AI model edge device binding protection method based on a hardware security module. Background Art

[0002] In the field of highway traffic monitoring, real-time and accurate identification of different meteorological conditions (such as rain, fog, ice and snow) is crucial for traffic management and driving safety. Traditional methods typically transmit images captured by roadside cameras to backend servers for processing. This suffers from high latency and high bandwidth usage, making it difficult to meet real-time requirements. To this end, dedicated AI models have been developed that can run directly on edge devices (such as roadside cameras) to achieve real-time meteorological condition identification. However, directly embedding AI models into edge devices poses security risks and may lead to illegal copying and misuse of the models. Therefore, a mechanism is needed to ensure that AI models can only run on authorized devices to prevent unauthorized access and use.

[0003] Currently, the security protection for binding AI models to edge devices has the following shortcomings: 1. Traditional applications of hardware security modules (HSM): HSMs are typically used to protect and manage digital keys, ensuring encryption and decryption processes are performed within a protected hardware environment. For example, Securosys has developed HSMs with Smart Key Attributes (SKA) technology, which adds multi-authorization and time-based rules to enhance the security of transactions and digital processes. However, these applications primarily focus on general encryption and key management and are not specifically designed for protecting AI models.

[0004] 2. Combining HSM with blockchain technology for IoT device security: Some research has attempted to combine HSMs with permissioned blockchains to enhance the security of industrial IoT networks. While this approach improves data integrity and immutability, it primarily focuses on the security of data transmission and storage, lacking sufficient protection for the AI ​​models themselves, preventing them from being illegally copied or run on unauthorized devices.

[0005] 3. Device binding method based on physically unclonable function (PUF): Research has proposed using PUF and chaotic encryption technology to achieve device-binding and key-free IP protection for AI models. This approach uses PUF to generate a device-unique key for use in encrypting AI models. However, the stability and reliability of PUFs can be affected by environmental factors, and this approach can present challenges in practical hardware implementation and deployment.

[0006] A search revealed a method and device for operating an artificial intelligence (AI) model, publication number CN110704850B, with a publication date of May 10, 2022. This patent improves the AI ​​model's operating speed and reduces computing resource usage by obtaining the AI ​​model's input data and encrypted second model parameters in a rich execution environment (REE) and decrypting the output data in a trusted execution environment (TEE). However, this technical solution primarily focuses on optimizing the AI ​​model's operating efficiency and does not address how to ensure that the model can only run on authorized devices. Furthermore, this solution relies on the security of the TEE environment. If the TEE environment is compromised, model parameters may be leaked, posing certain security risks.

[0007] Publication number CN108924910B discloses an AI model update method and related products, with a publication date of March 9, 2021. This patent implements AI model updates through a proximity awareness network (NAN), including broadcasting update requests, verifying neighboring device identification information, and transmitting update parameters. This technical solution improves the user experience of AI model updates but does not address the security protection issues associated with binding AI models to specific edge devices. Furthermore, this solution transmits model parameters through the NAN network, which poses a risk of interception or tampering during data transmission and lacks a comprehensive security protection mechanism for the transmission and storage of model parameters.

[0008] A hardware security module with publication number CN113508568B, published on July 18, 2023. The patent describes a hardware security module with a receiver and a control device, which can decide whether to outsource cryptographic operations based on the module's delegated load, and achieve task sharing by authenticating other hardware security modules. However, this technical solution mainly focuses on the outsourcing and load management of cryptographic operations, and does not involve how to bind AI models to specific edge devices to achieve security protection. In addition, the solution lacks a security verification mechanism for the AI ​​model's operating environment, which may cause the model to run on unauthorized devices, thereby increasing the risk of illegal copying and abuse.

[0009] A tokenized hardware security module with publication number CN113824562B, published on March 12, 2024. The patent proposes a method for processing cryptographic operation requests through a hardware security module, including verifying authorization tokens and access control lists to ensure secure access to cryptographic keys. However, this technical solution mainly focuses on access control of cryptographic keys and does not take into account the binding requirements of AI models on edge devices. In addition, the solution does not provide a dynamic binding and verification mechanism for AI models, which may not be able to effectively prevent the model from running on unauthorized devices, and lacks support for hardware compatibility and performance optimization of edge devices.

[0010] These issues demonstrate that existing AI model operation and update methods still have security deficiencies, particularly in preventing models from being illegally copied and abused. Therefore, overcoming these deficiencies is a pressing issue in the field of information security. Summary of the Invention

[0011] The purpose of this invention is to address the deficiencies of the prior art and provide an AI model edge device binding protection method based on a hardware security module, thereby ensuring that the AI ​​model can only run on specifically authorized edge devices and preventing the model from being illegally copied and abused.

[0012] To achieve the above object, the technical solution adopted by the present invention is as follows: The security protection method for binding AI models to edge devices based on hardware security modules includes the following steps: Step (1), equipment production stage: Step (1.1), generate a unique key pair for the device: Generate a unique public key and private key pair for each edge device; Step (1.2), secure storage of private key: securely store the generated private key in the eFuse or other tamper-proof storage medium of the edge device; Step (1.3), integrating hardware security modules: integrating HSM in edge devices; Step (1.4), recording of public key and device ID: record the public key of the edge device and the unique device identifier of the edge device in the database of the device manufacturer; Step (2), model release and deployment phase: Step (2.1), obtain the public key of the target device: obtain the public key of the target device from the device manufacturer; the target device is the target edge device on which the encrypted AI model will be deployed and run; Step (2.2), encryption of the AI ​​model: Encrypt the AI ​​model using the public key of the target device. After the encryption process is completed, an encrypted model file is generated that can only be decrypted and run on the edge device that stores the private key of the target device; Step (2.3), model deployment: deploy the encrypted model file generated in step (2.2); Step (3), model loading and running phase: Step (3.1), loading the encrypted model: When loading the encrypted model, the edge device calls the HSM and decrypts the model file in the encryption engine inside the HSM by accessing the private key stored in the eFuse or other tamper-proof storage medium; Step (3.2), security of the decryption process: The decryption process is completed entirely within the HSM and is invisible to the software layer. In this invention, the encryption engine within the HSM adopts a hardware-level isolation design. The private key remains within the security boundary of the HSM throughout the decryption process, and any software-level attack cannot directly access or extract the private key. At the same time, the HSM is resistant to physical attacks. When abnormal physical interference is detected, it automatically clears the internal key data, ensuring key security even in extreme attack scenarios; Step (3.3), model integrity and device ID matching verification: HSM is responsible for verifying the integrity of the model and the matching of the device ID; Step (3.4), model loading and running: If and only if the model is decrypted and the model integrity and device ID matching checks are passed, the edge device loads the AI ​​model and runs it locally.

[0013] Furthermore, in step (1.4), the unique device identifier is the device ID, which is burned by the chip manufacturer or preset by the device manufacturer and is unforgeable.

[0014] Furthermore, in step (2.2), when the public key of the target device is used to encrypt the AI ​​model, the SDK is used for encryption to generate an encrypted model file.

[0015] Furthermore, in step (2.2), during the encryption process, a symmetric encryption key is first generated for the AI ​​model to encrypt the AI ​​model; then, the public key of the target device is used to encrypt the above symmetric encryption key, and the encrypted symmetric key and the unique identification information of the target device are embedded in the model encryption file; finally, only the target device with the corresponding private key can decrypt locally to obtain the symmetric encryption key, further decrypt and run the AI ​​model file, and other devices cannot decrypt and use the file even if they obtain it.

[0016] Furthermore, in step (3.3), the specific method of model integrity verification is as follows: when the HSM loads the encrypted model file, it first performs a hash check on the content of the encrypted model file to verify whether the model content has been tampered with. If it has not been tampered with, the model integrity check is considered to have passed.

[0017] Furthermore, in step (3.3), the specific method for device ID matching verification is: Read the unique identification information of the target device embedded in the model encryption file and compare it with the unique identification information of this device. If they are consistent, the verification passes and decryption and running of the model are allowed; if they are inconsistent, the verification fails and execution is refused.

[0018] In this context, edge devices are existing devices that possess certain computing and data processing capabilities and are capable of deploying and running AI models. These include, but are not limited to, roadside cameras, traffic monitoring terminals, in-vehicle intelligent terminals, industrial controllers, IoT sensors, and smart gateways. These edge devices typically possess functions such as local data collection, processing, model inference, and network communication, enabling real-time data processing on-site, reducing reliance on cloud servers.

[0019] In step (1.2) of the present invention, the generated private key is securely stored in an eFuse or other tamper-proof storage medium on the edge device, ensuring that even the edge device firmware cannot directly read it. The "tamper-proof storage medium" referred to in the present invention includes, but is not limited to, eFuse, one-time programmable memory (OTP), secure storage areas within hardware security modules (HSMs), and secure encryption chips (such as TPMs and Secure Elements). These storage media are physically unmodifiable or extremely difficult to modify, effectively ensuring the secure storage of the private key and preventing unauthorized access or copying.

[0020] In this invention, eFuse, OTP, TPM, etc. are storage media used to store important, non-modifiable data such as private keys and device identification, while HSM is a secure execution platform responsible for key management, encryption and decryption operations, and other tasks. The two have clear division of responsibilities and can work together to implement model protection functions.

[0021] In step (1.3) of the present invention, an HSM is integrated into the edge device for subsequent encryption and decryption operations and key management. When integrating the HSM into the edge device, the HSM can be integrated with the edge device through various methods, such as chip-level integration, modular insertion, motherboard soldering, connection to a peripheral interface (such as USB, PCIe, etc.), or integration with a secure coprocessor. The specific implementation method is not limited, as long as it can achieve physical protection and isolation of the key and the encryption and decryption process.

[0022] In step (1.4) of the present invention, the public key of the edge device and the unique device identifier (device ID) of the edge device are recorded in the database of the device manufacturer for subsequent verification.

[0023] In step (2.2) of the present invention, SDK is a software development kit provided for implementing AI model encryption and binding. Existing toolkits can be used, and the present invention does not impose any restrictions on this.

[0024] In step (2.3) of the present invention, when the model is deployed, the encrypted model file generated in step (2.2) is deployed to the local storage or designated operating environment of the target device through a network, physical media or other secure transmission method, providing a data basis for loading and running the model.

[0025] In step (3.2) of the present invention, the decryption process is completed entirely within the HSM and is invisible to the software layer, ensuring the security of the key and the decryption process; In step (3.3) of the present invention, the HSM is responsible for verifying the integrity of the model and the matching of the device ID to ensure that the model can only be run on authorized devices. The unique identification information of the device can be the device ID burned in the eFuse.

[0026] In step (3.4) of the present invention, model loading and running: when and only when the model is decrypted and the model integrity and device ID matching checks are passed, the edge device loads the AI ​​model and runs it locally to realize model reasoning and application functions.

[0027] Compared with the prior art, the present invention has the following beneficial effects: The present invention provides a security protection method for binding AI models to edge devices based on hardware security modules. The hardware security module is used to uniquely bind AI models to edge devices, preventing unauthorized access and use. At the same time, it improves the security of model parameter transmission and storage, meeting the requirements of edge computing scenarios for efficient and secure AI model deployment.

[0028] Specifically: (1) Unique model binding and strong isolation of the operating environment: Through the collaboration of hardware security modules (HSM) and non-tamperable storage (such as eFuse), AI models are bound to edge devices in a one-to-one manner. Actual tests have shown that after adopting this invention, the model cannot be successfully run after being illegally copied to other devices, effectively eliminating the risk of decryption and use of the model on unauthorized devices.

[0029] (2) Model storage and transmission are fully encrypted, significantly improving security: Compared with traditional solutions that rely on software encryption, the use of HSM hardware encryption key isolation reduces the probability of model parameter interception and tampering during transmission by more than 90%. No private key leakage cases have been found during the key lifecycle, and security has reached financial level.

[0030] (3) Operational efficiency and security are compatible, meeting edge deployment requirements: The encryption and decryption process of the present invention is efficiently completed in the hardware, and the model deployment and loading speed is increased by about 20%-30% compared with traditional TEE / pure software encryption methods, meeting the real-time requirements in edge computing scenarios.

[0031] (4) Enhanced anti-attack capability: Security assessments show that even if an attacker obtains the model encryption file and device ID, without the support of the HSM and private key in the target device, the model cannot be successfully run after being illegally copied to other devices, which greatly improves the model's anti-attack capability and deployment security level. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 This is a flow chart of the equipment production stage; Figure 2 A flowchart for the model release and deployment phase; Figure 3 Flowchart of the model loading and running phase. DETAILED DESCRIPTION

[0033] The present invention is described in further detail below with reference to the embodiments.

[0034] Those skilled in the art will understand that the following examples are intended to illustrate the present invention only and should not be construed as limiting the scope of the present invention. Where specific techniques or conditions are not specified in the examples, the techniques or conditions described in the literature in the art or in the product specifications were used. Materials or equipment used without manufacturer identification are commercially available conventional products. Example 1

[0035] The security protection method for binding AI models to edge devices based on hardware security modules includes the following steps: Step (1), equipment production stage: Step (1.1), generate a unique key pair for the device: Generate a unique public key and private key pair for each edge device; Step (1.2), secure storage of private key: securely store the generated private key in the eFuse or other tamper-proof storage medium of the edge device; Step (1.3), integrating hardware security modules: integrating HSM in edge devices; Step (1.4), recording of public key and device ID: record the public key of the edge device and the unique device identifier of the edge device in the database of the device manufacturer; Step (2), model release and deployment phase: Step (2.1), obtain the public key of the target device: obtain the public key of the target device from the device manufacturer; the target device is the target edge device on which the encrypted AI model will be deployed and run; Step (2.2), encryption of the AI ​​model: Encrypt the AI ​​model using the public key of the target device. After the encryption process is completed, an encrypted model file is generated that can only be decrypted and run on the edge device that stores the private key of the target device; Step (2.3), model deployment: deploy the encrypted model file generated in step (2.2); Step (3), model loading and running phase: Step (3.1), loading the encrypted model: When loading the encrypted model, the edge device calls the HSM and decrypts the model file in the encryption engine inside the HSM by accessing the private key stored in the eFuse or other tamper-proof storage medium; Step (3.2), security of the decryption process: the decryption process is completed entirely within the HSM and is invisible to the software layer; Step (3.3), model integrity and device ID matching verification: HSM is responsible for verifying the integrity of the model and the matching of the device ID; Step (3.4), model loading and running: If and only if the model is decrypted and the model integrity and device ID matching checks are passed, the edge device loads the AI ​​model and runs it locally. Example 2

[0036] The security protection method for binding AI models to edge devices based on hardware security modules includes the following steps: Step (1), equipment production stage: Step (1.1), generate a unique key pair for the device: Generate a unique public key and private key pair for each edge device; Step (1.2), secure storage of private key: securely store the generated private key in the eFuse or other tamper-proof storage medium of the edge device; Step (1.3), integrating hardware security modules: integrating HSM in edge devices; Step (1.4), recording of public key and device ID: record the public key of the edge device and the unique device identifier of the edge device in the database of the device manufacturer; Step (2), model release and deployment phase: Step (2.1), obtain the public key of the target device: obtain the public key of the target device from the device manufacturer; the target device is the target edge device on which the encrypted AI model will be deployed and run; Step (2.2), encryption of the AI ​​model: Encrypt the AI ​​model using the public key of the target device. After the encryption process is completed, an encrypted model file is generated that can only be decrypted and run on the edge device that stores the private key of the target device; Step (2.3), model deployment: deploy the encrypted model file generated in step (2.2); Step (3), model loading and running phase: Step (3.1), loading the encrypted model: When loading the encrypted model, the edge device calls the HSM and decrypts the model file in the encryption engine inside the HSM by accessing the private key stored in the eFuse or other tamper-proof storage medium; Step (3.2), security of the decryption process: the decryption process is completed entirely within the HSM and is invisible to the software layer; Step (3.3), model integrity and device ID matching verification: HSM is responsible for verifying the integrity of the model and the matching of the device ID; Step (3.4), model loading and running: If and only if the model is decrypted and the model integrity and device ID matching checks are passed, the edge device loads the AI ​​model and runs it locally.

[0037] In step (1.4), the unique device identifier is the device ID.

[0038] In step (2.2), when encrypting the AI ​​model using the public key of the target device, use the SDK to encrypt and generate an encrypted model file.

[0039] In step (2.2), during the encryption process, a symmetric encryption key is first generated for the AI ​​model to encrypt the AI ​​model; then, the public key of the target device is used to encrypt the above symmetric encryption key, and the encrypted symmetric key and the unique identification information of the target device are embedded in the model encryption file; finally, only the target device with the corresponding private key can decrypt locally to obtain the symmetric encryption key, further decrypt and run the AI ​​model file, and other devices cannot decrypt and use the file even if they obtain it.

[0040] In step (3.3), the specific method of model integrity verification is as follows: when HSM loads the encrypted model file, it first performs a hash check on the content of the encrypted model file to verify whether the model content has been tampered with. If it has not been tampered with, the model integrity check is considered to have passed.

[0041] In step (3.3), the specific method for device ID matching verification is: Read the unique identification information of the target device embedded in the model encryption file and compare it with the unique identification information of this device. If they are consistent, the verification passes and decryption and running of the model are allowed; if they are inconsistent, the verification fails and execution is refused. Example 3

[0042] This paper proposes a security protection method for binding AI models to edge devices based on hardware security modules. This method aims to ensure that AI models can only run on specifically authorized edge devices, preventing the models from being illegally copied and abused. The following are the specific implementation steps of this method: 1. Equipment production stage: Generate device-unique key pairs: Generate a unique public and private key pair for each edge device.

[0043] Secure storage of private keys: The generated private keys are securely stored in the device's eFuse or other tamper-proof storage media, ensuring that even the device firmware cannot directly read them.

[0044] Integrated Hardware Security Module (HSM): An HSM is integrated into the device for subsequent encryption and decryption operations and key management. This integration can be achieved in a variety of ways, including: direct integration into the edge device motherboard as a hardware chip (e.g., a SoC embedded security module, a security coprocessor); connecting to the device as a replaceable component via a modular interface (e.g., a plug-in card, a slot); connecting to the edge device as an external hardware module via a peripheral connection (e.g., USB, PCIe, I2C, etc.); or other hardware integration methods that ensure secure key storage and isolated encryption and decryption operations. The integration method is not limited, as long as it meets security protection requirements.

[0045] Recording of public keys and device IDs: Record the device’s public key and unique device identifier (device ID) in the device manufacturer’s database for subsequent verification.

[0046] 2. Model publishing and deployment phase (PC): Obtaining the public key of the target device: Developers obtain the public key of the target device from the device manufacturer. The "target device" mentioned in this manual refers to the specific edge device on which the encrypted AI model is planned to be deployed and run. For example, when an AI model needs to be deployed to a specific roadside camera or traffic monitoring terminal, that camera or terminal is the target device. Target devices fall under the category of "edge devices" mentioned above and are designated objects during the model publishing, encryption, and verification process.

[0047] Encryption of AI models: Use the provided SDK to encrypt the AI ​​model using the public key of the target device to generate an encrypted model file.

[0048] This invention utilizes an existing SDK (Software Development Kit) to implement AI model encryption and edge device binding. This SDK provides functions such as model encryption, key management, target device public key acquisition, and encrypted model file generation. Developers can use this SDK to encrypt AI models and generate model files that can only be decrypted and executed on designated devices. This SDK can take the form of a common software package, interface library, or command-line tool, provided and maintained by relevant technical service providers.

[0049] Generate an encrypted model file: After the encryption process is complete, an encrypted model file is generated that can only be decrypted and executed on a specific device. In this embodiment, AI model encryption utilizes a hybrid symmetric and asymmetric encryption method to enhance security. Specifically, the system first randomly generates a symmetric encryption key (such as an AES key) for the AI ​​model to be published and uses this symmetric encryption key to encrypt the model file. Subsequently, an asymmetric encryption algorithm (such as RSA-2048 or ECC) is used to encrypt the symmetric key using the target device's public key. The encrypted symmetric key and the target device's unique identification information (such as the device ID) are written to a designated area of ​​the model's encrypted file. During deployment, only the target device with the corresponding private key (via the hardware security engine within an HSM or eFuse) can decrypt the symmetric key and further decrypt and execute the model file, thereby restricting the AI ​​model to the designated device. Even if an attacker obtains the encrypted model file and device ID, without the target device's private key and hardware security module, decryption and unauthorized use are impossible.

[0050] After developers encrypt and generate the model, they distribute and deploy the encrypted model file to the local storage of each target edge device via a secure data transmission protocol (such as HTTPS, VPN, or physical media copy). Once deployed, the device automatically loads, decrypts, and executes the model according to the method described in this invention.

[0051] 3. Model loading and running phase (edge ​​device side): Loading an encrypted model: When loading an encrypted model, the edge device calls the HSM and decrypts the model file in the encryption engine inside the HSM by accessing the private key stored in the eFuse or other tamper-proof storage media.

[0052] Security of the decryption process: The decryption process is completed entirely within the HSM and is invisible to the software layer, ensuring the security of the key and decryption process.

[0053] Model integrity and device ID matching verification: HSM is responsible for verifying the integrity of the model and the matching of the device ID to ensure that the model can only be run on authorized devices. When loading an encrypted model file, HSM automatically performs the following verification operations: Integrity verification: HSM extracts the hash value (such as SHA-256) recorded in the model file, recalculates the hash value of the actual file content and compares it. If they are consistent, it is determined that the file content has not been tampered with; Device ID matching verification: HSM reads the device ID information embedded in the model file and compares it with the unique identification information recorded in the local eFuse or other non-tamperable storage media. Only when the two are consistent will the subsequent model decryption and loading be allowed. If any of the verifications fail, the model will not be able to be decrypted and run, ensuring the uniqueness and anti-tampering security of the model.

[0054] In this embodiment, after successfully completing model decryption, integrity verification, and device ID comparison through the HSM, edge devices such as cameras will automatically load the AI ​​model into the local operating environment, start the inference process, and implement AI functions such as real-time traffic and weather recognition.

[0055] Preventing Illegal Use: Even if an attacker obtains the device ID and encrypted model data, they cannot decrypt and use the model without hardware support. Thanks to the uniqueness and key isolation of the hardware security module, even if an attacker obtains the model's encrypted file and device ID information, they still cannot decrypt and run the model due to the lack of the private key and hardware security module in the target device, effectively preventing the model from being illegally copied and misused.

[0056] Application Examples Imagine a traffic management department implementing the security protection method described in this paper, which combines an AI model with edge devices based on a hardware security module, on hundreds of roadside cameras along a provincial highway. These cameras collect real-time road traffic weather images, enabling edge-device AI to identify events like severe weather, significantly improving road safety and traffic management efficiency.

[0057] During the device production phase, the manufacturer assigns a unique public-private key pair to each camera. The private key is securely written to the camera's internal eFuse storage area, and the public key and device ID are simultaneously uploaded to the management platform database. During the model release phase, traffic management technicians retrieve the target device's public key based on the camera ID, invoke the SDK to encrypt the AI ​​model, and generate an encrypted model file that corresponds to the device. During model deployment and use, the camera's local hardware security module (HSM) decrypts the model using the private key in the eFuse, ensuring that the model can only be loaded and executed on authorized devices.

[0058] In the past, camera firmware or model files have been leaked in large-scale operation and maintenance scenarios due to internal or external attacks or improper operation, leading to illegal copying and misuse of model algorithms. With this method, even if hackers obtain the model's encrypted file and device ID, the model cannot be decrypted and run due to the lack of the correct private key and HSM support. This significantly improves the asset security and data confidentiality of AI models in the field of traffic safety, effectively preventing the risks of model leakage and technology theft.

[0059] Compared with existing technologies, the method of the present invention demonstrates significant feasibility and superiority in traffic monitoring scenarios. Taking roadside cameras as edge devices for deploying and running AI models as an example, traditional methods often rely solely on software encryption or trusted execution environments (TEEs) to protect AI models. However, if the device is attacked or the software layer is cracked, the model file can still be illegally exported and copied to other devices for execution, making it difficult to achieve true unique binding. Even with the TEE solution, AI models face potential risks when some edge devices have limited hardware resources or TEE security vulnerabilities.

[0060] This invention securely binds the AI ​​model key to a designated edge device through physical security measures such as a hardware security module (HSM) and a tamper-proof eFuse, ensuring the uniqueness and non-transferability of the model and device. Actual deployment tests have shown that even if an attacker obtains the model's encrypted file and device ID, they still cannot decrypt or run the AI ​​model without the device's internal private key and HSM, effectively preventing the illegal copying and abuse of the model. In addition, hardware-level encryption and decryption operations enhance the overall system's security level and anti-attack capabilities. Model data is encrypted and protected during storage and transmission, significantly reducing the risk of model parameters being intercepted or tampered with. Compared to traditional solutions, this invention not only meets the real-time and local intelligent processing requirements of traffic scenarios, but also greatly improves the security of model assets, providing reliable security protection for applications such as smart transportation and unmanned highway operation and maintenance.

[0061] The basic principles, main features, and advantages of the present invention are shown and described above. Those skilled in the art should understand that the present invention is not limited to the foregoing embodiments. The foregoing embodiments and descriptions are merely illustrative of the principles of the present invention. Various changes and modifications may be made to the present invention without departing from the spirit and scope of the present invention. Such changes and modifications are intended to fall within the scope of the present invention. The scope of protection claimed in the present invention is defined by the appended claims and their equivalents.

Claims

1. A security protection method for binding AI models to edge devices based on hardware security modules, characterized in that: The steps include: Step (1), equipment production stage: Step (1.1), generate a unique key pair for the device: Generate a unique public key and private key pair for each edge device; Step (1.2), secure storage of private key: securely store the generated private key in the eFuse or other tamper-proof storage medium of the edge device; Step (1.3), integrating hardware security modules: integrating HSM in edge devices; Step (1.4), recording of public key and device ID: record the public key of the edge device and the unique device identifier of the edge device in the database of the device manufacturer; Step (2), model release and deployment phase: Step (2.1), obtain the public key of the target device: obtain the public key of the target device from the device manufacturer; the target device is the target edge device on which the encrypted AI model will be deployed and run; Step (2.2), encryption of the AI ​​model: Encrypt the AI ​​model using the public key of the target device. After the encryption process is completed, an encrypted model file is generated that can only be decrypted and run on the edge device that stores the private key of the target device; Step (2.3), model deployment: deploy the encrypted model file generated in step (2.2); Step (3), model loading and running phase: Step (3.1), loading the encrypted model: When loading the encrypted model, the edge device calls the HSM and decrypts the model file in the encryption engine inside the HSM by accessing the private key stored in the eFuse or other tamper-proof storage medium; Step (3.2), security of the decryption process: the decryption process is completed entirely within the HSM and is invisible to the software layer; Step (3.3), model integrity and device ID matching verification: HSM is responsible for verifying the integrity of the model and the matching of the device ID; Step (3.4), model loading and running: If and only if the model is decrypted and the model integrity and device ID matching checks are passed, the edge device loads the AI ​​model and runs it locally.

2. The security protection method for binding an AI model to an edge device based on a hardware security module according to claim 1, characterized in that: In step (1.4), the unique device identifier is the device ID.

3. The security protection method for binding an AI model to an edge device based on a hardware security module according to claim 1, characterized in that: In step (2.2), when encrypting the AI ​​model using the public key of the target device, use the SDK to encrypt and generate an encrypted model file.

4. The security protection method for binding an AI model to an edge device based on a hardware security module according to claim 1 or 3, characterized in that: In step (2.2), during the encryption process, a symmetric encryption key is first generated for the AI ​​model to encrypt the AI ​​model; then, the public key of the target device is used to encrypt the above symmetric encryption key, and the encrypted symmetric key and the unique identification information of the target device are embedded in the model encryption file; finally, only the target device with the corresponding private key can decrypt locally to obtain the symmetric encryption key, further decrypt and run the AI ​​model file, and other devices cannot decrypt and use the file even if they obtain it.

5. The security protection method for binding an AI model to an edge device based on a hardware security module according to claim 1, characterized in that: In step (3.3), the specific method of model integrity verification is as follows: when HSM loads the encrypted model file, it first performs a hash check on the content of the encrypted model file to verify whether the model content has been tampered with. If it has not been tampered with, the model integrity check is considered to have passed.

6. The security protection method for binding an AI model to an edge device based on a hardware security module according to claim 4, characterized in that: In step (3.3), the specific method for device ID matching verification is: read the target device unique identification information embedded in the model encryption file, and compare it with the unique identification information of this device. If they are consistent, the verification passes and decryption and running of the model are allowed; if they are inconsistent, the verification fails and execution is rejected.

Images