Model reasoning method, model encryption method, electronic equipment and storage medium

Abstract

The invention discloses a model reasoning method, a model encryption method, electronic equipment and a storage medium, and belongs to the technical field of artificial intelligence. The method comprises the following steps: a main control chip receives a model encryption packet sent by a server; the main control chip calls the security chip to decrypt the symmetric key; the security chip decrypts the model encryption packet by using the symmetric key to obtain a model plaintext file, a model configuration file and a signature value, and stores the model plaintext file, the model configuration file and the signature value in a storage device; the master control chip verifies the signature of the model plaintext file and the model configuration file, and verifies the identity label of the terminal equipment under the condition that the signature verification is passed; and loading the model plaintext file for reasoning under the condition that the verification of the identity label of the terminal equipment is passed. The risk that the model is tampered or abused is reduced, the model is effectively protected, the reliability of the model reasoning result is improved, and the method can be used for various application scenes and is high in universality.

Description

Technical Field

[0001] The present application belongs to the field of artificial intelligence technology, and in particular relates to a model reasoning method, a model encryption method, an electronic device, and a storage medium. Background Art

[0002] With the widespread application of artificial intelligence technology in key areas such as autonomous driving and medical diagnosis, the security of AI models has become a critical issue. Malicious tampering, theft, or abuse of models not only infringes on the intellectual property rights of the model owner but may also cause serious security issues. Although a variety of model protection solutions have emerged, these solutions still have certain limitations. For example, solutions based on access control controllers and memory controllers require hardware design adjustments, which limits their versatility. Solutions based on Trusted Execution Environments (TEEs) are limited by computing power resources and cannot meet the high-performance computing requirements of large models. Solutions that obfuscate models and outputs in rich execution environments (REEs) have problems with high computational costs and high implementation complexity. Summary of the Invention

[0003] This application aims to address at least one of the technical problems existing in the related art. To this end, this application proposes a model inference method, a model encryption method, an electronic device, and a storage medium, which reduce the risk of model tampering or abuse, effectively protect the model, and thus improve the reliability of the model inference results. The method can be used in a variety of application scenarios and has strong versatility.

[0004] In a first aspect, the present application provides a model reasoning method, which is applied to a terminal device, wherein the terminal device includes a main control chip, a security chip, and a storage device, and the method includes:

[0005] The main control chip receives a model encryption package sent by the server, wherein the model encryption package includes an encrypted model plaintext file, a model configuration file, and a signature value, wherein the model configuration file includes an identity identifier of the terminal device;

[0006] The main control chip calls the security chip to use the first private key to decrypt the symmetric key from the model encryption package;

[0007] The security chip decrypts the model encryption package using the symmetric key to obtain a model plaintext file, a model configuration file, and a signature value, and stores the model plaintext file, the model configuration file, and the signature value in the storage device;

[0008] The main control chip verifies the signature of the model plaintext file and the model configuration file according to the second public key based on the signature value;

[0009] If the signature verification is successful, the main control chip verifies the terminal device identity according to the terminal device identity verification logic;

[0010] When the terminal device identity verification is passed, the main control chip loads the model plaintext file for inference.

[0011] In the above technical solution, the main control chip receives the model encryption package sent by the server, and the model encryption package includes the encrypted model plaintext file, model configuration file and signature value. The model configuration file includes the terminal device identity identification. The main control chip calls the security chip to use the first private key to decrypt the symmetric key from the model encryption package. The security chip uses the symmetric key to decrypt the model encryption package to obtain the model plaintext file, model configuration file and signature value, and stores the model plaintext file, model configuration file and signature value in the storage device. The main control chip verifies the model plaintext file and model configuration file based on the signature value and the second public key. If the signature verification passes, the main control chip verifies the terminal device identity identification according to the terminal device identity verification logic. The identification is verified. When the terminal device identity verification passes, the main control chip loads the model plaintext file for inference. This application uses the terminal device identity to implement a binding mechanism, which can effectively prevent the model from being illegally abused. Even if the attacker manages to copy or steal the original model file, he cannot successfully run the model on other unauthorized terminal devices. In addition, the built-in signature verification mechanism makes it impossible to maliciously modify the model and configuration files. By verifying the signature, verifying the terminal device identity, and transmitting the model files and configuration files in ciphertext, the risk of the model being tampered with or abused is reduced, and effective protection of the model is achieved, thereby improving the reliability of the model inference results. It can be used in a variety of application scenarios and has strong versatility.

[0012] According to one embodiment of the present application, when the signature verification passes, the main control chip verifies the terminal device identity according to the terminal device identity verification logic, including:

[0013] The main control chip obtains the terminal device identity in the model configuration file;

[0014] The main control chip determines a terminal device identity verification result according to the identifier of the terminal device and the terminal device identity in the model configuration file.

[0015] In the above technical solution, the main control chip obtains the terminal device identity in the model configuration file. The main control chip determines the terminal device identity verification result based on the terminal device identifier and the terminal device identity in the model configuration file, thereby realizing the verification of the terminal device identity. Furthermore, based on the verification result, it can be determined whether the terminal device can load the model plaintext file and perform inference, thereby reducing the risk of model abuse.

[0016] According to one embodiment of the present application, before the main control chip receives the model encryption package sent by the server, the method further includes:

[0017] The security chip generates a first public key and a first private key pair, the first public key and the first private key pair including a first public key and a first private key, and stores the first private key in the security chip.

[0018] In the above technical solution, the security chip generates a first public key and private key pair, the first public key and private key pair includes a first public key and a first private key, the first private key is stored in the security chip, and the first public key can be further used to encrypt the symmetric key, reducing the risk of key leakage.

[0019] According to one embodiment of the present application, the method further includes:

[0020] The main control chip sends a model configuration file application message to the server, wherein the model configuration file application message carries the terminal device identity and the first public key, and the terminal device identity is determined according to at least one of the following: MAC address, CPU serial number, disk serial number, BIOS serial number.

[0021] In the above technical solution, the main control chip sends a model configuration file application message to the server. The model configuration file application message carries the terminal device identity and the first public key. The first public key can be used to encrypt the symmetric key, reducing the risk of key leakage. The terminal device identity can be used to verify the terminal device identity to verify whether the terminal device identity matches the terminal device identity in the model configuration file, thereby reducing the risk of model abuse.

[0022] In a second aspect, the present application provides a model encryption method, the method comprising:

[0023] Generate a model configuration file based on the terminal device identity;

[0024] Sign the model plaintext file and the model configuration file according to the second private key to obtain a signature value;

[0025] Encrypting the model plaintext file, model configuration file, and signature value according to the symmetric key to obtain encrypted model plaintext file, model configuration file, and signature value;

[0026] Encrypting the symmetric key according to the first public key to obtain an encrypted symmetric key;

[0027] Packaging the encrypted model plaintext file, model configuration file and signature value, and the encrypted symmetric key to obtain a model encryption package;

[0028] Send the model encrypted package to the terminal device.

[0029] In the above technical solution, the model configuration file is determined according to the terminal device identity of the terminal device, the model plaintext file and the model configuration file are signed according to the second private key to obtain a signature value, the model plaintext file, the model configuration file and the signature value are encrypted according to the symmetric key to obtain the encrypted model plaintext file, the model configuration file and the signature value, the symmetric key is encrypted according to the first public key to obtain an encrypted symmetric key, the encrypted model plaintext file, the model configuration file and the signature value and the encrypted symmetric key are packaged to obtain a model encryption package, the model encryption package is sent to the terminal device, and the model is encrypted in combination with the terminal device identity and the signature value, thereby reducing the risk of the model being tampered with or abused and achieving effective protection of the model.

[0030] According to one embodiment of the present application, before generating the model configuration file according to the terminal device identity identifier, the method further includes:

[0031] Receive a model configuration file application message sent by the terminal device, where the model configuration file application message carries the terminal device identity and the first public key, and the terminal device identity is determined based on at least one of the following: MAC address, CPU serial number, disk serial number, and BIOS serial number.

[0032] In the above technical solution, before determining the model configuration file of the terminal device based on the identity of the terminal device, a model configuration file application message sent by the terminal device is received. The model configuration file application message carries the terminal device identity and the first public key. The terminal device identity is determined based on at least one of the following: MAC address, CPU serial number, disk serial number, BIOS serial number. The first public key can be used to encrypt the symmetric key, effectively reducing the risk of key leakage. The terminal device identity can be used to verify whether it matches the identity of the terminal device, reducing the risk of model abuse.

[0033] According to one embodiment of the present application, before signing the model plaintext file and the model configuration file according to the second private key to obtain the signature value, the method further includes:

[0034] Obfuscate the terminal device identity verification logic;

[0035] The obfuscated terminal device identity verification logic is embedded into the model plaintext file.

[0036] In the above technical solution, the terminal device identity verification logic is obfuscated and embedded into the model plaintext file, which can reduce the risk of the terminal device identity verification logic being removed or the model code being recompiled.

[0037] According to one embodiment of the present application, before signing the model plaintext file and the model configuration file according to the second private key to obtain the signature value, the method further includes:

[0038] Determining a second public and private key pair, the second public and private key pair comprising a second public key and the second private key;

[0039] Send the second public key to the terminal device.

[0040] In the above technical solution, a second public key and private key pair is determined, the second public key and private key pair includes a second public key and the second private key, the second public key is sent to the terminal device, and the second private key can be used to sign the model plaintext file and the model configuration file to obtain a signature value, which can be used to verify the integrity of the model plaintext file and the model configuration file to reduce the risk of the model plaintext file being tampered with.

[0041] In a third aspect, the present application provides a model reasoning device, which includes:

[0042] A first receiving unit is configured to receive a model encryption package sent by a server, wherein the model encryption package includes an encrypted model plaintext file, a model configuration file, and a signature value, wherein the model configuration file includes an identity identifier of a terminal device;

[0043] a decryption unit, configured to call the security chip to decrypt the symmetric key from the model encryption package using the first private key;

[0044] The decryption unit is further configured to decrypt the model encryption package using the symmetric key to obtain a model plaintext file, a model configuration file, and a signature value, and store the model plaintext file, the model configuration file, and the signature value in a storage device;

[0045] A signature verification unit, configured to verify the signature of the model plaintext file and the model configuration file based on the signature value and the second public key;

[0046] A verification unit, configured to verify the terminal device identity according to the terminal device identity verification logic when the signature verification passes;

[0047] The inference unit is used to load the model plaintext file for inference when the terminal device identity verification is passed.

[0048] In the above technical solution, the model inference device is used to receive the model encryption package sent by the server, the model encryption package includes the encrypted model plaintext file, model configuration file and signature value, the model configuration file includes the terminal device identity, call the security chip to use the first private key to decrypt the symmetric key from the model encryption package, use the symmetric key to decrypt the model encryption package, obtain the model plaintext file, model configuration file and signature value, and store the model plaintext file, model configuration file and signature value in the storage device, based on the signature value, verify the model plaintext file and model configuration file according to the second public key, if the signature verification passes, verify the terminal device identity according to the terminal device identity verification logic, if the terminal device identity verification passes, load the model plaintext file for reasoning, through signature verification and terminal device identity verification, reduce the risk of model tampering or abuse, achieve effective protection of the model, can be used in a variety of application scenarios, with strong versatility, thereby improving the reliability of model inference results.

[0049] In a fourth aspect, the present application provides a model encryption device, comprising:

[0050] A first processing unit, configured to generate a model configuration file according to an identity identifier of a terminal device;

[0051] A signing unit, configured to sign the model plaintext file and the model configuration file according to the second private key to obtain a signature value;

[0052] An encryption unit, configured to encrypt the model plaintext file, the model configuration file, and the signature value according to a symmetric key to obtain the encrypted model plaintext file, the model configuration file, and the signature value;

[0053] The encryption unit is further configured to encrypt the symmetric key according to the first public key to obtain an encrypted symmetric key;

[0054] A packaging unit, configured to package the encrypted model plaintext file, model configuration file and signature value, and the encrypted symmetric key to obtain a model encryption package;

[0055] The first sending unit is used to send the model encryption package to the terminal device.

[0056] In the above technical solution, the model encryption device is used to determine the model configuration file according to the terminal device identity of the terminal device, sign the model plaintext file and the model configuration file according to the second private key to obtain a signature value, encrypt the model plaintext file, the model configuration file and the signature value according to the symmetric key to obtain the encrypted model plaintext file, the model configuration file and the signature value, encrypt the symmetric key according to the first public key to obtain an encrypted symmetric key, package the encrypted model plaintext file, the model configuration file and the signature value and the encrypted symmetric key to obtain a model encryption package, send the model encryption package to the terminal device, encrypt the model in combination with the terminal device identity and the signature value, reduce the risk of the model being tampered with or abused, and achieve effective protection of the model.

[0057] In a fifth aspect, the present application provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the model inference method described in the first aspect above, or implements the model encryption method described in the second aspect above.

[0058] In a sixth aspect, the present application provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, it implements the model inference method as described in the first aspect above, or implements the model encryption method as described in the second aspect above.

[0059] In the seventh aspect, the present application provides a chip, which includes a processor and a communication interface, the communication interface and the processor are coupled, and the processor is used to run programs or instructions to implement the model reasoning method described in the first aspect above, or to implement the model encryption method described in the second aspect above.

[0060] In an eighth aspect, the present application provides a computer program product, comprising a computer program, which, when executed by a processor, implements the model reasoning method as described in the first aspect above, or implements the model encryption method as described in the second aspect above.

[0061] Additional aspects and advantages of the present application will be given in part in the description below, and in part will become obvious from the description below, or will be learned through practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the description of the embodiments in conjunction with the following drawings, in which:

[0063] Figure 1 This is one of the flowcharts of the model reasoning method provided in some embodiments of the present application;

[0064] Figure 2 This is the second flowchart of the model reasoning method provided in some embodiments of the present application;

[0065] Figure 3 is a flowchart of a model encryption method provided in some embodiments of the present application;

[0066] Figure 4 is a schematic diagram of the structure of a model reasoning device provided in some embodiments of the present application;

[0067] Figure 5 is a schematic diagram of the structure of a model encryption device provided in some embodiments of the present application;

[0068] Figure 6 It is a structural diagram of an electronic device provided in an embodiment of the present application.

[0069] Description of reference numerals:

[0070] 400: Model inference device; 401: First receiving unit; 402: Decryption unit; 403: Signature verification unit;

[0071] 404: verification unit; 405: inference unit; 500: model encryption device; 501: first processing unit;

[0072] 502: signature unit; 503: encryption unit; 504: packaging unit; 505: first sending unit;

[0073] 600: electronic device; 601: processor; 602: memory. DETAILED DESCRIPTION

[0074] The following will be combined with the accompanying drawings in the embodiments of the present application to clearly describe the technical solutions in the embodiments of the present application. Obviously, the embodiments described are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field are within the scope of protection of this application.

[0075] The terms "first," "second," and the like in the specification and claims of this application are used to distinguish similar objects, and are not used to describe a specific order or precedence. It should be understood that the terms used in this manner are interchangeable where appropriate, so that the embodiments of this application can be implemented in an order other than that illustrated or described herein, and that the objects distinguished by "first," "second," and the like are generally of the same type, and do not limit the number of objects; for example, the first object can be one or more. In addition, the term "and / or" in the specification and claims refers to at least one of the connected objects, and the character " / " generally indicates that the objects connected are in an "or" relationship.

[0076] The model reasoning method, model encryption method, electronic device and storage medium provided in the embodiments of the present application are described in detail below with reference to specific embodiments and their application scenarios in conjunction with the accompanying drawings.

[0077] Figure 1 This is one of the flow charts of the model reasoning method provided in some embodiments of this application. Figure 1 As shown, the model reasoning method includes: step 110, step 120, step 130, step 140, step 150 and step 160.

[0078] The execution subject of the model reasoning method can be a terminal device or a functional module or functional entity, integrated circuit or chip in the terminal device that can implement the model reasoning method, such as a main control chip, a security chip, etc. The terminal devices mentioned in the embodiments of this application include but are not limited to mobile phones, tablets, computers, cameras, and wearable devices. The model reasoning method provided in the embodiments of this application is described below using a terminal device as an example of the execution subject, wherein the terminal device includes a main control chip, a security chip, and a storage device.

[0079] Step 110: The main control chip receives a model encryption package sent by the server. The model encryption package includes an encrypted model plaintext file, a model configuration file, and a signature value. The model configuration file includes a terminal device identity.

[0080] It is understood that the main control chip is the main control chip of the terminal device in the embodiment of the present application and can be used to manage the operation of the terminal device. By unpacking the model encrypted package, the encrypted model plaintext file, model configuration file, signature value, and encryption symmetric key can be obtained. The model plaintext file can then be loaded by the terminal device and used for inference.

[0081] Optionally, the model configuration file is a JSON-formatted file that describes model-related parameters and the operating environment, including configuration items such as the model's basic information, operating environment, application time, and expiration date. In an embodiment of the present application, a terminal device identity, such as a terminal device identity ID (DID), is one of the configuration items in the model configuration file and can be used to verify the terminal device identity, thereby reducing the risk of unauthorized misuse of the model's plaintext file and effectively protecting the model.

[0082] Step 120: The main control chip calls the security chip to use the first private key to decrypt the symmetric key from the model encryption package.

[0083] It is understood that the security chip uses hardware-level encryption technology, which can effectively prevent external attacks and data theft. It can be used to store keys and feature data, and further used for key generation, model encryption and decryption, etc. In the embodiment of the present application, the security chip works in conjunction with the main control chip to jointly complete the decryption of the model encryption package and load the model plaintext file for inference.

[0084] Step 130: The security chip decrypts the model encryption package using the symmetric key to obtain a model plaintext file, a model configuration file, and a signature value, and stores the model plaintext file, model configuration file, and signature value in the storage device.

[0085] Optionally, a symmetric key is generated by the server and used to encrypt the model plaintext file, model configuration file, and signature value on the server to obtain the encrypted model plaintext file, model configuration file, and signature value. The symmetric key itself is also encrypted to obtain an encrypted symmetric key. This is packaged together with the encrypted model plaintext file, model configuration file, and signature value and sent to the terminal device. The terminal device can then decrypt the encrypted symmetric key to determine the symmetric key and further decrypt the encrypted model plaintext file, model configuration file, and signature value based on the symmetric key to obtain the model plaintext file, model configuration file, and signature value.

[0086] Step 140: The main control chip verifies the signature of the model plaintext file and the model configuration file based on the signature value and the second public key.

[0087] In some embodiments, before the main control chip verifies the signature of the model plaintext file and the model configuration file according to the second public key based on the signature value, the method further includes:

[0088] Receive the second public key sent by the server.

[0089] In an embodiment of the present application, the signature value is a specific value obtained by the server after processing the model plaintext file and the model configuration file (such as a hash operation), and then signing them using the second private key generated by the server. The server encrypts the signature value, the model plaintext file, and the model configuration file, and sends the encrypted values ​​to the terminal device.

[0090] The main control chip receives the second public key sent by the server before verifying the original model and model configuration file according to the second public key based on the signature value. The second public key and the second private key are a pair of asymmetric encryption keys determined by the server. After receiving the second public key sent by the server, the model plaintext file and model configuration file can be verified according to the second public key based on the signature value to verify whether the model plaintext file and model configuration file have been tampered with.

[0091] Step 150: When the signature verification is successful, the main control chip verifies the terminal device identity according to the terminal device identity verification logic.

[0092] It is understandable that the model plaintext file, model configuration file and signature value are stored in the storage device of the terminal device so that the main control chip can read and process them. In some embodiments, the terminal device identity verification logic is embedded in the original model after obfuscation processing. Optionally, the storage device is a general memory of the terminal device. The terminal device identity verification logic refers to the process of verifying the terminal device identity through a series of predefined rules and algorithms before loading the model and performing inference. It can be used to verify whether the current terminal device identity matches the terminal device identity in the model configuration file, reducing the risk of the model being abused without authorization, so as to improve the security of the model.

[0093] Step 160: When the terminal device identity verification is passed, the main control chip loads the model plaintext file for inference.

[0094] It can be understood that if the terminal device identity verification passes, it means that the terminal device identity in the model configuration file matches the identity of the current terminal device, and the model plaintext file can be loaded and reasoning can be performed according to the model configuration file; if the terminal device identity verification fails, it means that the terminal device identity in the model configuration file does not match the identity of the current terminal device, and the model plaintext file cannot be loaded and reasoning can not be performed on the current terminal device.

[0095] The model inference method provided by the embodiment of the present application is highly secure. Even if an attacker successfully copies or steals the original model file, the model cannot be run on other terminal devices. The reason is that the device unique identifier (DID) in the model configuration file strictly matches the ID of the terminal device. Any mismatch will cause the model to fail to start. In addition, if the model and configuration file are maliciously modified, its built-in signature verification mechanism will ensure that such tampering will not pass, further ensuring the security of the model.

[0096] The model reasoning method provided in the embodiments of the present application does not need to rely on a specific trusted execution environment (TEE) and is less affected by computing power limitations. It can selectively use model obfuscation technology without relying on complex obfuscation technology, has low computing costs, can flexibly adapt to and meet the needs of diverse business scenarios, can effectively avoid the risk of AI models being abused, ensure the security and compliance of the model, and provide solid and reliable protection in various business scenarios.

[0097] In the above technical solution, the main control chip receives the model encryption package sent by the server, and the model encryption package includes the encrypted model plaintext file, model configuration file and signature value. The model configuration file includes the terminal device identity identification. The main control chip calls the security chip to use the first private key to decrypt the symmetric key from the model encryption package. The security chip uses the symmetric key to decrypt the model encryption package to obtain the model plaintext file, model configuration file and signature value, and stores the model plaintext file, model configuration file and signature value in the storage device. The main control chip verifies the model plaintext file and model configuration file based on the signature value and the second public key. If the signature verification passes, the main control chip verifies the terminal device identity identification according to the terminal device identity verification logic. The identification is verified. When the terminal device identity verification passes, the main control chip loads the model plaintext file for inference. This application uses the terminal device identity to implement a binding mechanism, which can effectively prevent the model from being illegally abused. Even if the attacker manages to copy or steal the original model file, he cannot successfully run the model on other unauthorized terminal devices. In addition, the built-in signature verification mechanism makes it impossible to maliciously modify the model and configuration files. By verifying the signature, verifying the terminal device identity, and transmitting the model files and configuration files in ciphertext, the risk of the model being tampered with or abused is reduced, and effective protection of the model is achieved, thereby improving the reliability of the model inference results. It can be used in a variety of application scenarios and has strong versatility.

[0098] In some embodiments of the present application, when the signature verification passes, the main control chip verifies the terminal device identity according to the terminal device identity verification logic, including:

[0099] The main control chip obtains the terminal device identity in the model configuration file;

[0100] The main control chip determines a terminal device identity verification result according to the identifier of the terminal device and the terminal device identity in the model configuration file.

[0101] In this embodiment of the present application, the terminal device identity is one of the configuration items of the model configuration file, that is, the terminal device identity is written into the model configuration file. The terminal device identity verification logic refers to the process of verifying the terminal device identity through a series of predefined rules and algorithms before loading the model. It can be used to verify whether the current terminal device identity matches the terminal device identity in the model configuration file, reducing the risk of unauthorized misuse of the model and improving the security of the model.

[0102] It should be noted that if the current terminal device is authorized, then the terminal device identifier should be consistent with the terminal device identity identifier in the model configuration file.

[0103] In some embodiments, the terminal device identity verification logic is embedded in the model plaintext file after being obfuscated. In some embodiments, the terminal device identity verification logic is embedded in the model configuration file after being obfuscated. Through obfuscation processes such as code transformation, insertion of irrelevant instructions, and the use of unpredictable variable naming and function structures, it is more difficult for attackers to understand and tamper with the verification logic through means such as disassembly. This effectively prevents the removal of the terminal device identity verification logic or the recompilation of the model code, and improves the ability to protect the integrity and security of the model plaintext file.

[0104] Optionally, determining a terminal device identity verification result according to the identifier of the terminal device and the terminal device identity in the model configuration file includes:

[0105] If the terminal device identifier matches the terminal device identifier in the model configuration file, it is determined that the terminal device identifier verification has passed;

[0106] If the identifier of the terminal device does not match the terminal device identity identifier in the model configuration file, it is determined that the terminal device identity identifier verification fails.

[0107] In the above technical solution, the main control chip obtains the terminal device identity in the model configuration file. The main control chip determines the terminal device identity verification result based on the terminal device identifier and the terminal device identity in the model configuration file, thereby realizing the verification of the terminal device identity. Furthermore, based on the verification result, it can be determined whether the terminal device can load the model plaintext file and perform inference, thereby reducing the risk of model abuse.

[0108] In some embodiments of the present application, before the main control chip receives the model encryption package sent by the server, the method further includes:

[0109] The security chip generates a first public key and private key pair, the first public key and private key pair including a first public key and a first private key, and stores the first private key in the security chip.

[0110] Figure 2 This is the second flow chart of the model reasoning method provided in some embodiments of this application. Figure 2 As shown, before the main control chip receives the model encryption package sent by the server, the security chip generates a first public key and a first private key pair. It can be understood that the first public key and the first private key are a pair of asymmetric encryption keys generated by the security chip of the terminal device. The first public key is used to encrypt data and can be publicly distributed to other devices or the server; the first private key is used to decrypt data and is stored in the security chip and is not disclosed to the outside world.

[0111] In the above technical solution, the security chip generates a first public key and private key pair, the first public key and private key pair includes a first public key and a first private key, the first private key is stored in the security chip, and the first public key can be further used to encrypt the symmetric key, reducing the risk of key leakage.

[0112] In some embodiments of the present application, the method further comprises:

[0113] The main control chip sends a model configuration file application message to the server, wherein the model configuration file application message carries the terminal device identity and the first public key, and the terminal device identity is determined according to at least one of the following: MAC address, CPU serial number, disk serial number, BIOS serial number.

[0114] like Figure 2 As shown, after the security chip generates the first public key and private key pair, the main control chip sends the first public key to the server through the model configuration file application message. The server uses the first public key to encrypt the symmetric key to obtain the encrypted symmetric key, and only the security chip with the corresponding first private key can decrypt the encrypted symmetric key.

[0115] It can be understood that the main control chip sends a model configuration file application message carrying the terminal device identity and the first public key to the server. The terminal device identity is written into the model configuration file and can be used to verify the terminal device identity, so that only the terminal device that matches the terminal device identity in the model configuration file can load the model plaintext file and perform inference, reducing the risk of model abuse.

[0116] Optionally, the terminal device identity is determined by combining the MAC address, CPU serial number, disk serial number and BIOS serial number to more comprehensively identify the terminal device, thereby improving the reliability and security of the terminal device identity verification.

[0117] In the above technical solution, the main control chip sends a model configuration file application message to the server. The model configuration file application message carries the terminal device identity and the first public key. The first public key can be used to encrypt the symmetric key, reducing the risk of key leakage. The terminal device identity can be used to verify the terminal device identity to verify whether the terminal device identity matches the terminal device identity in the model configuration file, thereby reducing the risk of model abuse.

[0118] Figure 3 This is a flow chart of the model encryption method provided by some embodiments of the present application. Figure 3 As shown, the model encryption method includes: step 310, step 320, step 330, step 340, step 350 and step 360.

[0119] The execution subject of the model encryption method can be a server (device) or a functional module or functional entity, integrated circuit or chip in the server (device) that can implement the model encryption method.

[0120] Step 310: Generate a model configuration file based on the terminal device identity.

[0121] Optionally, the model configuration file is a file in JSON format that is used to describe model-related parameters and the operating environment, including configuration items such as the model's basic information, operating environment, application time, and expiration date. In an embodiment of the present application, the terminal device identity, such as the terminal device identity ID (DID), is one of the configuration items of the model configuration file. That is, the terminal device identity is written into the model configuration file and can be used to verify the terminal device identity, thereby reducing the risk of unauthorized abuse of the model plaintext file and achieving effective protection of the model.

[0122] Step 320: Sign the model plaintext file and the model configuration file according to the second private key to obtain a signature value.

[0123] The second public key and the second private key are a pair of asymmetric encryption keys. The signature value is a specific value generated by processing the model plaintext file and model configuration file (such as hash operation) and then signing with the second private key. The signature value is encrypted together with the model plaintext file and model configuration file and sent to the terminal device.

[0124] In some embodiments, signing the model plaintext file and the model configuration file according to the second private key to obtain a signature value includes:

[0125] Obtaining a first character string according to the model plaintext file and the model configuration file;

[0126] determining a hash value of the first string;

[0127] The hash value of the first character string is signed according to the second private key to obtain a signature value.

[0128] Step 330: Encrypt the model plaintext file, model configuration file, and signature value according to the symmetric key to obtain the encrypted model plaintext file, model configuration file, and signature value.

[0129] Step 340: Encrypt the symmetric key according to the first public key to obtain an encrypted symmetric key.

[0130] Step 350: Package the encrypted model plaintext file, model configuration file and signature value, and the encrypted symmetric key to obtain a model encryption package.

[0131] It is understood that the symmetric key is used to encrypt the model plaintext file, model configuration file, and signature value to obtain the encrypted model plaintext file, model configuration file, and signature value. The symmetric key itself is also encrypted with the first public key to obtain an encrypted symmetric key. This is packaged together with the encrypted model plaintext file, model configuration file, and signature value and sent to the terminal device. The terminal device can then decrypt the encrypted symmetric key to determine the symmetric key and further decrypt the encrypted model plaintext file, model configuration file, and signature value based on the symmetric key to obtain the model plaintext file, model configuration file, and signature value.

[0132] Step 360: Send the model encryption package to the terminal device.

[0133] In the above technical solution, the model configuration file is determined according to the terminal device identity of the terminal device, the model plaintext file and the model configuration file are signed according to the second private key to obtain a signature value, the model plaintext file, the model configuration file and the signature value are encrypted according to the symmetric key to obtain the encrypted model plaintext file, the model configuration file and the signature value, the symmetric key is encrypted according to the first public key to obtain an encrypted symmetric key, the encrypted model plaintext file, the model configuration file and the signature value and the encrypted symmetric key are packaged to obtain a model encryption package, the model encryption package is sent to the terminal device, and the model is encrypted in combination with the terminal device identity and the signature value, thereby reducing the risk of the model being tampered with or abused and achieving effective protection of the model.

[0134] In some embodiments of the present application, before generating the model configuration file according to the terminal device identity, the method further includes:

[0135] Receive a model configuration file application message sent by the terminal device, where the model configuration file application message carries the terminal device identity and the first public key, and the terminal device identity is determined based on at least one of the following: MAC address, CPU serial number, disk serial number, and BIOS serial number.

[0136] It can be understood that the model configuration file application message sent by the receiving terminal device carries the terminal device identity and the first public key. The first public key can be used to encrypt the symmetric key, effectively reducing the risk of key leakage. The terminal device identity is written into the model configuration file and can be used to verify the terminal device identity to verify whether the terminal device identity matches the terminal device identity in the model configuration file, reducing the risk of model abuse.

[0137] In the above technical solution, before determining the model configuration file of the terminal device based on the identity of the terminal device, a model configuration file application message sent by the terminal device is received. The model configuration file application message carries the terminal device identity and the first public key. The terminal device identity is determined based on at least one of the following: MAC address, CPU serial number, disk serial number, BIOS serial number. The first public key can be used to encrypt the symmetric key, effectively reducing the risk of key leakage. The terminal device identity can be used to verify whether it matches the identity of the terminal device, reducing the risk of model abuse.

[0138] In some embodiments of the present application, before signing the model plaintext file and the model configuration file according to the second private key to obtain the signature value, the method further includes:

[0139] Obfuscate the terminal device identity verification logic;

[0140] The obfuscated terminal device identity verification logic is embedded into the model plaintext file.

[0141] Through obfuscation processes such as code transformation, insertion of irrelevant instructions, and the use of unpredictable variable naming and function structures, it increases the difficulty for attackers to understand and tamper with the verification logic through means such as disassembly. It can effectively prevent the removal of terminal device identity verification logic or the recompilation of model code, further improving the ability to protect model integrity and security.

[0142] In the above technical solution, the terminal device identity verification logic is obfuscated and embedded into the model plaintext file, which can reduce the risk of the terminal device identity verification logic being removed or the model code being recompiled.

[0143] In some embodiments of the present application, before signing the model plaintext file and the model configuration file according to the second private key to obtain the signature value, the method further includes:

[0144] Determining a second public and private key pair, the second public and private key pair comprising a second public key and the second private key;

[0145] Send the second public key to the terminal device.

[0146] It can be understood that the second public key and the second private key are a pair of asymmetric encryption keys determined by the server. The second private key can be used to sign the model plaintext file and the model configuration file to obtain a signature value. The signature value can be used to verify the integrity of the model plaintext file and the model configuration file during the decryption process of the model encryption package. In addition, it can also be used to verify the identity of the server.

[0147] In the above technical solution, a second public key and private key pair is determined, the second public key and private key pair includes a second public key and the second private key, the second public key is sent to the terminal device, and the second private key can be used to sign the model plaintext file and the model configuration file to obtain a signature value, which can be used to verify the integrity of the model plaintext file and the model configuration file to reduce the risk of the model plaintext file being tampered with.

[0148] The model reasoning method provided in the embodiment of the present application can be executed by a model reasoning device. In the embodiment of the present application, the model reasoning device provided in the embodiment of the present application is described by taking the execution of the model reasoning method by the model reasoning device as an example.

[0149] Figure 4 This is a schematic diagram of the structure of the model reasoning device provided in some embodiments of the present application. Figure 4 As shown, the model reasoning device 400 includes:

[0150] The first receiving unit 401 is configured to receive a model encryption package sent by a server, wherein the model encryption package includes an encrypted model plaintext file, a model configuration file, and a signature value, wherein the model configuration file includes a terminal device identity;

[0151] The decryption unit 402 is configured to call the security chip to decrypt the symmetric key from the model encryption package using the first private key;

[0152] The decryption unit 402 is further configured to decrypt the model encrypted package using the symmetric key to obtain a model plaintext file, a model configuration file, and a signature value, and store the model plaintext file, the model configuration file, and the signature value in a storage device;

[0153] The signature verification unit 403 is configured to verify the signature of the model plaintext file and the model configuration file based on the signature value and the second public key;

[0154] The verification unit 404 is configured to verify the terminal device identity according to the terminal device identity verification logic when the signature verification passes;

[0155] The inference unit 405 is configured to load the model plaintext file for inference when the terminal device identity verification passes.

[0156] Optionally, the verification unit 404 is configured to:

[0157] Obtaining the terminal device identity in the model configuration file;

[0158] A terminal device identity verification result is determined according to the identifier of the terminal device and the terminal device identity in the model configuration file.

[0159] Optionally, the model reasoning device 400 further includes a second processing unit, which is used to: generate a first public key and private key pair, where the first public key and private key pair includes a first public key and a first private key, and store the first private key in the security chip.

[0160] Optionally, the model inference device 400 also includes a second sending unit, which is used to: send a model configuration file application to the server, wherein the model configuration file application message carries the terminal device identity and the first public key, and the terminal device identity is determined based on at least one of the following: MAC address, CPU serial number, disk serial number, BIOS serial number.

[0161] In the above technical solution, the model inference device is used to receive the model encryption package sent by the server, the model encryption package includes the encrypted model plaintext file, model configuration file and signature value, the model configuration file includes the terminal device identity, call the security chip to use the first private key to decrypt the symmetric key from the model encryption package, use the symmetric key to decrypt the model encryption package, obtain the model plaintext file, model configuration file and signature value, and store the model plaintext file, model configuration file and signature value in the storage device, based on the signature value, verify the model plaintext file and model configuration file according to the second public key, if the signature verification passes, verify the terminal device identity according to the terminal device identity verification logic, if the terminal device identity verification passes, load the model plaintext file for reasoning, through signature verification and terminal device identity verification, reduce the risk of model tampering or abuse, achieve effective protection of the model, can be used in a variety of application scenarios, with strong versatility, thereby improving the reliability of model inference results.

[0162] The model reasoning device in the embodiment of the present application can be an electronic device or a component in an electronic device, such as an integrated circuit or a chip. The electronic device can be a terminal or a device other than a terminal. For example, the electronic device can be a mobile phone, a tablet computer, a laptop computer, a PDA, a car-mounted electronic device, a mobile Internet device (Mobile Internet Device, MID), an augmented reality (augmented reality, AR) / virtual reality (virtual reality, VR) device, a robot, a wearable device, an ultra-mobile personal computer (ultra-mobile personal computer, UMPC), a netbook or a personal digital assistant (personal digital assistant, PDA), etc. It can also be a server, a network attached storage (Network Attached Storage, NAS), a personal computer (personal computer, PC), a television (television, TV), a teller machine or a self-service machine, etc., and the embodiment of the present application is not specifically limited.

[0163] The model inference device in the embodiment of the present application may be a device having an operating system. The operating system may be a Microsoft (Windows) operating system, an Android operating system, an iOS operating system, or other possible operating systems, which are not specifically limited in the embodiment of the present application.

[0164] The model encryption device provided in the embodiment of the present application can implement the various processes implemented in the above-mentioned model encryption method embodiment and achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0165] The model encryption method provided in the embodiment of the present application can be executed by a model encryption device. In the embodiment of the present application, the model encryption device provided in the embodiment of the present application is described by taking the execution of the model encryption method by the model encryption device as an example.

[0166] Figure 5 This is a schematic diagram of the structure of the model encryption device provided in some embodiments of the present application. Figure 5 As shown, the model encryption device 500 includes:

[0167] The first processing unit 501 is configured to generate a model configuration file according to the terminal device identity identifier;

[0168] The signing unit 502 is configured to sign the model plaintext file and the model configuration file according to the second private key to obtain a signature value;

[0169] An encryption unit 503 is configured to encrypt the model plaintext file, the model configuration file, and the signature value according to a symmetric key to obtain an encrypted model plaintext file, the model configuration file, and the signature value;

[0170] The encryption unit 503 is further configured to encrypt the symmetric key according to the first public key to obtain an encrypted symmetric key;

[0171] The packaging unit 504 is configured to package the encrypted model plaintext file, model configuration file and signature value, and the encrypted symmetric key to obtain a model encryption package;

[0172] The first sending unit 505 is configured to send the model encrypted package to a terminal device.

[0173] Optionally, the model encryption device 500 also includes a second receiving unit, which is used to: receive a model configuration file application message sent by the terminal device, the model configuration file application message carries the terminal device identity and the first public key, and the terminal device identity is determined based on at least one of the following: MAC address, CPU serial number, disk serial number, BIOS serial number.

[0174] Optionally, the model encryption device 500 further includes a third processing unit, which is configured to:

[0175] Determining a second public and private key pair, the second public and private key pair comprising a second public key and the second private key;

[0176] Send the second public key to the terminal device.

[0177] Optionally, the model encryption device 500 further includes a fourth processing unit, which is configured to:

[0178] Obfuscate the terminal device identity verification logic;

[0179] The obfuscated terminal device identity verification logic is embedded into the model plaintext file.

[0180] In the above technical solution, the model encryption device is used to determine the model configuration file according to the terminal device identity of the terminal device, sign the model plaintext file and the model configuration file according to the second private key to obtain a signature value, encrypt the model plaintext file, the model configuration file and the signature value according to the symmetric key to obtain the encrypted model plaintext file, the model configuration file and the signature value, encrypt the symmetric key according to the first public key to obtain an encrypted symmetric key, package the encrypted model plaintext file, the model configuration file and the signature value and the encrypted symmetric key to obtain a model encryption package, send the model encryption package to the terminal device, encrypt the model in combination with the terminal device identity and the signature value, reduce the risk of the model being tampered with or abused, and achieve effective protection of the model.

[0181] The model encryption device in the embodiment of the present application can be an electronic device or a component in the electronic device, such as an integrated circuit or chip. The electronic device can be a terminal or other device other than a terminal. For example, the electronic device can be a mobile phone, a tablet computer, a laptop computer, a PDA, an in-vehicle electronic device, a mobile Internet device (MID), an augmented reality (AR) / virtual reality (VR) device, a robot, a wearable device, an ultra-mobile personal computer (UMPC), a netbook or a personal digital assistant (PDA), etc. It can also be a server, a network attached storage (NAS), a personal computer (PC), a television (TV), a teller machine or a self-service machine, etc., and the embodiment of the present application does not specifically limit it.

[0182] The model encryption device in the embodiments of the present application may be a device having an operating system. The operating system may be a Microsoft (Windows) operating system, an Android operating system, an iOS operating system, or other possible operating systems, which are not specifically limited in the embodiments of the present application.

[0183] The model encryption device provided in the embodiment of the present application can implement the various processes implemented in the above-mentioned model encryption method embodiment and achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0184] In some embodiments, as Figure 6As shown, an embodiment of the present application also provides an electronic device 600, including a processor 601, a memory 602, and a computer program stored in the memory 602 and executable on the processor 601. When the program is executed by the processor 601, the various processes of the above-mentioned model reasoning method embodiment are implemented, or the various processes of the above-mentioned model encryption method embodiment are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0185] It should be noted that the electronic devices in the embodiments of the present application include the mobile electronic devices and non-mobile electronic devices mentioned above.

[0186] An embodiment of the present application also provides a non-transitory computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the various processes of the above-mentioned model reasoning method embodiment, or implements the various processes of the above-mentioned model encryption method embodiment, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0187] The processor is the processor in the electronic device described in the above embodiment. The readable storage medium includes a computer readable storage medium, such as a computer read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0188] An embodiment of the present application also provides a computer program product, including a computer program, which, when executed by a processor, implements the above-mentioned model reasoning method, or implements the above-mentioned model encryption method.

[0189] The processor is the processor in the electronic device described in the above embodiment. The readable storage medium includes a computer readable storage medium, such as a computer read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0190] An embodiment of the present application further provides a chip, which includes a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run programs or instructions to implement the various processes of the above-mentioned model reasoning method embodiment, or to implement the various processes of the above-mentioned model encryption method embodiment, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0191] It should be understood that the chip mentioned in the embodiments of the present application can also be called a system-level chip, a system chip, a chip system or a system-on-chip chip, etc.

[0192] It should be noted that, in this article, the terms "comprise", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the statement "comprises a ..." does not exclude the presence of other identical elements in the process, method, article or device comprising the element. In addition, it should be noted that the scope of the methods and devices in the embodiments of the present application is not limited to performing functions in the order shown or discussed, and may also include performing functions in a substantially simultaneous manner or in the opposite order according to the functions involved. For example, the described method may be performed in an order different from that described, and various steps may also be added, omitted, or combined. In addition, the features described with reference to certain examples may be combined in other examples.

[0193] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus the necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present application, or the part that contributes to the relevant technology, can be embodied in the form of a computer software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for enabling a terminal (which can be a mobile phone, computer, server, or network device, etc.) to execute the methods described in each embodiment of the present application.

[0194] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of this application, ordinary technicians in this field can also make many forms without departing from the purpose of this application and the scope of protection of the claims, all of which are within the protection of this application.

[0195] Throughout this specification, reference to terms such as "one embodiment," "some embodiments," "illustrative embodiments," "examples," "specific examples," or "some examples" means that the specific features, structures, materials, or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples.

[0196] Although the embodiments of the present application have been shown and described, those skilled in the art will appreciate that various changes, modifications, substitutions, and variations may be made to the embodiments without departing from the principles and intent of the present application, and that the scope of the present application is defined by the claims and their equivalents.

Claims

1. A model reasoning method, characterized in that: Applied to a terminal device, the terminal device includes a main control chip, a security chip, and a storage device, and the model reasoning method includes: The main control chip receives a model encryption package sent by the server, wherein the model encryption package includes an encrypted model plaintext file, a model configuration file, and a signature value, wherein the model configuration file includes an identity identifier of the terminal device; The main control chip calls the security chip to use the first private key to decrypt the symmetric key from the model encryption package; The security chip decrypts the model encryption package using the symmetric key to obtain a model plaintext file, a model configuration file, and a signature value, and stores the model plaintext file, the model configuration file, and the signature value in the storage device; The main control chip verifies the signature of the model plaintext file and the model configuration file according to the second public key based on the signature value; If the signature verification is successful, the main control chip verifies the terminal device identity according to the terminal device identity verification logic; When the terminal device identity verification is passed, the main control chip loads the model plaintext file for inference.

2. The model inference method according to claim 1, characterized in that When the signature verification is passed, the main control chip verifies the terminal device identity according to the terminal device identity verification logic, including: The main control chip obtains the terminal device identity in the model configuration file; The main control chip determines a terminal device identity verification result according to the identifier of the terminal device and the terminal device identity in the model configuration file.

3. The model inference method according to claim 1 or 2, characterized in that: Before the main control chip receives the model encryption package sent by the server, the method further includes: The security chip generates a first public key and private key pair, the first public key and private key pair including a first public key and a first private key, and stores the first private key in the security chip.

4. The model inference method according to claim 3, characterized in that: The method further comprises: The main control chip sends a model configuration file application message to the server, wherein the model configuration file application message carries the terminal device identity and the first public key, and the terminal device identity is determined according to at least one of the following: MAC address, CPU serial number, disk serial number, BIOS serial number.

5. A model encryption method, characterized in that: Applied to the server, including: Generate a model configuration file based on the terminal device identity; Sign the model plaintext file and the model configuration file according to the second private key to obtain a signature value; Encrypt the model plaintext file, model configuration file, and signature value according to the symmetric key to obtain the encrypted model plaintext file, model configuration file, and signature value; Encrypting the symmetric key according to the first public key to obtain an encrypted symmetric key; Packaging the encrypted model plaintext file, model configuration file and signature value, and the encrypted symmetric key to obtain a model encryption package; Send the model encrypted package to the terminal device.

6. The model encryption method according to claim 5, characterized in that: Before generating the model configuration file according to the terminal device identity, the method further includes: Receive a model configuration file application message sent by the terminal device, where the model configuration file application message carries the terminal device identity and the first public key, and the terminal device identity is determined based on at least one of the following: MAC address, CPU serial number, disk serial number, and BIOS serial number.

7. The model encryption method according to claim 5 or 6, characterized in that: Before signing the model plaintext file and the model configuration file according to the second private key to obtain the signature value, the method further includes: Determining a second public and private key pair, the second public and private key pair comprising a second public key and the second private key; Send the second public key to the terminal device.

8. The model encryption method according to claim 5 or 6, characterized in that: Before signing the model plaintext file and the model configuration file according to the second private key to obtain the signature value, the method further includes: Obfuscate the terminal device identity verification logic; The obfuscated terminal device identity verification logic is embedded into the model plaintext file.

9. A model reasoning device, characterized in that: include: A first receiving unit is configured to receive a model encryption package sent by a server, wherein the model encryption package includes an encrypted model plaintext file, a model configuration file, and a signature value, wherein the model configuration file includes an identity identifier of a terminal device; a decryption unit, configured to call the security chip to decrypt the symmetric key from the model encryption package using the first private key; The decryption unit is further configured to decrypt the model encryption package using the symmetric key to obtain a model plaintext file, a model configuration file, and a signature value, and store the model plaintext file, the model configuration file, and the signature value in a storage device; A signature verification unit, configured to verify the signature of the model plaintext file and the model configuration file based on the signature value and the second public key; A verification unit, configured to verify the terminal device identity according to the terminal device identity verification logic when the signature verification passes; The inference unit is used to load the model plaintext file for inference when the terminal device identity verification is passed.

10. A model encryption device, characterized in that: include: A first processing unit, configured to generate a model configuration file according to an identity identifier of a terminal device; A signing unit, configured to sign the model plaintext file and the model configuration file according to the second private key to obtain a signature value; An encryption unit, configured to encrypt the model plaintext file, the model configuration file, and the signature value according to a symmetric key to obtain the encrypted model plaintext file, the model configuration file, and the signature value; The encryption unit is further configured to encrypt the symmetric key according to the first public key to obtain an encrypted symmetric key; A packaging unit, configured to package the encrypted model plaintext file, model configuration file and signature value, and the encrypted symmetric key to obtain a model encryption package; The first sending unit is used to send the model encryption package to the terminal device.

11. An electronic device comprising a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, it implements the model inference method according to any one of claims 1 to 4, or implements the model encryption method according to any one of claims 5 to 8.

12. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, it implements the model reasoning method according to any one of claims 1 to 4, or implements the model encryption method according to any one of claims 5 to 8.

Images