Model encryption method, data processing method and device
By encrypting the key layers of the artificial intelligence model and decrypting it on the security chip terminal device, the problem of the model being easily tampered with or abused is solved, a balance is achieved between model security and computing efficiency, and it can adapt to diverse business scenarios.
Patent Information
- Application Number
- CN202510598601.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-05-09
- Publication Date
- 2025-09-23
AI Technical Summary
In existing technologies, the security of artificial intelligence models is difficult to ensure, especially in fields such as autonomous driving and medical diagnosis. The models are easily tampered with or abused, and existing protection solutions such as TEE and obfuscation solutions have problems with high computing resource consumption and prolonged inference time.
By determining the key and non-key layers of the model, encrypting the key layers, and using homomorphic encryption technology to generate an encrypted model, it is only decrypted on terminal devices equipped with security chips to ensure model security and computing efficiency.
It reduces the risk of model tampering or abuse, reduces the negative impact of encryption on model reasoning efficiency and computing resources, adapts to the needs of diverse business scenarios, and ensures the security of the model.
Smart Images
Figure CN120688069A_ABST
Abstract
Description
Technical Field
[0001] The present application belongs to the field of artificial intelligence technology, and in particular relates to a model encryption method, a data processing method and a device. Background Art
[0002] With the widespread application of artificial intelligence technology in key areas such as autonomous driving and medical diagnosis, the security of AI models has become a critical issue. Malicious tampering, theft, or misuse of models not only infringes on the intellectual property rights of the model owner but can also cause serious security issues. Although various model protection solutions have emerged, these solutions still have certain limitations. For example, solutions based on the Trusted Execution Environment (TEE) are limited by computing power resources and cannot meet the high-performance computing requirements of large models. Protection solutions based on obfuscation prevent model theft or reverse engineering by scrambling the computing logic, but the obfuscation process consumes a large amount of computing resources and prolongs model inference time. Summary of the Invention
[0003] This application aims to solve at least one of the technical problems existing in the related art. To this end, this application proposes a model encryption method, data processing method, and device. By encrypting the key layers of the model, the risk of model tampering or abuse is reduced, and the negative impact of encryption on model reasoning efficiency and computing resource requirements is reduced. This method can flexibly adapt to and meet the needs of diverse business scenarios.
[0004] In a first aspect, the present application provides a model encryption method, applied to a server, comprising:
[0005] Determine the key layers and non-key layers of the original model;
[0006] Encrypting each key layer of the original model according to the first public key to obtain each encrypted key layer of the original model;
[0007] Determining an encryption model corresponding to the original model according to each of the encryption key layers of the original model and each of the non-key layers of the original model;
[0008] The encrypted model is sent to the terminal device.
[0009] In the above technical solution, the key layers and non-key layers of the original model are determined, and the key layers of the original model are encrypted according to the first public key to obtain the encrypted key layers of the original model. According to the encrypted key layers of the original model and the non-key layers of the original model, the encryption model corresponding to the original model is determined, and the encrypted model is sent to the terminal device. By encrypting the key layers of the model, the risk of the model being tampered with or abused is reduced, and the negative impact of encryption on the model reasoning efficiency and computing resource requirements is also reduced, and it can flexibly adapt to and meet the needs of diverse business scenarios.
[0010] According to an embodiment of the present application, before encrypting the key layers of the original model according to the first public key to obtain the encrypted key layers of the original model, the method further includes:
[0011] Receive the first public key sent by the terminal device.
[0012] In the above technical solution, the first public key sent by the receiving terminal device can be used to encrypt the key layer of the original model according to the first public key to obtain an encrypted model. Data processing can be achieved through the encrypted model only when the corresponding first private key is possessed. This can effectively prevent the model from being illegally abused. Even if the attacker copies or steals the encrypted model, the data processing results of the encrypted key layer cannot be decrypted, which further ensures the security of the model.
[0013] In a second aspect, the present application provides a data processing method, applied to a terminal device, wherein the terminal device includes a security chip, the method comprising:
[0014] Receive the encryption model sent by the server;
[0015] Get the data to be processed;
[0016] Using homomorphic encryption technology, the data to be processed is input into the encryption model for processing to obtain a data processing result.
[0017] In the above technical solution, the encryption model sent by the server is received, the data to be processed is obtained, and the homomorphic encryption technology is used to input the data to be processed into the encryption model for processing to obtain the data processing result. The output result of the encryption key layer in the encryption model can only be decrypted by a terminal device equipped with a security chip and storing the corresponding first private key in the security chip, which reduces the risk of the model being abused without authorization. Even if an attacker maliciously copies the encryption model and runs it on other terminal devices, no valuable output results can be obtained, thereby ensuring the security of the model.
[0018] According to one embodiment of the present application, before receiving the encryption model sent by the server, the method further includes:
[0019] Generate a first public key and private key pair through the security chip, the first public key and private key pair including a first public key and a first private key, and store the first private key in the security chip;
[0020] Send the first public key to the server.
[0021] In the above technical solution, a first public key and private key pair is generated through a security chip, the first public key and private key pair including a first public key and a first private key, the first private key is stored in the security chip, and the first public key is sent to the server. The first public key can be used to encrypt the model to obtain an encrypted model, and the output result of the encryption key layer in the encryption model can only be decrypted by a terminal device equipped with a security chip and storing the corresponding first private key in the security chip, thereby effectively preventing the model from being illegally abused.
[0022] According to one embodiment of the present application, the use of homomorphic encryption technology to input the data to be processed into the encryption model for processing to obtain a data processing result includes:
[0023] In the case where the current layer of the encryption model is an encryption key layer, the data to be processed in the current layer is input into the current layer for encrypted processing to obtain a data processing result of the current layer.
[0024] In the above technical solution, when the current layer of the encryption model is the encryption key layer, the data to be processed in the current layer is input into the current layer for confidential processing to obtain the data processing result of the current layer. The data processing result of the current layer is also encrypted data, which can only be decrypted by a terminal device equipped with a security chip and storing the corresponding first private key in the security chip, thereby reducing the risk of the model being abused without authorization. Even if an attacker attempts to maliciously copy the encrypted model and run it on other terminal devices, he cannot obtain any valuable output results, thereby ensuring the security of the model.
[0025] According to one embodiment of the present application, the use of homomorphic encryption technology to input the data to be processed into the encryption model for processing to obtain a data processing result includes:
[0026] When the current layer of the encryption model is a non-critical layer and the layer above the current layer is an encryption critical layer, decrypting the data to be processed in the current layer using the first private key through the security chip, inputting the decrypted data to be processed in the current layer into the current layer for processing, and obtaining a data processing result of the current layer;
[0027] When the current layer of the encryption model is a non-critical layer and the previous layer of the current layer is also a non-critical layer, or when the current layer of the encryption model is a non-critical layer and the current layer is the first layer of the encryption model, the data to be processed of the current layer is input into the current layer for processing to obtain the data processing result of the current layer.
[0028] In the above technical solution, when the current layer of the encryption model is a non-critical layer and the layer above the current layer is an encryption critical layer, the data to be processed in the current layer is decrypted using the first private key through the security chip, and the decrypted data to be processed in the current layer is input into the current layer for processing to obtain the data processing result of the current layer; when the current layer of the encryption model is a non-critical layer and the layer above the current layer is also a non-critical layer, or when the current layer of the encryption model is a non-critical layer and the current layer is the first layer of the encryption model, the data to be processed in the current layer is input into the current layer for processing to obtain the data processing result of the current layer, and the data processing result of the encryption critical layer is decrypted using the first private key in the security chip as the data to be processed in the non-critical layer, thereby realizing data transmission between different layers in the encryption model. When the terminal device is not equipped with a security chip and the first private key stored in the security chip, the data processing result of the encryption critical layer cannot be decrypted, and thus no valuable output results can be obtained, thereby reducing the risk of the model being abused without authorization and ensuring the security of the model.
[0029] According to one embodiment of the present application, the method further includes:
[0030] When the current layer is an encryption key layer and the current layer is the last layer of the encryption model, the data processing result of the current layer is decrypted by the security chip using the first private key to obtain plaintext output data.
[0031] In the above technical solution, when the current layer is the encryption key layer and the current layer is the last layer of the encryption model, the data processing result of the current layer is decrypted using the first private key through the security chip to obtain plaintext output data, and the plaintext output data is used as the data processing result of the encryption model. If the terminal device is not equipped with a security chip and the first private key stored in the security chip, the data processing result of the model cannot be decrypted, which reduces the risk of the model being abused without authorization and ensures the security of the model.
[0032] In a third aspect, the present application provides a model encryption device, the device comprising:
[0033] Determination unit, used to determine the key layers and non-key layers of the original model;
[0034] an encryption unit, configured to encrypt the key layers of the original model according to the first public key to obtain the encrypted key layers of the original model;
[0035] The determining unit is further configured to determine an encryption model corresponding to the original model based on each of the encryption key layers of the original model and each of the non-key layers of the original model;
[0036] The first sending unit is configured to send the encryption model to a terminal device.
[0037] In the above technical solution, the model encryption device is used to determine the key layers and non-key layers of the original model, and encrypt the key layers of the original model according to the first public key to obtain the encrypted key layers of the original model. According to the encrypted key layers of the original model and the non-key layers of the original model, the encryption model corresponding to the original model is determined, and the encrypted model is sent to the terminal device. By encrypting the key layers of the model, the risk of the model being tampered with or abused is reduced, and the negative impact of encryption on the model reasoning efficiency and computing resource requirements is also reduced, and it can flexibly adapt to and meet the needs of diverse business scenarios.
[0038] In a fourth aspect, the present application provides a data processing device, comprising:
[0039] A first receiving unit, configured to receive an encryption model sent by a server;
[0040] An acquisition unit, used for acquiring data to be processed;
[0041] The first processing unit is used to use homomorphic encryption technology to input the data to be processed into the encryption model for processing to obtain a data processing result.
[0042] In the above technical solution, the data processing device is used to receive the encryption model sent by the server, obtain the data to be processed, use homomorphic encryption technology, input the data to be processed into the encryption model for processing, and obtain the data processing result. The output result of the encryption key layer in the encryption model can only be decrypted by a terminal device equipped with a security chip and storing the corresponding first private key in the security chip, thereby reducing the risk of the model being abused without authorization. Even if an attacker attempts to maliciously copy the encryption model and run it on other terminal devices, no valuable output results can be obtained, thereby ensuring the security of the model.
[0043] In a fifth aspect, the present application provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the processor implements the model encryption method as described in the first aspect above, or implements the data processing method as described in the second aspect above.
[0044] In a sixth aspect, the present application provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, it implements the model encryption method as described in the first aspect above, or implements the data processing method as described in the second aspect above.
[0045] In the seventh aspect, the present application provides a chip, which includes a processor and a communication interface, the communication interface and the processor are coupled, and the processor is used to run programs or instructions to implement the model encryption method described in the first aspect above, or to implement the data processing method described in the second aspect above.
[0046] In an eighth aspect, the present application provides a computer program product, comprising a computer program, which, when executed by a processor, implements the model encryption method as described in the first aspect above, or implements the data processing method as described in the second aspect above.
[0047] Additional aspects and advantages of the present application will be given in part in the description below, and in part will become obvious from the description below, or will be learned through practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS
[0048] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the description of the embodiments in conjunction with the following drawings, in which:
[0049] Figure 1 is a flowchart of a model encryption method provided in some embodiments of the present application;
[0050] Figure 2 is a flowchart of a data processing method provided in some embodiments of the present application;
[0051] Figure 3 is a schematic diagram of decrypting data to be processed provided by some embodiments of the present application;
[0052] Figure 4 is a schematic diagram of the structure of a model encryption device provided in some embodiments of the present application;
[0053] Figure 5 is a schematic structural diagram of a data processing device provided in some embodiments of the present application;
[0054] Figure 6 This is a schematic diagram of the structure of an electronic device provided in some embodiments of the present application.
[0055] Description of reference numerals:
[0056] 400: model encryption device; 401: determination unit; 402: encryption unit; 403: first sending unit;
[0057] 500: data processing device; 501: first receiving unit; 502: acquisition unit; 503: first processing unit;
[0058] 600: electronic device; 601: processor; 602: memory. DETAILED DESCRIPTION
[0059] The following will be combined with the accompanying drawings in the embodiments of the present application to clearly describe the technical solutions in the embodiments of the present application. Obviously, the embodiments described are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field are within the scope of protection of this application.
[0060] The terms "first," "second," and the like in the specification and claims of this application are used to distinguish similar objects, and are not used to describe a specific order or precedence. It should be understood that the terms used in this manner are interchangeable where appropriate, so that the embodiments of this application can be implemented in an order other than that illustrated or described herein, and that the objects distinguished by "first," "second," and the like are generally of the same type, and do not limit the number of objects; for example, the first object can be one or more. In addition, the term "and / or" in the specification and claims refers to at least one of the connected objects, and the character " / " generally indicates that the objects connected are in an "or" relationship.
[0061] The model encryption method, data processing method and device provided in the embodiments of the present application are described in detail below with reference to specific embodiments and their application scenarios in conjunction with the accompanying drawings.
[0062] Figure 1 This is a flow chart of the model encryption method provided by some embodiments of the present application. Figure 1 As shown, the model encryption method includes: step 110, step 120, step 130 and step 140.
[0063] The execution subject of the model encryption method can be a server (device) or a functional module or functional entity, integrated circuit or chip in the server (device) that can implement the model encryption method.
[0064] Step 110: Determine the key layers and non-key layers of the original model.
[0065] Key layers are layers in the original model that play an important role in model performance, feature extraction, or the decision-making process. They typically have a significant impact on output results, strong feature extraction capabilities, or rich gradient information. Key layers are usually difficult to replace with other layers. Removing or modifying a key layer may significantly reduce the performance of the original model or make it impossible to process data through the model (i.e., the model cannot perform inference). Non-key layers are layers in the original model that have less impact on model performance, feature extraction, or the decision-making process. Non-key layers may have a certain degree of redundancy, and removing or modifying non-key layers will have less impact on the overall performance of the original model.
[0066] It is understood that by analyzing the architecture, parameters, gradients, activation values, sensitivity, etc. of the original model, the layers that play an important role in the performance, feature extraction, or decision-making process of the original model can be determined, thereby determining the key layers in the original model. Optionally, the process of determining the key layers of the original model can be implemented using a deep learning analysis tool with functions such as model architecture analysis, parameter and gradient analysis, and activation value monitoring. The embodiments of this application do not specifically limit deep learning analysis tools.
[0067] Step 120: Encrypt each key layer of the original model according to the first public key to obtain each encrypted key layer of the original model.
[0068] In some embodiments, homomorphic encryption is used to encrypt the key layer of the original model. With homomorphic encryption, the key layer processes the data to be processed in an encrypted state. The processing results, after homomorphic decryption, are consistent with the results obtained by the key layer processing the same data to be processed in an unencrypted state. That is, even when the data to be processed and the key layer are encrypted, the output of the key layer can still maintain accuracy and consistency.
[0069] It is understandable that in order to achieve homomorphic encryption of each key layer, it is necessary to first build basic ciphertext operators, such as addition, subtraction, multiplication, division, comparison, and logical operations. Based on these basic ciphertext operators, specific ciphertext operators for key layer operations (such as convolution, activation functions, etc.) are further designed, so that the key layer can still process data normally in the encrypted state.
[0070] It is understandable that encrypting the model, especially using homomorphic encryption technology, will have a significant impact on the model's computing resource requirements and inference time. Specifically, the encrypted ciphertext data is usually larger than the original plaintext data, which increases storage requirements and requires more computing resources when processing and transmitting ciphertext data. In addition, the data encryption and decryption process itself also takes up a lot of computing resources, further reducing the efficiency of model inference.
[0071] Therefore, in the embodiments of the present application, only the key layers of the original model are selectively encrypted, rather than all layers of the original model. The purpose is to minimize the impact on the original model's reasoning efficiency while ensuring the security and stability of the original model. By encrypting the key layers of the original model, the core of the original model can be effectively protected, reducing the risk of model tampering or abuse, while avoiding unnecessary encryption of non-critical layers, thereby reducing computing overhead and latency, and optimizing the overall process of model reasoning.
[0072] Step 130: Determine the encryption model corresponding to the original model according to the encryption key layers of the original model and the non-key layers of the original model.
[0073] The encrypted key layer (i.e., the encrypted key layer) and the unencrypted non-key layer are combined to create the encrypted model corresponding to the original model. It is understood that during the inference process of the encrypted model, data is transmitted between the encrypted and non-encrypted layers, ensuring the security of the model while also reducing the negative impact of encryption on model inference efficiency and computing resource requirements, allowing for flexible adaptation and meeting the needs of diverse business scenarios.
[0074] Step 140: Send the encryption model to the terminal device.
[0075] In the above technical solution, the key layers and non-key layers of the original model are determined, and the key layers of the original model are encrypted according to the first public key to obtain the encrypted key layers of the original model. According to the encrypted key layers of the original model and the non-key layers of the original model, the encryption model corresponding to the original model is determined, and the encrypted model is sent to the terminal device. By encrypting the key layers of the model, the risk of the model being tampered with or abused is reduced, and the negative impact of encryption on the model reasoning efficiency and computing resource requirements is also reduced, and it can flexibly adapt to and meet the needs of diverse business scenarios.
[0076] In some embodiments of the present application, before encrypting the key layers of the original model according to the first public key to obtain the encrypted key layers of the original model, the method further includes:
[0077] Receive the first public key sent by the terminal device.
[0078] It can be understood that a pair of asymmetric encryption keys, namely a first public key and a private key pair, is determined by the terminal device, wherein the first public key is used to encrypt data and is publicly distributed to the server; the first private key is used to decrypt data and is not disclosed to the outside.
[0079] The key layer of the model is encrypted according to the first public key to obtain an encrypted model. Data processing can be achieved through the encrypted model only when the corresponding first private key is possessed. This can effectively prevent the model from being illegally abused. Even if an attacker copies or steals the encrypted model, he cannot obtain the output result after decryption of the key layer.
[0080] In the above technical solution, the first public key sent by the receiving terminal device can be used to encrypt the key layer of the original model according to the first public key to obtain an encrypted model. Data processing can be achieved through the encrypted model only when the corresponding first private key is possessed. This can effectively prevent the model from being illegally abused. Even if the attacker copies or steals the encrypted model, the data processing results of the encrypted key layer cannot be decrypted, which further ensures the security of the model.
[0081] Figure 2 This is a flow chart of the data processing method provided by some embodiments of the present application. Figure 2 As shown, the data processing method includes: step 210, step 220 and step 230.
[0082] The execution subject of the data processing method can be a terminal device or a functional module or functional entity, integrated circuit or chip in the terminal device that can implement the data processing method, such as a main control chip, a security chip, etc. The terminal devices mentioned in the embodiments of this application include but are not limited to mobile phones, tablets, computers, cameras, and wearable devices. The data processing method provided in the embodiments of this application is described below using a terminal device as an example of the execution subject, and the terminal device includes a security chip.
[0083] Step 210: Receive the encryption model sent by the server.
[0084] In some embodiments, before receiving the encryption model sent by the server, the method further includes:
[0085] Generate a first public key and private key pair through the security chip, the first public key and private key pair including a first public key and a first private key, and store the first private key in the security chip;
[0086] Send the first public key to the server.
[0087] It can be understood that before receiving the encryption model sent by the server, the terminal device determines a pair of asymmetric encryption keys through the security chip, namely the first public key and private key pair, wherein the first public key is used to encrypt data and can be publicly distributed to other devices or servers; the first private key is used to decrypt data, stored in the security chip, and not disclosed to the outside.
[0088] After a first public key and a private key pair are generated by the security chip, the first public key is sent to the server, and the server uses the first public key to encrypt the original model to obtain an encrypted model.
[0089] It is understandable that the security chip uses hardware-level encryption technology, which can effectively prevent external attacks and data theft. It can be used to store keys or sensitive data and further used for key generation, encryption and decryption, etc. In the embodiment of the present application, the first private key is stored in the security chip. The output result of the encryption key layer in the encryption model can only be decrypted by a terminal device equipped with a security chip and storing the corresponding first private key in the security chip. Even if an attacker attempts to maliciously copy the encryption model and run it on other terminal devices, no valuable output results can be obtained, reducing the risk of unauthorized abuse of the model.
[0090] In the above technical solution, a first public key and private key pair is generated through a security chip, the first public key and private key pair including a first public key and a first private key, the first private key is stored in the security chip, and the first public key is sent to the server. The first public key can be used to encrypt the model to obtain an encrypted model, and the output result of the encryption key layer in the encryption model can only be decrypted by a terminal device equipped with a security chip and storing the corresponding first private key in the security chip, which can effectively prevent the model from being illegally abused.
[0091] Step 220: Obtain data to be processed.
[0092] Step 230: Use homomorphic encryption technology to input the data to be processed into the encryption model for processing to obtain a data processing result.
[0093] It is understandable that the key layer processes the data to be processed in an encrypted state, and its processing results, after decryption, are consistent with the results of the key layer processing the same data to be processed in an unencrypted state. That is, when the data to be processed and the key layer are in an encrypted state, the output of the key layer can still maintain accuracy and consistency. The unencrypted non-key layer can only receive plaintext data as input. Therefore, in order to enable the encryption model to process data normally, in the embodiment of the present application, when the data to be processed is input into the encryption model for data processing, homomorphic encryption technology can be used to decrypt the output results of the encrypted key layer in the encryption model according to the first private key.
[0094] In the above technical solution, the encryption model sent by the server is received, the data to be processed is obtained, and the homomorphic encryption technology is used to input the data to be processed into the encryption model for processing to obtain the data processing result. The output result of the encryption key layer in the encryption model can only be decrypted by a terminal device equipped with a security chip and storing the corresponding first private key in the security chip, which reduces the risk of the model being abused without authorization. Even if an attacker attempts to maliciously copy the encryption model and run it on other terminal devices, he cannot obtain any valuable output results, thereby ensuring the security of the model.
[0095] In some embodiments of the present application, the use of homomorphic encryption technology to input the data to be processed into the encryption model for processing to obtain a data processing result includes:
[0096] In the case where the current layer of the encryption model is an encryption key layer, the data to be processed in the current layer is input into the current layer for encrypted processing to obtain a data processing result of the current layer.
[0097] It can be understood that when the current layer is not the first layer of the encryption model, the data to be processed in the current layer refers to the data processing results of the previous layer; when the current layer is the first layer of the encryption model, the data to be processed in the current layer refers to the input data of the encryption model.
[0098] It can be understood that encrypted processing means that the current layer processes the data to be processed in the current layer in an encrypted state to obtain the data processing result of the current layer, and the data processing result of the current layer is also encrypted data. When it is necessary to obtain the plaintext data corresponding to the data processing result of the current layer (for example, the layer below the current layer is an unencrypted, non-critical layer that can only receive plaintext data as input), the data processing result of the current layer can be decrypted using the first private key through the security chip.
[0099] In some embodiments, when the current layer of the encryption model is an encryption key layer and the layer above the current layer is a non-key layer, or when the current layer of the encryption model is an encryption key layer and the current layer is the first layer of the original model, the data to be processed in the current layer is encrypted according to the first public key, and the encrypted data to be processed in the current layer is input into the current layer for secret state processing to obtain a data processing result of the current layer;
[0100] When the current layer of the encryption model is an encryption key layer and the previous layer of the current layer is also an encryption key layer, the data to be processed in the current layer is input into the current layer for encrypted processing to obtain the data processing result of the current layer.
[0101] In the above technical solution, when the current layer of the encryption model is the encryption key layer, the data to be processed in the current layer is input into the current layer for confidential processing to obtain the data processing result of the current layer. The data processing result of the current layer is also encrypted data, which can only be decrypted by a terminal device equipped with a security chip and storing the corresponding first private key in the security chip, thereby reducing the risk of the model being abused without authorization. Even if an attacker attempts to maliciously copy the encrypted model and run it on other terminal devices, he cannot obtain any valuable output results, thereby ensuring the security of the model.
[0102] In some embodiments of the present application, the use of homomorphic encryption technology to input the data to be processed into the encryption model for processing to obtain a data processing result includes:
[0103] When the current layer of the encryption model is a non-critical layer and the layer above the current layer is an encryption critical layer, decrypting the data to be processed in the current layer using the first private key through the security chip, inputting the decrypted data to be processed in the current layer into the current layer for processing, and obtaining a data processing result of the current layer;
[0104] When the current layer of the encryption model is a non-critical layer and the previous layer of the current layer is also a non-critical layer, or when the current layer of the encryption model is a non-critical layer and the current layer is the first layer of the encryption model, the data to be processed of the current layer is input into the current layer for processing to obtain the data processing result of the current layer.
[0105] It can be understood that the data processing result of the previous layer is used as the data to be processed in the current layer. When the current layer of the encryption model is a non-critical layer and the previous layer of the current layer is an encryption critical layer, the data to be processed in the current layer cannot be directly input into the current layer, because the current layer is an unencrypted non-critical layer and can only receive plaintext data as input, and the data processing result of the previous layer is encrypted data, so the data to be processed in the current layer needs to be decrypted.
[0106] Figure 3 This is a schematic diagram of decrypting data to be processed provided by some embodiments of the present application. Figure 3 As shown, when the current layer of the encryption model is a non-critical layer and the layer above the current layer is an encryption critical layer, the data processing result (ciphertext) of the previous layer is decrypted through a security chip that stores a first private key, and the decrypted data is obtained as the data to be processed (plaintext) of the current layer, which is input into the current layer for processing to obtain the data processing result of the current layer.
[0107] If the current layer is non-critical and the previous layer is also non-critical, the data processed by the previous layer is plaintext and can be directly used as the data to be processed by the current layer, without the need for decryption by the security chip. If the current layer is the first layer of the encryption model, the data to be processed in the current layer refers to the input data of the encryption model.
[0108] In the above technical solution, when the current layer of the encryption model is a non-critical layer and the layer above the current layer is an encryption critical layer, the data to be processed in the current layer is decrypted using the first private key through the security chip, and the decrypted data to be processed in the current layer is input into the current layer for processing to obtain the data processing result of the current layer; when the current layer of the encryption model is a non-critical layer and the layer above the current layer is also a non-critical layer, or when the current layer of the encryption model is a non-critical layer and the current layer is the first layer of the encryption model, the data to be processed in the current layer is input into the current layer for processing to obtain the data processing result of the current layer, and the data processing result of the encryption critical layer is decrypted using the first private key in the security chip as the data to be processed in the non-critical layer, thereby realizing data transmission between different layers in the encryption model. When the terminal device is not equipped with a security chip and the first private key stored in the security chip, the data processing result of the encryption critical layer cannot be decrypted, and thus no valuable output results can be obtained, thereby reducing the risk of the model being abused without authorization and ensuring the security of the model.
[0109] In some embodiments of the present application, the method further comprises:
[0110] When the current layer is an encryption key layer and the current layer is the last layer of the encryption model, the data processing result of the current layer is decrypted by the security chip using the first private key to obtain plaintext output data.
[0111] It is understood that the current layer is the last layer of the encryption model, and the data processing results of the current layer will not be processed further. If the current layer is a non-critical layer, the data processing results of the current layer are plaintext output data, which can be directly used as the data processing results of the encryption model. If the current layer is an encryption-critical layer, the data processing results of the current layer are ciphertext and need to be decrypted by the security chip using the first private key to obtain the plaintext output data, which is used as the data processing results of the encryption model.
[0112] In the above technical solution, when the current layer is the encryption key layer and the current layer is the last layer of the encryption model, the data processing result of the current layer is decrypted using the first private key through the security chip to obtain plaintext output data, and the plaintext output data is used as the data processing result of the encryption model. If the terminal device is not equipped with a security chip and the first private key stored in the security chip, the data processing result of the model cannot be decrypted, which reduces the risk of the model being abused without authorization and ensures the security of the model.
[0113] The model encryption method provided in the embodiment of the present application can be executed by a model encryption device. In the embodiment of the present application, the model encryption device provided in the embodiment of the present application is described by taking the execution of the model encryption method by the model encryption device as an example.
[0114] Figure 4 This is a schematic diagram of the structure of the model encryption device provided in some embodiments of the present application. Figure 4 As shown, the model encryption device 400 includes:
[0115] A determination unit 401 is used to determine the key layers and non-key layers of the original model;
[0116] An encryption unit 402 is configured to encrypt the key layers of the original model according to a first public key to obtain the encrypted key layers of the original model;
[0117] The determining unit 402 is further configured to determine an encryption model corresponding to the original model based on the encryption key layers and the non-key layers of the original model;
[0118] The first sending unit 403 is configured to send the encryption model to a terminal device.
[0119] Optionally, the model encryption device 400 further includes a second receiving unit, which is configured to:
[0120] Receive the first public key sent by the terminal device.
[0121] In the above technical solution, the model encryption device is used to determine the key layers and non-key layers of the original model, and encrypt the key layers of the original model according to the first public key to obtain the encrypted key layers of the original model. According to the encrypted key layers of the original model and the non-key layers of the original model, the encryption model corresponding to the original model is determined, and the encrypted model is sent to the terminal device. By encrypting the key layers of the model, the risk of the model being tampered with or abused is reduced, and the negative impact of encryption on the model reasoning efficiency and computing resource requirements is also reduced, and it can flexibly adapt to and meet the needs of diverse business scenarios.
[0122] The model encryption device in the embodiment of the present application can be an electronic device or a component in the electronic device, such as an integrated circuit or chip. The electronic device can be a terminal or other device other than a terminal. For example, the electronic device can be a mobile phone, a tablet computer, a laptop computer, a PDA, an in-vehicle electronic device, a mobile Internet device (MID), an augmented reality (AR) / virtual reality (VR) device, a robot, a wearable device, an ultra-mobile personal computer (UMPC), a netbook or a personal digital assistant (PDA), etc. It can also be a server, a network attached storage (NAS), a personal computer (PC), a television (TV), a teller machine or a self-service machine, etc., and the embodiment of the present application does not specifically limit it.
[0123] The model encryption device in the embodiments of the present application may be a device having an operating system. The operating system may be a Microsoft (Windows) operating system, an Android operating system, an iOS operating system, or other possible operating systems, which are not specifically limited in the embodiments of the present application.
[0124] The model encryption device provided in the embodiment of the present application can implement the various processes implemented in the above-mentioned model encryption method embodiment and achieve the same technical effect. To avoid repetition, it will not be repeated here.
[0125] The data processing method provided in the embodiment of the present application can be executed by a data processing device. In the embodiment of the present application, the data processing device provided in the embodiment of the present application is described by taking the data processing method executed by the data processing device as an example.
[0126] Figure 5 This is a schematic diagram of the structure of the data processing device provided by some embodiments of the present application. Figure 5 As shown, the data processing device 500 includes:
[0127] The first receiving unit 501 is used to receive the encryption model sent by the server;
[0128] An acquisition unit 502 is used to acquire data to be processed;
[0129] The first processing unit 503 is used to use homomorphic encryption technology to input the data to be processed into the encryption model for processing to obtain a data processing result.
[0130] Optionally, the data processing device 500 further includes a second processing unit, which is configured to:
[0131] A first public key and private key pair is generated through the security chip, where the first public key and private key pair includes a first public key and a first private key, and the first private key is stored in the security chip.
[0132] Optionally, the data processing device 500 further includes a second sending unit, which is configured to:
[0133] Send the first public key to the server.
[0134] Optionally, the first processing unit 503 is configured to:
[0135] In the case where the current layer of the encryption model is an encryption key layer, the data to be processed in the current layer is input into the current layer for encrypted processing to obtain a data processing result of the current layer.
[0136] Optionally, the first processing unit 503 is configured to:
[0137] When the current layer of the encryption model is a non-critical layer and the layer above the current layer is an encryption critical layer, decrypting the data to be processed in the current layer using the first private key through the security chip, inputting the decrypted data to be processed in the current layer into the current layer for processing, and obtaining a data processing result of the current layer;
[0138] When the current layer of the encryption model is a non-critical layer and the previous layer of the current layer is also a non-critical layer, or when the current layer of the encryption model is a non-critical layer and the current layer is the first layer of the encryption model, the data to be processed of the current layer is input into the current layer for processing to obtain the data processing result of the current layer.
[0139] Optionally, the first processing unit 503 is further configured to:
[0140] When the current layer is an encryption key layer and the current layer is the last layer of the encryption model, the data processing result of the current layer is decrypted by the security chip using the first private key to obtain plaintext output data.
[0141] In the above technical solution, the data processing device is used to receive the encryption model sent by the server, obtain the data to be processed, use homomorphic encryption technology, input the data to be processed into the encryption model for processing, and obtain the data processing result. The output result of the encryption key layer in the encryption model can only be decrypted by a terminal device equipped with a security chip and storing the corresponding first private key in the security chip, thereby reducing the risk of the model being abused without authorization. Even if an attacker attempts to maliciously copy the encryption model and run it on other terminal devices, no valuable output results can be obtained, thereby ensuring the security of the model.
[0142] The data processing device in the embodiment of the present application can be an electronic device or a component in the electronic device, such as an integrated circuit or a chip. The electronic device can be a terminal or other device other than a terminal. For example, the electronic device can be a mobile phone, a tablet computer, a laptop computer, a PDA, an in-vehicle electronic device, a mobile Internet device (MID), an augmented reality (AR) / virtual reality (VR) device, a robot, a wearable device, an ultra-mobile personal computer (UMPC), a netbook or a personal digital assistant (PDA), etc. It can also be a server, a network attached storage (NAS), a personal computer (PC), a television (TV), a teller machine or a self-service machine, etc., and the embodiment of the present application does not specifically limit it.
[0143] The data processing device in the embodiments of the present application may be a device having an operating system. The operating system may be a Microsoft (Windows) operating system, an Android operating system, an iOS operating system, or other possible operating systems, which are not specifically limited in the embodiments of the present application.
[0144] The data processing device provided in the embodiment of the present application can implement the various processes implemented in the above-mentioned data processing method embodiment and achieve the same technical effect. To avoid repetition, it will not be described here.
[0145] In some embodiments, as Figure 6As shown, an embodiment of the present application further provides an electronic device 600, including a processor 601, a memory 602, and a computer program stored in the memory 602 and executable on the processor 601. When the program is executed by the processor 601, the program implements the various processes of the above-mentioned model encryption method embodiment, or implements the various processes of the above-mentioned data processing method embodiment, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.
[0146] It should be noted that the electronic devices in the embodiments of the present application include the mobile electronic devices and non-mobile electronic devices mentioned above.
[0147] An embodiment of the present application also provides a non-transitory computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, it implements the various processes of the above-mentioned model encryption method embodiment, or implements the various processes of the above-mentioned data processing method embodiment, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.
[0148] The processor is the processor in the electronic device described in the above embodiment. The readable storage medium includes a computer readable storage medium, such as a computer read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.
[0149] An embodiment of the present application also provides a computer program product, including a computer program, which implements the above-mentioned model encryption method or the above-mentioned data processing method when executed by a processor.
[0150] The processor is the processor in the electronic device described in the above embodiment. The readable storage medium includes a computer readable storage medium, such as a computer read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.
[0151] An embodiment of the present application further provides a chip, which includes a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run programs or instructions to implement the various processes of the above-mentioned model encryption method embodiment, or to implement the various processes of the above-mentioned data processing method embodiment, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.
[0152] It should be understood that the chip mentioned in the embodiments of the present application can also be called a system-level chip, a system chip, a chip system or a system-on-chip chip, etc.
[0153] It should be noted that, in this article, the terms "comprise", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the statement "comprises a ..." does not exclude the presence of other identical elements in the process, method, article or device comprising the element. In addition, it should be noted that the scope of the methods and devices in the embodiments of the present application is not limited to performing functions in the order shown or discussed, and may also include performing functions in a substantially simultaneous manner or in the opposite order according to the functions involved. For example, the described method may be performed in an order different from that described, and various steps may also be added, omitted, or combined. In addition, the features described with reference to certain examples may be combined in other examples.
[0154] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus the necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present application, or the part that contributes to the relevant technology, can be embodied in the form of a computer software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for enabling a terminal (which can be a mobile phone, computer, server, or network device, etc.) to execute the methods described in each embodiment of the present application.
[0155] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of this application, ordinary technicians in this field can also make many forms without departing from the purpose of this application and the scope of protection of the claims, all of which are within the protection of this application.
[0156] Throughout this specification, reference to terms such as "one embodiment," "some embodiments," "illustrative embodiments," "examples," "specific examples," or "some examples" means that the specific features, structures, materials, or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples.
[0157] Although the embodiments of the present application have been shown and described, those skilled in the art will appreciate that various changes, modifications, substitutions, and variations may be made to the embodiments without departing from the principles and intent of the present application, and that the scope of the present application is defined by the claims and their equivalents.
Claims
1. A model encryption method, characterized in that: Applied to the server, including: Determine the key layers and non-key layers of the original model; Encrypting each key layer of the original model according to the first public key to obtain each encrypted key layer of the original model; Determining an encryption model corresponding to the original model according to each of the encryption key layers of the original model and each of the non-key layers of the original model; The encrypted model is sent to the terminal device.
2. The model encryption method according to claim 1, characterized in that: Before encrypting the key layers of the original model according to the first public key to obtain the encrypted key layers of the original model, the method further includes: Receive the first public key sent by the terminal device.
3. A data processing method, characterized in that: Applied to a terminal device, the terminal device includes a security chip, and the data processing method includes: Receive the encryption model sent by the server; Get the data to be processed; Using homomorphic encryption technology, the data to be processed is input into the encryption model for processing to obtain a data processing result.
4. The data processing method according to claim 3, characterized in that: Before receiving the encryption model sent by the server, the method further includes: Generate a first public key and private key pair through the security chip, the first public key and private key pair including a first public key and a first private key, and store the first private key in the security chip; Send the first public key to the server.
5. The data processing method according to claim 4, characterized in that: The method of using homomorphic encryption technology to input the data to be processed into the encryption model for processing to obtain a data processing result includes: In the case where the current layer of the encryption model is an encryption key layer, the data to be processed in the current layer is input into the current layer for encrypted processing to obtain a data processing result of the current layer.
6. The data processing method according to claim 4, characterized in that: The method of using homomorphic encryption technology to input the data to be processed into the encryption model for processing to obtain a data processing result includes: When the current layer of the encryption model is a non-critical layer and the layer above the current layer is an encryption critical layer, decrypting the data to be processed in the current layer using the first private key through the security chip, inputting the decrypted data to be processed in the current layer into the current layer for processing, and obtaining a data processing result of the current layer; When the current layer of the encryption model is a non-critical layer and the previous layer of the current layer is also a non-critical layer, or when the current layer of the encryption model is a non-critical layer and the current layer is the first layer of the encryption model, the data to be processed of the current layer is input into the current layer for processing to obtain the data processing result of the current layer.
7. The data processing method according to claim 5, characterized in that: The method further comprises: When the current layer is an encryption key layer and the current layer is the last layer of the encryption model, the data processing result of the current layer is decrypted by the security chip using the first private key to obtain plaintext output data.
8. A model encryption device, characterized in that: include: Determination unit, used to determine the key layers and non-key layers of the original model; an encryption unit, configured to encrypt the key layers of the original model according to the first public key to obtain the encrypted key layers of the original model; The determining unit is further configured to determine an encryption model corresponding to the original model based on each of the encryption key layers of the original model and each of the non-key layers of the original model; The first sending unit is configured to send the encryption model to a terminal device.
9. A data processing device, characterized in that: include: A first receiving unit, configured to receive an encryption model sent by a server; An acquisition unit, used for acquiring data to be processed; The first processing unit is used to use homomorphic encryption technology to input the data to be processed into the encryption model for processing to obtain a data processing result.
10. An electronic device comprising a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, it implements the model encryption method according to any one of claims 1 to 2, or implements the data processing method according to any one of claims 3 to 7.
11. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, it implements the model encryption method according to any one of claims 1 to 2, or implements the data processing method according to any one of claims 3 to 7.