AI Model Security Protection System and Method Based on Domestic Cryptographic Algorithms and Digital Certificates

Abstract

This invention discloses an AI model security protection system and method based on domestically developed cryptographic algorithms and digital certificates. The system includes a Certificate Authority (CA), an AI model security gateway, a training terminal, and a deployment server. The CA is a certificate management system from a trusted third-party CA authority. The AI ​​model security gateway is used for secure access and compliance verification of training data. The training terminal is used for secure initialization of the model development end and for generating secure model packages; it is the terminal device used by developers for model training. The deployment server is used for security management of the model execution end. The method involves: first, data encryption and model certificate binding; then, identity authentication and transmission encryption; next, integrity verification and anti-tampering measures; and finally, version traceability and legality verification. This invention improves the security of AI models and the efficiency of model transmission and verification, achieves full-process model traceability, and is highly compatible and easy to promote.

Description

Technical Field

[0001] This invention relates to the intersection of artificial intelligence security and cryptography, and in particular to an AI model security protection system and method based on domestically developed cryptographic algorithms and digital certificates. Background Technology

[0002] Artificial intelligence (AI) is a new technological science that studies and develops theories, methods, technologies, and application systems to simulate, extend, and expand human intelligence. AI is a branch of computer science that attempts to understand the nature of intelligence and produce new intelligent machines that can react in a way similar to human intelligence. Research in this field includes robotics, speech recognition, image recognition, natural language processing, and expert systems.

[0003] AI models are a relatively new concept that has emerged in the last decade. They are typically pre-trained on massive datasets using self-supervised or semi-supervised learning, and then their performance and capabilities are further optimized through methods such as instruction fine-tuning and human alignment. AI models are characterized by a large number of parameters, large amounts of training data, and large computational resources, and possess the ability to solve general tasks, follow human instructions, and perform complex reasoning.

[0004] With the large-scale application of AI technology in key industries, the security risks and credibility issues of AI models are becoming increasingly prominent:

[0005] 1. Model security risks: AI models face risks of training data leakage and malicious tampering during the training phase; they are easily intercepted and stolen during the transmission phase; after deployment, they may be illegally copied, maliciously reverse engineered, or injected with adversarial examples; and there are issues of version forgery and illegal replacement during the update phase.

[0006] 2. Insufficient adaptability of cryptographic technologies: Existing AI security solutions mostly rely on international cryptographic algorithms (such as RSA and AES) and are not fully adapted to the domestic cryptographic algorithms (such as SM2 elliptic curve public key cryptography algorithm, SM3 cryptographic hash algorithm, and SM4 block cipher algorithm) specified in my country's "Information Security Technology Basic Requirements for Cryptographic Applications" (GB / T 39786-2021). This poses compliance and security risks in key applications.

[0007] 3. Lack of credibility traceability: Existing solutions lack a unique identifier for the identity of AI models and a full-process traceability mechanism, making it impossible to verify the legitimacy of the model publisher and the integrity of the version, making it difficult to trace the responsible party for malicious models.

[0008] Digital certificates, as online identity cards issued by authoritative institutions, can achieve identity authentication and data integrity verification; domestically developed cryptographic algorithms have the advantages of being independently controllable and having strong anti-attack capabilities. Deeply integrating these two with the security requirements of AI models can effectively address the security risks and trustworthiness issues of AI models, but currently there is no mature solution to achieve the synergistic interaction of these three elements. Summary of the Invention

[0009] The purpose of this invention is to provide an AI model security protection system and method that can achieve full lifecycle security protection, including AI model training data encryption, model identity authentication, transmission encryption, deployment anti-tampering, and update traceability, while meeting the compliance requirements of domestic cryptographic algorithms.

[0010] The technical solution to achieve the purpose of this invention is: an AI model security protection system based on domestic cryptographic algorithms and digital certificates, including a Certificate Authority (CA), an AI model security gateway, a training terminal, and a deployment server;

[0011] The Certificate Management Center (CA) mentioned above is a certificate management system of a third-party trusted Certificate Management Center (CA) authority. It supports the issuance and management of SM2 algorithm digital certificates, which are used to issue AI model developer certificates to AI model developers, generate unique AI model certificates for AI models, and issue device trust certificates for deployment servers.

[0012] The AI ​​model security gateway is the core processing node for system security, responsible for the secure access and compliance verification of training data. It integrates SM2, SM3, and SM4 algorithms for encrypting and decrypting AI model training data, verifying data compliance (including sensitive information verification, data format verification, and permission matching verification), and also for identity authentication and data encryption during AI model transmission, integrity verification and access control before AI model deployment, and version tracing and legality verification during AI model updates. This ensures unified management and secure sharing of training data and guarantees consistency of training data used by multiple terminals.

[0013] The training terminal is used for secure initialization of the AI ​​model development end and generation of secure model packages. It is a terminal device used by developers to train AI models. The training terminal integrates a cryptographic algorithm plugin, which is used to encrypt training data using the SM4 algorithm and upload it to the gateway, train the AI ​​model, use the SM3 algorithm to calculate the hash value of the AI ​​model to generate an AI model digest, apply for a unique certificate for the AI ​​model from the Certificate Authority (CA) and bind it to the AI ​​model digest, and generate a secure model package.

[0014] The deployment server is pre-installed with a device trust certificate for security management of the AI ​​model runtime and serves as the legitimate runtime carrier for the security model package. The deployment server is used as a server to run the AI ​​model. When receiving the AI ​​model, it verifies the legitimacy of the unique certificate of the AI ​​model using the SM2 algorithm, verifies whether the hash value of the AI ​​model is consistent with the AI ​​model digest using the SM3 algorithm, and monitors the integrity of the AI ​​model file in real time when running the AI ​​model.

[0015] Furthermore, the Certificate Management Center (CA) uses domestically produced servers and runs a domestically produced operating system. It deploys an SM2 algorithm certificate issuance system that conforms to the GM / T 0034-2014 SM2 algorithm-based certificate authentication system cryptography and security technical specifications. It realizes the functions of digital certificate application, issuance, renewal, and revocation, and uses a domestically produced database to store certificate information.

[0016] Furthermore, the AI ​​model security gateway uses a domestically produced encryption card in its hardware, supports hardware acceleration for SM2, SM3, and SM4 algorithms, has a processor clock speed of ≥2.5GHz and memory of ≥32GB, ensuring the efficiency of cryptographic operations and data forwarding; the software is developed based on the Linux kernel, realizing automated processing of SM2 algorithm authentication, SM4 algorithm encryption, and SM3 algorithm verification, with a latency of ≤10ms.

[0017] Furthermore, the training terminal uses a regular server or workstation as hardware, installs a domestic cryptographic algorithm plugin, and supports the SM4 algorithm for data encryption; the software is provided as a Python library, which supports calling the SM4 algorithm to encrypt training data and the SM3 algorithm to calculate the hash value of the AI ​​model, and the interface is compatible with TensorFlow and PyTorch AI frameworks.

[0018] Furthermore, the deployment server uses industrial-grade hardware, pre-installed with device trust certificates, and integrates an integrity monitoring plugin to support real-time hash verification; the software is developed in C++, with a background process performing SM3 algorithm verification once per hour, and the verification results are uploaded to the AI ​​model security gateway in real time, with alerts sent via SMS or email in case of anomalies.

[0019] A method for protecting the security of AI models based on domestically developed cryptographic algorithms and digital certificates, the method comprising the following steps, based on the aforementioned AI model security protection system:

[0020] Step 1: During the training phase, data encryption and AI model certificate binding are performed.

[0021] Step 2, the transmission phase, involves identity authentication and transmission encryption;

[0022] Step 3, Deployment Phase: Perform integrity verification and tamper protection.

[0023] Step 4, the update phase, involves tracing the version source and verifying its legality.

[0024] Furthermore, in the training phase described in step 1, data encryption and AI model certificate binding are performed, as detailed below:

[0025] Step 1.1: The developer initiates a training request through the training terminal and applies for an AI model developer certificate from the Certificate Management Center (CA). After verifying the developer's identity, the CA issues the AI ​​model developer certificate.

[0026] Step 1.2: The training terminal performs symmetric encryption on the training data using the SM4 algorithm. The key is generated through negotiation using the SM2 algorithm and is held only by the training terminal and the AI ​​model security gateway. The encrypted data is then uploaded to the AI ​​model security gateway to ensure that the training data complies with security standards from the source.

[0027] Step 1.3: The AI ​​model security gateway decrypts the training data, performs data compliance verification and data governance on the training data, and then uses the SM4 algorithm to symmetrically encrypt the compliant training data and feeds the result back to the training terminal. If the decryption and verification result are normal, the training terminal starts AI model training.

[0028] Step 1.4: After the AI ​​model training is completed, the training terminal calculates the AI ​​model hash value using the SM3 algorithm to generate an AI model summary, and applies to the Certificate Authority (CA) for a unique AI model certificate along with the AI ​​model developer certificate.

[0029] Step 1.5: After the Certificate Management Center (CA) verifies the legality of the developer certificate, it writes the AI ​​model ID, version number, and AI model summary into the unique AI model certificate and issues it to the training terminal, thus completing the binding between the AI ​​model and the unique AI model certificate.

[0030] Step 1.6: The training terminal generates a secure model package, including the AI ​​model file and the AI ​​model's unique certificate.

[0031] Furthermore, in the transmission stage described in step 2, identity authentication and transmission encryption are performed, as follows:

[0032] Step 2.1: The developer sends an AI model deployment command to the training terminal. The training terminal uses the SM4 algorithm to encrypt the security model package to obtain the encrypted security model package. The encrypted security model package and the AI ​​model developer certificate are then transmitted to the AI ​​model security gateway.

[0033] Step 2.2: The AI ​​model security gateway decrypts the AI ​​model file, the unique AI model certificate, and the AI ​​model developer certificate.

[0034] Step 2.3: The AI ​​model security gateway verifies the signature validity of the two certificates using the SM2 and SM3 algorithms to confirm the developer's identity and the validity of the AI ​​model.

[0035] Step 2.4: The deployment server sends the device trust certificate to the gateway, and the AI ​​model security gateway verifies the server's legitimacy;

[0036] Step 2.5: After successful authentication, the AI ​​model security gateway performs symmetric encryption on the AI ​​model file using the SM4 algorithm. The transmission key is dynamically negotiated using the SM2 algorithm. The encrypted AI model and the unique certificate of the AI ​​model are then transmitted to the deployment server.

[0037] Furthermore, in the deployment phase described in step 3, integrity verification and tamper protection are performed, as detailed below:

[0038] Step 3.1: After receiving the AI ​​model, the deployment server uses the SM4 algorithm to perform symmetric decryption on the encrypted secure AI model file, obtaining the AI ​​model file and the AI ​​model's unique certificate.

[0039] Step 3.2: Verify the signature of the AI ​​model's unique certificate using the SM2 algorithm to verify the identity of the Certificate Authority (CA) and whether the AI ​​model's unique certificate has been tampered with.

[0040] Step 3.3: The deployment server recalculates the received AI model hash value using the SM3 algorithm and compares it with the AI ​​model digest recorded in the AI ​​model's unique certificate. If they match, the AI ​​model has not been tampered with and deployment is allowed; if they do not match, the AI ​​model has been tampered with, deployment is rejected, and an alarm message is sent to the AI ​​model security gateway.

[0041] Step 3.4: During the AI ​​model operation, the deployment server verifies the integrity of the AI ​​model file every hour using the SM3 algorithm. If an abnormal AI model hash value is detected, the AI ​​model operation is immediately stopped and an alarm is triggered.

[0042] Furthermore, in the update phase described in step 4, version tracing and legality verification are performed, as follows:

[0043] Step 4.1: When developers release a new version of the AI ​​model, they repeat the training phase process, generate a summary of the new version of the AI ​​model, apply to the Certificate Authority (CA) for a new unique certificate for the AI ​​model, and increment the version number.

[0044] Step 4.2: Before transmitting the new version of the AI ​​model, the AI ​​model security gateway compares the hash values ​​of the old and new versions of the AI ​​model using the SM3 algorithm, generates a version difference report, and associates it with the unique certificate of the old version of the AI ​​model to achieve version traceability.

[0045] Step 4.3: After the deployment server receives the new version of the AI ​​model, it completes the integrity verification and queries the unique certificate of the historical version of the AI ​​model through the Certificate Management Center (CA) to confirm that the new version of the AI ​​model was released by the original developer, thus preventing malicious third parties from forging the version.

[0046] Step 4.4: After successful verification, deploy the server to replace the old AI model, and save the old version AI model file and the unique certificate of the AI ​​model for subsequent traceability auditing.

[0047] Compared with existing technologies, the present invention has the following significant advantages: (1) The entire process adopts the domestic cryptographic algorithms SM2 / SM3 / SM4, which comply with the requirements of the Cryptography Law and GB / T 39786-2021 and can be applied to key areas such as government affairs and finance; (2) It covers the four stages of AI model training, transmission, deployment and update, solves the core risks such as data leakage, model tampering and version forgery, and improves the security of AI models; (3) By binding the model identity with digital certificates, the entire process of model traceability can be realized, and the responsible party of malicious models can be quickly located; (4) Hardware-accelerated cryptographic operations are used to ensure the efficiency of model transmission and verification; (5) The interface is compatible with mainstream AI frameworks and domestic software and hardware, and is easy to promote. Attached Figure Description

[0048] Figure 1 This is a structural block diagram of the AI ​​model security protection system based on domestic cryptographic algorithms and digital certificates, as described in this invention.

[0049] Figure 2 This is a schematic diagram illustrating the process of data encryption and model certificate binding in this invention.

[0050] Figure 3 This is a schematic diagram of the identity authentication and transmission encryption process in this invention.

[0051] Figure 4 This is a schematic diagram of the integrity verification and anti-tampering process in this invention.

[0052] Figure 5 This is a schematic diagram of the version tracing and legality verification process in this invention. Detailed Implementation

[0053] The present invention will now be described in further detail with reference to the accompanying drawings.

[0054] like Figure 1 As shown, this invention provides an AI model security protection system based on domestic cryptographic algorithms and digital certificates, including a Certificate Authority (CA), an AI model security gateway, a training terminal, and a deployment server.

[0055] The Certificate Management Center (CA) mentioned above is a certificate management system of a third-party trusted Certificate Management Center (CA) authority. It supports the issuance and management of SM2 algorithm digital certificates, which are used to issue AI model developer certificates to AI model developers, generate unique AI model certificates for AI models, and issue device trust certificates for deployment servers.

[0056] The AI ​​model security gateway is the core processing node for system security, responsible for the secure access and compliance verification of training data. It integrates SM2, SM3, and SM4 algorithms for encrypting and decrypting AI model training data, and verifying data compliance, including sensitive information verification, data format verification, and permission matching verification. This ensures that training data complies with the Data Security Law, the Personal Information Protection Law, and industry compliance requirements. It also performs identity authentication and data encryption during AI model transmission, integrity verification and access control before AI model deployment, and version tracing and legality verification during AI model updates. This ensures unified management and secure sharing of training data, guarantees consistency of training data used by multiple terminals, and avoids AI model training deviations due to differences in terminal preprocessing.

[0057] The training terminal is used for secure initialization of the AI ​​model development end and generation of secure model packages. It is a terminal device used by developers to train AI models. The training terminal integrates a cryptographic algorithm plugin, which is used to encrypt training data using the SM4 algorithm and upload it to the gateway, train the AI ​​model, use the SM3 algorithm to calculate the hash value of the AI ​​model to generate an AI model digest, apply for a unique certificate for the AI ​​model from the Certificate Authority (CA) and bind it to the AI ​​model digest, and generate a secure model package.

[0058] The deployment server is pre-installed with a device trust certificate for security management of the AI ​​model runtime and serves as the legitimate runtime carrier for the security model package. The deployment server is used as a server to run the AI ​​model. When receiving the AI ​​model, it verifies the legitimacy of the unique certificate of the AI ​​model using the SM2 algorithm, verifies whether the hash value of the AI ​​model is consistent with the AI ​​model digest using the SM3 algorithm, and monitors the integrity of the AI ​​model file in real time when running the AI ​​model.

[0059] As a specific example, the Certificate Management Center (CA) uses domestically produced servers and runs a domestically produced operating system. It deploys an SM2 algorithm certificate issuance system that conforms to the GM / T 0034-2014 Cryptographic and Security Technical Specifications for Certificate Authentication Systems Based on the SM2 Algorithm. It realizes the functions of digital certificate application, issuance, renewal, and revocation, and uses a domestically produced database to store certificate information.

[0060] As a specific example, the AI ​​model security gateway uses a domestically produced encryption card in its hardware, supports hardware acceleration for SM2, SM3, and SM4 algorithms, has a processor clock speed of ≥2.5GHz and memory of ≥32GB, ensuring the efficiency of cryptographic operations and data forwarding; the software is developed based on the Linux kernel, realizing automated processing of SM2 algorithm authentication, SM4 algorithm encryption, and SM3 algorithm verification, with a latency of ≤10ms.

[0061] As a specific example, the training terminal uses a regular server or workstation as hardware, installs a domestic cryptographic algorithm plugin, and supports the SM4 algorithm for data encryption; the software is provided as a Python library, which supports calling the SM4 algorithm to encrypt training data and the SM3 algorithm to calculate the hash value of the AI ​​model, and the interface is compatible with TensorFlow and PyTorch AI frameworks.

[0062] As a specific example, the deployment server uses industrial-grade hardware, pre-installed with device trust certificates, and integrates an integrity monitoring plugin to support real-time hash verification. The software is developed in C++, with a background process performing SM3 algorithm verification every hour. The verification results are uploaded to the AI ​​model security gateway in real time, and alarms are sent via SMS or email in case of anomalies.

[0063] like Figures 2-5 As shown, this invention also provides a method for protecting the security of AI models based on domestically developed cryptographic algorithms and digital certificates. This method, based on the aforementioned AI model security protection system, includes the following steps:

[0064] Step 1: During the training phase, data encryption and AI model certificate binding are performed.

[0065] Step 2, the transmission phase, involves identity authentication and transmission encryption;

[0066] Step 3, Deployment Phase: Perform integrity verification and tamper protection.

[0067] Step 4, the update phase, involves tracing the version source and verifying its legality.

[0068] As a specific example, in the training phase described in step 1, data encryption and AI model certificate binding are performed as follows:

[0069] Step 1.1: The developer initiates a training request through the training terminal and applies for an AI model developer certificate from the Certificate Management Center (CA). After verifying the developer's identity, the CA issues the AI ​​model developer certificate.

[0070] Step 1.2: The training terminal performs symmetric encryption on the training data using the SM4 algorithm. The key is generated through negotiation using the SM2 algorithm and is held only by the training terminal and the AI ​​model security gateway. The encrypted data is then uploaded to the AI ​​model security gateway to ensure that the training data complies with security standards from the source.

[0071] Step 1.3: The AI ​​model security gateway decrypts the training data, performs data compliance verification and data governance on the training data, and then uses the SM4 algorithm to symmetrically encrypt the compliant training data and feeds the result back to the training terminal. If the decryption and verification result are normal, the training terminal starts AI model training.

[0072] Step 1.4: After the AI ​​model training is completed, the training terminal calculates the AI ​​model hash value using the SM3 algorithm to generate an AI model summary, and applies to the Certificate Authority (CA) for a unique AI model certificate along with the AI ​​model developer certificate.

[0073] Step 1.5: After the Certificate Management Center (CA) verifies the legality of the developer certificate, it writes the AI ​​model ID, version number, and AI model summary into the unique AI model certificate and issues it to the training terminal, thus completing the binding between the AI ​​model and the unique AI model certificate.

[0074] Step 1.6: The training terminal generates a secure model package, including the AI ​​model file and the AI ​​model's unique certificate.

[0075] As a specific example, in the transmission stage described in step 2, identity authentication and transmission encryption are performed as follows:

[0076] Step 2.1: The developer sends an AI model deployment command to the training terminal. The training terminal uses the SM4 algorithm to encrypt the security model package to obtain the encrypted security model package. The encrypted security model package and the AI ​​model developer certificate are then transmitted to the AI ​​model security gateway.

[0077] Step 2.2: The AI ​​model security gateway decrypts the AI ​​model file, the unique AI model certificate, and the AI ​​model developer certificate.

[0078] Step 2.3: The AI ​​model security gateway verifies the signature validity of the two certificates using the SM2 and SM3 algorithms to confirm the developer's identity and the validity of the AI ​​model.

[0079] Step 2.4: The deployment server sends the device trust certificate to the gateway, and the AI ​​model security gateway verifies the server's legitimacy;

[0080] Step 2.5: After successful authentication, the AI ​​model security gateway performs symmetric encryption on the AI ​​model file using the SM4 algorithm. The transmission key is dynamically negotiated using the SM2 algorithm. The encrypted AI model and the unique certificate of the AI ​​model are then transmitted to the deployment server.

[0081] As a specific example, the deployment phase described in step 3 includes integrity verification and tamper protection, as detailed below:

[0082] Step 3.1: After receiving the AI ​​model, the deployment server uses the SM4 algorithm to perform symmetric decryption on the encrypted secure AI model file, obtaining the AI ​​model file and the AI ​​model's unique certificate.

[0083] Step 3.2: Verify the signature of the AI ​​model's unique certificate using the SM2 algorithm to verify the identity of the Certificate Authority (CA) and whether the AI ​​model's unique certificate has been tampered with.

[0084] Step 3.3: The deployment server recalculates the received AI model hash value using the SM3 algorithm and compares it with the AI ​​model digest recorded in the AI ​​model's unique certificate. If they match, the AI ​​model has not been tampered with and deployment is allowed; if they do not match, the AI ​​model has been tampered with, deployment is rejected, and an alarm message is sent to the AI ​​model security gateway.

[0085] Step 3.4: During the AI ​​model operation, the deployment server verifies the integrity of the AI ​​model file every hour using the SM3 algorithm. If an abnormal AI model hash value is detected, the AI ​​model operation is immediately stopped and an alarm is triggered.

[0086] As a specific example, the update phase described in step 4 involves version tracing and legality verification, as follows:

[0087] Step 4.1: When developers release a new version of the AI ​​model, they repeat the training phase process, generate a summary of the new version of the AI ​​model, apply to the Certificate Authority (CA) for a new unique certificate for the AI ​​model, and increment the version number.

[0088] Step 4.2: Before transmitting the new version of the AI ​​model, the AI ​​model security gateway compares the hash values ​​of the old and new versions of the AI ​​model using the SM3 algorithm, generates a version difference report, and associates it with the unique certificate of the old version of the AI ​​model to achieve version traceability.

[0089] Step 4.3: After the deployment server receives the new version of the AI ​​model, it completes the integrity verification and queries the unique certificate of the historical version of the AI ​​model through the Certificate Management Center (CA) to confirm that the new version of the AI ​​model was released by the original developer, thus preventing malicious third parties from forging the version.

[0090] Step 4.4: After successful verification, deploy the server to replace the old AI model, and save the old version AI model file and the unique certificate of the AI ​​model for subsequent traceability auditing.

[0091] The present invention will be further described in detail below with reference to the embodiments.

[0092] Example

[0093] This embodiment uses an intelligent government approval AI model in the field of government affairs as an example to verify the effectiveness of this system:

[0094] Step 1, Training Phase: Developers use the training terminal to encrypt 100,000 government approval data records with SM4. After training, an SM3 encrypted model summary is generated. The CA issues a unique certificate for the model, certificate ID: GOV-AI-2024001, version V1.

[0095] Step 2, Transmission Phase: After the security gateway verifies the legality of the developer certificate and server certificate, it uses the SM4 encryption transmission model, with a transmission time of ≤5s;

[0096] Step 3, Deployment Phase: The deployment server verifies that the model hash value matches the certificate. Verification time is ≤1s, and the system is running normally. After simulating tampering with the model file, the server immediately triggers an alarm with a response time of ≤2s.

[0097] Step 4, Update Phase: Developers release the V2 version model, the CA issues a new certificate, the gateway generates a version difference report, and after the deployment server verifies the consistency between the V2 certificate and the V1 certificate, the update is completed, and the old version is traceable.

[0098] This invention tightly integrates three domestically developed cryptographic algorithms—SM2, SM3, and SM4—with the entire lifecycle of AI models, actively responding to my country's "Basic Requirements for Cryptographic Applications in Information Security Technology" (GB / T 39786-2021). It incorporates domestic cryptographic algorithms throughout all stages of AI model training, transmission, deployment, and updates. For example, during the training phase, the SM4 algorithm is used to encrypt training data, ensuring data security at the source, and the key is negotiated and generated using the SM2 algorithm, enhancing the security of key exchange. For integrity verification, the SM3 algorithm is used to calculate the model's hash value, providing a reliable means for verifying model integrity. This deep integration addresses the compliance risks associated with existing solutions relying on international algorithms and opens up a new path for combining AI security with domestically developed cryptographic algorithms.

[0099] The model digital identity mechanism assigns a unique digital certificate to each AI model. This certificate is bound to the model's identity information, such as model ID, version number, and integrity digest, and is a model hash value generated using the SM3 algorithm. Throughout the entire process of model development and final deployment, this certificate acts as a digital identity card for the model, enabling precise traceability. When a malicious model is discovered, the responsible party can be quickly identified based on the certificate information, solving the problem of lack of trust traceability in the AI ​​model field and providing a new approach and method for model security management.

[0100] The dynamic cryptographic negotiation and real-time monitoring mechanism employs SM2 to dynamically negotiate SM4 keys during transmission, abandoning the traditional static key model and significantly reducing the risk of key leakage. If a traditional static key is leaked, the entire encryption system will collapse. However, dynamically negotiated keys are different for each transmission, so even if a key is leaked in one transmission, it will not affect the security of other transmission processes. During deployment, real-time monitoring of model integrity is implemented. The deployment server verifies the integrity of model files hourly using the SM3 algorithm. Compared to previous passive protection, this proactive real-time monitoring can promptly detect whether the model has been tampered with. Once an abnormal hash value is detected, the model operation is immediately stopped and an alarm is triggered, shifting security protection from post-event remediation to pre-event prevention, significantly improving the security and stability of AI model operation.

[0101] The proposed solution covers four key stages of AI model training, transmission, deployment, and updating, forming a complete lifecycle protection closed loop. Taking the updating stage as an example, this invention not only manages versions by issuing new unique certificates for the model through a CA, but also generates version difference reports through a security gateway and associates them with old version certificates to achieve version traceability. This comprehensive protection mechanism covering the entire process and multiple stages is relatively rare in existing inventions.

[0102] In terms of model identity authentication and traceability, a unique certificate mechanism is adopted, which assigns a unique identifier to the model from the beginning of its development and verifies the model's identity and integrity through certificates in each subsequent stage, thus realizing a comprehensive and detailed model identity traceability and authentication system.

[0103] The above are merely preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. An AI model security protection method based on a domestic cryptographic algorithm and a digital certificate, characterized in that, Comprise the following steps: Step 1, training phase, data encryption and AI model certificate binding; Step 2, transmission phase, identity authentication and transmission encryption; Step 3, deployment phase, integrity check and tamper-proofing; Step 4, update phase, version traceability and legality verification; Step 1, the training phase, data encryption and AI model certificate binding, as follows: Step 1.1, the developer initiates a training request through the training terminal, applies for an AI model developer certificate to the certificate management center CA, and the certificate management center CA issues an AI model developer certificate after verifying the identity of the developer; Step 1.2, the training terminal encrypts the training data by SM4 algorithm, the key is generated by SM2 algorithm negotiation, only the training terminal and the AI model security gateway hold, the encrypted data is uploaded to the AI model security gateway, to ensure that the training data from the source meets the security specifications; Step 1.3, the AI model security gateway decrypts the training data, checks the data compliance and data governance, and then uses SM4 algorithm to symmetrically encrypt the compliant training data and feeds back the result to the training terminal, and the training terminal starts AI model training if the decryption and verification result is normal; Step 1.4, after the AI model training is completed, the training terminal calculates the AI model hash value to generate an AI model digest by SM3 algorithm, and applies for an AI model unique certificate to the certificate management center CA with the AI model developer certificate; Step 1.5, after the certificate management center CA verifies the legality of the developer certificate, the AI model ID, version number and AI model digest are written into the AI model unique certificate, which is issued to the training terminal, completing the binding of the AI model and the AI model unique certificate; Step 1.6, the training terminal generates a secure model package, including the AI model file and the AI model unique certificate; Step 2, the transmission phase, identity authentication and transmission encryption, as follows: Step 2.1, the developer initiates an AI model deployment instruction to the training terminal, the training terminal encrypts the secure model package by SM4 algorithm to obtain an encrypted secure model package, and transmits the encrypted secure model package and the AI model developer certificate to the AI model security gateway; Step 2.2, the AI model security gateway decrypts to obtain the AI model file, the AI model unique certificate and the AI model developer certificate; Step 2.3, the AI model security gateway verifies the signature legality of the two certificates by SM2 and SM3 algorithms, confirms the developer identity and the AI model validity; Step 2.4, the deployment server sends a device trust certificate to the gateway, and the AI model security gateway verifies the legality of the server; Step 2.5, after authentication, the AI model security gateway symmetrically encrypts the AI model file by SM4 algorithm, the transmission key is dynamically negotiated by SM2 algorithm, and the encrypted AI model and the AI model unique certificate are transmitted to the deployment server; Step 3, the deployment phase, integrity check and tamper-proofing, as follows: Step 3.1, after the deployment server receives the AI model, the encrypted secure AI model file is decrypted using the SM4 algorithm, and the AI model file and the AI model unique certificate are obtained, Step 3.2, verify the signature of the AI model unique certificate through the SM2 algorithm, and verify whether the certificate management center CA identity and the AI model unique certificate are tampered with; Step 3.3, the deployment server recalculates the received AI model hash value through the SM3 algorithm, and compares it with the AI model digest recorded in the AI model unique certificate. If they are consistent, the AI model has not been tampered with, and the deployment is allowed to run; if they are not consistent, the AI model has been tampered with, and the deployment is rejected and an alarm information is sent to the AI model security gateway; Step 3.4, during the running of the AI model, the deployment server checks the integrity of the AI model file every hour through the SM3 algorithm. If the AI model hash value is found to be abnormal, the AI model running is stopped immediately and an alarm is triggered.

2. The AI model security protection method based on domestic cryptographic algorithms and digital certificates according to claim 1, characterized in that, The updating stage described in step 4, version tracing and legality verification, is as follows: Step 4.1, when the developer releases a new version of the AI model, repeat the training stage process to generate a new version of the AI model digest, and apply for a new AI model unique certificate from the certificate management center CA, and the version number is incremented; Step 4.2, before transmitting the new version of the AI model, the AI model security gateway compares the hash values of the new and old versions of the AI model through the SM3 algorithm, generates a version difference report, and associates the old version of the AI model unique certificate to realize version tracing; Step 4.3, after the deployment server receives the new version of the AI model, it completes the integrity check, and queries the historical version of the AI model unique certificate of the new version of the AI model through the certificate management center CA, confirms that the new version of the AI model is released by the original developer, and prevents malicious third parties from forging versions; Step 4.4, after verification, the deployment server replaces the old AI model, and saves the old version of the AI model file and the AI model unique certificate for subsequent tracing and auditing.

3. An AI model security protection system based on a domestic cryptographic algorithm and a digital certificate, characterized in that, The system is used to realize the AI model security protection method based on domestic cryptographic algorithms and digital certificates according to claim 1 or 2, and the system comprises a certificate management center CA, an AI model security gateway, a training terminal and a deployment server; The certificate management center CA is a certificate management system of a third-party trusted certificate management center CA institution, supports issuing and managing SM2 algorithm digital certificates, and is used for issuing AI model developer certificates for AI model developers, generating AI model unique certificates for AI models, and issuing device trust certificates for deployment servers; The AI model security gateway is a system security core processing node, and is used for bearing security access and compliance verification of training data; the AI model security gateway integrates SM2, SM3 and SM4 algorithms, and is used for AI model training data encryption, decryption, data compliance verification, including sensitive information verification, data format verification and permission matching verification, and is also used for identity authentication and data encryption in an AI model transmission process, integrity verification and permission control before AI model deployment, version tracing and legality verification when the AI model is updated, guaranteeing unified management and safe sharing of training data and ensuring consistency of training data used by multiple terminals; The training terminal is used for security initialization of an AI model development end and generation of a security model package, and is a terminal device used by a developer for AI model training; the training terminal integrates a cryptographic algorithm plug-in, and is used for uploading training data to the gateway after encryption by the SM4 algorithm, training an AI model, calculating an AI model hash value by using the SM3 algorithm to generate an AI model digest, applying for an AI model unique certificate from a certificate authority CA and binding the AI model unique certificate with the AI model digest, and generating a security model package; The deployment server is used for security management and control of an AI model running end, and is a legal running carrier of the security model package; the deployment server is used for a server running the AI model, and is used for verifying the legality of the AI model unique certificate by using the SM2 algorithm when receiving the AI model, checking whether the AI model hash value is consistent with the AI model digest by using the SM3 algorithm, and monitoring AI model file integrity in real time when running the AI model.

4. The AI model security protection system based on domestic cryptographic algorithms and digital certificates according to claim 3, characterized in that, The certificate authority CA uses a domestic server in hardware and a domestic operating system, and deploys an SM2 algorithm certificate issuing system that meets the SM2 algorithm certificate authentication system password and security technical specification based on GM / T0034-2014. The functions of applying for, issuing, updating and revoking a digital certificate are realized, and a domestic database is used to store certificate information.

5. The AI model security protection system based on domestic cryptographic algorithms and digital certificates according to claim 3, characterized in that, The AI model security gateway uses a domestic encryption card in hardware, supports hardware acceleration of the SM2, SM3 and SM4 algorithms, has a processor main frequency of greater than or equal to 2.5 GHz and a memory of greater than or equal to 32 GB, and ensures the efficiency of password operation and data forwarding; the software is developed based on a Linux kernel, realizes automatic processing of SM2 algorithm authentication, SM4 algorithm encryption and SM3 algorithm verification, and has a delay of less than or equal to 10 ms.

6. The AI model security protection system based on domestic cryptographic algorithms and digital certificates according to claim 3, characterized in that, The training terminal uses a general server or workstation in hardware, installs a domestic cryptographic algorithm plug-in, and supports data encryption by using the SM4 algorithm; the software is provided in the form of a Python library, supports calling the SM4 algorithm to encrypt training data and the SM3 algorithm to calculate an AI model hash value, and is compatible with the TensorFlow and PyTorch AI frameworks.

7. The AI model security protection system based on domestic cryptographic algorithms and digital certificates according to claim 3, characterized in that, The deployment server uses an industrial server in hardware, preinstalls a device trust certificate, integrates an integrity monitoring plug-in, and supports real-time hash verification; the software is developed by using C++, an SM3 algorithm verification is performed by a background process every hour, verification results are uploaded to the AI model security gateway in real time, and an alarm is given by a short message or an email when an exception occurs.

Images