Data processing method, system and device, medium and program product

Abstract

The embodiment of the invention discloses a data processing method, system and device, a medium and a program product, and the method comprises the steps: determining a target security isolation region, and transmitting a preset network model and to-be-processed data to the target security isolation region under the condition that the security verification of the target security isolation region is passed, so that the data processing efficiency is improved. Acquiring a security operation instruction in the target security isolation area; and running a preset network model based on the security operation instruction, and performing related processing on the to-be-processed data by using the preset network model to generate a processing result. According to the scheme provided by the invention, the security of the data processing process is improved.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence technology, and in particular to a data processing method, system, device, medium, and program product. Background Technology

[0002] With the continuous development of artificial intelligence (AI) technology, the security of AI models and the protection of data privacy have become increasingly prominent issues. Related technologies typically rely on general-purpose processors to run AI models for data processing; however, this data processing lacks effective security isolation mechanisms, leaving AI models and the processed data vulnerable to various security threats.

[0003] Although related technologies attempt to effectively protect data security through software isolation methods (such as containerization and virtual machines), these methods cannot protect against hardware-level risks, resulting in persistent security issues in data processing. Summary of the Invention

[0004] In view of the above, embodiments of this application provide at least one data processing method, system, device, medium, and program product.

[0005] The technical solution of this application embodiment is implemented as follows:

[0006] In a first aspect, embodiments of this application provide a data processing method, the method comprising:

[0007] Determine the target security isolation zone;

[0008] Once the security verification in the target security isolation area is passed, the preset network model and the data to be processed will be transmitted to the target security isolation area.

[0009] Within the target secure isolation zone, obtain secure computation instructions;

[0010] The preset network model is run based on the security operation instructions, and the preset network model is used to perform relevant processing on the data to be processed, generating processing results.

[0011] Secondly, embodiments of this application provide a data processing system, the system including a secure boot module, a secure communication module, and a secure operation module, wherein:

[0012] The secure boot module is used to initialize a target secure isolation zone in a trusted environment.

[0013] The secure communication module is used to transmit the preset network model and the data to be processed to the target secure isolation area after the security verification of the target secure isolation area has been passed.

[0014] The secure operation module is used to process the data to be processed in the target secure isolation area using a preset network model and generate processing results.

[0015] Thirdly, embodiments of this application provide a computer device, including a memory and a processor, wherein the memory stores a computer program that can run on the processor, and the processor executes the program to implement some or all of the steps in the above-described method.

[0016] Fourthly, embodiments of this application provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements some or all of the steps in the above-described method.

[0017] Fifthly, embodiments of this application provide a program product, which includes a computer program or instructions that, when executed by a processor, implement some or all of the steps in the above-described method.

[0018] The data processing solutions provided in this application embodiment include, but are not limited to, data processing methods, systems, devices, media, and program products. The data processing method includes at least: determining a target security isolation area; and, if the security verification of the target security isolation area is passed, transmitting a preset network model and data to be processed to the target security isolation area. In this way, in the target security isolation area, security operation instructions can be obtained, and the preset network model can be run based on the security operation instructions, thereby using the preset network model to perform relevant processing on the data to be processed and generating processing results.

[0019] This data processing scheme performs security verification on the target security isolation zone before data processing, ensuring the security of the zone itself. Upon successful verification, the preset network model and the data to be processed are transmitted to this zone, ensuring their security. Then, within the target security isolation zone, the preset network model is used to process the data and generate results. This hardware-level security protection, achieved through the preset network model within the hardware-level target security isolation zone, contrasts with traditional software isolation mechanisms that cannot protect against hardware-level attacks. This application prevents reverse engineering or tampering of model parameters and avoids data leakage during processing, ensuring the security of the preset network model and the data during execution. This further enhances the security of the data processing process. Compared to existing software isolation schemes, this application's combination of physical isolation and encrypted transmission effectively improves the security and reliability of the data processing process.

[0020] It should be understood that the above general description and the following detailed description are merely exemplary and explanatory, and are not intended to limit the technical solutions of this application. Attached Figure Description

[0021] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with this application and, together with the specification, serve to explain the technical solutions of this application.

[0022] Figure 1 A schematic diagram of the implementation flow of a data processing method provided in this application embodiment. Figure 1 ;

[0023] Figure 2 A schematic diagram of the implementation flow of a data processing method provided in this application embodiment. Figure 2 ;

[0024] Figure 3 A schematic diagram of the implementation flow of a data processing method provided in this application embodiment. Figure 3 ;

[0025] Figure 4 A schematic diagram of the implementation flow of a data processing method provided in this application embodiment. Figure 4 ;

[0026] Figure 5 A schematic diagram of the composition structure of a data processing system provided in this application embodiment. Figure 1 ;

[0027] Figure 6 A schematic diagram of the composition structure of a data processing system provided in this application embodiment. Figure 2

[0028] Figure 7 A schematic diagram of an AI security enclave system for RISC-V architecture is provided for this application;

[0029] Figure 8 This is a schematic diagram of the hardware entity of a computer device provided in an embodiment of this application. Detailed Implementation

[0030] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application are further described in detail below with reference to the accompanying drawings and embodiments. The described embodiments should not be regarded as limitations on this application. All other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0031] In the following description, references to "some embodiments" refer to a subset of all possible embodiments. It is understood that "some embodiments" may be the same or different subsets of all possible embodiments and may be combined with each other without conflict. The terms "first / second / third" are used merely to distinguish similar objects and do not represent a specific ordering of objects. It is understood that "first / second / third" may be interchanged in a specific order or sequence where permitted, so that the embodiments of this application described herein can be implemented in an order other than that illustrated or described herein.

[0032] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains. The terminology used herein is for descriptive purposes only and is not intended to be limiting of this application.

[0033] With the continuous development of artificial intelligence technology, AI models are playing an increasingly important role in various applications. Related technologies typically rely on general-purpose processors to run AI models for data processing. This data processing lacks effective isolation mechanisms for sensitive computations, exposing AI models and the processed data to various security threats. For example, these security issues may include: ① Model extraction attacks: Attackers can steal model parameters and structure through multiple queries or side-channel attacks, damaging the model's intellectual property. ② Data privacy leaks: AI models processing sensitive personal data lack effective isolation, making the data potentially vulnerable to malware theft. ③ Model tampering risks: Unauthorized access can lead to malicious modification of AI model parameters, causing security vulnerabilities. ④ Side-channel attacks: Attackers can steal sensitive information during execution through side-channel attacks such as electromagnetic radiation and power consumption analysis.

[0034] Related technologies attempt to protect sensitive computing through software isolation methods (such as containerization and virtual machines). However, software isolation methods cannot protect against risks at the hardware level.

[0035] In some scenarios, a Universal Trusted Execution Environment (TEE) is used to protect sensitive data. However, the universal TEE itself has limitations, such as the need to rely on computing systems in external, untrusted execution environments for data processing.

[0036] Therefore, all secure data processing methods in related technologies suffer from poor security.

[0037] In view of this, this application provides a data processing method, system, device, medium, and program product. The data processing method includes at least: determining a target security isolation area; and, if the security verification of the target security isolation area is passed, transmitting a preset network model and data to be processed to the target security isolation area. In this way, in the target security isolation area, secure operation instructions can be obtained, and the preset network model can be run based on the secure operation instructions, thereby using the preset network model to perform relevant processing on the data to be processed and generating a processing result. In the aforementioned data processing method, before data processing is performed through the target secure isolation zone, the target secure isolation zone is first verified to ensure its security. If the security verification passes, the preset network model and the data to be processed are transmitted to this zone, ensuring their security. Then, within the target secure isolation zone, the preset network model is used to process the data and generate results. During data processing, the preset network model is used to process the data within the hardware-level target secure isolation zone. Compared to traditional technologies that use software isolation mechanisms for data processing and cannot protect against hardware-level attacks, this application achieves hardware-level security protection, preventing model parameters from being reverse-engineered or tampered with, and avoiding leakage of the data to be processed during processing. This ensures the security of the preset network model and the data to be processed during execution, further enhancing the security of the data processing process. Compared to existing software isolation schemes, this application's combination of physical isolation and encrypted transmission effectively improves the security and reliability of the data processing process.

[0038] This application provides a data processing method that can be executed by a processor of a computer device. The computer device can refer to a server, laptop, tablet, desktop computer, smart TV, set-top box, mobile device (e.g., mobile phone, portable video player, personal digital assistant, dedicated messaging device, portable gaming device), or other device with data processing capabilities. In this application embodiment, at least one secure enclave is pre-deployed in the computer device; this secure enclave is an independent area at the hardware level.

[0039] Figure 1 A schematic diagram of the implementation flow of a data processing method provided in this application embodiment. Figure 1 ,like Figure 1 As shown, the method includes the following steps S101 to S103:

[0040] Step S101: Determine the target security isolation area.

[0041] Here, the secure isolation region can be a secure execution environment implemented based on hardware devices under a specific architecture, which is an independent region at the hardware level. In the embodiments of this application, the specific architecture may include, but is not limited to, Reduced Instruction Set Computer-V (RISC-V) architecture, Advanced Reduced Instruction Set Computer (ARM) architecture, etc.

[0042] In this embodiment, the secure isolation region can have independent circuits and a clock domain. Its access control can be restricted according to a pre-configured Physical Memory Protection (PMP) mechanism. In some examples, this PMP mechanism incorporates settings for specific model attributes. This specific model may include, but is not limited to, AI models. Therefore, compared with related technologies, this can be referred to as an "enhanced PMP." For example, when the specific model is an AI model, the secure isolation region supports setting specific protection attributes for AI model parameters, such as setting access operations to read-only and control operations to compute-only, etc., to prevent the leakage of sensitive information.

[0043] Regarding the process of determining the target security isolation zone, in some examples, the server can receive a selection instruction input by the user and determine the target security isolation zone from among the various security isolation zones based on the selection instruction; in other examples, the server can determine the target security isolation zone according to the type of the preset network model to be processed. For example, if the preset network model is an AI model, the server can select the security isolation zone corresponding to the PMP mechanism that has added settings related to the AI ​​model attributes as the target security isolation zone.

[0044] In this embodiment of the application, before determining the target security isolation area, the relevant firmware of the target security isolation area is also verified to ensure that its status is normal. Regarding the firmware verification process, the server can perform it during the power-on process. In one possible implementation, the server can first drive the boot code in the immutable read-only memory to run, thereby realizing the step-by-step verification of the relevant firmware. This prevents the relevant firmware from being abnormal, such as the loading and running of old versions of firmware.

[0045] Here, the relevant firmware corresponds to the target security isolation area, which may include, but is not limited to, enclave firmware, security monitoring firmware, etc. Regarding the verification process of each relevant firmware, in this embodiment of the application, the digital signature of the next level firmware can be verified by the current level.

[0046] Step S102: If the security verification of the target security isolation area is passed, the preset network model and the data to be processed are transmitted to the target security isolation area.

[0047] Here, after the target security isolation area is determined, in order to ensure the security of the entire data processing process, the target security isolation area will also be subject to security verification. Only if the security verification is passed will the subsequent data processing steps be carried out.

[0048] Regarding the security verification process, in one possible implementation, the server can perform near-end verification by means of a recognized verification sequence or similar method.

[0049] In one possible implementation, the server can also perform remote security verification through digital signatures, key pairs, security certificates, etc. Therefore, the security verification process may include the following steps:

[0050] Step A: Obtain the authentication key to be verified.

[0051] Step B involves remotely verifying the target secure isolation area using the authentication key. If the authentication key matches the key in the target secure isolation area, the security verification of the target secure isolation area is considered successful. Here, "security verification" refers to verifying the security status of the target secure isolation area using the authentication key; if the authentication key matches the key in the target secure isolation area, the target secure isolation area is considered to be in a secure state, i.e., the verification is successful.

[0052] Here, the authentication key can be an encryption key sent by the user for security verification of the target security isolation area, or it can be part of a key pair derived from the unique key corresponding to the target security isolation area. The generation method can be based on the Elliptic Curve Digital Signature Algorithm (ECDSA); or it can be a temporary key generated based on zero-knowledge proof or other distributed authentication mechanisms.

[0053] The process by which the server obtains the authentication key can include, but is not limited to, the following two methods: In some examples, the server can remotely obtain the authentication key sent by the user through other devices via a preset transmission channel; in some examples, the server can obtain the authentication key issued by a secure third-party platform.

[0054] After obtaining the authentication key to be authenticated, the server can perform remote security verification on the target security isolation zone based on the authentication key. Here, remote security verification refers to remotely detecting the integrity, configuration status and operating environment of the target security isolation zone through the authentication key to confirm whether the target security isolation zone is in a trusted state.

[0055] In this embodiment of the application, a standardized remote verification protocol can be preset. The remote verification protocol may include a security status and a configured authentication report. Based on the remote verification protocol, the server can perform remote security verification according to the authentication key.

[0056] Remote security verification can be performed in any way, including but not limited to: In some examples, the server can compare the authentication key with the unique key corresponding to the target security isolation zone and determine whether the remote security verification is successful based on the comparison result; In some examples, the server can process the authentication key according to the remote security verification algorithm and verify and compare the processed result with the unique key corresponding to the target security isolation zone to determine whether the remote security verification is successful.

[0057] In this embodiment of the application, the result of remote security verification may include verification success and verification failure. If the verification is successful, the server can determine that the integrity, configuration status and operating environment of the target security isolation area are in a normal state. At this time, the server can perform subsequent data processing through the target security isolation area.

[0058] In the above embodiments, by obtaining the authentication key and performing remote security verification, the server can ensure the trustworthiness of the target secure isolation area. Since the remote security verification effectively prevents unauthorized access and operations, it can further enhance the security protection level for the model and data.

[0059] Once security verification is successful within the target secure isolation zone, the server can securely transmit the preset network model and the data to be processed to the target secure isolation zone. Here, the preset network model can be a pre-trained model for processing the data to be processed, and the preset network model can include, but is not limited to, AI models. Here, the data to be processed can be sensitive data that needs to be securely processed, such as facial images, medical records, etc.

[0060] In this embodiment, after the remote security verification of the target secure isolation area is passed, the server can establish a secure data channel (or "encrypted communication channel"). This encrypted communication channel is used to transmit the preset network model and the data to be processed in encrypted form to the target secure isolation area, thereby achieving secure transmission of the preset network model and the data to be processed. Here, "secure transmission" means that the preset network model and the data to be processed are encrypted during the transmission process, and the transmission channel used is an encrypted communication channel.

[0061] The method of encrypting input can be any. In one possible implementation, the server can encrypt the preset network model and the data to be processed using the same encryption method when communicating through the encrypted communication channel. In another possible implementation, the server can encrypt the preset network model and the data to be processed separately using different encryption methods, for example, by using different encryption keys.

[0062] Understandably, within the target secure isolation zone, a pre-defined network model can be used to process the data to be processed and generate the processing results. (Continue to refer to...) Figure 1 The method may also include:

[0063] Step S103: Obtain secure operation instructions.

[0064] In this embodiment, the secure computation instructions are preset basic computation instructions, which are related to the type of the preset network model. For example, when the preset network model is an AI model, the secure computation instructions may be matrix multiplication, convolution, etc. When the current device architecture is a RISC-V architecture, the secure computation instructions may be part of an extended instruction set, which may be matrix multiplication, convolution, etc.

[0065] In addition, in this embodiment of the application, the secure operation instructions can be stored in the processor corresponding to the target secure isolation region along with the extended instruction set, or they can be stored in the secure memory of the target secure isolation region.

[0066] Step S104: Run the preset network model based on the secure operation instructions, and use the preset network model to process the data to be processed to obtain the processing result.

[0067] In this embodiment of the application, when running the preset network model, the security operation instructions required for runtime can be directly obtained, and the processing flow of the preset network model can be advanced based on the security operation instructions. This realizes the secure data processing process in the target security isolation area at the hardware level, preventing the preset network model parameters and intermediate results from being illegally extracted or tampered with, thereby improving the security and reliability of the overall system.

[0068] It should also be noted that once the preset network model and the data to be processed are input into the target security isolation zone, the server can use the preset network model to process the data to be processed in the trusted environment of the target security isolation zone and generate the corresponding processing results.

[0069] Through the above embodiments, the server first obtains secure computation instructions to establish a secure execution environment, then loads and runs a preset network model, and after encrypting the data to be processed, inputs it into the preset network model for inference, and finally generates a secure processing result. In this process, by introducing secure computation instructions before model inference and combining the operating mechanism of the preset network model in the target secure isolation area, comprehensive protection of sensitive data and models is achieved.

[0070] Regarding the processing procedure, the server can first decrypt the preset network model and the data to be processed in the target security isolation area.

[0071] In some examples, the server can directly process the data to be processed based on the decrypted preset network model.

[0072] In some examples, for different preset network models, a set of secure computation instructions can be preset in the processor corresponding to the target secure isolation area. In this way, the server can obtain the secure computation instructions from the processor based on the relevant computations of the preset network model, and thus securely run the preset network model based on these instructions. Here, the secure computation instructions are related to the type of the preset network model; they can be basic model computation instructions. For example, when the preset network model is an AI model, the secure computation instructions could be matrix multiplication, convolution, etc., without any limitations.

[0073] This application provides a data processing method. Before data processing through a target secure isolation zone, the target secure isolation zone is first security verified to ensure its security. If the security verification passes, a preset network model and the data to be processed are transmitted to this zone, ensuring the security of the model and the data. Then, within the target secure isolation zone, the preset network model is used to process the data and generate results. During the data processing, the data is processed through the preset network model in the hardware-level target secure isolation zone. Compared to traditional technologies that use software isolation mechanisms for data processing and cannot protect against hardware-level attacks, this application achieves hardware-level security protection, preventing model parameters from being reverse engineered or tampered with, and avoiding leakage of the data to be processed during processing. This ensures the security of the preset network model and the data to be processed during execution, further improving the security of the data processing process. Compared to existing software isolation schemes, this application's combination of physical isolation and encrypted transmission effectively improves the security and reliability of the data processing process.

[0074] Understandably, in the embodiments of this application, before processing the data to be processed using a preset network model, reference is made to... Figure 2This is a schematic diagram of the implementation flow of a data processing method provided in an embodiment of this application. Figure 2 ,like Figure 2 As shown, the method also includes the following steps:

[0075] Step S201: Decrypt the encrypted preset network model based on the first decryption key to obtain the decrypted preset network model.

[0076] Here, the first decryption key is used to decrypt the encrypted preset network model, and this first decryption key corresponds to the first encryption key. In one possible implementation, before transmitting the encrypted preset network model to the target secure isolation area, the server also transmits the first decryption key to the target secure isolation area, so that when decrypting the encrypted preset network model, the first decryption key can be directly obtained from the target secure isolation area.

[0077] In one possible implementation, the server can respond to the received data processing instructions and decrypt the encrypted preset network model using the first decryption key, thereby performing subsequent data processing. In another possible implementation, before decrypting the encrypted preset network model, the server will first verify the identity and permissions of the user who is to process the data. After successful verification, the server will decrypt the encrypted preset network model using the first decryption key. This ensures that only users whose identity and permissions have been verified can load the encrypted preset network model, thus ensuring the security of the model loading process.

[0078] Step S202: Decrypt the encrypted data to be processed based on the second decryption key to obtain the decrypted data to be processed.

[0079] Here, the second decryption key is used to decrypt the encrypted data to be processed. This second decryption key corresponds to the second encryption key. In one possible scenario, the second decryption key can be generated by the key management module within the target secure isolation area based on the second encryption key.

[0080] In the above embodiments, by introducing a decryption mechanism, the server can securely load the preset network model in the target security isolation area and perform the correct decryption operation before the data to be processed is securely processed, thereby improving the security of the entire data processing process and strengthening privacy protection capabilities.

[0081] To further enhance data processing security, the target security isolation zone will be monitored during data processing by the server. For details on the monitoring process, please refer to [link / reference needed]. Figure 3 This is a schematic diagram of the implementation flow of a data processing method provided in an embodiment of this application. Figure 3 This may include the following steps:

[0082] Step S301: Obtain system monitoring data corresponding to the target security isolation area, and side-channel protection results corresponding to at least one side-channel protection task.

[0083] Here, system monitoring data can refer to the real-time monitoring information of the entire system when it is operating in the target safe isolation area, including but not limited to key parameters such as voltage, frequency, temperature, and access mode.

[0084] In some examples, the server can directly obtain system monitoring data from local archives; in other examples, the server can obtain system monitoring data by monitoring the target security isolation area in real time through a monitoring program.

[0085] During the secure data processing process through the target security isolation zone, the server also performs a series of side-channel protection tasks to obtain the corresponding side-channel protection results.

[0086] Here, the side-channel protection task can be a series of pre-designed protective measures against potential threats in the communication channel. Different side-channel protection tasks can be pre-designed for different dimensions of side-channel protection. For example, at least one side-channel protection task may include, but is not limited to: time-based side-channel protection task, power consumption-based side-channel protection task, and electromagnetic side-channel protection task.

[0087] For example, for time-side channel protection tasks, it may include, but is not limited to, performing key cryptographic operations at a preset time; for power-side channel protection tasks, it may include, but is not limited to, power equalization and random masking; for electromagnetic-side channel protection tasks, it may include, but is not limited to, physical shielding and signal obfuscation.

[0088] The side-channel protection result corresponds to the side-channel protection task, and may include, but is not limited to, detecting an attack on the current side-channel or not detecting an attack on the current side-channel.

[0089] Step S302: Based on system monitoring data and side-channel protection results, determine the current security level and the corresponding security response strategy.

[0090] The security response strategy includes at least one of the following: issuing a warning signal, resetting the target security isolation zone, and locking the target security isolation zone.

[0091] Here, the server can determine the corresponding security level based on system monitoring data and side-channel protection results. The security level refers to the security status level obtained after comprehensive evaluation based on system monitoring data and side-channel protection results.

[0092] In some examples, there is a mapping relationship between system monitoring data and side-channel protection results and various security levels. The server can determine the target mapping relationship based on the system monitoring data and side-channel protection results, and then determine the current security level from various security levels based on the target mapping relationship.

[0093] In some examples, the server can perform a comprehensive quantitative analysis of system monitoring data and side-channel protection results to obtain a corresponding evaluation score. Based on this evaluation score, the server can determine the current security level.

[0094] In one possible implementation, the security level may include, but is not limited to, three levels: low risk, medium risk, and high risk. Low risk indicates that the system is operating normally with no obvious security risks; medium risk indicates that there are some anomalies but have not yet caused actual harm; and high risk indicates that there is a serious threat requiring immediate countermeasures.

[0095] In this embodiment of the application, different security levels correspond to different security response strategies. Here, the security response strategy can be a specific response measure formulated according to the security level, including but not limited to issuing warning signals, resetting the target security isolation area, and locking the target security isolation area.

[0096] For example, when issuing warning signals, the server will alert operators to potential security issues through sound, visual means, or other methods when a medium or high risk is detected. When resetting a target security isolation zone, the server can automatically restore the target security isolation zone to its initial state upon detecting a high-risk event (such as an unauthorized access attempt), clearing any potentially contaminated data and configurations. When locking a target security isolation zone, if the server repeatedly detects that the current security level of the target security isolation zone is medium or high risk, the server can determine that the target security isolation zone is exhibiting persistent abnormal behavior. In this case, the server can completely isolate the target security isolation zone, prohibiting all external devices from accessing the zone until the security risks in the target security isolation zone are identified and remedied.

[0097] During this process, the server will also record the detected security level in the log in real time for later review.

[0098] In the above embodiments, by acquiring system monitoring data and side-channel protection results and dynamically assessing the security status of the target security isolation area, the server can promptly detect and handle potential security threats, thereby effectively preventing the leakage of sensitive data or malicious attacks, and further improving the security and stability of the overall data processing process.

[0099] In some embodiments, after the server processes the data to be processed through a preset network model, it will obtain the corresponding processing result. The subsequent processing of the processing result may include: encrypting the processing result in a target security isolation area to obtain an encrypted result, and storing the encrypted result in the target security isolation area.

[0100] To ensure the security of the processing results, the server can encrypt the results in various ways, including but not limited to, encrypting the results with an encryption key in some examples, encrypting the results with a specific encryption algorithm in others, and so on.

[0101] In this embodiment of the application, when the processing result is processed through an encryption key, the encryption key can be derived by the server through the key management module in the target security isolation zone based on the hardware key corresponding to the target security isolation zone.

[0102] After obtaining the encrypted result, to ensure the security of the storage process, the server directly stores the encrypted result in the target secure isolation area. In some examples, the target secure isolation area includes secure memory for storing data. The server can directly store the encrypted result in this secure memory instead of storing it in an external, untrusted area, further enhancing the security of the data processing process.

[0103] In the above embodiments, by encrypting the processing results in the target secure isolation area and storing the encrypted results in the target secure isolation area, the confidentiality and integrity of the data can be improved.

[0104] In some examples, users also need to access the processing results; for details on this process, please refer to [link / reference]. Figure 4 This is a schematic diagram of the implementation flow of a data processing method provided in an embodiment of this application. Figure 4 This may include the following steps:

[0105] In step S401, in response to the data access request, the encryption result is transmitted to the receiving device, and the identity and authorization of the data access request are verified.

[0106] Here, a data access request is a request initiated by a user to the server through a receiving device for the result of the access process. The receiving device can be a device that is connected to the server for communication. In some examples, the receiving device can generate a data access request based on the user's input. The server can receive the data access request returned by the receiving device and then perform subsequent identity and permission verification based on the data access request.

[0107] After receiving a data access request, the server will send the encrypted result to the receiving device. To ensure data security, the server will also verify the identity and permissions of the data access request, thereby checking the identity and access permissions of the requester to ensure that the requester has the legitimate right to access the target data.

[0108] Based on this, a data access request can typically include the requester's identity information and access intent. Regarding the identity and authorization verification process, the server can perform identity and authorization verification based on the requester's identity information and access intent included in the data access request. For example, the identity information can include digital certificates, biometrics, keys, etc. Correspondingly, the server's identity and authorization verification methods can include identity authentication based on digital certificates, identity authentication based on passwords, and identity authentication based on multi-factor authentication (such as biometrics + password).

[0109] In some examples, if authentication fails, the server can reject the data access request and log the relevant information. In other examples, if authentication succeeds, the server can send the encrypted result to the receiving device and perform subsequent operations.

[0110] In step S402, if the identity and authorization verification is successful, the third decryption key corresponding to the encryption result is sent to the receiving device so that the receiving device can decrypt the encryption result based on the third decryption key.

[0111] If the identity and authorization verification is successful, the server can send the decryption method to the receiving device. In this embodiment, the decryption method can be the third decryption key corresponding to the encryption result. Here, the third decryption key is used to decrypt the encryption result and is logically related to the encryption result. In some examples, the encryption result is generated by processing the processing result with a specific encryption algorithm, and the third decryption key can be the encryption algorithm and the encryption parameters used in the encryption process. In some examples, the encryption result is obtained by encrypting the processing result based on the third encryption key, and the third decryption key can be the decryption key corresponding to the third encryption key.

[0112] In this embodiment of the application, the server can send the third decryption key to the receiving device through a secure channel. The secure channel may include, but is not limited to, a transmission channel established based on an encrypted communication protocol, or a secure application programming interface (API).

[0113] In this way, the server sends the third decryption key to the receiving device only after the identity and authorization verification is successful, and the receiving device can then decrypt the encryption result, further improving the security of the data access process.

[0114] In some embodiments, the process of "transferring the preset network model and the data to be processed to the target secure isolation area" in step S102 above may include the following steps:

[0115] Step S1021: Encrypt the preset network model based on the first encryption key, and transmit the encrypted preset network model to the target secure isolation area.

[0116] Here, the first encryption key is a key used to encrypt the preset network model. In some examples, the server can generate the first encryption key using a preset cryptographic algorithm, which may include, but is not limited to, symmetric encryption algorithms, asymmetric encryption algorithms, elliptic curve cryptography algorithms, etc.

[0117] After processing the preset network model with the first encryption key, the server can transmit the encrypted preset network model to the target secure isolation area, thereby ensuring the security of the model transmission process.

[0118] In some embodiments, the server may also store the first encryption key in the target security isolation area, or store the decryption method corresponding to the first encryption key in the target security isolation area, so that the preset network model can be decrypted in the target isolation area later.

[0119] Step S1022: Encrypt the data to be processed based on the second encryption key, and transmit the encrypted data to the target secure isolation area.

[0120] Here, "data to be processed" refers to input data that needs to be processed by a pre-defined network model, such as user-uploaded images, text, or data collected by sensors. This data typically contains sensitive information, such as personally identifiable information, medical records, or trade secrets. Therefore, it is essential to encrypt this data during transmission to prevent data leakage or tampering.

[0121] In this embodiment of the application, the server encrypts the data to be processed using a second encryption key. Here, the second encryption key is a key used to encrypt the data to be processed. In some examples, the second encryption key may be derived by the key management module in the target security isolation area based on the hardware key corresponding to the target security isolation area.

[0122] Through the above embodiments, by encrypting the preset network model and the data to be processed using the first encryption key and the second encryption key respectively, and then transmitting the encrypted preset network model and the encrypted data to be processed to the target secure isolation area, the theft or tampering of the preset network model and the data to be processed during transmission can be effectively prevented, thereby ensuring the confidentiality and integrity of the preset network model and the data to be processed, and thus improving the security and reliability of the entire system.

[0123] The following describes the application of the data processing method provided in the embodiments of this application in a real-world scenario.

[0124] Based on the foregoing embodiments, this application provides a data processing system, which includes the included units and the modules included in each unit, which can be implemented by a processor in a computer device; of course, it can also be implemented by specific logic circuits; in the implementation process, the processor can be a central processing unit (CPU), microprocessor unit (MPU), digital signal processor (DSP) or field programmable gate array (FPGA), etc., and the computer device can be a server.

[0125] In some embodiments, Figure 5 A schematic diagram of the composition structure of a data processing system provided in this application embodiment. Figure 1 .like Figure 5 As shown, the data processing system 500 includes: a secure startup module 501, a secure communication module 502, and a secure operation module 503, wherein:

[0126] The secure boot module 501 is used to initialize the target secure isolation zone in a trusted environment;

[0127] The secure communication module 502 is used to transmit the preset network model and the data to be processed to the target secure isolation area after the security verification of the target secure isolation area has passed.

[0128] The secure operation module 503 is used to acquire secure operation instructions in the target secure isolation area; run a preset network model based on the secure operation instructions; and use the preset network model to process the data to be processed and generate processing results.

[0129] It should be noted that the secure boot module 501 is used to ensure that the target secure isolation region is initialized in a trusted environment, and may include, but is not limited to, a hardware root of trust and a secure boot sequence controller. The hardware root of trust can be implemented based on electrically programmable memory (eFuse) or physically unclonable function (PUF) technology, and its contents cannot be tampered with. The secure boot sequence controller is used to verify a multi-level boot process during the initialization of the target secure isolation region, thereby preventing verification rollback and avoiding the loading of older firmware versions. The specific boot process may include: starting with the boot code in immutable read-only memory (ROM); using a chained verification mechanism, each level verifies the digital signature of the next level.

[0130] In addition, regarding the process of the secure boot module 501 initializing the target secure isolation region, in one possible implementation, after the server is powered on, the ROM boot code is driven to run based on the secure boot sequence controller, and the security of the firmware is verified step by step. After the verification is successful, the initialized target secure isolation region is obtained.

[0131] It should also be noted that the secure communication module 502 can transmit the preset network model and the data to be processed to the target secure isolation area. The secure communication module 502 can provide a secure communication mechanism between the target secure isolation area and the external environment, which may include: a secure bus interface, a secure message passing mechanism, and a secure input / output (I / O) controller.

[0132] The secure bus interface can correspond to a preset secure communication protocol. This secure communication information may include, but is not limited to, the Encrypted Advanced eXtensible Interface (AXI) bus protocol. Based on this protocol, the secure communication module 502 can automatically encrypt any data transmitted to the target secure isolation area. The secure message passing mechanism can be based on a secure message queue in shared memory and hardware-mandated unidirectional data flow control. The secure I / O controller can be directly connected to the secure I / O path.

[0133] It should also be noted that the secure operation module 503 can process the data to be processed in the target secure isolation area through a preset network model, thereby ensuring the security of the data processing process.

[0134] In some embodiments, the secure operation module 503 may further include an instruction extension unit and an encrypted calculation unit, wherein:

[0135] Instruction extension unit, used to retrieve safe operation instructions;

[0136] The encrypted computing unit is used to run a preset network model based on secure computing instructions, and to use the preset network model to process the data to be processed and generate processing results.

[0137] Here, the secure operation module 503 includes an instruction extension unit, which can extend the instruction set under the current device architecture to add secure operation instructions for calculation of the preset network module. During implementation, the instruction extension unit can directly obtain secure operation instructions for subsequent data processing.

[0138] The encrypted computing unit provides encrypted computing capabilities for a preset network model, ensuring the security of the preset network model and the data to be processed during the processing. Here, the encrypted computing unit may include, but is not limited to, a homomorphic encryption accelerator corresponding to the target secure isolation area, a secure multi-party computing unit, and a confidential computing state protection mechanism. The homomorphic encryption accelerator can perform hardware-accelerated partial homomorphic encryption operations and supports basic algebraic operations within the encrypted domain. The secure multi-party computing unit can support a secure multi-party computing protocol based on secret sharing, which may include obfuscated circuit protocols and unintentional transmission protocols. The confidential computing state protection mechanism enables the server to encrypt and protect the register state during the computing process through the encrypted computing unit and ensures that sensitive data is immediately cleared from the register after use.

[0139] In some embodiments, the secure communication module 502 may include a secure memory control unit; wherein:

[0140] The secure memory control unit is used to encrypt the processing results, obtain the encrypted results, and store the encrypted results in the target secure isolation area.

[0141] Here, the secure memory control unit can manage secure memory within the target secure isolation area, ensuring secure memory access.

[0142] In some embodiments, see Figure 6 This is a schematic diagram of the composition structure of a data processing system provided in an embodiment of this application. Figure 2 The data processing system also includes a key management module 504, in which:

[0143] Key management module 504 is used to generate a first encryption key and a second encryption key;

[0144] The secure communication module 502 is used to encrypt a preset network model based on a first encryption key and transmit the encrypted preset network model to a target secure isolation area through a secure data channel.

[0145] The secure communication module 502 is also used to encrypt the data to be processed based on the second encryption key, and transmit the encrypted data to be processed to the target secure isolation area through a secure data channel.

[0146] Here, the key management module 504 is responsible for managing various keys used in the system, ensuring the secure generation, storage and use of keys. It may include a key generation unit, which can generate a first encryption key and a second encryption key. The generated keys can be used by the secure communication module 402 to encrypt the preset network model and the data to be processed respectively.

[0147] In some embodiments, the secure operation module 503 includes a decryption unit, wherein:

[0148] The decryption unit is used to obtain the first decryption key and decrypt the encrypted preset network model based on the first decryption key to obtain the decrypted preset network model.

[0149] The decryption unit is also used to obtain a second decryption key, and to decrypt the encrypted data to be processed based on the second decryption key to obtain the decrypted data to be processed.

[0150] Correspondingly, the secure operation module 503 includes a decryption unit, which can decrypt the encrypted preset network model and the encrypted data to be processed according to different decryption keys.

[0151] In some embodiments, see continue to see Figure 6 The data processing system may also include an access control module 505, wherein:

[0152] The authorization verification module 505 is used to respond to a data access request, transmit the encryption result to the receiving device, and verify the identity and authorization of the data access request; if the identity and authorization verification is successful, it sends the third decryption key corresponding to the encryption result to the receiving device, so that the receiving device can decrypt the encryption result based on the third decryption key.

[0153] Here, the permission verification module 505 can define a fine-grained access permission matrix to execute the corresponding access control policy, and also supports runtime dynamic permission configuration, which can realize the identity and permission verification of data access requests.

[0154] In some embodiments, see continue to see Figure 6 The data processing system may also include a security monitoring module 506, wherein:

[0155] The security monitoring module 506 is used to acquire system monitoring data corresponding to the target security isolation area, and side channel protection results corresponding to at least one side channel protection task; and determine the current security level and the security response strategy corresponding to the current security level based on the system monitoring data and the side channel protection results; wherein the security response strategy includes at least one of the following: issuing a warning signal, resetting the target security isolation area, and locking the target security isolation area.

[0156] Here, the security monitoring module 506 can be used to monitor the system security status of the side channel protection unit in real time, detect and respond to potential security threats, including but not limited to the security status monitor, the side channel protection unit and the anomaly response controller. Here, the security status monitor can obtain the system monitoring data corresponding to the target security isolation area, the side channel protection unit can perform side channel protection tasks to obtain the corresponding side channel protection results, and the anomaly response controller can determine the security response strategy based on the system monitoring data and the side channel protection results.

[0157] In some embodiments, the secure boot module 501 further includes a remote authentication unit, wherein:

[0158] The remote authentication unit is used to obtain the authentication key to be verified; it performs remote security verification on the target security isolation area based on the authentication key; and if the authentication key matches the key in the target security isolation area, it determines that the security verification of the target security isolation area has passed.

[0159] Here, the remote authentication unit can perform remote security verification, thereby ensuring the authenticity and integrity of the target secure isolation area before it is used for data processing.

[0160] The descriptions of the apparatus embodiments above are similar to those of the method embodiments above, and have similar beneficial effects. In some embodiments, the functions or modules included in the apparatus provided in this application can be used to perform the methods described in the method embodiments above. For technical details not disclosed in the apparatus embodiments of this application, please refer to the descriptions of the method embodiments of this application for understanding.

[0161] Taking the RISC-V architecture as an example, the following describes the application of the embodiments of this application in a real-world scenario.

[0162] With the rapid development and widespread application of artificial intelligence (AI) technology, the security and data privacy protection issues of AI technology are becoming increasingly prominent. In related technologies, AI computation is mainly performed on general-purpose processors, with users or systems running related tasks. General-purpose processors lack effective hardware security isolation mechanisms, and this design flaw exposes sensitive AI models and data to various security threats. For example, these security threats include, but are not limited to: model extraction attacks: attackers can steal model parameters and structure through multiple queries or side-channel attacks, damaging the model's intellectual property rights; AI applications processing sensitive personal data lack effective isolation of the data processing environment, and AI applications fail to implement sufficient protective measures, making data potentially vulnerable to malware theft; model tampering risks: unauthorized access can lead to malicious modification of AI model parameters, causing security vulnerabilities; side-channel attacks: attackers can steal sensitive information generated during execution through side-channel methods such as electromagnetic radiation and power consumption analysis.

[0163] Security solutions in related technologies are mostly based on software isolation technologies (such as secure virtualization and containerization) or general-purpose TEEs. Software isolation technologies and general-purpose TEE solutions have significant shortcomings: software isolation cannot defend against attacks on underlying system vulnerabilities or hardware levels; when handling artificial intelligence tasks, general-purpose TEEs lack specific optimizations for artificial intelligence tasks, leading to performance bottlenecks in the system during the execution of artificial intelligence tasks.

[0164] To address the aforementioned issues and achieve enhanced security and efficiency, this invention provides a system for the RISC-V architecture, designed to construct a secure execution environment dedicated to AI computing (corresponding to the aforementioned target security isolation area). The system provided by this invention effectively addresses various security threats faced by AI models and data, and enables high-performance and secure AI inference capabilities in resource-constrained edge devices.

[0165] like Figure 7 The diagram shown is a schematic of an AI security enclave system based on the RISC-V architecture provided in this application. The system adopts a layered architecture design, and in addition to the RISC-V core module, it may also include: a security hardware foundation layer 701, an AI acceleration and secure computing layer 702, a secure communication interface layer 703, and a software support layer 704.

[0166] In this embodiment, the security hardware foundation layer 701 can be defined and integrated by the system, including a secure boot module, a key management module, a physical isolation module (corresponding to the aforementioned enhanced PMP), and a security monitoring module. The AI ​​acceleration and secure computing layer 702 may include a secure AI instruction extension unit, an encrypted computing engine unit, and a secure memory controller. The secure communication interface layer 703 may include a secure data channel (corresponding to the aforementioned encrypted communication channel) and a remote authentication module. The software support layer 704 may include a secure driver module and an API library.

[0167] The following is a detailed description of the specific structure and functions of these four layers.

[0168] For the security hardware base layer 701, it may include:

[0169] 1. Secure Boot Module: This module ensures the system boots from a trusted state, preventing malicious tampering during the boot process. It mainly includes the following sub-modules:

[0170] (1) Hardware Root of Trust: An immutable hardware root of trust is implemented based on eFuse or PUF technology, storing the initial key material. It is mainly used to achieve the following functions: the eFuse area stores the hardware unique identifier and the initial public key hash value; the PUF circuit generates a chip-unique key for deriving other keys.

[0171] (2) Secure boot sequence controller, which can achieve the following functions: implement a multi-level verification boot process, starting from the ROM boot code; use a chain verification mechanism to verify the digital signature of the next level code at each level; and provide anti-rollback protection to prevent loading of old firmware versions.

[0172] Based on the above, the startup process of the secure boot module is as follows: a) After power-on, the ROM code first executes and verifies the integrity of the security monitoring firmware; b) After the security monitoring firmware starts, it verifies the secure enclave firmware; c) After the enclave firmware is verified, it initializes the secure memory area and key structure.

[0173] 2. Key Management Module: Responsible for managing all types of keys used in the system, ensuring the secure generation, storage, and use of keys. Main components include:

[0174] (1) Key generation unit, mainly used to implement the following functions: generate high-entropy random numbers based on hardware TrueRandom Number Generator (TRNG); support key generation of cryptographic algorithms such as Advanced Encryption Standard (AES-256) with a 256-bit key, RSA encryption algorithm (Rivest–Shamir–Adleman with a 4096-bit key, RSA-4096) and Elliptic Curve Cryptography (ECC).

[0175] (2) Key derivation engine unit, mainly used to implement the following functions: implement key derivation function based on hash-based Message Authentication Code-Secure Hash Algorithm 256-bit (HMAC-SHA256); support the derivation of session keys and temporary keys from hardware unique keys.

[0176] (3) Key protection storage unit, mainly used to achieve the following functions: a physically isolated key storage area that cannot be directly accessed from the outside; a key usage counter and lifecycle management mechanism.

[0177] 3. Physical isolation module: This module physically isolates the AI ​​security enclave from the main system to prevent unauthorized access. It mainly includes:

[0178] (1) Physical Memory Protection Unit (Enhanced PMP), whose main functions include: extending the RISC-V standard PMP to add specific AI security attributes; fine-grained memory area control, supporting page-level access control; and special protection types for AI model parameters (read-only, compute-only, etc.).

[0179] (2) Security access control matrix, whose main functions include: defining fine-grained subject-object access permission matrix; hardware-enforced access control policies; and supporting runtime dynamic permission configuration.

[0180] (3) Physical boundary isolation circuit (corresponding to the aforementioned independent circuit), whose main functions include: independent power supply domain and clock domain design; dedicated encrypted bus interface, and mandatory encryption of all out-of-bounds data transmission.

[0181] 4. Security monitoring module, responsible for real-time monitoring of system security status, detecting and responding to potential security threats. Main components include:

[0182] (1) Safety status monitor, whose main functions include: monitoring key system parameters (voltage, frequency, temperature, corresponding to the aforementioned system monitoring data); detecting abnormal access patterns and execution processes.

[0183] (2) Side channel protection unit, whose main functions include: time side channel protection: performing key cryptographic operations at fixed times; power side channel protection: balanced power consumption design and random masking technology; electromagnetic side channel protection: physical shielding and signal obfuscation technology.

[0184] (3) Anomaly response controller, whose main functions include: defining multi-level response policies (warning, reset, lock); security log recording mechanism to support post-event auditing.

[0185] For the AI ​​acceleration and secure computing layer 702, it may include:

[0186] 1. Secure AI Instruction Extension Unit: This unit extends the RISC-V instruction set, adding secure instructions specifically for AI computing. It mainly includes:

[0187] (1) Secure matrix operation instructions (corresponding to the aforementioned secure operation instructions), whose main functions include: supporting the direct execution of basic AI operations such as matrix multiplication and convolution within the encrypted domain; and having a built-in masking mechanism to prevent the leakage of intermediate results.

[0188] (2) Secure vector processing unit, whose main functions include: enhancing RISC-V vector extension (V extension) to support encrypted vector operations; vectorized privacy computation primitives, such as basic operations of secure multi-party computation.

[0189] (3) Security Tensor Accelerator (corresponding to the processor corresponding to the aforementioned target security isolation area), whose main functions include: a dedicated tensor computing unit that supports AI inference operations in encrypted state; configurable precision (8-bit Integers (INT8) / 16-bit Integers (INT16) / 16-bit Floating-Point (FP16) / 32-bit Floating-Point (FP32)) and operation type.

[0190] Here, the corresponding instruction execution flow is as follows: a) The instruction decoder identifies the secure AI instruction and routes it to the secure execution unit; b) The secure execution unit loads encrypted operands from secure memory; c) The computation is performed in a physically isolated environment, and the result is written back to secure memory.

[0191] 2. Encrypted Computation Engine Unit: Provides encrypted computation capabilities for AI models, ensuring the security of models and data during the computation process. Main components include:

[0192] (1) Homomorphic encryption accelerator, whose main functions include: hardware-accelerated partial homomorphic encryption operations; support for basic algebraic operations (addition, multiplication) within the encryption domain.

[0193] (2) Secure multi-party computation unit, whose main functions include: supporting secure multi-party computation protocols based on secret sharing; hardware-accelerated Garbled Circuit (GC) and Oblivious Transfer (OT) protocols.

[0194] (3) Confidential computing state protection, whose main functions include: encryption protection of register state during the computing process; and a zeroing mechanism to ensure that sensitive data is cleared from the register immediately after use.

[0195] 3. The secure memory controller manages the memory space of the secure enclave (corresponding to the aforementioned secure memory), ensuring secure memory access. It mainly includes:

[0196] (1) Memory encryption engine, whose main functions include: real-time encryption and integrity protection of memory based on Advanced Encryption Standard-Galois / Counter Mode (AES-GCM); page-level fine-grained encryption, supporting different security levels; and anti-replay protection mechanism to prevent memory tampering attacks.

[0197] (2) Secure caching architecture, whose main functions include: dedicated secure cache, physical isolation to prevent cache side-channel attacks; cache line shuffling technology to disrupt access patterns; cache locking mechanism to allow locking of key model parameters.

[0198] (3) Secure Direct Memory Access Controller (DMA controller), whose main functions include: supporting encrypted data transmission without CPU intervention; hardware-based access control to prevent unauthorized DMA access.

[0199] For the secure communication interface layer 703, it may include:

[0200] 1. Secure data channel (corresponding to the aforementioned secure communication module), providing a secure communication mechanism between the secure enclave and external systems. It mainly includes:

[0201] (1) Secure bus interface, whose main functions include: encrypted AXI bus protocol, all out-of-bounds data transmission is automatically encrypted; bus transaction authentication mechanism to prevent spoofing attacks.

[0202] (2) Secure message passing mechanism, whose main functions include: secure message queue based on shared memory; hardware-mandated one-way data flow control.

[0203] (3) Safety I / O controller, whose main functions include: a safety I / O path for direct connection to sensors; and a hardware-level data source authentication mechanism.

[0204] 2. Remote Authentication Module (corresponding to the aforementioned remote authentication module), providing remote verification capabilities, allowing third parties to verify the authenticity and integrity of the enclave. It mainly includes:

[0205] (1) Authentication key management, whose main functions include: authentication key pairs derived from the hardware unique key (corresponding to the hardware key corresponding to the aforementioned target security isolation area); and support for ECDSA key generation and signature operations.

[0206] (2) Remote authentication protocol engine, whose main functions include: implementing a standardized remote authentication protocol; generating authentication reports containing security status and configuration.

[0207] (3) Security Measurement Engine, whose main functions include: hardware security measurement register, which records system status; supports dynamic measurement updates and tracks enclave status changes.

[0208] For software support layer 704, it may include:

[0209] 1. Security driver module, used to provide operating system-level security enclave support. It mainly includes:

[0210] (1) Secure enclave management driver, whose main functions include: supporting enclave lifecycle management (creation, initialization, destruction); secure memory allocation and reclamation mechanism.

[0211] (2) Security interrupt handling procedure, whose main functions include: isolation interrupt handling to prevent leakage of interrupt-related side channels; and security interrupt routing mechanism to ensure that sensitive interrupts are handled correctly.

[0212] 2. API library, which provides a programming interface for applications to use secure enclaves. It mainly includes:

[0213] (1) Secure programming interface, whose main functions include: providing a secure programming library for C / C++ / Rust; abstracting the underlying security mechanism to simplify the development of secure applications.

[0214] (2) AI model secure loading interface, whose main functions include: supporting secure loading and verification of encrypted AI models; model isolation execution and secure result return mechanism.

[0215] Based on the hierarchical architecture in the above embodiments, the overall workflow of the technical solution provided in this application can be divided into the following stages:

[0216] A. Secure boot phase: (1) After power-on, verify the boot code based on the root of trust. (2) Verify the firmware and secure enclave code step by step. (3) Initialize the security monitoring and key management system.

[0217] B. AI Model Loading Stage: (1) The encrypted AI model is transmitted to the system through a secure channel. (2) The remote authentication module verifies the authenticity of the system and establishes a secure channel. (3) The secure enclave verifies the model signature, decrypts and loads the model.

[0218] C. Secure AI Execution Phase: (1) Input data enters the enclave through a secure channel. (2) Secure AI instructions execute model inference in a physically isolated environment. (3) The security monitoring module monitors the execution status in real time and defends against side-channel attacks.

[0219] D. Secure Output Stage: (1) The reasoning result (corresponding to the processing result mentioned above) is encrypted within the enclave. (2) The encrypted result is transmitted to the authorized recipient (corresponding to the receiving device mentioned above) through a secure channel. (3) The decryption key is released after verifying the identity of the recipient.

[0220] Based on the overall workflow described above, the workflow will be described below with reference to two specific embodiments.

[0221] In one specific embodiment, taking a secure face recognition system in an edge AI device as an example, the AI ​​security enclave is used to protect the face recognition model and user biometric data on the edge device.

[0222] 1. System configuration parameters:

[0223] (1) The fifth-generation reduced instruction set computer has a 64-bit architecture that supports general, compressed, and vector extensions (RISC-V RV64GCV) and integrates AI security enclave extensions.

[0224] (2) A 4MB secure memory area is used to store encryption model parameters and temporary data.

[0225] (3) Dedicated tensor accelerator, supporting neural network calculations with INT8 / FP16 precision.

[0226] 2. The workflow includes the following steps:

[0227] (1) When the device starts up, the safety startup module verifies the integrity of the system.

[0228] (2) The encrypted face recognition model is securely loaded into enclave after remote authentication.

[0229] (3) The facial images captured by the camera are directly processed by the enclave through the secure I / O channel.

[0230] (4) Image preprocessing and feature extraction are completed within the enclave to obtain feature vectors; and intermediate results do not leave the safe area.

[0231] (5) Securely compare the feature vector with the encrypted user template. The comparison algorithm is executed within the enclave.

[0232] (6) Only the final authentication result (success / failure) is returned to the main system through the secure channel.

[0233] 3. Security Guarantee:

[0234] (1) Biometric data is processed entirely within the enclave and is not exposed to the main system.

[0235] (2) The model parameters are protected by memory encryption to prevent extraction attacks.

[0236] (3) Side channel protection mechanism prevents inference of internal operation through time or power consumption analysis.

[0237] (4) Even if an attacker gains full operating system privileges, they will not be able to access the original biological data.

[0238] In another specific embodiment, taking a privacy-preserving diagnostic system in a medical AI application as an example, the AI ​​security enclave is used to protect medical diagnostic AI models and sensitive patient health data.

[0239] 1. System configuration parameters:

[0240] (1) The fifth-generation reduced instruction set computer has a 64-bit architecture that supports general, compressed, vector, and bit-manipulation extensions (RISC-V RV64GCVB) and integrates an enhanced security enclave.

[0241] (2) 16MB of secure memory to support larger-scale medical AI models.

[0242] (3) Homomorphic encryption accelerator, supporting basic medical data analysis in encrypted state.

[0243] 2. The workflow includes the following steps:

[0244] (1) Medical institutions verify the security status of diagnostic equipment through remote authentication.

[0245] (2) The encrypted medical AI model is securely loaded into the enclave.

[0246] (3) Patient health data is encrypted and then transmitted to enclave.

[0247] (4) The data is decrypted in the enclave and then analyzed using AI diagnostics.

[0248] (5) The analysis results are encrypted within the enclave and can only be decrypted and viewed by authorized doctors.

[0249] (6) All original patient data and intermediate results are safely removed from the enclave after the analysis is completed.

[0250] 3. Security Guarantee:

[0251] (1) Patient health data is encrypted and protected throughout the process, which complies with medical data privacy regulations.

[0252] (2) The intellectual property rights of the diagnostic model are protected to prevent reverse engineering.

[0253] (3) Supports multi-party secure computation, allowing multiple medical institutions to collaborate on analysis while protecting data privacy.

[0254] (4) Provide a complete audit log to record all data access operations.

[0255] In this application embodiment, the specific implementation of the aforementioned embodiments is described in detail through the above embodiments. It can be seen that, according to the technical solutions of the aforementioned embodiments, the following are mainly provided: ① A dedicated AI secure isolated execution region (enclave) architecture designed for RISC-V architecture to achieve hardware-level security protection for AI models and data; ② An enhanced physical memory protection (PMP) mechanism for AI computing, supporting special protection attributes and fine-grained access control for AI model parameters; ③ Secure AI instruction extensions, including AI-specific instruction set extensions such as matrix operations, convolution, and activation functions in encrypted states; ④ A side-channel protection system for AI computing, including time, power consumption, and electromagnetic side-channel protection measures to prevent the leakage of AI model parameters; ⑤ A deep integration scheme between a dedicated secure tensor accelerator and the enclave, providing efficient AI inference capabilities while ensuring secure isolation; ⑥ A lightweight homomorphic encryption accelerator design to support basic AI computing operations in encrypted states; ⑦ A secure cache architecture design to prevent the extraction of AI model parameters through cache side-channel attacks; ⑧ A secure boot and remote authentication mechanism to ensure that the AI ​​model is executed in a trusted environment and to support third-party verification of the integrity of the execution environment. Thus, on the one hand, based on the AI ​​security enclave designed specifically for the RISC-V architecture (corresponding to the aforementioned target security isolation area), this enclave is used to achieve hardware-level isolation protection for AI models and data to be processed; on the other hand, by integrating dedicated AI acceleration units with security isolation mechanisms, AI inference efficiency is improved while ensuring system security; furthermore, by adopting secure boot and remote authentication mechanisms, the system can ensure the integrity of the AI ​​model and establish a trusted execution environment; furthermore, it also provides methods or systems for implementing side-channel attack protection against AI computation, which can effectively protect sensitive model parameters and data, thereby ensuring their security; furthermore, it can also provide lightweight security solutions for resource-constrained edge AI devices, expanding the RISC-V security ecosystem.

[0256] It should be noted that, in the embodiments of this application, if the above-described data processing method is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiments of this application, or the part that contributes to the related technology, can be embodied in the form of a software product. This software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, mobile hard drives, read-only memory (ROM), magnetic disks, or optical disks. Thus, the embodiments of this application are not limited to any specific hardware, software, or firmware, or any combination of hardware, software, and firmware.

[0257] This application provides a computer device including a memory and a processor. The memory stores a computer program that can run on the processor. When the processor executes the program, it implements some or all of the steps in the above-described method.

[0258] This application provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements some or all of the steps in the above-described method. The computer-readable storage medium can be transient or non-transient.

[0259] This application provides a computer program including computer-readable code, wherein when the computer-readable code is executed in a computer device, a processor in the computer device performs some or all of the steps in the above-described method.

[0260] This application provides a computer program product, which includes a non-transitory computer-readable storage medium storing a computer program. When the computer program is read and executed by a computer, it implements some or all of the steps in the above-described method. This computer program product can be implemented specifically through hardware, software, or a combination thereof. In some embodiments, the computer program product is specifically embodied as a computer storage medium; in other embodiments, the computer program product is specifically embodied as a software product, such as a software development kit (SDK), etc.

[0261] It should be noted that the descriptions of the various embodiments above tend to emphasize the differences between them, while their similarities or commonalities can be referred to interchangeably. The descriptions of the above embodiments of the device, storage medium, computer program, and computer program product are similar to the descriptions of the above method embodiments and have similar beneficial effects. For technical details not disclosed in the embodiments of the device, storage medium, computer program, and computer program product of this application, please refer to the descriptions of the method embodiments of this application for understanding.

[0262] In some embodiments, Figure 8 This is a schematic diagram of the hardware entity of a computer device provided in an embodiment of this application. The computer device may be a server, such as... Figure 8 As shown, the hardware entity of the computer device 800 includes: a processor 801, a communication interface 802, and a memory 803, wherein:

[0263] When processor 801 executes a program, it implements the steps of any of the above-mentioned data processing methods. Processor 801 typically controls the overall operation of computer device 800.

[0264] The communication interface 802 enables computer devices to communicate with other terminals or servers over a network.

[0265] The memory 803 is configured to store instructions and applications executable by the processor 801, and can also cache data to be processed or already processed (e.g., image data, audio data, voice communication data, and video communication data) in the processor 801 and various modules in the computer device 800. It can be implemented using flash memory or random access memory (RAM). Data transfer between the processor 801, the communication interface 802, and the memory 803 can be performed via bus 804.

[0266] This application provides a computer storage medium that stores one or more programs, which can be executed by one or more processors to implement the steps of the data processing method as described in any of the above embodiments.

[0267] It should be noted that the descriptions of the storage medium and device embodiments above are similar to the descriptions of the method embodiments above, and have similar beneficial effects. For technical details not disclosed in the storage medium and device embodiments of this application, please refer to the descriptions of the method embodiments of this application for understanding.

[0268] The aforementioned processor can be at least one of the following: Application Specific Integrated Circuit (ASIC), Digital Signal Processor (DSP), Digital Signal Processing Device (DSPD), Programmable Logic Device (PLD), Field Programmable Gate Array (FPGA), Central Processing Unit (CPU), Controller, Microcontroller, and Microprocessor. It is understood that other electronic devices can also implement the functions of the aforementioned processor, and this application does not specifically limit the specific implementation.

[0269] The aforementioned computer storage media / memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), magnetic random access memory (FRAM), flash memory, magnetic surface memory, optical disc, or compact disc read-only memory (CD-ROM), etc.; or it can be various terminals that include one or any combination of the above-mentioned memories, such as mobile phones, computers, tablet devices, personal digital assistants, etc.

[0270] The above description is merely an embodiment of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application.

Claims

1. A data processing method, characterized in that, The method includes: Determine the target security isolation zone; If the security verification in the target security isolation area is passed, the preset network model and the data to be processed will be transmitted to the target security isolation area. Obtain secure operation instructions within the target secure isolation area; The preset network model is executed based on the security operation instructions, and the preset network model is used to process the data to be processed to generate the processing result.

2. The method according to claim 1, characterized in that, The method further includes: The processing result is encrypted in the target secure isolation area to obtain an encrypted result, and the encrypted result is stored in the target secure isolation area.

3. The method according to claim 1, characterized in that, The step of transmitting the preset network model and the data to be processed to the target secure isolation area includes: The preset network model is encrypted based on the first encryption key, and the encrypted preset network model is transmitted to the target secure isolation area. The data to be processed is encrypted using the second encryption key, and the encrypted data is then transmitted to the target secure isolation area.

4. The method according to claim 3, characterized in that, Before processing the data to be processed using the preset network model, the method further includes: The encrypted preset network model is decrypted based on the first decryption key to obtain the decrypted preset network model. The encrypted data to be processed is decrypted using the second decryption key to obtain the decrypted data to be processed.

5. The method according to claim 2, characterized in that, The method further includes: In response to a data access request, the encryption result is transmitted to the receiving device, and the identity and authorization of the data access request are verified. If the identity and authorization verification is successful, the third decryption key corresponding to the encryption result is sent to the receiving device so that the receiving device can decrypt the encryption result based on the third decryption key.

6. The method according to any one of claims 1 to 5, characterized in that, The method further includes: Obtain system monitoring data corresponding to the target security isolation area, and side-channel protection results corresponding to at least one side-channel protection task; Based on the system monitoring data and the side channel protection results, determine the current security level and the corresponding security response strategy. The security response strategy includes at least one of the following: issuing a warning signal, resetting the target security isolation area, and locking the target security isolation area.

7. The method according to claim 1, characterized in that, The method further includes: Obtain the authentication key to be verified; The target security isolation area is remotely verified based on the authentication key. If the authentication key matches the key in the target security isolation area, the security verification of the target security isolation area is deemed successful.

8. A data processing system, characterized in that, The data processing system includes a secure boot module, a secure communication module, and a secure operation module, wherein: The secure boot module is used to initialize the target secure isolation zone in a trusted environment; The secure communication module is used to transmit the preset network model and the data to be processed to the target secure isolation area when the security verification of the target secure isolation area is passed. The secure operation module is used to acquire secure operation instructions in the target secure isolation area; run the preset network model based on the secure operation instructions; and use the preset network model to perform relevant processing on the data to be processed, generating processing results.

9. The system according to claim 8, characterized in that, The secure communication module includes a secure memory control unit; The secure memory control unit is used to encrypt the processing result, obtain an encrypted result, and store the encrypted result in the target secure isolation area.

10. The system according to claim 8, characterized in that, The data processing system also includes a key management module, wherein: The key management module is used to generate a first encryption key and a second encryption key; The secure communication module is used to encrypt the preset network model based on the first encryption key, and transmit the encrypted preset network model to the target secure isolation area through a secure data channel; The secure communication module is further configured to encrypt the data to be processed based on the second encryption key, and transmit the encrypted data to be processed to the target secure isolation area through a secure data channel.

11. The system according to claim 10, characterized in that, The secure operation module includes a decryption unit, wherein: The decryption unit is used to obtain a first decryption key and decrypt the encrypted preset network model based on the first decryption key to obtain the decrypted preset network model. The decryption unit is further configured to obtain a second decryption key, and decrypt the encrypted data to be processed based on the second decryption key to obtain the decrypted data to be processed.

12. The system according to claim 9, characterized in that, The data processing system also includes an access control module, wherein: The permission verification module is used to respond to a data access request by transmitting the encryption result to the receiving device and verifying the identity and permission of the data access request; if the identity and permission verification is successful, the module sends the third decryption key corresponding to the encryption result to the receiving device so that the receiving device can decrypt the encryption result based on the third decryption key.

13. The system according to any one of claims 8 to 12, characterized in that, The data processing system also includes a security monitoring module, wherein: The security monitoring module is used to acquire system monitoring data corresponding to the target security isolation area, and side-channel protection results corresponding to at least one side-channel protection task; and determine the current security level and the security response strategy corresponding to the current security level based on the system monitoring data and the side-channel protection results; wherein, the security response strategy includes at least one of the following: issuing a warning signal, resetting the target security isolation area, and locking the target security isolation area.

14. The system according to claim 8, characterized in that, The data processing system also includes a remote authentication module, wherein: The remote authentication module is used to obtain the authentication key to be verified; perform remote security verification on the target security isolation area based on the authentication key; and determine that the security verification of the target security isolation area is successful if the authentication key matches the key in the target security isolation area.

15. A computer device comprising a memory and a processor, the memory storing a computer program executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 7.

16. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7.

17. A computer program product comprising a computer program or instructions, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 7.

Images