A method, operation method, device, and integrated equipment for deploying large-scale industry models

Abstract

This application discloses a method, operation method, apparatus, and integrated device for deploying large-scale industry models, relating to the fields of confidential computing technology and secure large-scale model computing technology. The method includes: an operator in the trusted execution environment (TEX) of the integrated device obtains a private key handle, a ciphertext encryption key, and ciphertext model data from a hardware cryptographic module within the TEX; the ciphertext encryption key and ciphertext model data are received by the hardware cryptographic module and originate from the model holder device; the ciphertext encryption key is decrypted using the private key handle to obtain a random symmetric key generated by the model holder device; the ciphertext model data is decrypted using the random symmetric key to obtain the model data of the large-scale industry model; and the model data is encrypted using the sealing key of the TEX to obtain the ciphertext large-scale industry model, which is then stored. This scheme effectively prevents the leakage of the model data of the large-scale industry model and improves the security of the large-scale industry model deployment.

Description

Technical Field

[0001] This application relates to the fields of confidential computing technology and large-scale model secure computing technology, and in particular to an industry large-scale model deployment method, operation method, device and all-in-one equipment. Background Technology

[0002] Vertical industry models, also known as industry-specific large-scale models, refer to artificial intelligence models that are specifically trained and optimized for a particular industry or field. Unlike general-purpose large-scale models that pursue broad applicability, they are more like "industry experts" who have been deeply involved in a specific field for many years, focusing on solving professional problems within that field. The essence of vertical industry models lies in vertical specialization, focusing on a single industry (such as healthcare, finance, or education). Through deep learning of the professional data and knowledge system of that field, they accurately grasp industry terminology, business logic, and professional rules, thereby providing more professional, accurate, and efficient solutions in specific application scenarios. The data used to train vertical industry models is highly targeted, with over 90% of the training data coming from specific industries (such as medical records, financial transaction records, and legal documents).

[0003] With the widespread application of Large Language Models (LLMs) across various industries, fine-tuning industry-specific large models using valuable industry data (such as medical, manufacturing, and scientific research data) on open-source base models (such as Qwen3 and Deepseek) can yield refined industry-specific large models. However, industry data is a crucial data asset purchased by enterprises, and the industry-specific large models trained using this data are also important intellectual property. Therefore, for companies developing industry-specific large models, the trained models (model parameters and weights) are vital data assets that require strict protection.

[0004] However, in the practical application of industry-wide big data models, Company A trains an industry-wide big data model using industry-value data, and Company B expects to use this model for model inference services. When Company A deploys the industry model to Company B in batches, there is a risk that Company B may leak the model. For example, in a traditional approach, Company A deploys the industry-wide big data model privatized on Company B's server and grants authorization to Company B. Company B can then access the plaintext parameters and weights of the model on its server. Company B can then copy these parameters and weights and resell them at a low price to another company, Company C. This indirectly equates to Company A's intellectual property being leaked through Company B, posing a significant risk.

[0005] In summary, existing technologies suffer from the problem of easy leakage of model data in large industry models. Summary of the Invention

[0006] This application provides a method, method, apparatus, and integrated device for deploying large industry models, in order to solve the problem that model data of large industry models is easily leaked in the prior art.

[0007] This application provides a method for deploying a large-scale industry model, applied to a deployer in a trusted execution environment of an all-in-one device for which a large-scale industry model is to be deployed. The all-in-one device further includes a hardware cryptographic module. The method includes: In the trusted execution environment, the private key handle, ciphertext encryption key, and ciphertext model data of the hardware cryptographic module are obtained. The ciphertext encryption key and the ciphertext model data are received by the hardware cryptographic module and come from the model holder device. The ciphertext encryption key is obtained by the model holder device using the public key from the hardware cryptographic module to encrypt a random symmetric key generated by the model holder device. The ciphertext model data is obtained by the model holder device using the random symmetric key to encrypt the model data of the industry large model. The private key handle represents a private key generated by the hardware cryptographic module and corresponds to the public key. By interacting with the hardware cryptographic module, the ciphertext encryption key is decrypted using the private key handle to obtain the random symmetric key generated by the model holder device; The encrypted model data is decrypted using the random symmetric key to obtain the model data of the industry-wide model; The model data is encrypted using the sealing key of the trusted execution environment to obtain a encrypted industry large model, which is then stored.

[0008] Furthermore, the sealing key is generated based on the environment information of the trusted execution environment and the hardware root of trust of the security processor of the all-in-one device; The sealing key corresponds one-to-one with the trusted execution environment.

[0009] Furthermore, it also includes: The public key and the private key generated by the hardware cryptographic module are deleted through message interaction with the hardware cryptographic module.

[0010] This application embodiment also provides a method for running an industry large model, applied to a runner in a trusted execution environment of an all-in-one device deploying an industry large model. The all-in-one device stores an encrypted industry large model, which is obtained by encrypting the model data of the industry large model using a sealing key of the trusted execution environment. The method includes: In the trusted execution environment, a sealing key for the trusted execution environment is generated; The encrypted industry model is decrypted using the sealing key to obtain the model data of the industry model. The industry-wide model is run based on the model data of the industry-wide model.

[0011] Furthermore, generating the sealing key for the trusted execution environment within the trusted execution environment includes: In the trusted execution environment, a sealing key for the trusted execution environment is generated based on the environment information of the trusted execution environment and the hardware root of trust of the security processor of the all-in-one device. The generated sealing key corresponds one-to-one with the trusted execution environment.

[0012] This application embodiment also provides an industry large-scale model deployment device, which is applied to a deployer in the trusted execution environment of an all-in-one device to which an industry large-scale model is to be deployed. The all-in-one device further has a hardware cryptographic module. The device includes: The data acquisition module is used to acquire the private key handle, ciphertext encryption key, and ciphertext model data of the hardware cryptographic module in the trusted execution environment. The ciphertext encryption key and the ciphertext model data are received by the hardware cryptographic module and come from the model holder device. The ciphertext encryption key is obtained by the model holder device encrypting a random symmetric key generated by the model holder device using the public key from the hardware cryptographic module. The ciphertext model data is obtained by the model holder device encrypting the model data of the industry large model using the random symmetric key. The private key handle represents a private key generated by the hardware cryptographic module and corresponds to the public key. The key decryption module is used to decrypt the ciphertext encryption key using the private key handle through message interaction with the hardware cryptographic module, so as to obtain the random symmetric key generated by the model holder device. The data decryption module is used to decrypt the ciphertext model data using the random symmetric key to obtain the model data of the industry big model; The data encryption module is used to encrypt the model data using the sealing key of the trusted execution environment to obtain a encrypted industry large model, and then store it.

[0013] Furthermore, the sealing key is generated based on the environment information of the trusted execution environment and the hardware root of trust of the security processor of the all-in-one device; The sealing key corresponds one-to-one with the trusted execution environment.

[0014] Furthermore, the data encryption module is also used to delete the public key and the private key generated by the hardware cryptographic module through message interaction with the hardware cryptographic module.

[0015] This application embodiment also provides an industry large-scale model running device, applied to a runner in a trusted execution environment of an all-in-one device deploying an industry large-scale model. The all-in-one device stores an encrypted industry large-scale model, which is obtained by encrypting the model data of the industry large-scale model using a sealing key of the trusted execution environment. The device includes: A sealing key generation module is used to generate a sealing key for the trusted execution environment in the trusted execution environment. The large model decryption module is used to decrypt the encrypted industry large model using the sealing key to obtain the model data of the industry large model; The large model running module is used to run the industry large model based on the model data of the industry large model.

[0016] Furthermore, the sealing key generation module is specifically used to generate a sealing key for the trusted execution environment based on the environment information of the trusted execution environment and the hardware root of trust of the security processor of the all-in-one device, and the generated sealing key corresponds one-to-one with the trusted execution environment.

[0017] This application embodiment also provides an all-in-one device, including: the deployer and the hardware cryptographic module in any of the above-described industry large-scale model deployment methods, and the runner in any of the above-described industry large-scale model operation methods.

[0018] Furthermore, the all-in-one device has multiple trusted execution environments, each containing the deployer and the runner.

[0019] This application also provides an electronic device, including a processor and a machine-readable storage medium, wherein the machine-readable storage medium stores machine-executable instructions that can be executed by the processor, and the processor is prompted by the machine-executable instructions to: implement any of the above-described industry large-scale model deployment methods, or implement any of the above-described industry large-scale model operation methods.

[0020] This application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements either the industry large-scale model deployment method or the industry large-scale model operation method described above.

[0021] This application also provides a computer program product containing instructions that, when run on a computer, cause the computer to execute any of the above-described industry large-scale model deployment methods, or to execute any of the above-described industry large-scale model operation methods.

[0022] The beneficial effects of this application include: In the industry large-scale model deployment method provided in this application embodiment, the all-in-one device to which the industry large-scale model is to be deployed has a trusted execution environment and a hardware cryptographic module. The method is applied to the deployer in the trusted execution environment. During the deployment of the industry large-scale model, the hardware cryptographic module generates corresponding public and private keys. The model holder device obtains the public key and uses it to encrypt the generated random symmetric key to obtain a ciphertext encryption key. The model holder device also uses the generated random symmetric key to encrypt the model data of the industry large-scale model to obtain ciphertext model data. The hardware cryptographic module receives the ciphertext encryption key and ciphertext model data from the model holder device. The deployer obtains the private key handle, ciphertext encryption key, and ciphertext model data of the hardware cryptographic module in the trusted execution environment, and uses the private key handle to decrypt the ciphertext encryption key to obtain a random symmetric key. It then uses the random symmetric key to decrypt the ciphertext model data to obtain the model data of the industry large-scale model. Finally, it uses the sealing key of the trusted execution environment to encrypt the model data to obtain the ciphertext industry large-scale model, and stores it, thereby completing the deployment of the industry large-scale model. In the aforementioned process of deploying the industry-wide large-scale model, the model data is transmitted to the all-in-one device in encrypted form. Within the all-in-one device, all model data is stored in encrypted form, with no plaintext data stored on disk. The random symmetric key used to decrypt this encrypted model data is encrypted using a public key generated by the hardware cryptographic module of the all-in-one device and transmitted in encrypted form. The random symmetric key is then decrypted using the private key corresponding to the public key by the hardware cryptographic module, effectively preventing the leakage of the random symmetric key. Furthermore, the decryption and re-encryption of the model data are completed in a trusted execution environment, thereby effectively preventing the leakage of the industry-wide large-scale model data and improving the security of the industry-wide large-scale model deployment.

[0023] Accordingly, in the industry-wide large-scale model operation method provided in this application embodiment, for the encrypted industry-wide large-scale model deployed in conjunction with the trusted execution environment of the all-in-one device, the runner in the trusted execution environment generates a sealing key for the trusted execution environment, and uses the sealing key to decrypt the encrypted industry-wide large-scale model to obtain the model data of the industry-wide large-scale model. Based on the model data of the industry-wide large-scale model, the model is run. In the above process of running the industry-wide large-scale model, the encrypted industry-wide large-scale model is decrypted and run in the trusted execution environment, thereby effectively preventing the leakage of the model data of the industry-wide large-scale model and improving the security of the industry-wide large-scale model operation.

[0024] Other features and advantages of this application will be set forth in the following description and will be apparent in part from the description or may be learned by practicing the application. The objectives and other advantages of this application may be realized and obtained by means of the structures particularly pointed out in the written description, claims, and drawings. Attached Figure Description

[0025] The accompanying drawings are provided to further illustrate the present application and form part of the specification. They are used together with the embodiments of the present application to explain the application and do not constitute a limitation thereof. In the drawings: Figure 1 A flowchart illustrating the industry large-scale model deployment method provided in this application embodiment; Figure 2 This is a schematic diagram of the system architecture for deploying large industry models from the model holder device to the all-in-one device in this application embodiment; Figure 3 A flowchart of an industry large-scale model deployment method provided in another embodiment of this application; Figure 4 A flowchart of the industry large model operation method provided in the embodiments of this application; Figure 5 A schematic diagram of the structure of the industry large-scale model deployment device provided in the embodiments of this application; Figure 6 This is a schematic diagram of the structure of the industry large-scale model running device provided in the embodiments of this application; Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0026] To provide an effective solution for preventing the leakage of model data from large-scale industry models, this application provides a method for deploying, operating, and operating large-scale industry models, as well as an integrated device. The preferred embodiments of this application are described below with reference to the accompanying drawings. It should be understood that the preferred embodiments described herein are for illustrative and explanatory purposes only and are not intended to limit the scope of this application. Furthermore, the embodiments and features described herein can be combined with each other unless otherwise specified.

[0027] This application provides a method for deploying a large-scale industry model, applied to a deployer within a trusted execution environment of an all-in-one device on which the large-scale industry model is to be deployed. The all-in-one device also has a hardware cryptographic module, such as... Figure 1 and Figure 2 As shown, the method includes: Step 11: In the trusted execution environment, obtain the private key handle, ciphertext encryption key, and ciphertext model data of the hardware cryptographic module. The ciphertext encryption key and ciphertext model data are received by the hardware cryptographic module and come from the model holder device. The ciphertext encryption key is obtained by the model holder device using the public key from the hardware cryptographic module to encrypt the random symmetric key generated by the model holder device. The ciphertext model data is obtained by the model holder device using the random symmetric key to encrypt the model data of the industry large model. The private key handle represents the private key generated by the hardware cryptographic module and corresponds to the public key. Step 12: Through message interaction with the hardware cryptographic module, use the private key handle to decrypt the ciphertext encryption key to obtain the random symmetric key generated by the model holder device; Step 13: Decrypt the ciphertext model data using a random symmetric key to obtain the model data of the industry's large model; Step 14: Use the sealing key of the trusted execution environment to encrypt the model data, obtain the encrypted industry large model, and store it.

[0028] Using the industry-wide large-scale model deployment method provided in this application, during the deployment of the industry-wide large-scale model, the model data is transmitted to the all-in-one device in encrypted form. Furthermore, the model data is stored in encrypted form within the all-in-one device, with no plaintext data stored on disk. The random symmetric key used to decrypt the encrypted model data is encrypted using a public key generated by the hardware cryptographic module of the all-in-one device and transmitted in encrypted form. The random symmetric key is then decrypted using the private key corresponding to the public key by the hardware cryptographic module, effectively preventing the leakage of the random symmetric key. Moreover, the decryption and re-encryption process of the model data is completed in a trusted execution environment, thereby effectively preventing the leakage of the industry-wide large-scale model data and improving the security of the industry-wide large-scale model deployment.

[0029] like Figure 2 As shown, the all-in-one device for deploying industry-wide models can have multiple trusted execution environments. Each trusted execution environment can have its own deployer installed. Each deployer can deploy the same or different industry-wide models in its respective trusted execution environment.

[0030] Each Trusted Execution Environment (TEE) sealing key can be generated based on the environment information of that TEE and the hardware root of trust (RoT) of the security processor of the all-in-one device. The sealing key corresponds one-to-one with the TEE, meaning that the sealing key is different for different TEEs.

[0031] The environment information of the Trusted Execution Environment used to generate the sealing key may include: information about the virtual machine or confidential container to which the Trusted Execution Environment belongs, such as ID, version number, startup policy, component startup summary, etc.

[0032] The sealing key of the Trusted Execution Environment (TEE) remains unchanged after the TEE is shut down and restarted; this function is the sealing and sealing function of the TEE.

[0033] like Figure 2 As shown, a model holder device can deploy the same large industry model in different all-in-one devices. The public keys generated by the hardware cryptographic modules of different all-in-one devices are different. Therefore, the ciphertext encryption keys obtained by encrypting the random symmetric key with different public keys are also different. Furthermore, different random symmetric keys can be generated for different all-in-one devices. Correspondingly, the ciphertext model data obtained by encrypting the model data of the large industry model with different random symmetric keys are also different.

[0034] The industry large model deployment method provided in this application can be divided into two stages. The first stage is to transmit the model data of the industry large model in encrypted form from the model holder device to the all-in-one device to be deployed, and to bind the hardware device for the privacy symmetric key used as the encryption key. The second stage is to decrypt and re-encrypt the encrypted model data in a trusted execution environment to obtain the encrypted industry large model, thereby realizing the binding between the encrypted industry large model and the trusted execution environment.

[0035] The following describes in detail the industry large-scale model deployment method provided in the embodiments of this application, with reference to the accompanying drawings. Figure 3 As shown, it includes: Step 31: The model holder device generates a random symmetric key (sym_key).

[0036] Step 32: The model holder device uses a random symmetric key to encrypt the model data (model_data) of the industry large model to obtain ciphertext model data (sym_key(model_data)).

[0037] Step 33: The hardware cryptographic module of the all-in-one device for deploying the industry large model generates a key pair containing the corresponding public key (pub_key) and private key (priv_key), and sends the public key to the model holder device.

[0038] Step 34: The model holder device uses the public key from the all-in-one device to encrypt the random symmetric key to obtain the ciphertext encryption key (pub_key(sym_key)).

[0039] Step 35: Transfer the encrypted encryption key and encrypted model data from the model holder's device to the all-in-one device.

[0040] In this step, the encrypted encryption key and the encrypted model data can be combined into a digital envelope (pub_key(sym_key), sym_key(model_data)) and transmitted to the all-in-one device.

[0041] In practical applications, the encrypted encryption key and encrypted model data can be directly transmitted from the model holder device to the all-in-one device, or they can be transmitted to the all-in-one device via physical media (USB flash drive, optical disc, etc.).

[0042] Through steps 31 to 35 above, the first stage of the industry large model deployment is completed. The model data of the industry large model is transmitted in encrypted form from the model holder device to the all-in-one device to be deployed, and the hardware device is bound to the privacy symmetric key used as the encryption key. The encrypted encryption key and the encrypted model data can only be decrypted by the private key generated by the hardware cryptographic module of the all-in-one device, thus completing the hardware device binding of the encryption key.

[0043] Step 36: The deployer in the trusted execution environment of the all-in-one device obtains the private key handle, ciphertext encryption key and ciphertext model data of the hardware cryptographic module in the trusted execution environment.

[0044] The private key handle represents a private key generated by the hardware cryptographic module and corresponds to the public key, namely the private key (priv_key) generated in step 33 above.

[0045] Step 37: The deployer decrypts the ciphertext encryption key (pub_key(sym_key)) using the private key handle through message interaction with the hardware cryptographic module, and obtains the random symmetric key (sym_key) generated by the model holder device.

[0046] In this step, the private key generated by the hardware cryptographic module will only exist within the hardware cryptographic module. The decryption operation of the ciphertext encryption key will be performed inside the hardware cryptographic module. The resulting random symmetric key will be directly transferred from the hardware cryptographic module to the memory of the trusted execution environment. In other words, the decryption and transmission operations of the ciphertext encryption key are both completed inside the secure processor, which is not visible to the outside world and will not be exposed to the system memory or storage of the all-in-one device. This physically eliminates the risk of the private key being stolen, thereby reducing the risk of the random symmetric key being leaked. Furthermore, it also reduces the risk of model data encrypted with the random symmetric key being leaked.

[0047] Step 38: In this trusted execution environment, the deployer uses a random symmetric key to decrypt the encrypted model data to obtain the model data of the industry-wide large model.

[0048] Step 39: The deployer uses the sealed key of the trusted execution environment to encrypt the model data, obtain the encrypted industry large model, and store it.

[0049] In this step, the generated encrypted industry model can be stored in an external storage medium outside the trusted execution environment.

[0050] The sealing key used in this step can be generated based on the environment information of the trusted execution environment and the hardware root of trust (RoT) of the security processor of the all-in-one device. The sealing key corresponds one-to-one with the trusted execution environment, that is, the sealing key is different for different trusted execution environments.

[0051] Trusted Execution Environments (TEEs) feature memory encryption, kernel isolation, and protection against administrator access. Therefore, the encryption of model data using a sealing key in this step can be done within the memory corresponding to the TEE. Different TEEs correspond to different memory locations, thereby further enhancing the security of the model data.

[0052] Through steps 36 to 39 above, the second stage of the industry large-scale model deployment is completed. In the trusted execution environment, the encrypted model data is decrypted and re-encrypted to obtain the encrypted industry large-scale model. This achieves the binding between the encrypted industry large-scale model and the trusted execution environment. In essence, it is equivalent to switching the encryption key of the industry large-scale model data from the private key of the original hardware cryptographic module to the sealed key of the trusted execution environment. This can effectively prevent the leakage of the model data of the industry large-scale model, improve the security of the industry large-scale model deployment, and at the same time, provide a foundation for the more secure operation of the industry large-scale model in the trusted execution environment in the future.

[0053] When other trusted execution environments of this all-in-one device need to deploy large-scale industry models, the above-mentioned methods can be used. Figure 3 The deployment process is shown. After the deployment is complete, the deployer can delete the public and private keys generated by the hardware cryptographic module, as well as the encrypted encryption key and encrypted model data from the model holder device, through message interaction with the hardware cryptographic module.

[0054] Accordingly, this application also provides a method for running an industry-wide large-scale model, applied to a runner in a trusted execution environment of an all-in-one device deploying an industry-wide large-scale model. The all-in-one device stores an encrypted industry-wide large-scale model, which is obtained by encrypting the model data of the industry-wide large-scale model using a sealing key of the trusted execution environment, such as... Figure 2 and Figure 4 As shown, the method includes: Step 41: In the Trusted Execution Environment (TEE), generate the TEE's sealing key; Step 42: Decrypt the encrypted industry model using the sealing key to obtain the model data of the industry model; Step 43: Run the industry-wide model based on the model data of the industry-wide model.

[0055] The industry-wide model operation method provided in this application, for an encrypted industry-wide model deployed in conjunction with a trusted execution environment (TEX) of an all-in-one device, involves a runner within the TEX generating a sealing key for the TEX, using the sealing key to decrypt the encrypted industry-wide model, obtaining the model data, and then running the industry-wide model based on this model data. During the above process of running the industry-wide model, the encrypted industry-wide model is decrypted and run within the TEX, effectively preventing the leakage of the model data and improving the security of the industry-wide model operation.

[0056] Furthermore, in one embodiment of this application, regarding step 41 above, a sealing key for the trusted execution environment is generated in the trusted execution environment. Corresponding to the method of generating the sealing key in the above-mentioned industry large-scale model deployment method, the sealing key for the trusted execution environment can be generated in the trusted execution environment based on the environment information of the trusted execution environment and the hardware trusted root of the security processor of the all-in-one device. The generated sealing key corresponds one-to-one with the trusted execution environment.

[0057] In practical applications, after the trusted execution environment is shut down and restarted, when the industry-wide model needs to be run, a sealing key for the trusted execution environment must first be generated, and the encrypted industry-wide model must be decrypted to obtain the model data. If the trusted execution environment is tampered with, the sealing key generated based on the environment information of the tampered trusted execution environment will also change. It will be different from the sealing key used when the encrypted industry-wide model was encrypted, and the newly generated sealing key cannot be used to successfully decrypt the encrypted industry-wide model, further improving the security of the model data during the operation of the industry-wide model.

[0058] Using the industry large model deployment and operation method provided in the embodiments of this application, the model data is transmitted from the model holder device to the all-in-one device to be deployed in encrypted form. The decryption and re-encryption operations are completed in the trusted execution environment of the all-in-one device. No plaintext data is stored on disk. Moreover, the encryption key used for re-encryption is a sealed key that corresponds one-to-one with the trusted execution environment. The sealed key is permanently stored in the hardware and will not be exposed to the outside world, thereby effectively preventing the leakage of model data.

[0059] Furthermore, during the deployment and operation of the industry-wide model, the model data is stored securely on disk and only loaded into the trusted execution environment at runtime, where it is decrypted into plaintext for inference calculations. The trusted execution environment features an independent Guest OS kernel, runtime memory encryption, and inaccessibility to administrators, thus ensuring that the model data is usable but not visible to the model users, protecting the intellectual property rights of the industry model generators.

[0060] After binding the encrypted industry model to the deployed trusted execution environment with a hardware key (sealing key), only the trusted execution environment can decrypt the encrypted industry model. If the trusted execution environment is tampered with, it will be impossible to decrypt the encrypted industry model. Furthermore, malware and system administrators of all-in-one devices will not be able to steal the model data of the industry model, further improving the security of the model data.

[0061] Based on the same inventive concept, and according to the industry large-scale model deployment method provided in the above embodiments of this application, another embodiment of this application also provides an industry large-scale model deployment device, which is applied to a deployer in the trusted execution environment of an all-in-one device to which an industry large-scale model is to be deployed. The all-in-one device also has a hardware cryptographic module, the structural diagram of which is shown below. Figure 5 As shown, it specifically includes: The data acquisition module 51 is used to acquire the private key handle, ciphertext encryption key, and ciphertext model data of the hardware cryptographic module in the trusted execution environment. The ciphertext encryption key and the ciphertext model data are received by the hardware cryptographic module and come from the model holder device. The ciphertext encryption key is obtained by the model holder device encrypting a random symmetric key generated by the model holder device using the public key from the hardware cryptographic module. The ciphertext model data is obtained by the model holder device encrypting the model data of the industry large model using the random symmetric key. The private key handle represents a private key generated by the hardware cryptographic module and corresponds to the public key. The key decryption module 52 is used to decrypt the ciphertext encryption key using the private key handle through message interaction with the hardware cryptographic module, so as to obtain the random symmetric key generated by the model holder device. Data decryption module 53 is used to decrypt the ciphertext model data using the random symmetric key to obtain the model data of the industry big model; The data encryption module 54 is used to encrypt the model data using the sealing key of the trusted execution environment to obtain a encrypted industry large model and store it.

[0062] Furthermore, the sealing key is generated based on the environment information of the trusted execution environment and the hardware root of trust of the security processor of the all-in-one device; The sealing key corresponds one-to-one with the trusted execution environment.

[0063] Furthermore, the data encryption module 54 is also used to delete the public key and the private key generated by the hardware cryptographic module through message interaction with the hardware cryptographic module.

[0064] Based on the same inventive concept, and according to the industry large-scale model running method provided in the above embodiments of this application, another embodiment of this application also provides an industry large-scale model running device, applied to a runner in a trusted execution environment of an all-in-one device deploying an industry large-scale model. The all-in-one device stores a encrypted industry large-scale model, which is obtained by encrypting the model data of the industry large-scale model using a sealing key of the trusted execution environment. Its structural schematic diagram is shown below. Figure 6 As shown, it specifically includes: The sealing key generation module 61 is used to generate a sealing key for the trusted execution environment in the trusted execution environment. Large model decryption module 62 is used to decrypt the encrypted industry large model using the sealing key to obtain the model data of the industry large model; Large model running module 63 is used to run the industry large model based on the model data of the industry large model.

[0065] Furthermore, the sealing key generation module 61 is specifically used to generate a sealing key for the trusted execution environment based on the environment information of the trusted execution environment and the hardware root of trust of the security processor of the all-in-one device, and the generated sealing key corresponds one-to-one with the trusted execution environment.

[0066] The functions of the above modules can be corresponding to Figures 1 to 4 The corresponding processing steps in the process shown will not be repeated here.

[0067] The industry large-scale model deployment device and industry large-scale model operation device provided in the embodiments of this application can be implemented by computer programs. Those skilled in the art should understand that the above-described module division method is only one of many module division methods. If it is divided into other modules or not divided into modules, as long as the industry large-scale model deployment device and industry large-scale model operation device have the above-described functions, they should all be within the protection scope of this application.

[0068] Accordingly, embodiments of this application also provide an all-in-one device, such as... Figure 2 As shown, it includes: the deployer and the hardware cryptographic module in any of the above-described industry large-scale model deployment methods, and the runner in any of the above-described industry large-scale model operation methods.

[0069] Furthermore, the all-in-one device has multiple trusted execution environments, each containing the deployer and the runner.

[0070] This application also provides an electronic device, such as... Figure 7 As shown, it includes a processor 71 and a machine-readable storage medium 72, the machine-readable storage medium 72 storing machine-executable instructions that can be executed by the processor 71, the processor 71 being prompted by the machine-executable instructions to: implement any of the above-described industry large-scale model deployment methods, or implement any of the above-described industry large-scale model operation methods.

[0071] This application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements either the industry large-scale model deployment method or the industry large-scale model operation method described above.

[0072] This application also provides a computer program product containing instructions that, when run on a computer, cause the computer to execute any of the above-described industry large-scale model deployment methods, or to execute any of the above-described industry large-scale model operation methods.

[0073] The machine-readable storage medium in the aforementioned electronic device may include random access memory (RAM) or non-volatile memory (NVM), such as at least one disk storage device. Optionally, the memory may also be at least one storage device located remotely from the aforementioned processor.

[0074] The processors mentioned above can be general-purpose processors, including central processing units (CPUs), network processors (NPs), etc.; they can also be digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0075] The various embodiments in this specification are described in a related manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, for embodiments of devices, all-in-one machines, electronic devices, computer-readable storage media, and computer program products, since they are basically similar to the method embodiments, the descriptions are relatively simple, and relevant parts can be referred to the descriptions of the method embodiments.

[0076] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0077] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1A device that provides the functions specified in one or more boxes.

[0078] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0079] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0080] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A method for deploying a large-scale industry model, characterized in that, A deployer applied to a trusted execution environment of an all-in-one appliance device for deploying large-scale industry models, the all-in-one appliance device further having a hardware cryptographic module, the method comprising: In the trusted execution environment, the private key handle, ciphertext encryption key, and ciphertext model data of the hardware cryptographic module are obtained. The ciphertext encryption key and the ciphertext model data are received by the hardware cryptographic module and come from the model holder device. The ciphertext encryption key is obtained by the model holder device using the public key from the hardware cryptographic module to encrypt a random symmetric key generated by the model holder device. The ciphertext model data is obtained by the model holder device using the random symmetric key to encrypt the model data of the industry large model. The private key handle represents a private key generated by the hardware cryptographic module and corresponds to the public key. Through message interaction with the hardware cryptographic module, the ciphertext encryption key is decrypted using the private key handle to obtain the random symmetric key generated by the model holder device. The private key generated by the hardware cryptographic module will only exist in the hardware cryptographic module. The decryption operation of the ciphertext encryption key is performed inside the hardware cryptographic module. The decrypted random symmetric key is directly transferred from the hardware cryptographic module to the memory of the trusted execution environment. The encrypted model data is decrypted using the random symmetric key to obtain the model data of the industry-wide model; Using the sealing key of the Trusted Execution Environment (TEE), the model data is encrypted in the memory of the TEE to obtain a ciphertext industry large model, which is then stored in an external storage medium outside the TEE. The sealing key is generated based on the environment information of the TEE and the hardware root of trust of the security processor of the all-in-one device. The sealing key corresponds one-to-one with the TEE. The sealing key of the TEE remains unchanged after the TEE is shut down and restarted. Different TEEs correspond to different memory.

2. The method as described in claim 1, characterized in that, Also includes: The public key and the private key generated by the hardware cryptographic module are deleted through message interaction with the hardware cryptographic module.

3. A method for operating a large-scale industry model, characterized in that, An application is provided for a runner in a trusted execution environment (TEX) of an all-in-one device deploying an industry-wide model. The TEX stores an encrypted industry-wide model in an external storage medium outside the TEX. This encrypted industry-wide model is obtained by encrypting model data within the TEX's memory using a sealing key from the TEX. The sealing key of the TEX remains unchanged after the TEX is shut down and restarted. Different TEXs correspond to different memory locations. The method includes: In the trusted execution environment, a sealing key for the trusted execution environment is generated based on the environment information of the trusted execution environment and the hardware trusted root of the security processor of the all-in-one device. The generated sealing key corresponds one-to-one with the trusted execution environment. The encrypted industry model is decrypted using the sealing key to obtain the model data of the industry model. The industry-wide model is run based on the model data of the industry-wide model.

4. An industry-wide large-scale model deployment device, characterized in that, A deployer for a trusted execution environment of an all-in-one appliance device to be deployed on a large-scale industry model, the all-in-one appliance device also having a hardware cryptographic module, the device comprising: The data acquisition module is used to acquire the private key handle, ciphertext encryption key, and ciphertext model data of the hardware cryptographic module in the trusted execution environment. The ciphertext encryption key and the ciphertext model data are received by the hardware cryptographic module and come from the model holder device. The ciphertext encryption key is obtained by the model holder device encrypting a random symmetric key generated by the model holder device using the public key from the hardware cryptographic module. The ciphertext model data is obtained by the model holder device encrypting the model data of the industry large model using the random symmetric key. The private key handle represents a private key generated by the hardware cryptographic module and corresponds to the public key. The key decryption module is used to decrypt the ciphertext encryption key using the private key handle through message interaction with the hardware cryptographic module to obtain the random symmetric key generated by the model holder device. The private key generated by the hardware cryptographic module will only exist in the hardware cryptographic module. The decryption operation of the ciphertext encryption key is performed inside the hardware cryptographic module. The decrypted random symmetric key is directly transferred from the hardware cryptographic module to the memory of the trusted execution environment. The data decryption module is used to decrypt the ciphertext model data using the random symmetric key to obtain the model data of the industry big model; The data encryption module is used to encrypt the model data in the memory of the trusted execution environment using the sealing key of the trusted execution environment, to obtain a encrypted industry large model, and store it in an external storage medium outside the trusted execution environment. The sealing key is generated based on the environment information of the trusted execution environment and the hardware root of trust of the security processor of the all-in-one device. The sealing key corresponds one-to-one with the trusted execution environment. The sealing key of the trusted execution environment remains unchanged after the trusted execution environment is shut down and restarted. Different trusted execution environments correspond to different memory.

5. A large-scale industrial model operating device, characterized in that, An operator is applied to a trusted execution environment (TEX) of an all-in-one device deploying an industry-wide model. The TEX of the all-in-one device stores an encrypted industry-wide model in an external storage medium outside the TEX. The encrypted industry-wide model is obtained by encrypting model data of the industry-wide model in the memory of the TEX using a sealing key from the TEX. The sealing key of the TEX remains unchanged after the TEX is shut down and restarted. Different TEXs correspond to different memory locations. The device includes: A sealing key generation module is used to generate a sealing key for the trusted execution environment based on the environment information of the trusted execution environment and the hardware root of trust of the security processor of the all-in-one device, wherein the generated sealing key corresponds one-to-one with the trusted execution environment. The large model decryption module is used to decrypt the encrypted industry large model using the sealing key to obtain the model data of the industry large model; The large model running module is used to run the industry large model based on the model data of the industry large model.

6. An all-in-one machine, characterized in that, include: The deployer and the hardware cryptographic module in the method of any one of claims 1-2, and the runner in the method of claim 3.

7. The all-in-one machine as described in claim 6, characterized in that, The all-in-one device has multiple trusted execution environments, each of which contains the deployer and the runner.

8. An electronic device, characterized in that, The device includes a processor and a machine-readable storage medium storing machine-executable instructions that can be executed by the processor, the processor being prompted by the machine-executable instructions to: implement the method of any one of claims 1-2, or implement the method of claim 3.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the method of any one of claims 1-2, or implements the method of claim 3.

Images