Key value caching method and device for model reasoning, medium, equipment and product

Abstract

The invention discloses a key value caching method and device for model reasoning, a medium, equipment and a product. The method comprises the following steps executed in a first trusted execution environment: obtaining first key value data generated when a first model performs reasoning based on a first input request; encrypting the first key value data based on a first key to obtain first key value encrypted data; and sending the first key value encrypted data to a key value sharing cache library outside the first trusted execution environment. The key value data generated in the model reasoning process is encrypted, the corresponding encrypted data is obtained and then stored in the key value sharing cache library outside the trusted execution environment, the confidentiality and integrity of the key value data are effectively guaranteed, the data leakage risk is reduced, the storage resource occupation in the trusted execution environment can be reduced, and the reliability of the trusted execution environment is improved. And the model reasoning performance is ensured.

Description

Technical Field

[0001] This disclosure relates to the field of model technology, and more specifically, to a key-value caching method, apparatus, medium, device, and product for model reasoning. Background Technology

[0002] Running model inference within a Trusted Execution Environment (TEE) ensures the security of core computation. The key-value cache (KV cache) generated during model inference becomes crucial for improving model inference speed.

[0003] In related technologies, storing the key-value cache within a trusted execution environment will consume storage resources within that environment, thereby reducing model inference performance. Summary of the Invention

[0004] This summary section is provided to briefly introduce the concepts, which will be described in detail in the detailed description section below. This summary section is not intended to identify key or essential features of the claimed technical solution, nor is it intended to limit the scope of the claimed technical solution.

[0005] In a first aspect, this disclosure provides a key-value caching method for model inference, the method comprising the following steps performed in a first trusted execution environment: Obtain the first key-value data generated when the first model performs inference based on the first input request; The first key-value data is encrypted using the first key to obtain encrypted first key-value data; The first key-value encrypted data is sent to a key-value shared cache outside the first trusted execution environment.

[0006] Secondly, this disclosure provides a key-value caching device for model inference, the device comprising the following modules operating in a first trusted execution environment: The acquisition module is used to acquire the first key-value data generated when the first model performs inference based on the first input request; An encryption module is used to encrypt the first key-value data based on a first key to obtain encrypted first key-value data; The sending module is used to send the first key-value encrypted data to a key-value shared cache library outside the first trusted execution environment.

[0007] Thirdly, this disclosure provides a computer-readable medium having a computer program stored thereon, which, when executed by a processing device, implements the steps of the method described in the first aspect.

[0008] Fourthly, this disclosure provides an electronic device, comprising: A storage device on which computer programs are stored; A processing device for executing the computer program in the storage device to implement the steps of the method in the first aspect.

[0009] Fifthly, this disclosure provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the method described in the first aspect.

[0010] The above technical solution involves acquiring the first key-value data generated during inference by the first model based on the first input request within a trusted execution environment. This first key-value data is then encrypted using a first key to obtain encrypted first key-value data, which is then sent to a shared key-value cache outside the trusted execution environment. By encrypting the key-value data generated during model inference and storing the corresponding encrypted data in a shared key-value cache outside the trusted execution environment, the confidentiality and integrity of the key-value data are effectively guaranteed, reducing the risk of data leakage. Furthermore, it reduces the storage resource consumption within the trusted execution environment, thereby ensuring model inference performance.

[0011] Other features and advantages of this disclosure will be described in detail in the following detailed description section. Attached Figure Description

[0012] The above and other features, advantages, and aspects of the embodiments of this disclosure will become more apparent from the accompanying drawings and the following detailed description. Throughout the drawings, the same or similar reference numerals denote the same or similar elements. It should be understood that the drawings are schematic, and the originals and elements are not necessarily drawn to scale. In the drawings: Figure 1 This is a flowchart illustrating a key-value caching method for model inference according to an exemplary embodiment.

[0013] Figure 2 This is a schematic diagram illustrating an encryption process for a key-value cache according to an exemplary embodiment.

[0014] Figure 3 This is a schematic diagram illustrating a block encryption process for a key-value cache according to an exemplary embodiment.

[0015] Figure 4 This is a schematic diagram illustrating the decryption process of a key-value cache according to an exemplary embodiment.

[0016] Figure 5 This is a schematic diagram illustrating a model interaction process according to an exemplary embodiment.

[0017] Figure 6 This is a schematic diagram illustrating the structure of a key-value caching device for model inference according to an exemplary embodiment.

[0018] Figure 7 This is a schematic diagram of the structure of an electronic device according to an exemplary embodiment. Detailed Implementation

[0019] Embodiments of this disclosure will now be described in more detail with reference to the accompanying drawings. While some embodiments of this disclosure are shown in the drawings, it should be understood that this disclosure can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of this disclosure. It should be understood that the accompanying drawings and embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of protection of this disclosure.

[0020] It should be understood that the steps described in the method embodiments of this disclosure may be performed in different orders and / or in parallel. Furthermore, the method embodiments may include additional steps and / or omit the steps shown. The scope of this disclosure is not limited in this respect.

[0021] The term "comprising" and its variations as used herein are open-ended inclusions, meaning "including but not limited to". The term "based on" means "at least partially based on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". Definitions of other terms will be given in the description below.

[0022] It should be noted that the concepts of "first" and "second" mentioned in this disclosure are used only to distinguish different devices, modules or units, and are not used to limit the order of functions performed by these devices, modules or units or their interdependencies.

[0023] It should be noted that the terms "a" and "a plurality of" used in this disclosure are illustrative rather than restrictive, and those skilled in the art should understand that, unless otherwise expressly indicated in the context, they should be understood as "one or more".

[0024] The names of messages or information exchanged between multiple devices in the embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of such messages or information.

[0025] It is understood that before using the technical solutions disclosed in the various embodiments of this disclosure, users should be informed of the types, scope of use, and usage scenarios of the personal information involved in this disclosure in an appropriate manner in accordance with relevant laws and regulations, and user authorization should be obtained.

[0026] For example, upon receiving a user's active request, a prompt message is sent to the user to explicitly inform them that the requested operation will require the acquisition and use of the user's personal information. This allows the user to independently choose whether to provide personal information to the software or hardware, such as the electronic device, application, server, or storage medium performing the operations of this disclosed technical solution, based on the prompt message.

[0027] As an optional but non-limiting implementation, in response to a user's active request, sending a prompt message to the user can be done via a pop-up window, where the prompt message can be presented in text format. Furthermore, the pop-up window can also include a selection control allowing the user to choose "agree" or "disagree" to provide personal information to the electronic device.

[0028] It is understood that the above notification and user authorization process are merely illustrative and do not constitute a limitation on the implementation of this disclosure. Other methods that comply with relevant laws and regulations may also be applied to the implementation of this disclosure.

[0029] Meanwhile, it is understood that the data involved in this technical solution (including but not limited to the data itself, the acquisition or use of the data) shall comply with the requirements of relevant laws, regulations and related provisions.

[0030] With the large-scale deployment of Large Language Models (LLMs) in the cloud, key-value (KV) caching generated during the inference process has become crucial for improving inference speed. This involves caching the key and value vectors of tokens already computed during inference to avoid redundant attention calculations in subsequent token generation; this is known as KV cache sharing technology. To provide higher request-per-minute (RPM) processing capabilities and lower time-to-first-token (TTFT) latency, cloud service providers typically employ KV cache sharing technology. This involves caching the intermediate KV values ​​generated from processed input tokens during model inference and reusing the cached KV values ​​in subsequent token processing. This "store-based computation" approach reduces redundant computation, significantly improving inference performance.

[0031] In related technologies, two common modes are local KV caching and external KV caching. Local KV caching, where the cache is stored within the TEE (Trusted Execution Environment), ensures the confidentiality and integrity of the KV cache, but its capacity is limited by available internal storage resources, becoming a performance bottleneck. External KV caching, while significantly improving capacity and system throughput, involves storing the KV cache outside the TEE's control in untrusted media (such as untrusted video memory, main memory, or shared cache pools). This compromises confidentiality and integrity; for example, plaintext KV caches may leak intermediate model features, user input, and context, posing a data leakage risk.

[0032] In view of this, the present disclosure provides a key-value caching method, apparatus, medium, device and product for model inference to solve the above-mentioned technical problems.

[0033] Figure 1 This is a flowchart illustrating a key-value caching method for model inference according to an exemplary embodiment. Figure 1 As shown, the method may include the following steps performed in the first trusted execution environment: S101: Obtain the first key-value data generated when the first model performs inference based on the first input request.

[0034] For example, the first model is a large language model, a multimodal model, or other model that requires autoregressive sequence generation; this disclosure does not impose any restrictions on this. Figure 2 As shown, the model inference process is an autoregressive process, during which a key-value cache corresponding to the input token is generated. The first key-value data is the plaintext form of the key-value cache generated by the model during the inference process of obtaining the output sequence based on the input sequence.

[0035] S102: Encrypt the first key-value data based on the first key to obtain the first key-value encrypted data.

[0036] For example, such as Figure 2 As shown, the first key-value encrypted data is the ciphertext form of the KV cache obtained by encrypting the KV cache in the form of encryption.

[0037] The first key is the key corresponding to the first model. This allows for the use of the key corresponding to the model to encrypt the key-value data of different models, thereby enabling multiple model owners to securely share the same key-value caching system and ensuring data isolation between different model owners, further improving data security and confidentiality.

[0038] S103: Send the first key-value encrypted data to the key-value shared cache outside the first trusted execution environment.

[0039] For example, such as Figure 2As shown, both the model inference module and the encryption module run within a trusted execution environment. The encrypted key-value cache is stored in an external key-value shared cache library (in an untrusted execution environment), and a corresponding index is created to facilitate the reuse of this key-value cache in subsequent model inference processes. The model inference module is the module that deploys the first model.

[0040] By encrypting the key-value data generated during model inference and storing the encrypted data in a key-value shared cache outside the trusted execution environment, the confidentiality and integrity of the key-value data are effectively guaranteed, the risk of data leakage is reduced, and the storage resource consumption within the trusted execution environment is reduced, thereby ensuring the performance of model inference.

[0041] In one possible manner, the method further includes the following steps performed in a first trusted execution environment: generating a second key for the first model in response to a key update operation on the first model; wherein the first key is used to encrypt and decrypt key-value data of the first model before the key update operation, and the second key is used to encrypt and decrypt key-value data of the first model after the key update operation.

[0042] In this embodiment, to ensure the security of KV cached data throughout its entire lifecycle, the keys corresponding to the model can be rotated periodically.

[0043] For example, a key update operation can be initiated by a security timer within the TEE environment to generate a new model key within the TEE. The historical KV cache is encrypted and marked using the old key; upon retrieval, it is automatically decrypted using the old key based on the marked key. The newly generated KV cache is encrypted and marked using the new key; upon retrieval, it is automatically decrypted using the new key based on the marked key, effectively performing parallel loading with dual keys. This limits the key exposure time window, reduces the impact of key leakage, and thus improves the security of the KV cache.

[0044] In one possible manner, the method further includes the following steps performed in a first trusted execution environment: after a preset time period, retrieving and decrypting second key-value encrypted data encrypted with a first key from a key-value shared cache to obtain second key-value data; encrypting the second key-value data with the second key to obtain third key-value encrypted data; storing the third key-value encrypted data in a key-value shared cache, deleting the second key-value encrypted data from the key-value shared cache, and cancelling the first key.

[0045] For example, a transition period between the old and new keys can be set, during which parallel loading of both keys is allowed. After the transition period, the historical KV cache can be deleted or re-encrypted with the new key as needed. Then, the old key is deregistered, the new key is retained, and all valid data in the key-value shared cache is encrypted with the new key, ensuring inference continuity and data security.

[0046] In one possible approach, encrypting the first key-value data based on the first key to obtain the first key-value encrypted data includes: dividing the first key-value data into blocks to obtain multiple data blocks; and encrypting the multiple data blocks in parallel using multiple threads based on the first key to obtain the first key-value encrypted data.

[0047] For example, such as Figure 2 As shown, key-value data can be divided into blocks according to a preset data length to obtain multiple data blocks (such as...). Figure 2 Each small square shown is then encrypted using a GPU (Graphics Processing Unit) parallel processing encryption module, thereby improving the encryption efficiency of the KV cache.

[0048] For example, such as Figure 3 As shown, a grid is the top-level organizational unit for GPU tasks. A grid contains x blocks and is responsible for managing the block-level allocation of the entire encryption task. A block is the next level unit of the grid, containing y threads. Threads within a block can share memory and are used to collaboratively process parts of the encryption task. A thread is the smallest execution unit for GPU parallel computing. Each thread has an independent index, and a single thread enters a loop within itself, processing multiple data blocks allocated to that thread to ensure that computing power is fully utilized.

[0049] In one possible approach, multiple threads encrypt multiple data blocks in parallel based on a first key to obtain first key-value encrypted data. This includes: each thread repeatedly executing the following steps until all data blocks are encrypted, and obtaining first key-value encrypted data based on the encrypted data blocks: obtaining a first data block; wherein the first data block is an unencrypted data block among the multiple data blocks; determining a first key stream corresponding to the first data block based on the first key, and encrypting the first data block based on the first key stream to obtain the encrypted first encrypted data block.

[0050] For example, after each thread starts, it determines the plaintext data block it is currently responsible for, then determines the corresponding keystream based on the model key, and performs an XOR operation between the generated keystream and the plaintext data block to obtain the ciphertext encrypted data block. Here, data boundaries can be checked when writing the ciphertext; that is, when processing incomplete blocks at the end, only the valid part is encrypted. If there are still unprocessed data blocks, the above process is repeated until all data blocks are processed, at which point the thread terminates. This can be done by allocating data blocks to each thread first, or by having a thread finish encrypting a data block before acquiring a new unencrypted data block; this disclosure does not impose any restrictions on this. This allows the parallel computing capabilities of the GPU to be utilized to improve the encryption efficiency of the KV cache.

[0051] In one possible approach, determining the first key stream corresponding to the first data block based on the first key includes: obtaining an initial vector from shared memory corresponding to multiple threads; determining a first counter value corresponding to the first data block based on the initial vector and the first sequence number of the first data block; wherein the first sequence number represents the order of the first data block among multiple data blocks; and generating the first key stream corresponding to the first data block based on the first counter value and the first key.

[0052] For example, after a thread starts, it reads the initialization vector (IV) from the GPU shared memory and uses it as the base value for a counter. Then, it increments the counter value based on the sequence number or ID of the currently managed data block, ensuring that each data block corresponds to a unique counter value and avoiding keystream duplication. The keystream is a pseudo-random bit sequence of the same length as the plaintext. A bit-by-bit XOR operation is performed between the plaintext bits and the keystream bits to obtain the corresponding ciphertext. During decryption, the same key is used to generate an identical keystream, which is then XORed again with the ciphertext to recover the plaintext.

[0053] For example, a keystream can be generated based on a preset encryption algorithm, such as AES (Advanced Encryption Standard), and this disclosure does not impose any restrictions on it. AES block encryption is performed on the counter value corresponding to the currently managed data block. First, a basic encryption transformation is completed through nine rounds of "byte substitution (data obfuscation), row shifting (data diffusion), column mixing (enhancing byte correlation), and round key addition (incorporating model keys)." Finally, a final round of "byte substitution, row shifting, and round key addition" (removing column mixing to simplify decryption) generates the corresponding keystream. The specific keystream can be determined based on the selected encryption algorithm, and this disclosure does not impose any restrictions on it. Encrypting the KV cache through the keystream has low computational overhead and can improve encryption efficiency and real-time performance.

[0054] In one possible manner, the method further includes the following steps performed in a first trusted execution environment: in response to reusing the first key-value data when the first model performs inference based on the second input request, obtaining the first key-value encrypted data from a key-value shared cache outside the first trusted execution environment; and decrypting the first key-value encrypted data based on the first key to obtain the first key-value data.

[0055] For example, such as Figure 4 As shown, during model inference, if a reusable key-value (KV) cache is determined to exist in the input sequence, the encrypted KV cache can be obtained from the key-value shared cache library and then decrypted. Encryption protection of the transmission and storage of the KV cache effectively prevents data leakage and enhances the overall security of the system. For a single model service, service capacity is increased, while TTFT is significantly reduced and RPM is improved, thereby enhancing overall inference efficiency.

[0056] In one possible approach, the first key-value encrypted data includes multiple encrypted data blocks; decrypting the first key-value encrypted data based on a first key to obtain the first key-value data includes: repeatedly executing the following steps by each of multiple threads until all encrypted data blocks are decrypted, and obtaining the first key-value data based on the decrypted data blocks: obtaining an initial vector from the shared memory corresponding to the multiple threads, and obtaining an encrypted second data block; wherein the encrypted second data block is the undecrypted data block among the encrypted data blocks; determining a second count value corresponding to the encrypted second data block based on the initial vector and the second sequence number of the encrypted second data block; wherein the second sequence number represents the order of the encrypted second data block among the encrypted data blocks; determining a second key stream corresponding to the encrypted second data block based on the first key and the second count value, and decrypting the encrypted second data block based on the second key stream to obtain the second data block.

[0057] For example, such as Figure 4 As shown, key-value data can be divided into blocks according to a preset data length to obtain multiple encrypted data blocks. These blocks can then be decrypted using a GPU-processed parallel decryption module, thereby improving the encryption efficiency of the KV cache. The decryption module and encryption module can be different modules or integrated into a single encryption / decryption module; this disclosure does not impose any restrictions on this. The decryption process is similar to the encryption process.

[0058] During encryption and decryption, the encrypted key-value data corresponding to the key-value data has the same length. By dividing the data into blocks of the same preset length, multiple data blocks correspond one-to-one with multiple encrypted data blocks; that is, the sequence number of the data block is also the same as the sequence number of the corresponding encrypted data block. Using the same initial vector, the keystream generated from the encrypted data block is also consistent with the keystream generated during encryption, thus enabling decryption. Decrypting the KV cache through the keystream has low computational overhead, improving decryption efficiency and real-time performance.

[0059] like Figure 5As shown, the key-value caching method in this embodiment can be applied to multi-tenant trusted model inference service scenarios, achieving the dual goals of high throughput and data security. First, the model owner hosts the model and private key (model key) to the confidential computing platform and deploys the model to the TEE environment of the confidential computing platform. The inference service connects to an external KV cache library. On the client side, users initiate multi-round session inference requests via the SDK (Software Development Kit), which can be encrypted using the session key, depending on the specific situation. The trusted model inference service receives the encrypted request from the client side, decrypts it using the session key, and obtains the plaintext prompt for model inference. In the model inference Prefill stage, it first checks whether the plaintext prompt already exists in the KV cache library: if not, it encrypts the KV cache generated in the Prefill stage using the model key and the GPU parallel encryption module, and then stores it in the external KV cache library; if it exists, it decrypts the retrieved encrypted KV cache using the GPU parallel decryption module and the model key, and continues with subsequent model inference. The model service encrypts all output tokens using a session key before responding to user requests. On the client side, the user decrypts the response using the session key to obtain the plaintext of the model response.

[0060] By leveraging parallel programming on GPUs to transform the serial nature of block cryptography into a highly parallel, memory-friendly, low-branch-overhead implementation and improve throughput, confidentiality protection of the KV cache during swapping and storage is achieved in confidential inference environments with controllable performance overhead. Furthermore, it allows multiple tenants to securely share the same KV cache system, ensuring data isolation and confidentiality, effectively increasing model inference service capacity, significantly reducing TTFT and improving RPM, thus enhancing overall inference efficiency.

[0061] Figure 6 This is a schematic diagram illustrating the structure of a key-value caching device for model inference according to an exemplary embodiment. Figure 6 As shown, the key-value caching device 600 for model inference includes the following modules that run in the first trusted execution environment: The acquisition module 601 is used to acquire the first key-value data generated when the first model performs inference based on the first input request; Encryption module 602 is used to encrypt the first key-value data based on the first key to obtain encrypted first key-value data; The sending module 603 is used to send the first key-value encrypted data to a key-value shared cache library outside the first trusted execution environment.

[0062] Optionally, the first key is a key corresponding to the first model.

[0063] Optionally, the encryption module 602 is used for: The first key-value data is divided into blocks to obtain multiple data blocks; The first key-value encrypted data is obtained by encrypting the multiple data blocks in parallel using the first key through multiple threads.

[0064] Optionally, the encryption module 602 is used for: The following steps are repeated in each of the multiple threads until all the multiple data blocks are encrypted, and the first key-value encrypted data is obtained based on the encrypted multiple data blocks: Obtain a first data block; wherein, the first data block is an unencrypted data block among the plurality of data blocks; Based on the first key, a first key stream corresponding to the first data block is determined, and the first data block is encrypted based on the first key stream to obtain an encrypted first data block.

[0065] Optionally, the encryption module 602 is used for: Obtain the initial vector from the shared memory corresponding to the multiple threads; Based on the initial vector and the first sequence number of the first data block, a first counter value corresponding to the first data block is determined; wherein, the first sequence number represents the order of the first data block in the plurality of data blocks; A first key stream corresponding to the first data block is generated based on the first counter value and the first key.

[0066] Optionally, the key-value caching device 600 for model inference further includes: The decryption module is configured to, in response to the first model performing inference based on the second input request, reuse the first key-value data, obtain the first key-value encrypted data from the key-value shared cache library outside the first trusted execution environment, and decrypt the first key-value encrypted data based on the first key to obtain the first key-value data.

[0067] Optionally, the first key-value encrypted data includes multiple encrypted data blocks; the decryption module is used for: The following steps are repeated in each of the multiple threads until all the encrypted data blocks are decrypted, and the first key-value data is obtained based on the decrypted data blocks: Obtain an initial vector from the shared memory corresponding to the multiple threads, and obtain an encrypted second data block; wherein, the encrypted second data block is the undecrypted data block among the multiple encrypted data blocks; Based on the initial vector and the second sequence number of the encrypted second data block, a second count value corresponding to the encrypted second data block is determined; wherein, the second sequence number represents the order of the encrypted second data block in the plurality of encrypted data blocks; The second key stream corresponding to the encrypted second data block is determined based on the first key and the second count value, and the encrypted second data block is decrypted based on the second key stream to obtain the second data block.

[0068] Optionally, the key-value caching device 600 for model inference further includes: An update module is used to generate a second key for the first model in response to a key update operation on the first model; wherein the first key is used to encrypt and decrypt the key-value data of the first model before the key update operation, and the second key is used to encrypt and decrypt the key-value data of the first model after the key update operation.

[0069] Optionally, the key-value caching device 600 for model inference further includes: The deregistration module is used to, after a preset time period, retrieve and decrypt second key-value encrypted data encrypted with the first key from the key-value shared cache library to obtain second key-value data; encrypt the second key-value data with the second key to obtain third key-value encrypted data; store the third key-value encrypted data in the key-value shared cache library; delete the second key-value encrypted data in the key-value shared cache library; and deregister the first key.

[0070] Regarding the key-value caching device for model inference in the above embodiments, the method logic executed by each functional module has been described in detail in the section on methods, and will not be repeated here.

[0071] Based on the same concept, embodiments of this disclosure also provide a computer-readable medium having a computer program stored thereon, which, when executed by a processing device, implements the steps of any of the above-described key-value caching methods for model inference.

[0072] Based on the same concept, this disclosure also provides an electronic device that may include: A storage device on which computer programs are stored; A processing device for executing a computer program in a storage device to implement the steps of any of the above-described key-value caching methods for model inference.

[0073] Based on the same concept, embodiments of this disclosure also provide a computer program product, including a computer program that, when executed by a processor, implements the steps of any of the key-value caching methods for model inference described above.

[0074] The following is for reference. Figure 7 The diagram illustrates a structural schematic of an electronic device 700 suitable for implementing embodiments of the present disclosure. Terminal devices in embodiments of the present disclosure may include, but are not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 7 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments disclosed herein.

[0075] like Figure 7 As shown, the electronic device 700 may include a processing unit (e.g., a central processing unit, a graphics processor, etc.) 701, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 702 or a program loaded from a storage device 708 into a random access memory (RAM) 703. The RAM 703 also stores various programs and data required for the operation of the electronic device 700. The processing unit 701, ROM 702, and RAM 703 are interconnected via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0076] Typically, the following devices can be connected to I / O interface 705: input devices 706 including, for example, touchscreens, touchpads, keyboards, mice, cameras, microphones, accelerometers, gyroscopes, etc.; output devices 707 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 708 including, for example, magnetic tapes, hard disks, etc.; and communication devices 709. Communication device 709 allows electronic device 700 to communicate wirelessly or wiredly with other devices to exchange data. Although Figure 7 An electronic device 700 with various devices is shown; however, it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed alternatively.

[0077] In particular, according to embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication device 709, or installed from storage device 708, or installed from ROM 702. When the computer program is executed by processing device 701, it performs the functions defined in the methods of embodiments of this disclosure.

[0078] It should be noted that the computer-readable medium described in this disclosure can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this disclosure, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this disclosure, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium can be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wires, optical fibers, RF (radio frequency), etc., or any suitable combination thereof.

[0079] In some implementations, communication can be conducted using any currently known or future-developed network protocol such as HTTP (Hypertext Transfer Protocol), and can be interconnected with digital data communication (e.g., communication networks) of any form or medium. Examples of communication networks include local area networks (“LANs”), wide area networks (“WANs”), the Internet (e.g., the Internet of Things), and end-to-end networks (e.g., ad hoc end-to-end networks), as well as any currently known or future-developed networks.

[0080] The aforementioned computer-readable medium may be included in the aforementioned electronic device; or it may exist independently and not assembled into the electronic device.

[0081] The aforementioned computer-readable medium carries one or more programs, which, when executed by the electronic device, cause the electronic device to: acquire first key-value data generated when the first model performs inference based on the first input request; encrypt the first key-value data based on the first key to obtain first key-value encrypted data; and send the first key-value encrypted data to a key-value shared cache outside the first trusted execution environment.

[0082] Computer program code for performing the operations of this disclosure can be written in one or more programming languages ​​or a combination thereof, including but not limited to object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0083] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0084] The modules described in the embodiments of this disclosure can be implemented in software or hardware. The names of the modules are not, in some cases, intended to limit the functionality of the module itself.

[0085] The functions described above in this document can be performed at least in part by one or more hardware logic components. For example, exemplary types of hardware logic components that can be used, without limitation, include: field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), system-on-a-chip (SoCs), complex programmable logic devices (CPLDs), and so on.

[0086] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0087] The above description is merely a preferred embodiment of this disclosure and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of this disclosure is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-described concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features disclosed in this disclosure that have similar functions.

[0088] Furthermore, while the operations are described in a specific order, this should not be construed as requiring these operations to be performed in the specific order shown or in a sequential order. In certain environments, multitasking and parallel processing may be advantageous. Similarly, while several specific implementation details are included in the above discussion, these should not be construed as limiting the scope of this disclosure. Certain features described in the context of individual embodiments may also be implemented in combination in a single embodiment. Conversely, various features described in the context of a single embodiment may also be implemented individually or in any suitable sub-combination in multiple embodiments.

[0089] Although the subject matter has been described using language specific to structural features and / or methodological logic, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. Rather, the specific features and actions described above are merely illustrative forms of implementing the claims. Regarding the apparatus in the above embodiments, the specific manner in which the various modules perform their operations has been described in detail in the embodiments relating to the method, and will not be elaborated upon here.

Claims

1. A key-value caching method for model inference, characterized in that, The method includes the following steps performed in a first trusted execution environment: Obtain the first key-value data generated when the first model performs inference based on the first input request; The first key-value data is encrypted using the first key to obtain encrypted first key-value data; The first key-value encrypted data is sent to a key-value shared cache outside the first trusted execution environment.

2. The method according to claim 1, characterized in that, The first key is the key corresponding to the first model.

3. The method according to claim 1, characterized in that, The step of encrypting the first key-value data based on the first key to obtain the first key-value encrypted data includes: The first key-value data is divided into blocks to obtain multiple data blocks; The first key-value encrypted data is obtained by encrypting the multiple data blocks in parallel using the first key through multiple threads.

4. The method according to claim 3, characterized in that, The step of encrypting the multiple data blocks in parallel using multiple threads based on the first key to obtain the first key-value encrypted data includes: The following steps are repeated in each of the multiple threads until all the multiple data blocks are encrypted, and the first key-value encrypted data is obtained based on the encrypted multiple data blocks: Obtain a first data block; wherein, the first data block is an unencrypted data block among the plurality of data blocks; Based on the first key, a first key stream corresponding to the first data block is determined, and the first data block is encrypted based on the first key stream to obtain an encrypted first data block.

5. The method according to claim 4, characterized in that, Determining the first key stream corresponding to the first data block based on the first key includes: Obtain the initial vector from the shared memory corresponding to the multiple threads; Based on the initial vector and the first sequence number of the first data block, a first counter value corresponding to the first data block is determined; wherein, the first sequence number represents the order of the first data block in the plurality of data blocks; A first key stream corresponding to the first data block is generated based on the first counter value and the first key.

6. The method according to any one of claims 1-5, characterized in that, The method further includes the following steps performed in the first trusted execution environment: In response to reusing the first key-value data when the first model performs inference based on the second input request, the first key-value encrypted data is obtained from the key-value shared cache outside the first trusted execution environment; The first key-value encrypted data is decrypted based on the first key to obtain the first key-value data.

7. The method according to claim 6, characterized in that, The first key-value encrypted data includes multiple encrypted data blocks; the step of decrypting the first key-value encrypted data based on the first key to obtain the first key-value data includes: The following steps are repeated in each of the multiple threads until all the encrypted data blocks are decrypted, and the first key-value data is obtained based on the decrypted data blocks: Obtain an initial vector from the shared memory corresponding to the multiple threads, and obtain an encrypted second data block; wherein, the encrypted second data block is the undecrypted data block among the multiple encrypted data blocks; Based on the initial vector and the second sequence number of the encrypted second data block, a second count value corresponding to the encrypted second data block is determined; wherein, the second sequence number represents the order of the encrypted second data block in the plurality of encrypted data blocks; The second key stream corresponding to the encrypted second data block is determined based on the first key and the second count value, and the encrypted second data block is decrypted based on the second key stream to obtain the second data block.

8. The method according to any one of claims 1-5, characterized in that, The method further includes the following steps performed in the first trusted execution environment: In response to the key update operation on the first model, a second key for the first model is generated; Wherein, the first key is used to encrypt and decrypt the key-value data of the first model before the key update operation, and the second key is used to encrypt and decrypt the key-value data of the first model after the key update operation.

9. The method according to claim 8, characterized in that, The method further includes the following steps performed in the first trusted execution environment: After a preset time period, the second key-value encrypted data, encrypted based on the first key, is retrieved from the key-value shared cache library and decrypted to obtain the second key-value data; The second key-value data is encrypted using the second key to obtain the third key-value encrypted data; The third key-value encrypted data is stored in the key-value shared cache library, the second key-value encrypted data is deleted from the key-value shared cache library, and the first key is deregistered.

10. A key-value caching device for model inference, characterized in that, The device includes the following modules that run in a first trusted execution environment: The acquisition module is used to acquire the first key-value data generated when the first model performs inference based on the first input request; An encryption module is used to encrypt the first key-value data based on a first key to obtain encrypted first key-value data; The sending module is used to send the first key-value encrypted data to a key-value shared cache library outside the first trusted execution environment.

11. A computer-readable medium having a computer program stored thereon, characterized in that, When executed by a processing device, the computer program performs the steps of the method according to any one of claims 1-9.

12. An electronic device, characterized in that, include: A storage device on which computer programs are stored; A processing device for executing the computer program in the storage device to implement the steps of the method according to any one of claims 1-9.

13. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1-9.

Images