Large model weight encryption and decryption method and system based on AGE encryption tool, medium, terminal and program product

Abstract

The invention provides a large model weight encryption and decryption method and system based on an AGE encryption tool, a medium, a terminal and a program product, and the method comprises the steps: generating a key pair based on the AGE encryption tool, and carrying out the management of the generated key pair based on a preset authority management mechanism; segmenting the to-be-encrypted large model weight file according to a preset granularity to obtain a plurality of data segments; encrypting the plurality of data segments according to the public key; decrypting the plurality of encrypted data segments packed in the container according to the private key; transmitting the decrypted data file to a model loading framework based on a memory intermediary mechanism; and recording related parameters in the whole process of the decryption operation, and triggering a security protection mechanism according to the recorded related parameters. According to the method and the device, when the encryption protection of the super-large scale model weight file is carried out, the encryption processing efficiency is improved, the authority management key pair is refined, and plaintext disk falling, auditing in the decryption process and collaboration with a containerized environment are avoided.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence technology, and in particular to a large model weighted encryption and decryption method, system, medium, terminal and program product based on the AGE encryption tool. Background Technology

[0002] With the widespread application of large-scale pre-trained models (LLMs) in natural language processing, data generation, intelligent customer service, and industry models, large model weight files are increasingly characterized by large parameter scale, enormous size (often tens to hundreds of GB), and complex deployment scenarios. Model files typically contain a company's core algorithm assets and training results, possessing extremely high commercial value. Illegal copying, leakage, or misappropriation will cause incalculable economic losses and security risks to the model provider. Therefore, providing strong encryption protection for large model weight files and ensuring secure and controllable decryption and use during actual deployment has become a crucial industry requirement.

[0003] Existing encryption methods for large model files mainly include symmetric encryption (such as AES) and asymmetric encryption (such as RSA, ECC, etc.). While these methods can protect model data to some extent, they have the following drawbacks in large file encryption scenarios: (1) Insufficient processing efficiency for large-scale weights: Traditional encryption algorithms are mostly used for small and medium-sized files. When using overall encryption for model weights of tens of GB, problems such as long encryption time, large memory overhead, and lack of support for streaming operations will occur, which is not conducive to rapid delivery in the model deployment process; (2) Difficulty in key management: Deployment environments are increasingly adopting containerized and microservice architectures, but the key distribution of traditional encryption systems often relies on manual configuration or static files, which is not convenient for implementing fine-grained permission management in distributed environments such as Kubernetes, and cannot dynamically control "different users, different services, and different nodes"; (3) High risk of exposure during model decryption: Some existing solutions require the model to be decrypted to the local disk on the business node before being loaded by the framework, which will result in "plaintext model temporarily being stored on disk", increasing the attack surface of model leakage; (4) Lack of traceable mechanism: Traditional solutions generally do not record the decryption behavior of model files, making it difficult to trace "who decrypted the model at what time and in what way", leaving gaps in auditing and security compliance.

[0004] Furthermore, as model inference services migrate to Kubernetes and cloud-native architectures, loading model files typically requires a combination of mechanisms, including shared storage, mount points, container lifecycle hooks, and node resource scheduling. During the deployment and loading of encrypted model files, ensuring that containers automatically, securely, and seamlessly decrypt them upon startup, while maintaining seamless integration with existing inference frameworks and loading processes, remains a challenging technical problem in the industry. While some open-source projects (such as SOPs) have been developed in recent years to support the encryption of structured files, offering advantages such as simplicity, modernity, and clear key models, these tools were initially designed for encrypting small text files and configuration files. They lack specific optimizations for large model weight files (tens of gigabytes) and are difficult to apply directly in containerized inference scenarios.

[0005] Therefore, it is necessary to provide a large-model weighted encryption and decryption method, system, medium, terminal, and program product based on the AGE encryption tool to solve the above-mentioned problems in the existing technology. Summary of the Invention

[0006] In view of the shortcomings of the prior art described above, the purpose of this application is to provide a method, system, medium, terminal and program product for large model weight encryption and decryption based on the AGE encryption tool, in order to solve the technical problems of insufficient encryption processing efficiency, lack of fine-grained permission management, inability to avoid plaintext being written to disk, difficulty in auditing the decryption process and difficulty in cooperating with containerized environments when facing the encryption protection of ultra-large-scale model weight files.

[0007] To achieve the above and other related objectives, a first aspect of this application provides a method for encrypting and decrypting large model weights based on the AGE encryption tool, comprising: generating a key pair based on the AGE encryption tool, and managing the generated key pair based on a preset permission management mechanism; the key pair includes a public key and a private key; obtaining a large model weight file to be encrypted, segmenting the large model weight file according to a preset granularity to obtain multiple data segments; encrypting the multiple data segments according to the generated public key; decrypting the encrypted multiple data segments packaged in a container according to the generated private key; transmitting the decrypted data file to a model loading framework based on a memory mediation mechanism; recording relevant parameters throughout the entire decryption process, and triggering a security protection mechanism based on the recorded relevant parameters.

[0008] In some embodiments of the first aspect of this application, the preset permission management mechanism includes: a user-level authorization mechanism, a service-level authorization mechanism, and a node-level authorization mechanism; wherein, the user-level authorization mechanism is used to identify the identity of the decryption initiator; if it is a user allowed to access the key pair, the generated key pair is sent to that user; otherwise, an error message is returned; the service-level authorization mechanism is used to identify the service or inference component to which it belongs; if it is identified as a specified service or inference component, the generated key pair is sent to that service or inference component; otherwise, an error message is returned; the node-level authorization mechanism is used to identify the Kubernetes node, namespace, and Pod tag of the running container; if it is a Kubernetes node, namespace, or Pod tag, the generated key pair is sent to that node; otherwise, an error message is returned.

[0009] In some embodiments of the first aspect of this application, the hash values ​​of the encrypted data segment and the decrypted data segment are calculated and compared to verify whether the contents of the data segments are consistent.

[0010] In some embodiments of the first aspect of this application, the memory mediation mechanism includes: a tmpfs file system, a memory mapping mechanism, and a memory pipe mechanism.

[0011] In some embodiments of the first aspect of this application, the relevant parameters in the entire process of the decryption operation include: decryption request time, decryption initiator identifier, decryption segment number, authorization information, key pair usage lifecycle, and abnormal decryption behavior information.

[0012] In some embodiments of the first aspect of this application, the security protection mechanism includes: a key pair desensitization mechanism and a decryption circuit breaker mechanism; wherein, the key pair desensitization mechanism is used to downgrade access key pair permissions to read-only or prohibition; and the decryption circuit breaker mechanism is used to suspend unfinished segment-level decryption operations.

[0013] To achieve the above and other related objectives, a second aspect of this application provides a large model weight encryption and decryption system based on the AGE encryption tool, comprising: a key pair management module, used to generate key pairs based on the AGE encryption tool and manage the generated key pairs based on a preset permission management mechanism; the key pair includes a public key and a private key; an encryption module, used to obtain a large model weight file to be encrypted, segment the large model weight file according to a preset granularity to obtain multiple data segments; and encrypt the multiple data segments according to the generated public key; a containerized decryption module, used to decrypt the multiple encrypted data segments packaged in a container according to the generated private key; and transmit the decrypted data file to a model loading framework based on a memory mediation mechanism; and a decryption audit module, used to record relevant parameters throughout the entire decryption operation process and trigger a security protection mechanism based on the recorded relevant parameters.

[0014] To achieve the above and other related objectives, a third aspect of this application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method.

[0015] To achieve the above and other related objectives, a fourth aspect of this application provides a computer program product comprising computer program code that, when executed on a computer, causes the computer to implement the method.

[0016] To achieve the above and other related objectives, a fifth aspect of this application provides an electronic terminal, including a memory, a processor, and a computer program stored in the memory; the processor executes the computer program to implement the method.

[0017] As described above, the large-model weighted encryption and decryption method, system, medium, terminal, and program products based on the AGE encryption tool of this application have the following beneficial effects:

[0018] (1) Achieve refined permission management for model files: By managing the key pairs generated by the AGE encryption tool through a pre-defined permission management mechanism, the encryption and decryption permissions of the model can be finely divided, improving the problem of the coarse key management in the existing technology and the difficulty in restricting the initiating entity of encryption and decryption;

[0019] (2) Improve the encryption efficiency and adaptability of ultra-large-scale model weight files: By first dividing the obtained large model weight file to be encrypted into multiple data segments according to the preset granularity, and then encrypting the multiple data segments based on the public key generated by the AGE encryption tool, the problems of long time and large memory consumption in the traditional overall encryption method when processing tens of GB-level files are avoided, making the encryption process more adaptable to the characteristics of large models and improving the encryption processing efficiency.

[0020] (3) Avoid exposing the model plaintext on the disk, reduce the risk of leakage, and improve the automation of deployment in the containerized environment: Decrypt multiple data segments that are encrypted and packaged in the container based on the generated private key, and transfer the decrypted data file to the model loading framework based on the memory intermediary mechanism, so that the model weight file is not written to the disk during the decryption stage, which solves the risk of plaintext exposure caused by writing the decrypted file to the container or host file system in the existing mode, and improves the data security of the model during the online process; At the same time, the decryption process is linked with the containerized environment to enable collaboration with the containerization.

[0021] (4) Enhance the traceability and security audit capability of the model decryption process: By recording relevant parameter information in the entire process of decryption operation and triggering security protection mechanism in abnormal situations, the entire process of decryption behavior can be monitored and traced, which helps to meet the security audit requirements. Attached Figure Description

[0022] Figure 1 The diagram shown is a flowchart of a large model weighted encryption / decryption method based on the AGE encryption tool in one embodiment of this application.

[0023] Figure 2 The diagram shown illustrates the working principle of a large model weighted encryption / decryption method based on the AGE encryption tool in one embodiment of this application.

[0024] Figure 3 The diagram shown is a block diagram of a large model weighted encryption and decryption system based on the AGE encryption tool in one embodiment of this application.

[0025] Figure 4 The diagram shown is a structural schematic of an electronic terminal according to an embodiment of this application. Detailed Implementation

[0026] The following specific examples illustrate the implementation of this application. Those skilled in the art can easily understand other advantages and effects of this application from the content disclosed in this specification. This application can also be implemented or applied through other different specific embodiments, and various details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of this application. It should be noted that, unless otherwise specified, the following embodiments and features in the embodiments can be combined with each other.

[0027] In the embodiments of this application, terms such as "first" and "second" are used to distinguish identical or similar items with essentially the same function and effect. For example, "first XX" and "second XX" are merely used to distinguish different XXs and do not limit their order. Those skilled in the art will understand that terms such as "first" and "second" do not limit the quantity or execution order, and that "first" and "second" do not necessarily imply that they are different.

[0028] It should be noted that, in the embodiments of this application, the words "exemplary" or "for example" indicate examples, illustrations, or descriptions. Any embodiment or design described as "exemplary" or "for example" in this application should not be construed as being more preferred or advantageous than other embodiments or design solutions. Specifically, the use of words such as "exemplary" or "for example" is intended to present the relevant concepts in a specific manner.

[0029] In this application embodiment, "at least one" refers to one or more, and "more than one" refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can represent: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple.

[0030] Before providing a further detailed description of the present invention, the nouns and terms used in the embodiments of the present invention are explained, and the nouns and terms used in the embodiments of the present invention are subject to the following interpretations:

[0031] <1> AGE (Actually Good Encryption) is a simple, modern, and secure command-line file encryption tool that supports both public-key and password encryption, suitable for secure file transfer and storage.

[0032] <2> The tmpfs file system is a memory-based temporary file system that stores all files in virtual memory. It allows data to be stored in memory and swap partitions and is typically used to speed up file access or ensure that content is automatically cleared after a reboot. The size of tmpfs is automatically adjusted according to system memory, and all data is lost when it is unmounted.

[0033] <3> The memory mapping (mmap) mechanism is a system call in Linux used to map files or devices into the virtual memory space of a process. Through this mechanism, users can access file content as if they were operating on memory, thereby improving file access efficiency. Its core is to establish a mapping relationship between the virtual memory in user space and the physical memory in kernel space. After mapping, user operations on virtual memory will be directly reflected in physical memory or files, without the need for data copying through the traditional read and write system calls.

[0034] <4> The memory pipe mechanism is a half-duplex communication method. It is a buffer in the kernel where data can only flow in one direction, with one end writing and the other reading. It can only be used between related processes (parent and child processes). In addition, the pipe transmits an unformatted stream of bytes, and the size of the pipe buffer is limited.

[0035] <5> Init Container: A special type of container in Kubernetes that runs before the application container within a Pod starts; Init containers can contain utilities and installation scripts that are not present in the application image.

[0036] <6> Sidecar containers are auxiliary containers that run in the same Pod as the main application container. These auxiliary containers enhance or extend the functionality of the main application container by providing additional services or features (such as logging, monitoring, security, or data synchronization) without directly modifying the main application code.

[0037] <7> Kubernetes (K8s) is an open-source container orchestration platform used to automate the deployment, management, and scaling of containerized applications.

[0038] <8> Key Management Service (KMS) is a one-stop key management and data encryption service platform that provides simple, reliable, secure, and compliant data encryption protection capabilities.

[0039] To facilitate understanding of the embodiments of this application, in conjunction with Figure 1 and Figure 2 Detailed explanation. Figure 1 The diagram illustrates a flowchart of a large model weighted encryption / decryption method based on the AGE encryption tool in an embodiment of the present invention. Figure 2 This illustration shows a schematic diagram illustrating the working principle of a large model weighted encryption / decryption method based on the AGE encryption tool according to an embodiment of the present invention. The large model weighted encryption / decryption method based on the AGE encryption tool in this embodiment includes the following steps:

[0040] Step S11: Generate a key pair based on the AGE encryption tool, and manage the generated key pair based on a preset permission management mechanism; the key pair includes a public key and a private key.

[0041] By constructing a preset permission management mechanism based on the key pairs generated by the AGE encryption tool, the encryption and decryption permissions of the model can be finely divided and managed, and authorization priority and conflict handling can be supported. This significantly improves the problems of extensive key management and difficulty in restricting encryption and decryption subjects in existing solutions.

[0042] In some embodiments of this application, the preset permission management mechanism includes: a user-level authorization mechanism, a service-level authorization mechanism, and a node-level authorization mechanism; wherein, the user-level authorization mechanism is used to identify the identity of the decryption initiator; if it is a user authorized to access the key pair, the generated key pair is sent to that user; otherwise, an error message is returned; the service-level authorization mechanism is used to identify the service or inference component to which it belongs; if it is identified as a specified service or inference component, the generated key pair is sent to that service or inference component; otherwise, an error message is returned; the node-level authorization mechanism is used to identify the Kubernetes node, namespace, and Pod tag of the running container; if it is a Kubernetes node, namespace, or Pod tag, the generated key pair is sent to that node; otherwise, an error message is returned.

[0043] To meet the permission isolation requirements of different users, services, and environments, the permission management mechanism designs a multi-layered key access control structure, including user-level authorization, service-level authorization, and node-level authorization. The user-level authorization mechanism determines decryption permission based on the user's identity. If identified as a user authorized to access the key pair (e.g., a model administrator or service account manager), the private key generated using the AGE encryption tool is distributed to that user for management. If identified as not being the decryption initiator, an error message is returned, and the private key is not distributed. The service-level authorization mechanism only allows specified inference services, tasks, or microservices to access the key pair. If identified as a specified service, the key pair is distributed to that service level. If identified as not a specified task, an error message is returned, and the key pair is not distributed. The node-level authorization mechanism establishes an authorization mechanism when passing keys to specific Kubernetes nodes or namespaces to prevent keys from being exposed across nodes. If identified as a Kubernetes node, namespace, or Pod tag running a container, the key pair is distributed to that node. If identified as a non-Kubernetes node, namespace, or Pod tag, an error message is returned, and the key pair is not distributed. In addition, authorization priorities can be set for user-level authorization mechanisms, service-level authorization mechanisms, and node-level authorization mechanisms. For example, node-level authorization mechanism > service-level authorization mechanism > user-level authorization mechanism. When conflicts arise between multiple authorization levels, the authorization priority strategy will be implemented.

[0044] For example, key escrow can be implemented using any of the following methods: Key Management Service (KMS), Encryption Controller, or Key Distribution Service. A dynamic key distribution and eviction mechanism ensures real-time authorization. Taking a Key Management Service as an example, a unified Key Management Service is established to implement key escrow, permission determination, and access auditing functions. Three authorization dimensions are defined: user-level authorization, service-level authorization, and node-level authorization. Each type of permission can be independently configured to allow or deny access. Specifically, three characteristics of the decryption request are first collected—user, service, and node. Then, the three authorization rules are matched according to the collected characteristics, resulting in three authorization results. Finally, a priority-based judgment is made to determine whether the key can be accessed. If authorization is granted, KMS securely distributes the key generated based on the AGE encryption tool to the decryption agent for decryption. This method prevents the key from being used by unauthorized services in the cluster.

[0045] Step S12: Obtain the large model weight file to be encrypted, segment the large model weight file according to the preset granularity to obtain multiple data segments; and encrypt the multiple data segments according to the generated public key.

[0046] The large model weight file to be encrypted is first divided into multiple independent data segments according to a preset granularity, such as 64MB or 128MB, and each data segment contains a continuous byte range of the original weight data. Then, each data segment is encrypted according to the generated public key, and each data segment generates an independent encryption header. Finally, all the encrypted data segments are assembled into an encrypted model package in the original order. This avoids the problems of long processing time and large memory consumption when processing tens of gigabytes of files by traditional whole encryption methods. This makes the encryption process more suitable for the characteristics of large models, ensures the encryption processing efficiency of large model weight files, and also enables the subsequent decryption operation to be parallelized and streamed.

[0047] In some embodiments of this application, the hash values ​​of the encrypted and decrypted data segments are calculated and compared to verify whether the contents of the data segments are consistent.

[0048] In this embodiment, a lossless verification mechanism is designed, which records the hash value of each encrypted data segment for verification during decryption, and supports restoration verification after segmented decryption to ensure that the model weights are completely consistent.

[0049] For example, a large, trained model weight file (tens of gigabytes in size) is read. This file contains tensors, parameter matrices, and KV cache initialization data. The file is then sequentially segmented at a 64MB segmentation granularity, generating an index table for each segment to record its byte range, verification method, and segment number. Each segment contains continuous raw bytes, requiring no understanding of the model's internal structure. Each segment is then encrypted using the corresponding public key, creating an independent encrypted segment. Metadata containing an encryption header, random numbers, and a checksum is generated for each encrypted segment. After encryption, the encrypted segments are sequentially written into the encrypted model package, which ultimately includes the number of segments, their index table, the encrypted data for each segment, and a list of hash checksums. This structure supports on-demand, parallel, or streaming processing at the decryption end, ensuring the model file is lossless and reproducible, and is suitable for large file scenarios.

[0050] Step S13: Decrypt the encrypted data segments packaged in the container using the generated private key; and transfer the decrypted data file to the model loading framework based on the memory intermediary mechanism.

[0051] By decrypting multiple encrypted data segments packaged in the container using the generated private key and transferring the decrypted data files to the model loading framework based on a memory mediation mechanism, the large model weight files are not written to disk during the decryption stage. This solves the risk of plaintext exposure caused by writing decrypted files to the container or host file system in the existing model, and improves the data security of the model during the deployment process. At the same time, the decryption process is linked with the container lifecycle, mount point, and model loading process, so that the large model weight files can be automatically decrypted and mounted when the container starts, reducing manual intervention, improving deployment consistency, and thus improving the degree of deployment automation in the containerized environment.

[0052] In some embodiments of this application, the memory mediation mechanism includes: a tmpfs file system, a memory mapping mechanism, and a memory pipe mechanism.

[0053] Specifically, before container startup or during initialization, a decryption proxy is injected into the initialization container (e.g., Init Container or Sidecar container) to automatically read the metadata of the encrypted model package, determine whether decryption is needed, and trigger the decryption operation. During decryption, instead of writing back to the host machine or container file system, a memory intermediary mechanism including the tmpfs file system, memory mapping, and memory pipes is used to directly pass the decrypted data to the model loading component. This allows plaintext data to be consumed in memory immediately, without being persisted to disk. Simultaneously, the decryption proxy interacts with model loading frameworks (e.g., MindSpore, PyTorch, Ascend inference frameworks) to achieve decryption and loading simultaneously, supporting streaming weight loading and reducing the initialization time for large models. Finally, the decrypted model file is exposed as a standard path within the container through the memory file system, allowing the inference program to load the model without modification.

[0054] For example, in a Kubernetes deployment scenario, automatic decryption during the model deployment phase can be achieved through an Init Container or a Sidecar container. Specifically, the Init Container is responsible for downloading the model encryption package and triggering decryption, while the Sidecar container is responsible for decryption and key rotation, i.e., injecting a decryption agent. After the decryption agent starts, it reads the encryption package path and key acquisition method from the mounted configuration or environment variables. The decryption agent initiates a decryption authorization request to KMS through an authentication mechanism, including: Service Account identity, Pod... The system obtains the decryption key by sending a key pair to the decryption agent based on the node information and deployment environment tag information via KMS. The decryption agent reads the encrypted segments of the encrypted model package segment by segment, decrypts the encrypted segments according to the private key to obtain the plaintext segment data, and then uses the tmpfs file system, memory mapping mechanism and memory pipe mechanism to directly map the plaintext segment data to the memory file system. The plaintext segment data is released immediately after being read by the model loader to reduce long-term resident memory. The entire process does not generate any persistent plaintext files to prevent leakage. The model loading framework loads the model from the preset path. When a data segment has been decrypted and mapped, it can be read. Segments that have not been decrypted will block the read request or trigger the loading queue waiting mechanism. At the same time, the decryption agent and the model loading synchronize the segment status through the status file or shared channel, thereby realizing decryption and loading simultaneously and accelerating model startup.

[0055] In addition, a segmented decryption and streaming loading collaborative optimization mechanism was designed to improve decryption and loading efficiency. Specifically, the decryption is performed in parallel according to the original encrypted segments, making full use of the CPU multi-core capabilities, that is, each data segment is decrypted independently; the model inference framework can be preloaded when some weights have been decrypted, thereby reducing the overall loading time; or the segment content is lightly compressed before encryption to improve transmission efficiency, while ensuring that the original weights can still be restored without loss after decryption. This mechanism allows the model to start initialization without complete decryption before going online, which is suitable for the rapid startup of tens of gigabyte models in container environments.

[0056] By employing mechanisms such as segment-level parallel decryption and loading while decrypting, model initialization can be performed without waiting for the complete file decryption to be completed, thereby reducing the startup time of large models and improving deployment efficiency in containerized and Kubernetes environments.

[0057] Step S14: Record the relevant parameters in the entire decryption process and trigger the security protection mechanism based on the recorded parameters.

[0058] By recording relevant parameters throughout the entire decryption process and triggering security protection mechanisms in abnormal situations, the entire decryption process can be monitored and traced, which helps to meet security audit and compliance requirements.

[0059] In some embodiments of this application, the relevant parameters in the entire process of the decryption operation include: decryption request time, decryption initiator identifier, decryption segment number, authorization information, key pair usage lifecycle, and abnormal decryption behavior information.

[0060] To enhance tracking capabilities, all key requests and decryption events are recorded, including: decryption request time, decryption initiator identifier (such as user, service, node), decryption segment number, authorization information, key pair usage lifecycle, and abnormal decryption behavior information (such as high-frequency decryption requests within a short period of time).

[0061] In some embodiments of this application, the security protection mechanism includes: a key pair desensitization mechanism and a decryption circuit breaker mechanism; wherein, the key pair desensitization mechanism is used to downgrade access key pair permissions to read-only or prohibit them; and the decryption circuit breaker mechanism is used to suspend unfinished segment-level decryption operations.

[0062] When abnormal behavior is detected, the KMS is notified to trigger key desensitization, downgrading some authorizations to read-only or prohibiting them; alternatively, the circuit breaker mechanism is triggered to suspend unfinished segment-level decryption tasks; and the abnormal information is pushed to the security management platform. This mechanism improves the security and auditing capabilities during the model deployment process.

[0063] Figure 3 This is a schematic block diagram of a large-model weighted encryption / decryption system based on the AGE encryption tool provided in an embodiment of this application. Figure 3 As shown, the large model weighted encryption / decryption system 300 based on the AGE encryption tool includes:

[0064] The key pair management module 301 is used to generate key pairs based on the AGE encryption tool and manage the generated key pairs based on a preset permission management mechanism; the key pair includes a public key and a private key;

[0065] The encryption module 302 is used to obtain the large model weight file to be encrypted, segment the large model weight file according to a preset granularity to obtain multiple data segments, and encrypt the multiple data segments according to the generated public key.

[0066] The containerized decryption module 303 is used to decrypt multiple encrypted data segments packaged in a container based on the generated private key; and to transfer the decrypted data file to the model loading framework based on a memory mediation mechanism.

[0067] The decryption audit module 304 is used to record relevant parameters throughout the entire decryption process and trigger security protection mechanisms based on the recorded parameters.

[0068] The large model weight encryption and decryption system based on the AGE encryption tool in this application can realize segmented encryption of model weights at the tens of GB level, fine-grained authorization management, automatic decryption and loading of containers without plaintext on disk, and traceable decryption auditing, meeting the security deployment requirements of large models in cloud-native environments.

[0069] Furthermore, to further shorten loading time, multi-threaded parallel decryption and a pipelined mode are supported. Specifically: the main control thread maintains a segment queue; multiple decryption threads process different segments; the loading thread is immediately notified when a segment is decrypted; if lightweight compression is enabled for a segment, it is decompressed before decryption; and the model loading thread reconstructs the weight structure in sequence according to the segment number. This pipelined approach shortens the overall loading time for large models.

[0070] It should be understood that the specific process of each module performing the above-mentioned steps has been described in detail in the above method embodiments, and will not be repeated here for the sake of brevity.

[0071] It should also be understood that the module division in the embodiments of this application is illustrative and only represents a logical functional division; in actual implementation, there may be other division methods. Furthermore, the functional modules in the various embodiments of this application can be integrated into a single processor, exist as separate physical entities, or be integrated into a single module. The integrated modules described above can be implemented in hardware or as software functional modules.

[0072] Figure 4 This is a schematic block diagram of the electronic terminal provided in an embodiment of this application. Figure 4 As shown, the electronic terminal 400 includes at least one processor 401, a memory 402, at least one network interface 403, and a user interface 405. The various components in the electronic terminal 400 are coupled together via a bus system 404. It is understood that the bus system 404 is used to implement communication between these components. In addition to a data bus, the bus system 404 also includes a power bus, a control bus, and a status signal bus. However, for clarity, in… Figure 4 The general will label all buses as bus systems.

[0073] The user interface 405 may include a monitor, keyboard, mouse, trackball, clicker, button, touchpad, or touch screen.

[0074] It is understood that memory 402 can be volatile memory or non-volatile memory, or both. Non-volatile memory can be read-only memory (ROM) or programmable read-only memory (PROM), used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as static random access memory (SRAM) and synchronous static random access memory (SSRAM). The memories described in the embodiments of this invention are intended to include, but are not limited to, these and any other suitable categories of memory.

[0075] In this embodiment of the invention, the memory 402 is used to store various types of data to support the operation of the electronic terminal 400. Examples of this data include: any executable program for operation on the electronic terminal 400, such as the operating system 4021 and application programs 4022; the operating system 4021 contains various system programs, such as the framework layer, core library layer, driver layer, etc., for implementing various basic services and handling hardware-based tasks. The application program 4022 may contain various applications, such as a media player, browser, etc., for implementing various application services. The methods provided in this embodiment of the invention can be included in the application program 4022.

[0076] The methods disclosed in the above embodiments of the present invention can be applied to processor 401, or implemented by processor 401. Processor 401 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the integrated logic circuit of the hardware in processor 401 or by instructions in the form of software. The processor 401 may be a general-purpose processor, a digital signal processor (DSP), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Processor 401 can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of the present invention. General-purpose processor 401 may be a microprocessor or any conventional processor, etc. The steps of the accessory optimization method provided in the embodiments of the present invention can be directly reflected as being executed by a hardware decoding processor, or being executed by a combination of hardware and software modules in the decoding processor. The software module may be located in a storage medium, which is located in a memory. The processor reads the information in the memory and combines it with its hardware to complete the steps of the aforementioned method.

[0077] In an exemplary embodiment, the electronic terminal 400 may be used by one or more application-specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), or complex programmable logic devices (CPLDs) to execute the aforementioned method.

[0078] According to the method provided in the embodiments of this application, this application also provides a computer program product, which includes: computer program code, which, when run on a computer, causes the computer to execute... Figures 1 to 2 The method of any of the embodiments shown.

[0079] According to the method provided in the embodiments of this application, this application also provides a computer-readable storage medium storing program code, which, when executed on a computer, causes the computer to perform... Figures 1 to 2 The method of any of the embodiments shown.

[0080] As used in this specification, the terms "component," "module," "system," etc., are used to refer to computer-related entities, hardware, firmware, combinations of hardware and software, software, or software in execution. For example, a component can be, but is not limited to, a process running on a processor, a processor, an object, an executable file, an execution thread, a program, and / or a computer. As illustrated, applications running on computing devices and computing devices can both be components. One or more components may reside in a process and / or an execution thread, and components may be located on a single computer and / or distributed among two or more computers. Furthermore, these components can be executed from various computer-readable media on which various data structures are stored. Components can communicate, for example, via local and / or remote processes based on signals having one or more data packets (e.g., data from two components interacting with another component between a local system, a distributed system, and / or a network, such as the Internet interacting with other systems via signals).

[0081] Those skilled in the art will recognize that the various illustrative logical blocks and steps described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this application.

[0082] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0083] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0084] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment, depending on actual needs.

[0085] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0086] In the above embodiments, the functions of each functional unit can be implemented entirely or partially through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented entirely or partially in the form of a computer program product. A computer program product includes one or more computer instructions (programs). When the computer program instructions (programs) are loaded and executed on a computer, all or part of the flow or function according to the embodiments of this application is generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. Computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available media can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., high-density digital video discs, DVDs), or semiconductor media (e.g., solid-state disks, SSDs, etc.).

[0087] If a function is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0088] In summary, in view of the technical problems of insufficient encryption processing efficiency, lack of fine-grained permission management, inability to avoid plaintext being written to disk, difficulty in auditing the decryption process, and difficulty in cooperating with containerized environments when facing the encryption protection of ultra-large-scale model weight files, this application provides a large model weight encryption and decryption method, system, medium, terminal and program product based on the AGE encryption tool, which can adapt to the encryption and decryption strategy of large model characteristics and closely integrate with the cloud-native deployment system to realize the full-link security protection of model weight files from encrypted storage, authorization management to decryption at container runtime. Specifically: (1) Realize fine-grained permission management of model files: By constructing a preset permission management mechanism based on the key pair generated by the AGE encryption tool, the model encryption and decryption permissions can be finely divided, which improves the coarse key management in the prior art. (1) It is difficult to restrict the subject of encryption and decryption; (2) Improve the encryption efficiency and adaptability of ultra-large-scale model weight files: by first dividing the obtained large model weight file to be encrypted into multiple data segments according to the preset granularity, and then encrypting the multiple data segments based on the public key generated by the AGE encryption tool, the traditional overall encryption method avoids the problems of long time and large memory overhead when processing tens of GB-level files, making the encryption process more adaptable to the characteristics of large models and improving the encryption processing efficiency; (3) Avoid the exposure of model plaintext on disk, reduce the risk of leakage, and improve the degree of deployment automation in containerized environment: based on the generated private key, the encrypted data packaged in the container is encrypted. Multiple data segments are decrypted, and the decrypted data file is transmitted to the model loading framework based on the memory intermediary mechanism, so that the model weight file is not written to disk during the decryption stage. This solves the risk of plaintext exposure caused by writing the decrypted file to the container or host file system in the existing mode, and improves the data security of the model during the online process. At the same time, the decryption process is linked with the containerized environment, so as to achieve collaboration with the containerization. (4) Enhance the traceability and security audit capability of the model decryption process: By recording the relevant parameter information in the entire process of decryption operation and triggering the security protection mechanism in abnormal situations, the entire process of decryption behavior can be monitored and traced, which helps to meet the security audit requirements. Therefore, this application effectively overcomes the various shortcomings of the prior art and has high industrial utilization value.

[0089] The above embodiments are merely illustrative of the principles and effects of this application and are not intended to limit this application. Any person skilled in the art can modify or alter the above embodiments without departing from the spirit and scope of this application. Therefore, all equivalent modifications or alterations made by those skilled in the art without departing from the spirit and technical concept disclosed in this application should still be covered by the claims of this application.

Claims

1. A large-model weighted encryption and decryption method based on the AGE encryption tool, characterized in that, include: Key pairs are generated using the AGE encryption tool, and the generated key pairs are managed based on a preset access control mechanism. The key pair includes a public key and a private key; Obtain the large model weight file to be encrypted, and segment the large model weight file according to the preset granularity to obtain multiple data segments; The generated public key is used to encrypt multiple data segments. The generated private key is used to decrypt the encrypted data segments packaged in the container. The decrypted data file is then transferred to the model loading framework based on a memory intermediary mechanism. The system records all relevant parameters throughout the decryption process and triggers security protection mechanisms based on these recorded parameters.

2. The large model weight encryption and decryption method based on the AGE encryption tool according to claim 1, characterized in that, The preset permission management mechanism includes: a user-level authorization mechanism, a service-level authorization mechanism, and a node-level authorization mechanism. The user-level authorization mechanism identifies the identity of the decryption initiator; if it is a user authorized to access the key pair, the generated key pair is sent to that user; otherwise, an error message is returned. The service-level authorization mechanism identifies the service or inference component to which the key pair belongs; if it is identified as a specific service or inference component, the generated key pair is sent to that service or inference component; otherwise, an error message is returned. The node-level authorization mechanism identifies the Kubernetes node, namespace, and Pod tag of the running container; if it is a Kubernetes node, namespace, or Pod tag, the generated key pair is sent to that node; otherwise, an error message is returned.

3. The large model weight encryption and decryption method based on the AGE encryption tool according to claim 1, characterized in that, The hash values ​​of the encrypted and decrypted data segments are calculated and compared to verify whether the data segment contents are consistent.

4. The large model weight encryption and decryption method based on the AGE encryption tool according to claim 1, characterized in that, The memory mediation mechanisms include: the tmpfs file system, memory mapping mechanism, and memory pipe mechanism.

5. The large model weight encryption and decryption method based on the AGE encryption tool according to claim 1, characterized in that, The relevant parameters in the entire decryption process include: decryption request time, decryption initiator identifier, decryption segment number, authorization information, key pair usage lifecycle, and abnormal decryption behavior information.

6. The large model weight encryption and decryption method based on the AGE encryption tool according to claim 1, characterized in that, The security protection mechanism includes a key pair desensitization mechanism and a decryption circuit breaker mechanism; wherein, the key pair desensitization mechanism is used to downgrade access key pair permissions to read-only or prohibit them; the decryption circuit breaker mechanism is used to suspend unfinished segment-level decryption operations.

7. A large-model weighted encryption / decryption system based on the AGE encryption tool, characterized in that, include: The key pair management module is used to generate key pairs based on the AGE encryption tool and manage the generated key pairs based on a preset permission management mechanism. The key pair includes a public key and a private key; The encryption module is used to obtain the large model weight file to be encrypted, and to segment the large model weight file according to a preset granularity to obtain multiple data segments; The generated public key is used to encrypt multiple data segments. The containerized decryption module is used to decrypt multiple encrypted data segments packaged in a container based on the generated private key. The decrypted data file is then transferred to the model loading framework based on a memory intermediary mechanism. The decryption audit module is used to record relevant parameters throughout the entire decryption process and trigger security protection mechanisms based on the recorded parameters.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method as described in any one of claims 1 to 6.

9. A computer program product, characterized in that, The computer program product includes computer program code that, when run on a computer, causes the computer to implement the method as described in any one of claims 1 to 6.

10. An electronic terminal, comprising a memory, a processor, and a computer program stored in the memory, characterized in that, The processor executes the computer program to implement the method as described in any one of claims 1 to 6.

Images