A service processing method, electronic device and server

Abstract

The application provides a service processing method, an electronic device and a server. When a user triggers an AIGC service of a mobile phone, the mobile phone sends a request 1 to an IDS. In response to the request 1, the IDS sends target node information to the mobile phone, the target node information including an address of a target node and a public key corresponding to the target node. Then, the mobile phone encrypts collected service data by using a first shared key to obtain first data. The first shared key is generated based on the public key and a private key corresponding to the mobile phone. Then, the mobile phone sends the first data to the target node based on the address of the target node. Then, the mobile phone receives a target processing result sent by the target node, the target processing result indicating an encrypted model processing result, and the model processing result being obtained by the target node after processing the first data. Then, the mobile phone decrypts the target processing result by using the target processing result to obtain a decrypted model processing result, and displays the encrypted model processing result, thereby ensuring the security of user data.

Description

Technical Field

[0001] This application relates to the field of terminal technology, and in particular to a business processing method, electronic device and server. Background Technology

[0002] With the development of electronic devices, some electronic devices can now provide artificial intelligence-generated content (AIGC) services. To ensure the performance of electronic devices, they can utilize servers to provide AIGC services to users.

[0003] When a user triggers an electronic device to run AIGC (AIGC) services, the device retrieves relevant business data and uploads it to the server. The server processes this data to obtain the corresponding processing result. The server then sends the processing result back to the electronic device. Finally, the electronic device outputs the result to the user, thus providing AIGC services and meeting the user's needs. Since the electronic device needs to interact with the server when providing AIGC services, the security of this interaction must be ensured. Summary of the Invention

[0004] This application provides a business processing method, an electronic device, and a server to ensure the security of interaction between the electronic device and the server, thereby ensuring the security of user data and preventing the leakage of user privacy.

[0005] In one aspect, this application provides a service processing method applied to an electronic device, wherein the electronic device receives a first operation, and the first operation is used to trigger the electronic device to run a first service.

[0006] In response to the first operation, the electronic device sends a first request to the first server; wherein the first request is used to obtain information about the target server processing the first service. Subsequently, the electronic device receives server information sent by the first server, which includes the address of the target server and N public keys corresponding to the target server, where N is a positive integer.

[0007] Subsequently, the electronic device sends first data to the target server based on the target server's address; the first data includes first encrypted business data, the public key corresponding to the electronic device, and the first public key information corresponding to the target server. The first encrypted business data is obtained by encrypting the business data of the first business based on the first shared key; the first shared key is generated based on the first public key information indicated by the first public key information among the N public keys corresponding to the target server and the private key corresponding to the electronic device.

[0008] Next, the electronic device receives the target processing result sent by the target server; wherein, the target processing result is obtained by the target server encrypting the processing result corresponding to the first encrypted business data using a second shared key; the second shared key is generated based on the public key corresponding to the electronic device and the first private key corresponding to the first public key. Then, the electronic device displays the decrypted result; wherein, the decrypted result is obtained by decrypting the target processing result using the first shared key.

[0009] In this application, all data transmitted between the electronic device and the target server is encrypted using a shared key, ensuring the security of the interaction between the two parties and thus guaranteeing data security. Furthermore, when the data involves user data, it prevents the leakage of user privacy. In addition, the shared key used by the electronic device and the target server is the other party's corresponding public key, which can also verify identity to a certain extent, ensuring the reliability of the other party and thus guaranteeing the security of the interaction.

[0010] Optionally, the aforementioned server information may include one or more candidate server information. When there is only one candidate server, that candidate server can be directly used as the target server. When there are multiple candidate servers, the electronic device can select one candidate server from among the multiple candidate servers as the target server.

[0011] In one possible design, the aforementioned server information is sent after the first server successfully authenticates the electronic device.

[0012] In one possible design, the aforementioned server information also includes the blind-signed OTP of the target server. Accordingly, before sending the first data to the target server, the electronic device sends the blind-signed OTP to the target server.

[0013] The first piece of data mentioned above was sent after the target server successfully authenticated the OTP after blind signing.

[0014] Therefore, the OTP after blind signing is equivalent to the identity credential of the target server. Successful authentication of the blind-signed OTP indicates that the electronic device is trustworthy, allowing it to continue communicating normally with the target server and ensuring communication security.

[0015] In one possible design, after sending the first data to the target server, if the first public key expires, the electronic device can determine the second public key from the remaining public keys corresponding to the target server and re-establish a connection with the target server. The remaining public keys represent the public keys that have not expired among N public keys. Then, based on the re-established connection, the electronic device can send the second data to the target server; the second data includes second encrypted business data and the second public key information corresponding to the target server; the second encrypted business data is obtained by encrypting it with a third shared key; the third shared key is generated based on the second public key and the private key corresponding to the electronic device.

[0016] Optionally, the first public key becomes invalid if the connection between the electronic device and the target server is lost.

[0017] In one possible design, if the target server malfunctions, the electronic device ceases communication with that target server and determines a new target server from among multiple candidate servers. Then, based on the address of the new target server, the electronic device transmits third data related to the first service to the new target server. Therefore, when the target server with which the electronic device is communicating malfunctions, the electronic device can refrain from transmitting data related to the first service to that target server and instead continue transmitting data related to the first service with the newly determined target server, ensuring communication security.

[0018] In one possible design, after receiving a first notification message from the target server indicating an anomaly, the electronic device can display a first prompt message suggesting that the first service be retried. Based on this, when the target server malfunctions, the electronic device can stop the first service to ensure data security and prompt the user to retry the first service, thus improving the user experience.

[0019] In one possible design, the first service described above is an AIGC (Artificial Intelligence Generated Content) service, and the first private key resides in a security module within the target server. The target processing result is obtained by the target server within the security module, encrypting the processing result corresponding to the first encrypted service data using a second shared key; the processing result corresponding to the first encrypted service data is obtained by the target server based on an AIGC model. This ensures the security of user data, thereby preventing the leakage of user privacy.

[0020] Secondly, this application provides a business processing method applied to a second server. After receiving first data corresponding to a first service sent by an electronic device, the second server decrypts the first encrypted service data based on a second shared key to obtain decrypted data. The second shared key is generated based on the public key corresponding to the electronic device and the first private key corresponding to the first public key information.

[0021] Subsequently, the second server can send the target processing result to the electronic device. The target processing result is obtained by encrypting the processing result corresponding to the first encrypted business data based on the second shared key. The processing result corresponding to the first encrypted business data is obtained by processing the decrypted data.

[0022] Based on this, it is ensured that both the second server and the electronic device are trustworthy and that communication is secure, thereby guaranteeing the security of user data and preventing the leakage of user privacy.

[0023] The second server mentioned above can be the target server mentioned above.

[0024] In one possible design, the second server includes a security module. The private key corresponding to the public key information resides within the security module. Decryption of the first data, processing of the decrypted data, and encryption of the processing result corresponding to the first data based on the second shared key are all performed within the security module.

[0025] Therefore, we can ensure the security of user data.

[0026] In one possible design, if the first public key indicated by the first public key information becomes invalid, and the number of remaining key pairs corresponding to the second server is less than or equal to a preset number, the second server can generate a new key pair corresponding to the second server, which includes the public key and private key corresponding to the second server; the remaining key pairs represent the non-invalid key pairs among the N key pairs corresponding to the second server.

[0027] The second server can then send a second public key to the electronic device; this second public key includes the public key from the new key pair. This prevents the electronic device from lacking the public key corresponding to the second server, thus ensuring the normal operation of the first service.

[0028] In one possible design, before sending the target processing result to the electronic device, the second server can encrypt the processing result corresponding to the first encrypted business data based on a second shared key, obtaining an encrypted processing result. Then, the second server can run the business code of the first service to encapsulate the encrypted processing result, obtaining the target processing result. Based on this, it ensures that user data is not used by the second server's business, thereby protecting user privacy. Furthermore, the encrypted processing result can be encapsulated according to business needs to meet user requirements.

[0029] In one possible design, the second server can retrieve the target code segment from the business logic code in its memory. Then, the hash value of the target code segment is calculated.

[0030] If the hash value of the target code segment is inconsistent with the standard hash value of the target code segment, a first notification message is sent to the electronic device; wherein the first notification message indicates that the second server is abnormal. Based on this, the second server can perform security checks on the business code to ensure the integrity of the business code.

[0031] In one possible design, before receiving the first data corresponding to the first service sent by the electronic device, the second server may send a registration request to the third server; the registration request includes N public keys corresponding to the second server. Afterwards, the second server receives a registration success message from the third server, which is sent after the third server verifies the validity of its certificate. This ensures the reliability of the second server's identity.

[0032] Thirdly, this application provides a service processing method in which an electronic device receives a first operation; wherein the first operation is used to trigger the electronic device to run a first service;

[0033] The electronic device sends a first request to the first server;

[0034] In response to the first request, the first server authenticates the electronic device;

[0035] If authentication is successful, the first server sends a second request to the third server;

[0036] In response to the second request, the third server sends server information to the first server; wherein, the server information includes the address of the target server and N public keys corresponding to the target server, where N is a positive integer;

[0037] The first server sends the server information to the electronic device;

[0038] The electronic device sends first data to the target server based on the address of the target server; wherein, the first data includes first encrypted service data, the public key corresponding to the electronic device, and the first public key information corresponding to the target server; the encrypted service data is obtained by encrypting the service data of the first service based on a first shared key; the first shared key is generated based on the first public key indicated by the first public key information among the N public keys corresponding to the target server and the private key corresponding to the electronic device;

[0039] The target server decrypts the first encrypted business data based on the second shared key to obtain the decrypted data; wherein, the second shared key is generated based on the public key corresponding to the electronic device and the first private key corresponding to the first public key information;

[0040] The target server sends a target processing result to the electronic device; wherein, the target processing result is obtained by encrypting the processing result corresponding to the first encrypted service data based on the second shared key; the processing result corresponding to the first encrypted service data is obtained by processing the decrypted data;

[0041] The electronic device displays the decrypted result; wherein the decrypted result is obtained by decrypting the target processing result using the first shared key.

[0042] Fourthly, this application provides an electronic device, the electronic device including a display screen, a memory, and one or more processors; the display screen, the memory, and the processors are coupled; the display screen is used to display an image generated by the processor, the memory is used to store computer program code, the computer program code including computer instructions; when the processor executes the computer instructions, the electronic device performs the method described in the first aspect above.

[0043] Fifthly, this application provides a server, the server including a memory and one or more processors; the memory and the processors are coupled; the memory is used to store computer program code, the computer program code including computer instructions; when the processor executes the computer instructions, the server performs the method described in the second aspect above.

[0044] Sixthly, this application provides a chip, the chip including a communication interface and at least one processor:

[0045] The communication interface is used for inputting and / or outputting signaling or data;

[0046] The at least one processor is configured to execute a computer program to implement the business processing method described in the first or second aspect above.

[0047] In a seventh aspect, this application provides a computer-readable storage medium including computer instructions that, when executed on an electronic device, cause the electronic device to perform the business processing method described in the first aspect above.

[0048] Eighthly, this application provides a computer-readable storage medium including computer instructions that, when executed on an electronic device, cause the electronic device to perform the business processing method described in the second aspect above.

[0049] Ninthly, this application provides a computer program product that, when run on an electronic device, causes the electronic device to perform the business processing method described in the first or second aspect above.

[0050] It is understood that the beneficial effects achieved by the business processing methods described in the second and third aspects above, the electronic devices described in the fourth aspect, the servers described in the fifth aspect, the chips described in the sixth aspect, the computer-readable storage media described in the seventh and eighth aspects, and the computer program products described in the ninth aspect can be referred to the beneficial effects in the first aspect and any of its possible design embodiments, and will not be repeated here. Attached Figure Description

[0051] Figure 1 This application provides a schematic diagram of the structure of a node according to an embodiment of the present application;

[0052] Figure 2 A schematic diagram of a cloud-based structure is provided as an embodiment of this application;

[0053] Figure 3 A flowchart illustrating a business processing method provided in this application embodiment. Figure 1 ;

[0054] Figure 4 This application provides an illustration of a scenario for AIGC service operation. Figure 1 ;

[0055] Figure 5 This application provides an illustration of a scenario for AIGC service operation. Figure 2 ;

[0056] Figure 6 A flowchart illustrating a business processing method provided in this application embodiment. Figure 2 ;

[0057] Figure 7This application provides an illustration of a scenario for AIGC service operation. Figure 3 ;

[0058] Figure 8 A flowchart illustrating a business processing method provided in this application embodiment. Figure 3 ;

[0059] Figure 9 This application provides an illustration of a scenario for AIGC service operation. Figure 3 ;

[0060] Figure 10 A flowchart illustrating a business processing method provided in this application embodiment. Figure 4 ;

[0061] Figure 11 A schematic diagram of the hardware structure of an electronic device provided in this application embodiment. Figure 1 ;

[0062] Figure 12 A schematic diagram of the hardware structure of an electronic device provided in this application embodiment. Figure 2 ;

[0063] Figure 13 This is a schematic diagram of a chip system provided in an embodiment of this application. Detailed Implementation

[0064] To facilitate a clear description of the technical solutions in the embodiments of this application, the terms "exemplary" or "for example" are used in the embodiments of this application to indicate examples, illustrations, or explanations. Any embodiment or design scheme described as "exemplary" or "for example" in this application should not be construed as being more preferred or advantageous than other embodiments or design schemes. Specifically, the use of terms such as "exemplary" or "for example" is intended to present related concepts in a specific manner. In the embodiments of this application, "at least one" refers to one or more, and "more" refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can represent: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple. In the embodiments of this application, "first," "second," "1," and "2" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Therefore, features defined with "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this embodiment, unless otherwise stated, "multiple" means two or more.

[0065] To facilitate understanding of the technical solutions described in this application, the terms used in this application will be explained below.

[0066] Certificate certify service (CCS): Used for issuing, renewing, and revoking certificates.

[0067] ECDH (elliptic curve Diffie-Hellman): This refers to a key exchange protocol where both parties perform mathematical operations based on a specific elliptic curve to obtain the same key.

[0068] Advanced Encryption Standard (AES) algorithm: is a symmetric encryption algorithm.

[0069] Node: Used to provide AIGC services through the AIGC model, encrypting and decrypting data within an internal secure environment. This secure environment can be implemented using a security module, which represents a trusted execution environment (TEE) in the cloud. Optionally, the security module can be an SGX-secure module.

[0070] For example, such as Figure 1 As shown, the aforementioned security module may include a model inference computation module and a key processing module. The model inference computation module includes an AIGC model, which is used to implement the AIGC service. Optionally, the AIGC model in the security module is small.

[0071] The key processing module is used to generate key pairs, calculate keys (such as ECDH keys), and encrypt and decrypt data. A key pair consists of a public key and a private key, with the private key remaining within the security model.

[0072] Alternatively, such as Figure 1 As shown, a node can also include a business module. The business module includes business code, used to process the inference results obtained from the AIGC model inference according to the AIGC business requirements. Of course, a node can also include other modules, such as... Figure 1 The model set and code signing authentication service (SVD) shown are shown.

[0073] A model set includes one or more models, which may include AIGC models. The models in the model set are large.

[0074] SVD is used to verify the business code or model set in the above business model to determine whether the model set and business code have been tampered with.

[0075] Node scheduling service; used to manage nodes and push nodes that provide AIGC services to electronic devices (or described as clients).

[0076] Identity service (IDS): Used to verify the reliability of clients.

[0077] Dynamic password (one-time password, OTP), also known as one-time password: used for client authentication.

[0078] RSA (Rivest Shamir Adleman) is an asymmetric encryption algorithm.

[0079] RSA-Blind signature: This method allows the signer to sign a message without knowing the content being signed, protecting the signer's privacy, preventing them from seeing the original content, and also ensuring the untraceability of the signed content. This application's embodiment primarily ensures that OTP transmissions are only performed once through RSA-Blind signature.

[0080] With the development of AIGC technology in the internet information age, electronic devices (using mobile phones as an example below) can now provide various AIGC services. The implementation of AIGC services generally relies on AIGC models, and the operation of these models can significantly impact mobile phone performance. Therefore, to ensure mobile phone performance, AIGC models are typically deployed in the cloud, and the mobile phone provides AIGC services to users through these cloud-based models.

[0081] For example, when a user triggers an AIGC (AI Generative Data Collection) service on their mobile phone, the phone can upload the collected data to the cloud, allowing the cloud-based AIGC model to perform inference based on this data and obtain the corresponding inference result. The cloud then sends this inference result to the phone, enabling the phone to receive the processing result corresponding to the AIGC service. The phone can then output this inference result to meet the user's needs.

[0082] In scenarios where AIGC services are provided through cloud-based AIGC models, the data uploaded by mobile phones may involve sensitive user data, such as user text messages and captured images. Therefore, to ensure data security and protect user privacy, this application provides a trusted proof method for secure mutual trust between edge-cloud interactive nodes. This method ensures secure cloud uploading of user data and enables secure data processing, preventing user data leakage and thus protecting user privacy.

[0083] The trusted proof method for secure node trust in edge-cloud interaction mainly includes two parts: connection security trust establishment and runtime security trust establishment. Connection security trust establishment is used to achieve a secure connection between the mobile phone and the cloud; details can be found below. Runtime security trust establishment is used to securely send data collected by the mobile phone to the cloud for secure cloud processing to implement corresponding AIGC services; details can also be found below.

[0084] Establishing secure and trustworthy connections

[0085] like Figure 2As shown, the cloud includes a cloud server and an IDS service. The cloud server independently deploys an AIGC cluster and a node scheduling service. This AIGC cluster includes at least one node, each deploying one or more AIGC models. Each AIGC model implements a corresponding AIGC service to provide that service. The node scheduling service determines the target node for providing AIGC services to the mobile phone based on the node's state (idle or non-idle). To ensure the security of communication between the target node and the mobile phone, the IDS service verifies the phone's security. Once the phone is secure, the target node can communicate with it. The process of the mobile phone communicating with the cloud server through the IDS service will be described in detail below. Figure 3 As shown, the process includes:

[0086] S101. Before a node in the AIGC cluster comes online, the node calls the certificate authentication service to issue a certificate for that node.

[0087] In this context, "node online" indicates that the node is capable of providing AIGC services.

[0088] Certificate 1 is used for security trust verification of the node. Optionally, Certificate 1 can be stored in the security module of a new node and will not leave the security module.

[0089] In some embodiments, nodes are also pre-configured with a root certificate issued by a certificate authentication service. It should be understood that each node in an AIGC cluster has a root certificate.

[0090] In this embodiment of the application, when a node is set as a node in the AIGC cluster, if a new node joins the AIGC cluster, the new node cannot go online immediately. The certificate authentication service issues certificate 1 to the new node so that the new node can use certificate 1 to perform online related operations, such as registering with the node scheduling service.

[0091] S102, The security module in the node generates 10 key pairs corresponding to the node. Each key pair includes a public key and a private key.

[0092] Ten key pairs are stored in the security module, and the ten private keys in each key pair remain within the security module. Furthermore, the ten key pairs mentioned above are merely an example; nodes can generate other numbers of key pairs. In summary, the node generates key pairs (Node_Pub, Node_Priv), and the number of these key pairs is the preset key count.

[0093] For example, the security module can generate key pairs corresponding to nodes based on an asymmetric encryption algorithm. Specifically, the key processing module within the security module can generate key pairs corresponding to nodes.

[0094] S103. The node sends a registration request to the node scheduling service. The registration request includes the node's information, which includes the node's 10 public keys.

[0095] Optionally, node information may also include other information, such as the node's status. The node's status may include an idle state or a non-idle state. An idle state indicates that the node's load is low, while a non-idle state indicates that the node's load is high. It should be understood that when a node's status changes, the node can send its latest status to the node scheduling service to synchronize the node's status, thereby enabling the node scheduling service to accurately select a suitable target node based on the node's latest status.

[0096] S104. In response to the registration request, the node scheduling service verifies the validity of the node's certificate 1.

[0097] S105. If the node's certificate 1 is valid, the node scheduling service will create an index for each of the 10 public keys corresponding to the node, thus obtaining the index corresponding to each public key of the node.

[0098] In this embodiment, when a node registers with the node scheduling service, the node scheduling service can first verify the node's security through its certificate. The node scheduling service can verify the validity of the node's certificate 1 through the root certificate. If certificate 1 is valid, it indicates that the node is trustworthy, and the node scheduling service can create an index for each public key corresponding to the node to achieve node registration. For example, the indices of the 10 public keys corresponding to node A are pubA01, pubA02, pubA03, ..., pubA10.

[0099] If certificate 1 is invalid, it indicates that the node is not trustworthy, and the node scheduling service can refuse the node's registration. Optionally, the node scheduling service can return a registration failure message to the node.

[0100] It should be noted that Certificate 1 mentioned above includes a CCS root certificate signature. The root certificate is located at the root node of the certificate chain, and Certificate 1 is a leaf node in this chain. The node scheduling service can verify the authenticity of the CCS root certificate signature of Certificate 1 using the CCS public key in the root certificate. Successful verification indicates that Certificate 1 is genuine and valid. Failed verification indicates that Certificate 1 is forged and invalid.

[0101] In some embodiments, when a node registers with the node scheduling service, the node can be referred to as the registered node. Other nodes in the AIGC cluster can also verify the identity of the registered node through the root certificate of the registered node to determine whether the root certificate of the registered node was issued by CSS.

[0102] In some embodiments, the node scheduling service (i.e., the server where the node scheduling service resides) also has a certificate 1 issued by the certificate authentication service and a root certificate. Accordingly, the node can also verify the validity of the node scheduling service's certificate 1. For example, when sending a registration request, the node verifies the validity of the node scheduling service's certificate 1 based on the root certificate of the node scheduling service. If the node scheduling service's certificate 1 is valid, it indicates that the node scheduling service is trustworthy, and the node can continue to send registration requests to the node scheduling service. If the node scheduling service's certificate 1 is invalid, it indicates that the node scheduling service is untrustworthy, and the node stops sending registration requests to the node scheduling service.

[0103] Based on this, the node verifies the trustworthiness of the node scheduling service through certificate 1 of the node scheduling service, and the node scheduling service also verifies the trustworthiness of the node through certificate 1 of the node, realizing two-way authentication between the node and the node scheduling service to ensure the trustworthiness of both parties in data communication.

[0104] In some embodiments, if node certificate 1 is invalid, the node scheduling service can perform an anomaly alarm operation to indicate that the node is untrusted, in other words, to indicate that the node is abnormal. Similarly, if node certificate 1 of the node scheduling service is invalid, the node can also perform an anomaly alarm operation. The anomaly alarm operation may be to output (voice or display) an anomaly alarm message or send an anomaly alarm message to the terminal of relevant personnel so that relevant personnel can resolve the anomaly in a timely manner.

[0105] S106. After successful node registration, the node scheduling service sets the node to go online.

[0106] Among them, nodes that have gone online are trusted nodes that can provide AIGC services to clients, such as the mobile phones mentioned above.

[0107] In some embodiments, after a node successfully registers, the node scheduling service can send a registration success message to the node to inform it that the node has successfully registered.

[0108] It should be noted that the steps described in S101-S106 above are only one possible implementation process for node registration and going online. Node registration and going online can also involve other processes, which can be configured according to actual needs. For example, the node scheduling service does not need to verify the validity of the node's certificate 1, but directly creates indexes for the 10 public keys corresponding to that node. Alternatively, the indexes corresponding to the node's public keys may not be created by the node scheduling service, but rather created by the node itself and sent to the node scheduling service. For example, if a node has the permission to generate the indexes corresponding to its public keys, then the node can send its public keys and their corresponding indexes to the node scheduling service.

[0109] The above describes the process of node registration and going online in the AIGC cluster. The following section will describe how a mobile phone establishes a communication connection with the online nodes in the AIGC cluster through the IDS service and node scheduling service when running AIGC services.

[0110] S107. The mobile phone receives the user's trigger operation on the SMS knowledge base control in the mobile phone.

[0111] The SMS knowledge base control is used to trigger the phone to run the SMS knowledge base service, which is an AIGC (AIGC) service. Additionally, the user's triggering action on the SMS knowledge base control on the phone can be an example of the first action.

[0112] S108. In response to the triggering operation of the SMS knowledge base control, the mobile phone sends Request 1 to the IDS service. Request 1 instructs the mobile phone to start running the SMS knowledge base service.

[0113] Specifically, Request 1 (or the first request) is used to request node resources to provide SMS knowledge base services.

[0114] For example, when a user triggers the SMS knowledge base service through the SMS knowledge base control, the mobile phone (such as the YOYO suggestion application on the mobile phone) can send request 1 to the IDS service to indicate that the mobile phone is running the SMS knowledge base service and needs to apply for node resources.

[0115] For example, such as Figure 4 As shown, in response to a user's click on the YOYO Suggestions app icon 10, the phone can launch the YOYO Suggestions app and display the YOYO Suggestions interface 11. Subsequently, in response to a click on the SMS Knowledge Base control 12 on the YOYO Suggestions interface 11, the YOYO Suggestions app on the phone can run the SMS Knowledge Base service. Since the SMS Knowledge Base service is an AIGC service, the YOYO Suggestions app can send Request 1 to the IDS service to request node resources that provide the AIGC service through the IDS service.

[0116] In some embodiments, since running AIGC services requires access to mobile phone data, which may involve user data, the mobile phone may display a prompt message 1 (e.g., ...). Figure 5 The prompt message 20 shown is the same as prompt message 1), indicating that user data needs to be collected. Prompt message 20 may include, for example: Figure 5 The consent control 21 and the rejection control 22 are shown. When the user clicks the consent control 21, it indicates that the user agrees to the mobile phone collecting user data (including SMS data). In response to the click operation of the consent control 22, YOYO suggests that the application continue to send the above request 1.

[0117] When the user clicks the reject control 22, it indicates that the user does not agree to the collection of user data. In response to the click operation of the reject control 22, YOYO recommends that the application stop the above request 1.

[0118] S109, IDS service receives request 1.

[0119] In response to request 1, the S110 and IDS services authenticate the mobile phone. This authentication includes device authentication, app authentication, and user authentication.

[0120] In this embodiment, upon receiving Request 1, it indicates that the mobile phone needs to utilize the node to provide AIGC services. To ensure security, the IDS service can first authenticate the mobile phone to determine its trustworthiness, thereby preventing abnormalities in the nodes communicating with the mobile phone due to attacks. After successful authentication, the IDS service can determine that the mobile phone is trustworthy. This authentication may include device authentication, APP authentication, and user authentication.

[0121] User authentication is based on verifying the account logged in to the mobile phone to confirm whether the phone is logged into a Honor account. If the phone is successfully logged into an Honor account, the IDS service can determine that the user authentication was successful. Otherwise, the IDS service can determine that the user authentication failed.

[0122] Device authentication is based on verifying the device certificate on the mobile phone to confirm its validity. When the device certificate is determined to be valid, the IDS service can determine that the device authentication was successful. Conversely, when the device authentication is determined to be invalid, the IDS service can determine that the device certificate authentication failed.

[0123] App authentication verifies the identity of the app by examining the signature certificate fingerprint of the application within the device certificate. This verification determines that the interacting app is the one that sent request 1 (here, the YOYO recommended app), thus confirming successful app authentication. For example, the IDS service compares the signature certificate fingerprint of the YOYO recommended app in the device certificate with a pre-stored signature certificate fingerprint of the YOYO recommended app. If they match, the IDS service determines that request 1 was triggered by the YOYO recommended app, and app authentication succeeds. If they do not match, the IDS service determines that request 1 was not triggered by the YOYO recommended app, and app authentication fails.

[0124] S111. After successful authentication, the IDS service sends request 2 to the node scheduling service. Request 2 is used to request node resources that provide AIGC services.

[0125] Request 2 (or the second request) may be the same as or different from Request 1.

[0126] In this embodiment, when device authentication, APP authentication, and user authentication are all successful, it indicates that the mobile phone is secure, that is, trustworthy. Therefore, the IDS service can normally apply for node resources for the YOYO suggestion application on the mobile phone to provide the corresponding AIGC service.

[0127] In addition, when device authentication, APP authentication, or user authentication fails, it indicates that the phone's identity is suspicious and its security level is low. In order to ensure the security of the interaction, the IDS service stops applying for node resources for the phone.

[0128] It should be noted that the above authentication, including device authentication, app authentication, and user authentication, is merely an example; authentication can also include device authentication, app authentication, or user authentication alone. Correspondingly, successful authentication indicates that all aspects of the authentication process were successful. Taking successful authentication including app authentication as an example, when app authentication is successful, the IDS service can determine that the authentication was successful.

[0129] Alternatively, authentication can include two of the following methods: device authentication, app authentication, and user authentication. Correspondingly, successful authentication indicates that the authentication processes involved are successful. Taking device authentication and app authentication as an example, if both device authentication and app authentication succeed, the IDS service can determine that the authentication was successful. Conversely, if either device authentication or app authentication fails, the IDS service can determine that the authentication failed.

[0130] In summary, the above authentication methods can include one or more of device authentication, app authentication, or user authentication, which can be configured according to actual needs. For example, to improve mobile phone security, the IDS service can perform device authentication, app authentication, and user authentication. Alternatively, to improve authentication efficiency, the IDS service can perform device authentication, app authentication, or user authentication. And yet another example is that to ensure both mobile phone security and authentication efficiency, the IDS service can perform two of the following authentication methods: device authentication, app authentication, or user authentication.

[0131] S112. The node scheduling service determines the target node based on the status of the nodes in the AIGC cluster.

[0132] For example, the node scheduling service can perform idle scheduling based on the status of nodes in the AIGC cluster, such as selecting a node from nodes in an idle state and using the selected node as the target node.

[0133] The number of target nodes can be one or more.

[0134] S113. The node scheduling service generates the target node's OTP based on a dynamic cryptographic algorithm, and performs blind signing on the target node's OTP to obtain the blind-signed OTP.

[0135] Among them, OTP is a unique identifier. For example, if the node scheduling service determines that node C is the target node, then the node scheduling service can generate a TockenC for node C, and this TockenC is the OTP of the target node.

[0136] When there are multiple target nodes, the node scheduling service can generate an OTP for each target node.

[0137] In some embodiments, the above blind signature can be an RSA-based blind signature. The node scheduling service performs a blind signature on the OTP based on the RSA private key to obtain the blind-signed OTP.

[0138] S114. The node scheduling service sends the target node information to the IDS service. The target node information includes the target node's address, the blind-signed OTP of the target node, the 10 public keys corresponding to the target node, and the index corresponding to each public key.

[0139] Optionally, the target node information may also include other information, such as the identifier of the target node.

[0140] S115 and IDS services send target node information to the mobile phone.

[0141] For example, for each target node, the IDS service can transmit the target node information corresponding to that target node to the mobile phone.

[0142] S116. Mobile phone collects SMS data from the mobile phone.

[0143] Optionally, the aforementioned SMS data can be all SMS records on the phone, or SMS records within a target time period, which can be the phone's default time period, or a time period selected by the user, or SMS records selected by the user.

[0144] S117. The mobile phone generates a shared key 1 based on the private key corresponding to the mobile phone and public key 1 among the 10 public keys corresponding to the target node.

[0145] In this embodiment, the mobile phone randomly generates a key pair and uses this key pair as the key pair corresponding to the mobile phone. The key pair corresponding to the mobile phone (clientRandomPub, clientRandomPriv) may include the public key (clientRandomPub) and the private key (clientRandomPriv) of the mobile phone. Then, the mobile phone can generate shared key 1 (or the first shared key) based on the private key corresponding to the mobile phone and public key 1 from the 10 public keys corresponding to the target node.

[0146] Optionally, the mobile phone can use the ECDH algorithm to generate a shared key 1 based on the mobile phone's private key and public key 1 from the 10 public keys corresponding to the target node. tempAESKey = ECDH(clientRandomPriv, Node_Pub). Where tempAESKey represents shared key 1, clientRandomPriv represents the private key corresponding to the mobile phone, and Node_Pub represents public key 1 corresponding to the target node.

[0147] Optionally, public key 1 can be the first public key among the 10 public keys corresponding to the target node. The mobile phone can select a public key from the 10 public keys corresponding to the target node in index order and use the selected public key as public key 1. Alternatively, public key 1 can be any of the 10 public keys corresponding to the target node. The mobile phone can randomly select one public key from the 10 public keys and use it as public key 1.

[0148] In some embodiments, when there are multiple target nodes, the mobile phone can select one target node from among them as the target node for providing the AIGC service, i.e., the target node for communication with the mobile phone. Accordingly, the mobile phone can generate a shared key 1 based on its private key and public key 1 from the 10 public keys corresponding to the selected target node. For example, the mobile phone can randomly select a target node from among the target nodes.

[0149] In addition, if the selected target node fails (e.g., goes offline), the mobile phone can select another target node from the remaining target nodes to avoid communication interruption caused by the failure of the target node, which would lead to abnormal operation of the AIGC service. This ensures that the AIGC service on the mobile phone can operate normally, allowing users to use the AIGC service normally and improving user satisfaction.

[0150] S118. The mobile phone uses shared key 1 to encrypt the SMS data, thus obtaining encrypted SMS data.

[0151] S119. The mobile phone establishes a connection with the target node based on the target node's address.

[0152] S120, The mobile phone sends the blind-signed OTP to the target node.

[0153] In this embodiment of the application, since the IDS service has already sent the address of the target node to the mobile phone, the mobile phone can directly send the blind-signed OTP to the target node without having to continue communicating with the target node through the IDS service and the node scheduling service.

[0154] S121. The target node performs OTP authentication based on the blind-signed OTP.

[0155] In this embodiment of the application, when establishing a connection, the target node can perform OTP authentication based on the blind-signed OTP to determine whether the mobile phone is trustworthy.

[0156] In this context, OTP authentication refers to the target node verifying the blind-signed OTP. Successful verification indicates successful OTP authentication, while failed verification indicates failed OTP authentication. Taking the blind-signed OTP as an example (based on RSA-blind signing), the target node can use an RSA public key to verify the blind-signed OTP.

[0157] S122. If OTP authentication is successful, the mobile phone sends data 1 to the target node. Data 1 includes encrypted SMS data, the index corresponding to public key 1, and the public key corresponding to the mobile phone.

[0158] In this embodiment, after receiving data 1 from the mobile phone, the node scheduling service can perform OTP authentication to ensure security. If OTP authentication is successful, it indicates that the blind-signed OTP sent by the mobile phone was generated by the node scheduling service, the mobile phone is trustworthy, and the target node (or target server) can continue to communicate with the mobile phone. Thus, the mobile phone can continue to send relevant data for the SMS knowledge base service to the target node, namely data 1 (including encrypted SMS data (or alternatively described as first encrypted service data), the index corresponding to public key 1 (or first public key), and the public key corresponding to the mobile phone), for processing using the target node's AIGC model. Since the mobile phone can directly send data 1 to itself, the data transmission efficiency between the mobile phone and the target node is improved. Furthermore, the mobile phone sends encrypted SMS data, ensuring secure cloud transmission of user data, protecting user data security, and thus protecting user privacy.

[0159] In addition, if OTP authentication fails, it indicates that the mobile phone is untrusted. The target node stops communicating with the mobile phone, disconnects from the mobile phone, and the mobile phone stops running the SMS knowledge base service.

[0160] Specifically, the target node that the aforementioned mobile phone communicates with can be the node corresponding to the identifier of the target node corresponding to public key 1.

[0161] In some embodiments, the OTP after blind signing, or OTP, has an expiration time. It becomes invalid after the connection is broken. Since the blind-signed OTP is transmitted by the node scheduling service when the mobile phone requests node resources, it is a one-time transmission. When the mobile phone re-establishes a connection with the target node within a short period, it can continue transmitting relevant data for the SMS knowledge base service. However, if the mobile phone re-establishes a connection with the target node after a longer period, the target node cannot determine whether the mobile phone is still trustworthy. Therefore, the connection between the target node and the mobile phone is lost, and the mobile phone cannot continue transmitting relevant data for the SMS knowledge base service. Accordingly, the mobile phone can re-determine the target node for communication from other target nodes.

[0162] The connection (or session) established between the mobile phone and the target node is a long-lived connection. Specifically, a long-lived connection can be a socket long-lived connection.

[0163] In some embodiments, the mobile phone can also communicate with the target node through a node scheduling service. On the one hand, when the target node is abnormal, the mobile phone can avoid direct communication with the abnormal target node, thereby ensuring the security of the mobile phone. On the other hand, when the mobile phone is abnormal, the target node can avoid direct communication with the abnormal mobile phone, ensuring the security of the target node, and thus ensuring the security of user data on the target node. In this way, the security of the other party can be guaranteed when either the mobile phone or the target node is abnormal (e.g., under attack), ensuring the security of communication.

[0164] In some embodiments, the data included in Data 1 above, such as encrypted SMS data, the index corresponding to the public key, and the public key corresponding to the mobile phone, can be sent by the mobile phone all at once or sent separately. For example, the public key corresponding to the mobile phone can be generated by the mobile phone and then sent directly to the node scheduling service.

[0165] It should be noted that Data 1 above may also include the OTP after blind signing. The target node can first obtain the blind-signed OTP from Data 1. After successful OTP authentication, it can continue to process the encrypted SMS data in Data 1, thereby reducing the number of data transmissions.

[0166] In some embodiments, the OTP authentication described above is an optional step, and the node scheduling service does not need to generate an OTP. Accordingly, target node 1 also does not need to perform OTP authentication, and the mobile phone can directly send data 1 to the target node.

[0167] The above describes the implementation process of establishing secure mutual trust for connections. The following describes the implementation process of establishing secure mutual trust for runtime.

[0168] Establishment of operational security and mutual trust

[0169] The security module in the target node of the cloud server can decrypt encrypted SMS data sent by the mobile phone using the private key corresponding to the target node, obtaining the decrypted SMS data. Then, based on the AIGC model, the security module performs inference on the decrypted SMS data to obtain the corresponding inference results, providing AIGC services. This ensures that user data decryption and inference are performed within the security module, thereby guaranteeing user data security and protecting user privacy. The implementation process of the target node providing AIGC services will be further detailed below. Figure 6 As shown, the process includes:

[0170] S201, The target node receives data 1 sent by the mobile phone.

[0171] After receiving data 1, the target node can send data 1 to the security module. For example, the target node can send data 1 to the key processing module within the security module.

[0172] S202. The security module in the target node retrieves public key 1 based on the index corresponding to public key 1 in data 1.

[0173] In some embodiments, after the node scheduling service establishes the index corresponding to each public key of the target node, the node scheduling service can also send the index corresponding to each public key to the target node, so that the target node can determine the public key according to the index corresponding to the public key.

[0174] It should be noted that establishing the index corresponding to the node in this application is also an optional step. When the mobile phone interacts with the cloud, if it is necessary to transmit the index corresponding to the public key, the public key can be transmitted directly. For example, data 1 can include public key 1, but not the index corresponding to public key 1. In summary, the target node information mentioned above can include the public key information corresponding to the target node. The public key information includes N public keys corresponding to the target node, or N public keys and the index corresponding to each public key. N is a positive integer. Similarly, data 1 mentioned above includes encrypted SMS data, information about public key 1, and the public key corresponding to the mobile phone. The information about public key 1 can be public key 1 or the index corresponding to public key 1.

[0175] S203. The security module generates a shared key 2 based on the private key 1 corresponding to public key 1 and the public key corresponding to the mobile phone.

[0176] The encryption algorithm used to generate shared key 2 (or the second shared key) is the same as the encryption algorithm used to generate shared key 1.

[0177] Similar to the previous example, shared key 2 in S203 can be generated based on the ECDH algorithm. tempAES = ECDH(clientRandomPub, Node_Priv). Here, tempAES represents shared key 2, clientRandomPub represents the public key corresponding to the mobile phone, and Node_Priv represents the private key 1 corresponding to public key 1.

[0178] In this embodiment, since the 10 key pairs generated by the target node are stored in the security module, the security module can directly obtain the private key in the key pair to which public key 1 belongs, thus obtaining private key 1 (or the first private key) corresponding to public key 1. This private key 1 and the public key corresponding to the mobile phone can then be used to generate the corresponding shared key 2. For example, shared key 2 can be generated by the key processing module in the security module.

[0179] S204. The security module decrypts the encrypted SMS data in data 1 based on shared key 2 to obtain the decrypted SMS data.

[0180] For example, S204 described above can be executed by the key processing module in the security module. After obtaining the decrypted SMS data, the key processing module can input the decrypted SMS data into the model inference calculation module.

[0181] S205: The security module, based on the AIGC model, performs inference on the decrypted SMS data to obtain the SMS inference result.

[0182] For example, the model inference calculation module uses the decrypted SMS data as input parameters to the AIGC model within the module, runs the AIGC model to analyze and infer the decrypted SMS data, and obtains the corresponding SMS inference results (or alternatively, the processing results corresponding to the first encrypted business data). For instance, if the decrypted SMS data includes one thousand SMS messages, the AIGC module can perform inductive analysis on these one thousand messages to obtain the corresponding SMS inference results. These inference results include the source of the SMS messages, such as which messages belong to specific contacts and which are advertisements. Alternatively, the SMS inference results may include information about SMS messages at different points in time. This application does not impose any limitations on the SMS inference results.

[0183] In this embodiment, to prevent the leakage of user privacy, the target node can decrypt the encrypted SMS data (i.e., user-related data, which may be sensitive personal data) within its security module to obtain decrypted SMS data. Modules of the target node other than the security module then obtain the decrypted SMS data, thus preventing the leakage of user privacy. Furthermore, the target node also directly performs inference on the decrypted SMS data within its security module to obtain the corresponding inference results, which also ensures the security of user data and protects user privacy.

[0184] In some embodiments, the target node can provide one or more AIGC services and deploy AIGC models corresponding to different AIGC services. In other words, each AIGC model can be used to implement an AIGC service. To enable the target node to accurately and quickly determine the required AIGC model, the mobile phone can send the service identifier corresponding to the SMS knowledge base to the target node through the node scheduling service. In one case, the target node (such as the service module in the target node) determines the identifier of the AIGC model corresponding to the service identifier and sends the identifier of the AIGC model to the security module. The security module (such as the model inference calculation module in the security module) can determine the AIGC model providing the AIGC service corresponding to the SMS knowledge base based on the identifier of the AIGC model, so that the decrypted SMS data can be inferred using the AIGC model.

[0185] In another scenario, the target node can directly send the business identifier corresponding to the SMS knowledge base to the security module, so that the model inference and calculation module in the security module can determine the AIGC model based on the business identifier.

[0186] S206. The security module encrypts the SMS reasoning result based on shared key 2 to obtain the encrypted reasoning result.

[0187] The above describes the process of AIGC model inference, encryption, and decryption within the security module. Next, the target node needs to utilize the business module to perform relevant business processing.

[0188] S207. The security module sends the encrypted inference result to the business module.

[0189] Since SMS inference results may also involve user privacy, the target node can encrypt the SMS inference results within its security module, obtaining encrypted inference results. Then, the security module can send the encrypted inference results to the business module, effectively removing the encrypted inference results from the security module, instead of sending the SMS inference results directly to the business module. This avoids the leakage of unencrypted SMS inference results, protecting data security and user privacy. Furthermore, because the target node's business module receives encrypted inference results, rather than SMS inference results, it ensures that user data is not used for business purposes.

[0190] In this embodiment, the target node utilizes trusted computing technology (such as the security module described above) to determine that the environment in which the target node processes user data is trusted, thereby protecting user security. Furthermore, the security module protects the user data processing process at the hardware level. It is understood that the security module is only one example of trusted computing technology; other trusted computing technologies, such as trusted platform modules (TPM) and TEEs, can also be used.

[0191] In some embodiments, the operations performed by the security module in S206 and S207 above may be performed by the key processing module in the security module.

[0192] S208. The business module encapsulates the encrypted inference result to obtain the encapsulated inference result.

[0193] For example, the upper-layer business module can encapsulate the encrypted inference result by adding specific business data to it. This encapsulated inference result can also be referred to as the target processing result.

[0194] S209. The business module sends the encapsulated inference results to the mobile phone.

[0195] In some embodiments, since the AIGC model in the security module (such as the model inference computation module within the security module) is small, to improve data processing efficiency, the model inference computation module can utilize models in the model set (such as AIGC models) for inference. For example, the model inference computation module can perform preliminary processing on the decrypted SMS data to obtain a preliminary inference result. Then, the model inference computation module can input the preliminary inference result into the relevant AIGC model in the model set, so that the relevant AIGC model in the model set can further process the preliminary inference result to obtain the SMS inference result. Then, the AIGC model continues to send the SMS inference result to the key processing module in the security module, so that the key processing module can use shared key 2 to encrypt the SMS inference result, obtaining the encrypted inference result. Because the security module performs preliminary processing on the decrypted SMS data, rather than directly sending the decrypted SMS data to the model set outside the security module, the security of user data is guaranteed to a certain extent, and user privacy is also protected.

[0196] Optionally, the aforementioned preliminary processing can be configured according to requirements. For example, to prevent the leakage of user privacy, the preliminary processing may include de-identification of the decrypted SMS data, such as replacing sensitive data, like phone numbers, in the decrypted SMS data with specific information.

[0197] S210, The security module deletes public key 1 and the corresponding private key 1.

[0198] In this embodiment, to ensure security, the key pair corresponding to the target node can have an expiration date. After obtaining the shared key generated based on the private key 2 corresponding to public key 1, the security module can delete public key 1 and the private key 2 corresponding to public key 1, avoiding the reuse of the key pair, thereby reducing the risk of private key leakage in the key pair, and thus ensuring the security of user data.

[0199] Optionally, the security module can also delete information related to public key 1, such as the index corresponding to public key 1.

[0200] In some embodiments, the connection established between the mobile phone and the target node is a persistent connection. Therefore, after the persistent connection is closed, the security module in the target node deletes the public key corresponding to the persistent connection and the private key corresponding to that public key (such as public key 1 and private key 1 mentioned above). The public key corresponding to the persistent connection may be the public key of the target node used in the encrypted SMS data transmitted through the persistent connection. It should be understood that the public key corresponding to the persistent connection becomes invalid after the persistent connection is closed.

[0201] S211. If the number of remaining key pairs corresponding to the target node is less than or equal to a preset number, the security module generates a new key pair corresponding to the target node. The sum of the number of the new key pair and the number of remaining key pairs is 10.

[0202] The remaining key pairs represent the unused key pairs in the key pairs corresponding to the target node, that is, the key pairs that have not expired. In other words, the mobile phone has not yet used the public key in the remaining key pairs to encrypt data.

[0203] In this embodiment, the security module can determine whether the number of remaining key pairs corresponding to the target node is less than or equal to a preset number. If the number of remaining key pairs is less than or equal to the preset number, it indicates that there are few remaining key pairs. In order to ensure that the mobile phone can generate a shared key using the public key corresponding to the target node in a timely manner, the security module (such as the key processing module in the security module) can generate new key pairs. The number of new key pairs is the difference between 10 (i.e., the preset number of keys) and the number of remaining key pairs, so that the number of public keys corresponding to the target node that the mobile phone can use reaches the preset number of keys, thus meeting the usage requirements of the mobile phone.

[0204] If the number of remaining key pairs is greater than the preset number, it means that the remaining key pairs can still meet the needs of the mobile phone. Therefore, the security module does not need to generate new key pairs.

[0205] The preset number can be set according to requirements. For example, if the preset number is 9, the security module can generate a new key pair after deleting one. Or, if the preset number is 0, all key pairs will be invalidated after the security module deletes them, and the target node can regenerate 10 key pairs.

[0206] It should be noted that the security module may not delete public key 1 and its corresponding private key 1, but instead directly generate a new key pair for the target node. Furthermore, the target node may not generate a new key pair by checking if the number of remaining key pairs is less than or equal to a preset number, but may instead generate a certain number of new key pairs at regular intervals. The sum of the number of new key pairs and the number of remaining key pairs may not be the preset number of key pairs.

[0207] S212. The security module registers the public key of the new key pair corresponding to the target node with the node scheduling service.

[0208] S213, The node scheduling service generates an index corresponding to the new public key.

[0209] Similar to the previous example, for each new key pair, i.e., for each new public key, the node scheduling service can generate an index corresponding to that new public key.

[0210] S214. The node scheduling service sends the new public key corresponding to the target node and the index corresponding to the new public key to the mobile phone.

[0211] Similar to the previous example, the node scheduling service can send the public key of the new target node and its corresponding index to the IDS service. The IDS service can then send the public key and its corresponding index to the mobile phone. Alternatively, the node scheduling service can send the index corresponding to the new public key to the target node, and the target node can send the new public key and its corresponding index to the mobile phone. Furthermore, when the target node has the permission to generate an index corresponding to a public key, it can directly send the new public key and its corresponding index to the mobile phone.

[0212] The implementation process of S212-S214 can be found in the previous text, and will not be repeated here.

[0213] S215, The mobile phone receives the inference results after encapsulation.

[0214] S216. The mobile phone deletes the public key 1 corresponding to the target node.

[0215] Optionally, the phone can delete information related to public key 1, such as the index corresponding to public key 1.

[0216] In some embodiments, similar to the preceding text, after the long connection between the mobile phone and the target node is broken, it indicates that the public key corresponding to the target node used for transmitting encrypted SMS data based on the long connection, i.e., the public key corresponding to the long connection (such as public key 1 mentioned above), has become invalid. The mobile phone can re-establish a long connection with the node scheduling service and select a public key from the remaining public keys corresponding to the target node. This public key can then be reused as public key 1. When data needs to be transmitted to the target node again, the mobile phone can use the new public key 1 (or alternatively described as the second public key) to encrypt and transmit the data (or the second encrypted service data). The selected public key corresponding to the target node can be used as the public key corresponding to the long connection, and when the re-established long connection is broken, the public key corresponding to the long connection also becomes invalid.

[0217] It should be noted that, similar to the previous point, the mobile phone may not delete the public key corresponding to the invalid target node, that is, it may not execute S216 above. Furthermore, the target node may not encapsulate the cryptographic inference result, but may directly send the cryptographic inference result to the mobile phone. Accordingly, S208 above is optional.

[0218] S217. The mobile phone obtains the encrypted inference result from the encapsulated inference result.

[0219] S218. The mobile phone uses shared key 1 to decrypt the encrypted reasoning result and obtain the decrypted SMS reasoning result.

[0220] S219. The mobile phone displays the decrypted SMS reasoning result.

[0221] For example, the mobile phone can display the decrypted SMS inference results (or alternatively describe them as the decrypted results) in a preset display mode, such as displaying the decrypted SMS inference results in the form of a list.

[0222] In this embodiment, the target node uses a security module to securely process user data, ensuring its security and protecting user privacy. Furthermore, during interaction between the client and the cloud, both parties use a combination of symmetric and asymmetric encryption to ensure the confidentiality and integrity of data during transmission, thereby guaranteeing data security and preventing user privacy leaks.

[0223] Optionally, the mobile phone can also perform corresponding processing operations on the business data in the encapsulated inference results as needed, such as displaying the business data.

[0224] In some embodiments, when the mobile phone runs AIGC services again (such as SMS knowledge base services or image knowledge base services), it needs to interact with the cloud again, and the mobile phone can return to S108 as described above. However, the determined public key 1 is a new public key determined from the remaining public keys (or the latest public key) corresponding to the target node. This remaining public key represents the unused public key corresponding to the target node, that is, the public key corresponding to the target node that has not yet been used to generate the shared key. Alternatively, the mobile phone can also communicate directly with the node scheduling service without going through the IDS service. Optionally, when the mobile phone runs AIGC services again, it can reapply for node resources or not; this application does not impose any restrictions on this.

[0225] In some embodiments, not only may the target node obtain the encryption inference result normally as described above, but there is also a possibility that it cannot obtain the encryption inference result. For example, when the security module cannot successfully decrypt the encrypted SMS data using the private key corresponding to the target node, it indicates that the public key corresponding to the target node or the private key corresponding to the mobile phone used to encrypt the SMS data is forged, and the encrypted SMS data may have been tampered with. Therefore, the security module can discard the encrypted SMS data and send an alarm message to the mobile phone. In response to this alarm message, the mobile phone can report an error and output prompt message 1, which instructs the SMS knowledge base to stop operating.

[0226] Alternatively, prompt message 1 (see Figure 7 The prompt message 30 shown may also include a retry control (see [link]). Figure 7 The retry control 31 shown is used to trigger a re-run of the SMS knowledge base service. For example, the mobile phone may reselect a public key from the remaining public keys corresponding to the target node, and generate a shared key based on the reselected public key and the mobile phone's private key. This allows the phone to resend encrypted SMS data, which has been encrypted using the shared key, to the node scheduling service. Of course, the target node can also be a target node reselected by the mobile phone.

[0227] Alternatively, as described above Figure 7 As shown, the aforementioned prompt 30 (i.e., the aforementioned prompt 1) can be displayed in the form of a pop-up window. Alternatively, prompt 30 may also include an end control 32, which is used to trigger the termination of the SMS knowledge base service, such as allowing the phone to exit the YOYO suggestion application and display the desktop.

[0228] In some embodiments, as described above Figure 1 As shown, the target node also includes a code signing and authentication service. This service performs security checks on the business code of the business modules, preventing tampering and ensuring the integrity of the business code.

[0229] For example, such as Figure 8 As shown, since the business code runs in memory, the code signing and authentication service can execute S301 to determine the target code segment from the business code running in memory on the target node.

[0230] Afterwards, the code signing and authentication service can execute S302 to calculate the hash value of the target code segment. The hash value of the target code segment is used to reflect the target code segment that is actually running.

[0231] Afterwards, the code signing authentication service can execute S303 to determine whether the hash value of the target code segment is the same as its standard hash value. The standard hash value of the target code segment is used to reflect the correctness of the target code segment.

[0232] If the hash value of the target code segment is the same as the standard hash value of the target code segment, it indicates that the target code segment has not been tampered with and is normal, which means that the business code is normal. Therefore, the code signing authentication service can execute S304.

[0233] If the hash value of the target code segment is different from the standard hash value of the target code segment, it indicates that the target code segment has been tampered with and is abnormal, which means that the business code is abnormal. Therefore, the code signing authentication service can execute S305.

[0234] The standard hash value of the target code segment can be obtained by calculating the hash value of the target code segment when the target node is first started. Of course, the standard hash value of the target code segment can also be preset.

[0235] S304. The code signing and authentication service continues to perform the next business code inspection. For example, the code signing and authentication service may perform business code inspections irregularly or periodically (i.e., periodically) to achieve trust inspection during code execution.

[0236] S305. The code signing and authentication service sends notification message 1 to the node scheduling service. Notification message 1 indicates that the target node is abnormal.

[0237] Upon receiving notification message 1 (or the first notification message), the node scheduling service can execute S306 to take the target node offline and send notification message 1 to the mobile phone. Once offline, the target node can no longer provide AIGC services.

[0238] After receiving notification message 1, the mobile phone can execute S307 in response to notification message 1 and output prompt message 2. Prompt message 2 prompts the user to re-enter the SMS knowledge base service.

[0239] Optionally, prompt message 2 (see Figure 9The displayed prompt message 40 may also include an agree control 41 and a refuse control 42. The agree control 41 is used to trigger the mobile phone to restart the SMS knowledge base service. The refuse control 42 is used to trigger the mobile phone to stop the SMS knowledge base service. Here, prompt message 2 can also be referred to as the first prompt message.

[0240] The process of re-establishing the SMS knowledge base service is similar to that of establishing the SMS database service described above, except that the mobile phone does not need to re-collect SMS data and does not need to re-apply for node resources; it only needs to redetermine the target node.

[0241] The re-determined target node (or new target server) can be a target node selected by the mobile phone from multiple target nodes excluding abnormal target nodes. This can be alternatively described as determining a new target server from other candidate servers besides the target server among the multiple candidate servers. Alternatively, the re-determined target node can be the mobile phone re-requesting node resources from the node scheduling service; this application does not limit this.

[0242] Alternatively, the mobile phone can re-request node resources from the node scheduling service through the IDS service.

[0243] In some embodiments, in response to notification message 1, the mobile phone can directly resume the SMS knowledge base service without user triggering, such as clicking the above. Figure 9 The consent control 41 in the middle avoids users wondering why the SMS knowledge base is malfunctioning and protects the user experience.

[0244] In this embodiment of the application, during the execution of the business code, the target node can verify the target code segment (i.e., the critical business code) in the runtime memory to determine the integrity of the target code segment and whether it has been tampered with, thereby ensuring the security of the business code execution.

[0245] In some embodiments, such as Figure 1 As shown, the target node can also include a model set. Since the model set is not within the secure module, the models within it are susceptible to tampering. Correspondingly, the code signing and authentication service can also perform security checks on the model set. Similar to the previous example, as... Figure 10 As shown, the code signing authentication service can execute S401, retrieving the static dataset for each model in the model set. It should be understood that, generally speaking, the static dataset of a model does not change.

[0246] Afterwards, the code signing and authentication service can execute S402 to calculate the hash value of the model's static dataset, thus obtaining the model's hash value. The model's hash value is used to reflect the current status of the model's actual static dataset.

[0247] Afterwards, the code signing authentication service can execute S403 to determine whether the model's hash value is the same as the model's standard hash value. The model's standard hash value is used to reflect the correct static dataset of the model.

[0248] If the model's hash value is the same as its standard hash value, it indicates that the model's static dataset has not been tampered with, meaning the model is normal. The current security check of the model is complete, and therefore, the code signing authentication service can execute S404.

[0249] If the hash value of the model differs from the standard hash value of the model, it indicates that the model has been tampered with, meaning the model is abnormal. Therefore, the code signing authentication service can execute S405.

[0250] The standard hash value of the model can be obtained by calculating the hash value of the model's static dataset when the target node is first started. Alternatively, the standard hash value of the model can be calculated when the target node installs the model. Of course, the standard hash value of the model can also be preset. This preset standard hash value of the model can be calculated based on the model's static dataset when the model is published.

[0251] S404. The code signing authentication service continues with the next model check. For example, the code signing authentication service can perform security checks on the models in the model set periodically or irregularly (i.e., periodically) to achieve dynamic trust checks during the operation of the model set.

[0252] S405, the code signing and authentication service sends notification message 1 to the node scheduling service. Notification message 1 indicates that the target node is abnormal.

[0253] Upon receiving notification message 1, the node scheduling service can execute S406 to take the target node offline and send notification message 1 to the mobile phone. Once offline, the target node can no longer provide AIGC services.

[0254] After receiving notification message 1, the mobile phone can execute S407 in response to notification message 1 and output prompt message 2, which prompts the user to re-enter the SMS knowledge base service.

[0255] In this embodiment of the application, during the operation of the model set, the target node can verify the model to determine its integrity and whether it has been tampered with, thereby ensuring the security of the AIGC model operation.

[0256] In some embodiments, the operations performed by the node scheduling service can be operations performed by the server where the node scheduling service resides (or server 1). A node can be a server or a virtual machine; different nodes can reside on different servers, and some or all nodes can reside on the same server. However, generally speaking, the operations performed by the nodes can be simply understood as operations performed by server 2. Server 1 (or the third server) and server 2 (or the second server) can be the same server or different servers; this application does not impose any limitations on them.

[0257] It is understood that the execution order of the steps shown above is only an example, and the step numbers do not represent the actual execution order of the steps. For example, S211 (i.e., the security module deletes public key 1 and the private key 1 corresponding to public key 1) can be executed before S209 (i.e., the business module sends the encapsulated inference result to the node management service), or after S209, or at the same time. This application does not impose any restrictions on it.

[0258] It should be noted that after a user triggers the SMS knowledge base service, the operations performed by the mobile phone can be those suggested by YOYO on the phone. However, in general, it is still performed by the mobile phone. Furthermore, the operations performed by the modules in the aforementioned target node (such as the security module, business module, and SVD) are actually performed by the target node itself, that is, by server 2 to which the target node belongs.

[0259] Similarly, the operations performed by the node scheduling service are actually executed by server 1, where the node scheduling service resides. The operations performed by the IDS service are actually executed by server 3 (or the first server), where the IDS service resides. Generally, server 3 and server 1 are different devices; however, they can also be the same device, and this application does not limit this.

[0260] It is understood that the above-mentioned server processing the business data collected by the mobile phone through the AIGC model is only one possible way to process business data. The server may also process the data directly through a preset algorithm instead of through the AIGC model, and this application does not impose any restrictions on this.

[0261] In some embodiments, the above description uses an SMS knowledge base service as an example to illustrate the process of a mobile phone providing an SMS knowledge base service through the cloud. This SMS knowledge base service is an AIGC (AI Generic Data Collection) service, and the corresponding SMS knowledge base service is an AIGC service. Of course, the mobile phone can also run other AIGC services, that is, provide other AIGC services to users. Furthermore, the solution described in this application can also be applied to scenarios involving non-AIGC services; this application does not limit the type of service.

[0262] Furthermore, the aforementioned mobile phone is merely one example of an electronic device. This electronic device can also be other devices, such as tablets, desktop computers, laptops, handheld computers, notebook computers, ultra-mobile personal computers (UMPCs), netbooks, wearable devices (smartwatches, smart bracelets, etc.), personal digital assistants (PDAs), augmented reality (AR) / virtual reality (VR) devices, and other devices capable of running applications. This application does not impose any special limitations on the specific form of this electronic device.

[0263] For example, Figure 10 A schematic diagram of the structure of the electronic device 200 is shown. Figure 10 A schematic diagram of the structure of electronic device 200 is shown. For example... Figure 10 As shown, the electronic device 200 may include a processor 210, an external memory interface 220, an internal memory 221, a universal serial bus (USB) interface 230, a charging management module 211, a power management module 212, a battery 213, an antenna 1, an antenna 2, a mobile communication module 240, a wireless communication module 250, an audio module 270, a speaker 270A, a receiver 270B, a microphone 270C, a headphone jack 270D, a sensor module 280, buttons 290, a motor 291, an indicator 292, a camera 293, a display screen 294, and a subscriber identification module (SIM) card interface 295, etc.

[0264] It is understood that the structures illustrated in the embodiments of the present invention do not constitute a specific limitation on the electronic device 200. In other embodiments of this application, the electronic device 200 may include more or fewer components than illustrated, or combine some components, or split some components, or have different component arrangements. The illustrated components may be implemented in hardware, software, or a combination of software and hardware.

[0265] Processor 210 may include one or more processing units, such as application processor (AP), modem processor, graphics processing unit (GPU), image signal processor (ISP), controller, memory, video codec, digital signal processor (DSP), baseband processor, and / or neural network processing unit (NPU). Different processing units may be independent devices or integrated into one or more processors.

[0266] The controller can be the nerve center and command center of the electronic device 200. The controller can generate operation control signals based on the instruction opcode and timing signals to control the fetching and execution of instructions.

[0267] The processor 210 may also include a memory for storing instructions and data. In some embodiments, the memory in the processor 210 is a cache memory. This memory can store instructions or data that the processor 210 has just used or that are used repeatedly. If the processor 210 needs to use the instruction or data again, it can directly retrieve it from the memory. This avoids repeated accesses, reduces the waiting time of the processor 210, and thus improves the efficiency of the system.

[0268] The wireless communication function of electronic device 200 can be implemented through antenna 1, antenna 2, mobile communication module 240, wireless communication module 250, modem processor, and baseband processor.

[0269] Antenna 1 and antenna 2 are used to transmit and receive electromagnetic wave signals. Each antenna in electronic device 200 can be used to cover one or more communication frequency bands. Different antennas can also be multiplexed to improve antenna utilization. For example, antenna 1 can be multiplexed as a diversity antenna for a wireless local area network. In some other embodiments, the antennas can be used in conjunction with a tuning switch.

[0270] The mobile communication module 240 can provide solutions for wireless communication, including 2G / 3G / 4G / 5G, applied to the electronic device 200. The mobile communication module 240 may include at least one filter, switch, power amplifier, low noise amplifier (LNA), etc. The mobile communication module 240 can receive electromagnetic waves via antenna 1, and perform filtering, amplification, and other processing on the received electromagnetic waves before transmitting them to a modem processor for demodulation. The mobile communication module 240 can also amplify the signal modulated by the modem processor and convert it into electromagnetic waves for radiation via antenna 1. In some embodiments, at least some functional modules of the mobile communication module 240 may be housed in the processor 210. In some embodiments, at least some functional modules of the mobile communication module 240 and at least some modules of the processor 210 may be housed in the same device.

[0271] The modem processor may include a modulator and a demodulator. The modulator modulates the low-frequency baseband signal to be transmitted into a mid-to-high frequency signal. The demodulator demodulates the received electromagnetic wave signal into a low-frequency baseband signal. The demodulator then transmits the demodulated low-frequency baseband signal to the baseband processor for processing. After processing by the baseband processor, the low-frequency baseband signal is transmitted to the application processor. The application processor outputs sound signals through an audio device (not limited to speaker 270A, receiver 270B, etc.) or displays images or videos through the display screen 294. In some embodiments, the modem processor may be a separate device. In other embodiments, the modem processor may be independent of the processor 210 and may be housed in the same device as the mobile communication module 240 or other functional modules.

[0272] The wireless communication module 250 can provide solutions for wireless communication applications on the electronic device 200, including wireless local area networks (WLAN) (such as Wi-Fi), Bluetooth (BT), global navigation satellite system (GNSS), frequency modulation (FM), near field communication (NFC), and infrared (IR). The wireless communication module 250 can be one or more devices integrating at least one communication processing module. The wireless communication module 250 receives electromagnetic waves via antenna 2, performs frequency modulation and filtering of the electromagnetic wave signal, and sends the processed signal to processor 210. The wireless communication module 250 can also receive signals to be transmitted from processor 210, perform frequency modulation and amplification, and convert them into electromagnetic waves for radiation via antenna 2.

[0273] The electronic device 200 implements display functions through a GPU, a display screen 294, and an application processor. In some embodiments, the electronic device 200 may include one or N display screens 294, where N is a positive integer greater than 1.

[0274] Electronic device 200 can perform shooting functions through ISP, camera 293, video codec, GPU, display screen 294 and application processor.

[0275] The external storage interface 220 can be used to connect an external memory card, such as a Micro SD card, to expand the storage capacity of the electronic device 200.

[0276] Internal memory 221 can be used to store computer executable program code, which includes instructions. Processor 210 executes various functional applications and data processing of electronic device 200 by running the instructions stored in internal memory 221. Internal memory 221 may include a program storage area and a data storage area. The program storage area may store the operating system, at least one application program required for a function, etc. The data storage area may store data created during the use of electronic device 200 (such as audio data, phonebook, etc.). Furthermore, internal memory 221 may include high-speed random access memory and may also include non-volatile memory, such as at least one disk storage device, flash memory device, universal flash storage (UFS), etc.

[0277] Electronic device 200 can implement audio functions such as music playback and recording through audio module 270, speaker 270A, receiver 270B, microphone 270C, headphone jack 270D, and application processor.

[0278] Buttons 290 include a power button, volume buttons, etc. Indicator 292 may be an indicator light.

[0279] The sensor module 280 may include pressure sensors, gyroscope sensors, barometric pressure sensors, magnetic sensors, accelerometers, distance sensors, proximity sensors, fingerprint sensors, temperature sensors, touch sensors, ambient light sensors, bone conduction sensors, etc.

[0280] The collection, storage, use, processing, transmission, provision, and disclosure of user personal information in the technical solution disclosed in this application are all done with the consent of the user, comply with the provisions of relevant laws and regulations, and do not violate public order and good morals.

[0281] The above mainly describes the solutions provided by the embodiments of this application from a methodological perspective. It is understood that, in order to achieve the above functions, the electronic device includes hardware structures and / or software modules corresponding to the execution of each function. Based on the units and algorithm steps of the various examples described in the embodiments disclosed in this application, the embodiments of this application can be implemented in hardware or a combination of hardware and computer software.

[0282] Whether a function is implemented through hardware or by a computer-driven hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described function for each specific application, but such implementations should not be considered beyond the scope of the technical solutions in this application.

[0283] This application provides embodiments for dividing an electronic device into functional modules based on the above method examples. For example, each function can be divided into its own functional modules, or two or more functions can be integrated into a single processing unit. The integrated unit can be implemented in hardware or as a software functional module. It should be noted that the unit division in this application embodiment is illustrative and represents only one logical functional division; in actual implementation, other division methods may be used.

[0284] like Figure 12The diagram shown is a structural schematic of an electronic device provided in an embodiment of this application. This electronic device 1000 can be used to implement the methods executed by the electronic devices described in the above method embodiments. For example, the electronic device 1000 may include a processing unit 1001, a communication unit 1002, and a display unit 1003. The processing unit 1001 is used to support the electronic device 1000 in executing... Figures 3 to 11 The electronic device 1000 includes a processing function, a communication unit 1002 for supporting the communication function of the electronic device 1000, and a display unit 1003 for supporting the display function of the electronic device 1000.

[0285] Optional, Figure 12 The illustrated electronic device 1000 may also include a storage unit ( Figure 12 (not shown in the image), this storage unit stores a program or instruction. When the processing unit 1001 executes the program or instruction, it causes... Figure 12 The electronic device 1000 shown can perform the method described in the above-described method embodiments.

[0286] Figure 12 The technical effects of the electronic device 1000 shown can be referred to the technical effects described in the above method embodiments, and will not be repeated here. Figure 12 The processing unit 1001 in the illustrated electronic device 1000 can be implemented by a processor or processor-related circuit components, and can be a processor or processing module. The communication unit 1002 can be implemented by a transceiver or transceiver-related circuit components, and can be a transceiver or transceiver module. The display unit 1003 can be implemented by display screen-related components.

[0287] Similarly, the servers mentioned above (such as server 1, server 2, and server 3) include a processing unit and a communication unit. The processing unit is used to support the server in executing... Figures 1 to 10 The processing function and communication unit of any of the servers described herein are used to support the communication function of the server.

[0288] Optionally, the server may also include a display unit to support the server's display functions.

[0289] Optionally, the server may further include a storage unit that stores programs or instructions. When the processing unit executes the program or instructions, the server can perform the methods described in the above embodiments.

[0290] In some embodiments, when the server is used as server 2, the server may also include a security module.

[0291] This application also provides a chip system, such as... Figure 13As shown, the chip system includes at least one processor 1101 and at least one interface circuit 1102. The processor 1101 and the interface circuit 1102 are interconnected via lines. For example, the interface circuit 1102 can be used to receive signals from other devices. As another example, the interface circuit 1102 can be used to send signals to other devices (e.g., the processor 1101). Exemplarily, the interface circuit 1102 can read instructions stored in memory and send those instructions to the processor 1101. When the instructions are executed by the processor 1101, the electronic device can perform the various steps performed by the electronic device in the above embodiments. Of course, the chip system may also include other discrete devices, and this application embodiment does not specifically limit this.

[0292] Optionally, the chip system may include one or more processors. These processors can be implemented in hardware or software. When implemented in hardware, the processor can be a logic circuit, an integrated circuit, etc. When implemented in software, the processor can be a general-purpose processor, implemented by reading software code stored in memory.

[0293] Optionally, the chip system may contain one or more memories. The memory may be integrated with the processor or disposed separately from it; this application does not limit this. For example, the memory may be a non-transient processor, such as a read-only memory (ROM), which may be integrated with the processor on the same chip or disposed separately on different chips. This application does not specifically limit the type of memory or the arrangement of the memory and processor.

[0294] For example, the chip system may be a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), a system on chip (SoC), a central processor unit (CPU), a network processor (NP), a digital signal processor (DSP), a micro controller unit (MCU), a programmable logic device (PLD), or other integrated chips.

[0295] In some embodiments, this application also provides a chip system including at least one processor and at least one interface circuit. The processor and the interface circuit are interconnected via lines. When instructions are executed by the processor, the server can perform the various steps executed by the server in the above embodiments. Of course, the chip system may also include other discrete devices, and this application does not specifically limit this.

[0296] It should be understood that each step in the above method embodiments can be completed by integrated logic circuits in the processor hardware or by instructions in software form. The method steps disclosed in the embodiments of this application can be directly manifested as being executed by a hardware processor, or being executed by a combination of hardware and software modules in the processor.

[0297] This application also provides a computer storage medium storing computer instructions. When the computer instructions are executed on an electronic device, the electronic device performs the business processing method described in the above method embodiments.

[0298] This application also provides a computer storage medium storing computer instructions. When the computer instructions are run on a server, the server executes the business processing method described in the above method embodiments.

[0299] This application provides a computer program product, which includes a computer program or instructions. When the computer program or instructions are run on an electronic device, the electronic device performs the business processing method described in the above method embodiments.

[0300] This application provides a computer program product, which includes a computer program or instructions. When the computer program or instructions are run on a server, the server executes the business processing method described in the above method embodiments.

[0301] In addition, this application embodiment also provides an apparatus, which may specifically be a chip, component, or module. The apparatus may include a connected processor and a memory. The memory stores computer execution instructions. When the apparatus is running, the processor executes the computer execution instructions stored in the memory to cause the apparatus to perform the business processing methods described in the above-described method embodiments. The electronic devices, servers, computer storage media, computer program products, or chips provided in this embodiment are all used to execute the corresponding methods provided above. Therefore, the beneficial effects they achieve can be referred to in the beneficial effects of the corresponding methods provided above, and will not be repeated here.

[0302] Through the above description of the embodiments, those skilled in the art will understand that, for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0303] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. The embodiments can be combined with or referenced to each other without conflict. The apparatus embodiments described above are merely illustrative; for example, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another device, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0304] The units described as separate components may or may not be physically separate. A component shown as a unit can be one or more physical units; that is, it can be located in one place or distributed in multiple different locations. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0305] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0306] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium. Based on this understanding, the technical solutions of the embodiments of this application, in essence, or the parts that contribute to the prior art, or all or part of the technical solutions, can be embodied in the form of a software product. This software product is stored in a storage medium and includes several instructions to cause a device (which may be a microcontroller, chip, etc.) or processor to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0307] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A business processing method, characterized in that, Applied to electronic devices, the method includes: Receive a first operation; wherein the first operation is used to trigger the electronic device to run a first service; Send a first request to the first server; wherein the first request is used to obtain information about the target server that processes the first service; Receive server information sent by the first server; wherein, the server information includes the address of the target server and N public keys corresponding to the target server, where N is a positive integer; Based on the address of the target server, first data is sent to the target server; wherein, the first data includes first encrypted service data, the public key corresponding to the electronic device, and the first public key information corresponding to the target server; the first encrypted service data is obtained by encrypting the service data of the first service based on the first shared key; the first shared key is generated based on the first public key indicated by the first public key information among the N public keys corresponding to the target server and the private key corresponding to the electronic device; The system receives a target processing result sent by the target server; wherein the target processing result is obtained by the target server encrypting the processing result corresponding to the first encrypted business data using a second shared key; the second shared key is generated based on the public key corresponding to the electronic device and the first private key corresponding to the first public key. The result after decryption is displayed; wherein the result after decryption is obtained by decrypting the target processing result using the first shared key.

2. The method according to claim 1, characterized in that, The server information also includes the target server's blind-signed dynamic password OTP; Before sending the first data to the target server, the method further includes: Send the blind-signed OTP to the target server; The first data is sent when the target server successfully authenticates the blind-signed OTP.

3. The method according to claim 1 or 2, characterized in that, After sending the first data to the target server, the method further includes: If the first public key fails, a second public key is determined from the remaining public keys corresponding to the target server; wherein, the remaining public keys represent the public keys that have not failed among the N public keys; Send second data to the target server; wherein the second data includes second encrypted business data and second public key information corresponding to the target server; the second encrypted business data is obtained by encryption with a third shared key; the third shared key is generated based on the second public key and the private key corresponding to the electronic device.

4. The method according to any one of claims 1 to 3, characterized in that, The server information includes information on multiple candidate servers, and the target server is one of the multiple candidate servers. The method further includes: In the event that the target server is abnormal, a new target server is determined from the candidate servers other than the target server among the plurality of candidate servers; Based on the address of the new target server, third data related to the first service is transmitted to the new target server.

5. The method according to any one of claims 1 to 4, characterized in that, The method further includes: Receive a first notification message sent by the target server; wherein the first notification message indicates that the target server is abnormal; In response to the first notification message, a first prompt message is displayed; wherein the first prompt message prompts the user to re-perform the first service.

6. The method according to any one of claims 1 to 5, characterized in that, The first service is AIGC (Artificial Intelligence Generated Content) service; the first private key is located in the security module of the target server; The target processing result is obtained by the target server encrypting the processing result corresponding to the first encrypted business data within the security module using the second shared key; the processing result corresponding to the first encrypted business data is obtained by the target server based on the AIGC model.

7. A business processing method, characterized in that, Applied to a second server, the method further includes: Receive first data corresponding to a first service sent by an electronic device; the first data includes first encrypted service data, the public key corresponding to the electronic device, and the first public key information corresponding to the second server. Based on the second shared key, the first encrypted service data is decrypted to obtain decrypted data; wherein, the second shared key is generated based on the public key corresponding to the electronic device and the first private key corresponding to the first public key information; Send the target processing result to the electronic device; wherein the target processing result is obtained by encrypting the processing result corresponding to the first encrypted service data based on the second shared key; the processing result corresponding to the first encrypted service data is obtained by processing the decrypted data.

8. The method according to claim 7, characterized in that, The second server includes a security module; the private key corresponding to the public key information is located within the security module. The decryption of the first data, the processing of the decrypted data, and the encryption of the processing result corresponding to the first data based on the second shared key are all performed within the security module.

9. The method according to claim 7 or 8, characterized in that, The method further includes: If the first public key indicated by the first public key information becomes invalid, and the number of remaining key pairs corresponding to the second server is less than or equal to a preset number, then a new key pair corresponding to the second server is generated; wherein, the key pair includes the public key and private key corresponding to the second server; the remaining key pairs represent the non-invalid key pairs among the N key pairs corresponding to the second server; Send a second public key information to the electronic device; wherein the second public key information includes the public key in the new key pair.

10. The method according to any one of claims 7 to 9, characterized in that, Before sending the target processing result to the electronic device, the method further includes: The processing result corresponding to the first encrypted business data is encrypted based on the second shared key to obtain the encrypted processing result; The business code that runs the first service encapsulates the encryption processing result to obtain the target processing result.

11. The method according to claim 10, characterized in that, The method further includes: Obtain the target code segment from the business code in the memory of the second server; Calculate the hash value of the target code segment; If the hash value of the target code segment is inconsistent with the standard hash value of the target code segment, a first notification message is sent to the electronic device; wherein the first notification message indicates that the second server is abnormal.

12. The method according to any one of claims 7 to 11, characterized in that, Before receiving the first data corresponding to the first service sent by the electronic device, the method further includes: Send a registration request to a third server; the registration request includes N public keys corresponding to the second server; Receive a registration success message sent by the third server; wherein the registration success message is sent by the third server after verifying that the third server's certificate is valid.

13. A business processing method, characterized in that, The method includes: The electronic device receives a first operation; wherein the first operation is used to trigger the electronic device to run a first service; The electronic device sends a first request to the first server; In response to the first request, the first server authenticates the electronic device; If authentication is successful, the first server sends a second request to the third server; In response to the second request, the third server sends server information to the first server; wherein, the server information includes the address of the target server and N public keys corresponding to the target server, where N is a positive integer; The first server sends the server information to the electronic device; The electronic device sends first data to the target server based on the address of the target server; wherein, the first data includes first encrypted service data, the public key corresponding to the electronic device, and the first public key information corresponding to the target server; the encrypted service data is obtained by encrypting the service data of the first service based on a first shared key; the first shared key is generated based on the first public key indicated by the first public key information among the N public keys corresponding to the target server and the private key corresponding to the electronic device; The target server decrypts the first encrypted business data based on the second shared key to obtain the decrypted data; wherein, the second shared key is generated based on the public key corresponding to the electronic device and the first private key corresponding to the first public key information; The target server sends a target processing result to the electronic device; wherein, the target processing result is obtained by encrypting the processing result corresponding to the first encrypted service data based on the second shared key; the processing result corresponding to the first encrypted service data is obtained by processing the decrypted data; The electronic device displays the decrypted result; wherein the decrypted result is obtained by decrypting the target processing result using the first shared key.

14. An electronic device, characterized in that, The electronic device includes a display screen, a memory, and one or more processors; the display screen, the memory, and the processors are coupled; the display screen is used to display an image generated by the processor, the memory is used to store computer program code, the computer program code including computer instructions; when the processor executes the computer instructions, the electronic device performs the method as described in any one of claims 1 to 6.

15. A server, characterized in that, The server includes a memory and one or more processors; the memory and the processors are coupled; the memory is used to store computer program code, the computer program code including computer instructions; when the processor executes the computer instructions, the server performs the method as described in any one of claims 7 to 12.

16. A computer-readable storage medium, characterized in that, Includes computer instructions that, when executed on an electronic device, cause the electronic device to perform the method as described in any one of claims 1 to 6.

17. A computer-readable storage medium, characterized in that, Includes computer instructions that, when executed on a server, cause the electronic device to perform the method as described in any one of claims 7 to 12.

18. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the method as described in any one of claims 1 to 12.

Images