Decryption authorization and secure data transmission method based on large model fingerprint binding

Abstract

The application relates to the technical field of data transmission and discloses a decryption authorization and secure data transmission method based on large model fingerprint binding, which comprises the following steps: a sending end combines a receiving end to publicly bind a descriptor to encrypt and assemble a session key and to-be-protected data into a transmission data packet; a relay gateway node completes transparent transmission based on a header and additional authentication data; a server model node extracts an online feature vector, quantizes to generate an online fingerprint, and reconstructs a candidate root seed; when a seed hash digest is consistent with the descriptor and remote proof passes, a private key is derived to decrypt the session key and the payload; and when the seed hash digest is inconsistent, decryption is blocked; the application sinks decryption authorization to a model running state, blocks clear text leakage of a relay node and unauthorized processing of an unexpected model, and guarantees end-to-end transmission safety of a multi-hop network.

Description

Technical Field

[0001] This invention belongs to the field of data transmission technology, and in particular relates to a decryption authorization and secure data transmission method based on large model fingerprint binding. Background Technology

[0002] In communication networks for distributed intelligent computing scenarios, data between clients and servers typically needs to be transmitted through multiple nodes such as gateways, proxy routers, and relay nodes. To ensure the confidentiality of transmitted data, existing communication systems usually employ transport layer security protocols and hybrid public key encryption mechanisms, use network interface certificates for identity verification, and utilize the receiver's static private key to decrypt the data payload. These methods primarily protect data from the network interface and transmission link sides and are currently commonly used communication security measures.

[0003] There are still certain limitations in multi-hop transmission. On the one hand, when relay agent nodes perform protocol conversion or route switching, they need to decrypt and repackage data packets, which may cause the data payload to appear in plaintext form at intermediate nodes, thus affecting the confidentiality of end-to-end transmission. On the other hand, when using static keys for decryption authorization, the main basis for determining whether decryption can be performed is whether the private key matches. It is impossible to identify the actual model version and security status of the receiving end. When data packets are forwarded to an unauthorized model due to routing configuration errors, or when the private key is spread to an untrusted environment, the relevant nodes may still use the private key to decrypt data, resulting in unauthorized processing and leakage of sensitive data. When it is necessary to establish a correlation between the actual operating status of the receiving end and decryption authority, there is also the problem of balancing model feature stability and cryptographic determinism. Model operating features are usually represented as high-dimensional continuous floating-point vectors, which are easily affected by small perturbations in floating-point calculations. If the hash digest is directly calculated for such features, even small feature changes may cause significant changes in the hash result, making it difficult to form a stable and deterministic key.

[0004] Therefore, how to establish a correlation between the decryption authorization of transmitted data packets and the real-time operating status of the receiving end model, and how to prevent unauthorized nodes from decrypting data while the relay node maintains transparent transmission, are problems that existing technologies need to solve. Summary of the Invention

[0005] To address the problems in the background art, the technical solution of the present invention is as follows: A decryption authorization and secure data transmission method based on large model fingerprint binding, comprising the following steps: Step S1: The sending end obtains the public binding descriptor of the receiving end. The public binding descriptor contains the model identifier, the model public key, public auxiliary data, and the root seed commitment value. The sending end determines the data object to be protected, encapsulates the session key based on the model public key to generate key-encapsulated ciphertext, and uses the session key to encrypt the data object to be protected to generate data payload ciphertext. The sending end assembles a transmission data packet containing header fields, additional authentication data, public auxiliary data, key-encapsulated ciphertext, and data payload ciphertext and sends it to the communication network. In step S2, the relay gateway node parses the header field and additional authentication data in the transmitted data packet to complete the routing and forwarding, and transmits the data packet while keeping the data payload ciphertext encrypted. Step S3: The server-side model node receives the transmission data packet, extracts the online feature vector of the currently running model within the controlled security boundary, and quantizes it to generate an online discrete fingerprint. Based on the online discrete fingerprint and public auxiliary data, the candidate root seed is reconstructed. In step S4, the server-side model node calculates the cryptographic hash value of the candidate root seed. When the cryptographic hash value matches the root seed commitment value and the remote proof passes, the session key is decrypted based on the candidate root seed's derived model private key, and the data payload ciphertext is decrypted to obtain the plaintext of the data object to be protected. When the comparison is inconsistent, the decryption process is terminated and data processing is blocked.

[0006] Preferably, the process includes an offline registration step S201, whereby the registration and authorization server collects parameter features, internal layer activation response features, and external behavior output features of the target artificial intelligence model in a trusted environment, weighted fusion to generate a high-dimensional continuous model fingerprint, and performs gridded quantization on the high-dimensional continuous model fingerprint to generate an offline binary fingerprint; the fuzzy extraction generation logic is called to process the offline binary fingerprint to output a cryptographic root seed and public auxiliary data, a hash digest is calculated on the cryptographic root seed to generate a root seed commitment value, a model public key is derived based on the cryptographic root seed, a public binding descriptor is assembled and published.

[0007] Preferably, step S1 includes sub-step S11, whereby the sending end concatenates the model identifier, version number, random number, timestamp, and remote proof policy hash value to generate additional authentication data; the sending end uses an associated data authentication encryption algorithm to encrypt the data object to be protected based on the session key and the additional authentication data to generate ciphertext for the data payload; after receiving the transmission data packet, the relay gateway node reads the header field and the additional authentication data to complete the addressing and positioning, and transmits the transmission data packet to the server model node without obtaining the session key.

[0008] Preferably, the server-side model node is configured with a key management security module; step S4 includes sub-step S41, whereby the server-side model node inputs the online discrete fingerprint and public auxiliary data into the key management security module; the key management security module completes candidate root seed reconstruction and cryptographic hash value verification within its internal security boundary, and triggers decryption gating authorization conditions when the verification passes and the remote proof passes, thereby decrypting the session key within the key management security module and outputting it to the trusted memory, ensuring that the model private key remains within the hardware security boundary throughout the entire process.

[0009] Preferably, the key management security module includes at least one of a hardware security module, a key management service component, or a secure isolation zone within a trusted execution environment; when the key management security module is a hardware security module or a secure isolation zone within a trusted execution environment, the model private key is pre-set or dynamically generated in a controlled storage area inside the chip, and the key encapsulated ciphertext is directly decrypted inside the chip; when the key management security module is a key management service component, access control policies are triggered based on the consistency of the cryptographic hash values ​​of the candidate root seeds, releasing the decryption authorization for the current session.

[0010] Preferably, the offline registration step S201 includes: the registration authorization server splits the cryptographic root seed into a model fingerprint secret share and a hardware fixed secret share; the model fingerprint secret share is bound to the offline binary fingerprint to generate public auxiliary data, and the hardware fixed secret share is fixed in the target hardware security module; in step S4, the server model node reconstructs the model fingerprint secret share based on the online feature vector, and performs an XOR operation with the hardware fixed secret share read by the hardware security module to reconstruct the candidate root seed.

[0011] Preferably, in the multi-agent cascaded transmission scenario, step S1 includes sub-step S12, whereby the master intelligent agent node obtains the public binding descriptors of multiple controlled intelligent agent nodes on the transmission link, and uses multi-layer hybrid encapsulation logic to encapsulate control signaling and payload ciphertext layer by layer for the model public key corresponding to each level of controlled intelligent agent node to generate cascaded transmission data packets; after receiving the cascaded transmission data packets, each level of controlled intelligent agent node decrypts the current level control signaling and transmits the downstream ciphertext after the local model features and hardware remote proof verification pass.

[0012] Preferably, after decrypting the plaintext of the data object to be protected in step S4, the following steps are included: Step S5, the server-side model node uses the plaintext of the data object to be protected as input to run inference calculations and obtain the output result; Step S6, the trusted execution environment of the server-side model node calls the internal signature private key to digitally sign the response data containing the model identifier, version number, random number, timestamp, hash digest of the transmission data packet and hash digest of the output result to generate a response data packet and return it to the sending end.

[0013] Preferably, step S4 includes an exception handling sub-step S42. When the cryptographic hash value is inconsistent with the root seed commitment value, or the remote proof of the trusted execution environment fails, the server-side model node terminates the decryption process, sends an exception alarm signal containing a timestamp, random number, current model identifier and fault status code to the security audit system, and erases the intermediate temporary data generated by the calculation of this session.

[0014] Preferably, sub-step S11 includes a more detailed step S111, a decryption authorization and secure data transmission method based on large model fingerprint binding: the sending end generates a one-time asymmetric key pair, calls the elliptic curve key negotiation algorithm to derive a symmetric session key from the model public key, and uses the temporary public key in the one-time asymmetric key pair as the key to encapsulate ciphertext; the sending end constructs a binary data packet containing the protocol version number, model identifier, version number, random number, timestamp, key encapsulation ciphertext, data payload ciphertext, additional authentication data, and policy identifier as the transmission data packet, wherein the additional authentication data serves as transparent input verification data for the associated data authentication encryption algorithm.

[0015] Compared with existing technologies, the decryption authorization and secure data transmission method based on large-model fingerprint binding of this invention has the following advantages: 1. In the decryption authorization and secure data transmission of large model fingerprint binding, the sending end uses the model public key to encapsulate the session key. The relay gateway node forwards the data only based on the header field and additional authentication data, without decrypting the data payload. This allows the protected data object to maintain its encrypted state during multi-hop transmission, reducing the risk of intermediate nodes accessing plaintext data. At the same time, the decryption authorization is bound to the online discrete fingerprint of the currently running model at the receiving end. The session key can only be decapsulated when the model state meets the requirements of the public binding descriptor. This prevents unauthorized models or nodes that receive data due to incorrect routing from obtaining plaintext data, thus balancing multi-hop forwarding and decryption permission control under the actual operating state of the receiving end.

[0016] 2. The model's private key is stored in the controlled area of ​​the hardware security module. During the online decryption process, the root seed reconstruction, hash digest verification, and session key decryption are all completed within the hardware security boundary. This ensures that the model's private key does not need to enter the motherboard memory or the host operating system in plaintext form. This reduces the risk of the private key being extracted from memory and the resulting data leakage, and also reduces the possibility of unintended nodes obtaining plaintext by intercepting communication data. This ensures that the critical private key required for decryption is always protected by the hardware security boundary.

[0017] 3. By splitting the cryptographic root seed into a model fingerprint secret share and a hardware fixed secret share, the decryption authorization is constrained by both the current model state and the specified hardware. Only when the online model features meet the fingerprint fault tolerance conditions and the corresponding hardware security module can provide the hardware fixed secret share can the candidate root seed be reconstructed and decryption continue. Therefore, simply copying the model parameters or simply obtaining control of the hardware node cannot complete the data decryption independently, reducing the risk of unauthorized decryption caused by the model or hardware being copied or controlled independently. Attached Figure Description

[0018] Figure 1 This is a flowchart of the fingerprint verification and decryption authorization process for the model of this invention; Figure 2 This is a diagram of the server-side controlled boundary and communication node architecture of the present invention. Detailed Implementation

[0019] The technical solutions of the embodiments of this application will be clearly described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of this application are within the scope of protection of this application.

[0020] A decryption authorization and secure data transmission method based on large model fingerprint binding includes the following steps: Step S1: The sending end obtains the public binding descriptor of the receiving end. The public binding descriptor contains the model identifier, the model public key, public auxiliary data, and the root seed commitment value. The sending end determines the data object to be protected, encapsulates the session key based on the model public key to generate key-encapsulated ciphertext, and uses the session key to encrypt the data object to be protected to generate data payload ciphertext. The sending end assembles a transmission data packet containing header fields, additional authentication data, public auxiliary data, key-encapsulated ciphertext, and data payload ciphertext and sends it to the communication network. In step S2, the relay gateway node parses the header field and additional authentication data in the transmitted data packet to complete the routing and forwarding, and transmits the data packet while keeping the data payload ciphertext encrypted. Step S3: The server-side model node receives the transmission data packet, extracts the online feature vector of the currently running model within the controlled security boundary, and quantizes it to generate an online discrete fingerprint. Based on the online discrete fingerprint and public auxiliary data, the candidate root seed is reconstructed. In step S4, the server-side model node calculates the cryptographic hash value of the candidate root seed. When the cryptographic hash value matches the root seed commitment value and the remote proof passes, the session key is decrypted based on the candidate root seed's derived model private key, and the data payload ciphertext is decrypted to obtain the plaintext of the data object to be protected. When the comparison is inconsistent, the decryption process is terminated and data processing is blocked.

[0021] Preferably, the process includes an offline registration step S201, whereby the registration and authorization server collects parameter features, internal layer activation response features, and external behavior output features of the target artificial intelligence model in a trusted environment, weighted fusion to generate a high-dimensional continuous model fingerprint, and performs gridded quantization on the high-dimensional continuous model fingerprint to generate an offline binary fingerprint; the fuzzy extraction generation logic is called to process the offline binary fingerprint to output a cryptographic root seed and public auxiliary data, a hash digest is calculated on the cryptographic root seed to generate a root seed commitment value, a model public key is derived based on the cryptographic root seed, a public binding descriptor is assembled and published.

[0022] Preferably, step S1 includes sub-step S11, whereby the sending end concatenates the model identifier, version number, random number, timestamp, and remote proof policy hash value to generate additional authentication data; the sending end uses an associated data authentication encryption algorithm to encrypt the data object to be protected based on the session key and the additional authentication data to generate ciphertext for the data payload; after receiving the transmission data packet, the relay gateway node reads the header field and the additional authentication data to complete the addressing and positioning, and transmits the transmission data packet to the server model node without obtaining the session key.

[0023] Preferably, the server-side model node is configured with a key management security module; step S4 includes sub-step S41, whereby the server-side model node inputs the online discrete fingerprint and public auxiliary data into the key management security module; the key management security module completes candidate root seed reconstruction and cryptographic hash value verification within its internal security boundary, and triggers decryption gating authorization conditions when the verification passes and the remote proof passes, thereby decrypting the session key within the key management security module and outputting it to the trusted memory, ensuring that the model private key remains within the hardware security boundary throughout the entire process.

[0024] Preferably, the key management security module includes at least one of a hardware security module, a key management service component, or a secure isolation zone within a trusted execution environment; when the key management security module is a hardware security module or a secure isolation zone within a trusted execution environment, the model private key is pre-set or dynamically generated in a controlled storage area inside the chip, and the key encapsulated ciphertext is directly decrypted inside the chip; when the key management security module is a key management service component, access control policies are triggered based on the consistency of the cryptographic hash values ​​of the candidate root seeds, releasing the decryption authorization for the current session.

[0025] Preferably, the offline registration step S201 includes: the registration authorization server splits the cryptographic root seed into a model fingerprint secret share and a hardware fixed secret share; the model fingerprint secret share is bound to the offline binary fingerprint to generate public auxiliary data, and the hardware fixed secret share is fixed in the target hardware security module; in step S4, the server model node reconstructs the model fingerprint secret share based on the online feature vector, and performs an XOR operation with the hardware fixed secret share read by the hardware security module to reconstruct the candidate root seed.

[0026] Preferably, in the multi-agent cascaded transmission scenario, step S1 includes sub-step S12, whereby the master intelligent agent node obtains the public binding descriptors of multiple controlled intelligent agent nodes on the transmission link, and uses multi-layer hybrid encapsulation logic to encapsulate control signaling and payload ciphertext layer by layer for the model public key corresponding to each level of controlled intelligent agent node to generate cascaded transmission data packets; after receiving the cascaded transmission data packets, each level of controlled intelligent agent node decrypts the current level control signaling and transmits the downstream ciphertext after the local model features and hardware remote proof verification pass.

[0027] Preferably, after decrypting the plaintext of the data object to be protected in step S4, the following steps are included: Step S5, the server-side model node uses the plaintext of the data object to be protected as input to run inference calculations and obtain the output result; Step S6, the trusted execution environment of the server-side model node calls the internal signature private key to digitally sign the response data containing the model identifier, version number, random number, timestamp, hash digest of the transmission data packet and hash digest of the output result to generate a response data packet and return it to the sending end.

[0028] Preferably, step S4 includes an exception handling sub-step S42. When the cryptographic hash value is inconsistent with the root seed commitment value, or the remote proof of the trusted execution environment fails, the server-side model node terminates the decryption process, sends an exception alarm signal containing a timestamp, random number, current model identifier and fault status code to the security audit system, and erases the intermediate temporary data generated by the calculation of this session.

[0029] Preferably, sub-step S11 includes a more detailed step S111, a decryption authorization and secure data transmission method based on large model fingerprint binding: the sending end generates a one-time asymmetric key pair, calls the elliptic curve key negotiation algorithm to derive a symmetric session key from the model public key, and uses the temporary public key in the one-time asymmetric key pair as the key to encapsulate ciphertext; the sending end constructs a binary data packet containing the protocol version number, model identifier, version number, random number, timestamp, key encapsulation ciphertext, data payload ciphertext, additional authentication data, and policy identifier as the transmission data packet, wherein the additional authentication data serves as transparent input verification data for the associated data authentication encryption algorithm.

[0030] Example 1: In a financial large-scale model inference communication topology spanning untrusted relay nodes, a system deployed in the core data center with the identifier […]. The model instance, with version number [version number missing]. The receiving end and client channel traverse a multi-hop transmission network consisting of edge service gateways, virtual private network proxy nodes, content security auditing platforms, and third-party model routing relays, carrying the protected data object to be transmitted. The data to be protected is a 512-byte financial business query text vector. The data objects to be protected include, but are not limited to, at least one of the following: complete input prompts for a large model, multimodal files or data blocks, input vector representations generated by front-end encoding, key hidden layer representation components in the model inference and computation process, and session key materials used for subsequent multi-party collaborative computation. In specific business deployment scenarios, the data objects to be protected can be arbitrarily structured and encapsulated and divided into blocks according to actual transmission requirements. Intermediate transmission nodes may come into contact with plaintext payloads during the termination and protocol conversion of the transport layer security protocol, or due to elastic scheduling, data packets may be mismatched and forwarded to unauthorized low-version models, replacement models, or nodes lacking controlled security isolation protection. Traditional hybrid public-key encryption mechanisms rely on static private keys to complete session key decryption, and cannot perceive the actual physical state of the model running inside the server. At the same time, the continuous feature vectors of the model are affected by floating-point operation perturbations and cannot be directly used as deterministic cryptographic keys. The protection of transmission confidentiality and the trust measurement of model operation are disconnected.

[0031] Run the target model instance in a trusted baseline environment to determine authorized deployment configuration parameters and security challenge datasets. Collect internal model parameter features Inner layer activation response characteristics and external behavioral output features Through feature fusion weight matrix Complete weighted fusion to generate a high-dimensional continuous model fingerprint. ,in, For feature fusion mapping function, For model parameter features, For inner layer activation response characteristics, Output features for external behavior. The feature fusion weight matrix is ​​then used; subsequently, the fingerprint of the high-dimensional continuous model is processed. Perform mesh quantization and output length. 256-bit offline binary fingerprint Calling fuzzy extraction to generate offline binary fingerprints Its generating function is denoted as , Generate length A 256-bit cryptographic root seed With 384 bytes of common auxiliary data ,satisfy ,in, For generating functions for the fuzz extractor, For offline binary fingerprints, For cryptographic root seed, For public auxiliary data; compute cryptographic root seed The cryptographic hash digest is used to obtain the root seed commitment value. ,in, For cryptographic hash digest functions, The cryptographic root seed is used; the cryptographic root seed is input using the key derivation function. And a context identifier composed of the model identifier and version number, from which a 256-bit model private key is derived. ,in, Derived function for key. This is a string concatenation operator, and a 32-byte model public key is generated by a public key derivation function based on the Curve25519 elliptic curve. ,in, Derivation functions for public keys based on Curve25519 elliptic curves; assembly of public binding descriptors. ,in, For model identifier, For version number, For the model's public key, For public auxiliary data, The root seed commitment value, The fault tolerance threshold is set to 20 bits. Remote proof strategy for controlled security boundaries, For digital signatures of registered authorizing agencies, publicly bound descriptors will be used. The data is published to the network signaling service system. Specifically, when extracting and fusing features, the attention weight matrix and activation vector are first extracted from the last attention layer and the intermediate hidden layer of the target model. The log-likelihood expectation of the probability distribution of the external output is then taken, and the three are normalized by mean and standardized by unit variance, respectively. Subsequently, a feature fusion weight matrix composed of orthogonal linear transformations is established. The standardized multi-source heterogeneous features are concatenated into a composite vector of a unified dimension, and mapped to a continuous feature space of a fixed dimension through matrix multiplication to complete the weighted fusion generation of the high-dimensional continuous model fingerprint.

[0032] During the online transmission phase, the client obtains the public binding descriptor from the network signaling service system. Verify signature After confirming that there are no errors, determine the data objects to be protected. Generate one-time asymmetric key pairs The algorithm calls an elliptic curve key negotiation algorithm based on Curve25519 to exchange the temporary private key in a one-time asymmetric key pair. With model public key Perform key negotiation to derive a 256-bit symmetric session key. and the temporary public key in the one-time asymmetric key pair Encapsulate the ciphertext as a 32-byte key.

[0033] The above packaging process is denoted as: in, This is a hybrid public-key cryptographic encapsulation function based on elliptic curve key negotiation. This is the public key for the model.

[0034] Combined with 12-byte random numbers timestamp and remote proof strategy hash value Build 64-byte additional authentication data : ,in, For model identifier, For version number, It is a random number. For timestamps, The hash value for the remote proof strategy.

[0035] Invoke the associated data authentication encryption algorithm to protect the 512-byte data object. Encryption, generating a 528-byte ciphertext data payload. : ,in, Encryption algorithm for associated data authentication, For symmetric session keys, For the data object to be protected, Transparent input verification data for attaching authentication data and serving as associated data authentication encryption algorithm.

[0036] Protocol version number Model identifier Model version number Random numbers timestamp , , and strategy identifiers Assembled into a transmission data packet with a total length of 688 bytes It is sent to the communication network.

[0037] Intermediate routing gateways only parse public headers and additional authentication data. Addressing forwarding, due to the gateway lacking a model private key Furthermore, it is impossible to obtain the model fingerprint and the encrypted data payload. Encapsulating ciphertext with key The encrypted state is maintained throughout the multi-hop pass-through process, preventing relay agent nodes from accessing the data object to be protected. The plain text form.

[0038] The target server node receives the transmitted data packets. Subsequently, within the controlled safety boundary, online feature vectors are re-acquired for the currently loaded and running model. Online discrete fingerprints are obtained through gridding and quantization. Due to minor perturbations in the floating-point calculation environment, online discrete fingerprinting... With offline binary fingerprints There is a 14-bit flip difference, and the Hamming distance satisfies... ,in, The function for calculating Hamming distance is... For offline binary fingerprints, This is an online discrete fingerprint; since the Hamming distance of 14 is less than or equal to the fault tolerance threshold... Within the error correction code's correction range, the server calls the fuzzy extraction and reconstruction function within the controlled security boundary. Correcting the 14-bit bit flip, where, For fuzzy extraction and reconstruction functions, For online discrete fingerprints, Recover candidate root seeds from public auxiliary data. ,and ; Calculate candidate root seeds cryptographic hash value The root seed commitment value in the public binding descriptor Remote verification report that matches and is within controlled security boundaries Satisfaction Strategy When required, based on candidate root seeds And a context identifier composed of the model identifier and version number, through which the model private key is derived using a key derivation function. Then, using the model's private key Encapsulated ciphertext as a key The temporary public key performs the corresponding Curve25519 elliptic curve key negotiation to derive a symmetric session key consistent with that of the sender. and decrypt the data payload ciphertext ,in, To decapsulate the function, For the model's private key, Encapsulate the ciphertext with the key; obtain 512 bytes of the original plaintext data object to be protected. The delivery model inference engine calculates and signs the response data packet and returns it to the client. When a network misrouting forwards the data packet to an unauthorized degraded model node, the Hamming distance between the sampled online discrete fingerprint and the offline binary fingerprint reaches 85 bits and exceeds the fault tolerance threshold. The reconstruction function outputs a pseudo-random error sequence. If the cryptographic hash value of the candidate root seed does not match the root seed commitment value, the session key decapsulation process is terminated and data processing is blocked. The server-side model node assembles the current timestamp, the random number in the transmitted data packet, the current model identifier, and the fault status code corresponding to this comparison failure into an abnormal alarm signaling, sends it to the security audit system, and erases the candidate root seed and intermediate temporary data generated during this session reconstruction process. Furthermore, the controlled security boundary establishes a secure interconnection with the hardware-level encryption bus through the secure direct memory access channel of trusted hardware. The trusted execution environment is configured with a trusted driver and a secure memory mapping area. When the model inference calculation is triggered, the trusted driver directly reads the operator runtime tensor data within the controlled security boundary through the secure direct memory access channel, and completes the online feature vector acquisition without being stolen or tampered with by the host operating system and the conventional shared bus.

[0039] The ability to decrypt transmitted payloads depends on the online discrete fingerprint and common auxiliary data during the runtime of the receiving model. Candidate root seeds obtained from reconstruction The Hamming distance between online discrete fingerprints and offline binary fingerprints exceeds the fault tolerance threshold. At that time, if the cryptographic hash value does not match the root seed commitment value, the network proxy node will determine the appropriate action based on the data packet. Public header and additional authentication data Forwarding enables the desealing of session keys for header routing and receiver model runtime state constraints.

[0040] Example 2: This example establishes a test network topology containing one client node, four relay proxy nodes, and one target server node. It evaluates and analyzes the security and fault tolerance performance of the system under typical design configurations. This is used to test the inference communication process of a large financial model across untrusted relay nodes. The target server deploys model identifiers. For LLM-Finance-V2, version number For the inference instance of version 2.1.0, the relay link sequentially includes an edge service gateway, a virtual private network proxy node, a content security audit platform, and a third-party model routing proxy. The evaluation dataset centrally sets 1000 typical data objects (Dp) to be protected under financial business query scenarios. In the design model, the size of each data object to be protected is set to 512 bytes. During data transmission and offline sampling, Gaussian white noise and floating-point calculation fluctuations are simulated to generate online discrete fingerprints from the server-side online feature vector quantization. Offline binary fingerprint generated during the offline registration phase Bit flipping occurs, fault tolerance threshold Based on the fingerprint bit flipping amount of the legitimate model under floating-point jitter in the hardware environment and the Hamming distance of the unauthorized replacement model, the upper limit of the theoretical Hamming distance envelope of the legitimate model under floating-point jitter is calibrated to 19 bits, and the lower limit of the minimum Hamming distance of the unauthorized downgraded model is calibrated to 52 bits. Accordingly, in the current preferred implementation scenario, the fault tolerance threshold τ is set to 20 bits. In the process of determining the gridded quantization parameters, 100 baseline samples are performed on continuous features. The maximum amplitude of floating-point jitter of 0.022 is obtained by statistically analyzing the envelope based on three times the standard deviation. The gridded quantization step size is taken as approximately 2.3 times this amplitude, i.e., 0.05. At this time, the probability of a single-dimensional feature crossing the grid boundary is 7.4%. Combined with the 256-dimensional projection dimension, the expected value of full-dimensional bit flipping is 18.94 bits. After rounding down and reserving 1 bit of engineering margin, the fault tolerance threshold is determined to be 20 bits.

[0041] The experiment included four control groups: the present invention sample group, control group one, control group two, control group three, and control group four. The present invention sample group used a publicly available binding descriptor. The model public key is 32 bytes, the public auxiliary data is 384 bytes, the root seed commitment value is 256 bits, and the fault tolerance threshold is... It is 20 bits long and includes a remote authentication strategy and a registered authority digital signature; the server obtains the online discrete fingerprint within a controlled security boundary. Call the fuzzy extraction and reconstruction function to recover the candidate root seed. Subsequently, the cryptographic hash values ​​of the candidate root seeds were compared with the root seed commitment values, and the remote proof reports were verified. Control group one canceled the model fingerprint constraints and fuzzy extraction mechanism, and directly decrypted the session key using a static private key; control group two canceled the fuzzy extraction and reconstruction function, and directly compared online discrete fingerprints. With offline binary fingerprints The hash value; the fault tolerance threshold of control group three. Set to 5 bits; control group four sets the fault tolerance threshold. The test conditions are set to 40 bits, including the standard test condition for a valid model, the critical perturbation test condition for a valid model, the downgrade test condition for an unauthorized model version, and the test condition for model weight tampering. The version number in the downgrade test condition for the unauthorized model version is specified. For version 2.0.0, the client constructs and transmits data packets. It contains a 32-byte key encapsulated ciphertext. 528-byte data payload ciphertext and 64 bytes of additional authentication data The total length of the transmitted data packet is 688 bytes; the relay node parses the public header and additional authentication data. Complete addressing and forwarding, and record the fingerprint Hamming distance, root seed reconstruction and hash verification results, and session key under each working condition. Unsealing results, plaintext of data objects to be protected The decryption status, average relay pass-through latency, and illegal access interception rate.

[0042] The present invention provides online discrete fingerprints for sample groups under the standard operating conditions of a valid model. With offline binary fingerprints The Hamming distance is 14 bits, which is within the fault tolerance range. The root seed reconstruction and hash verification passed. The session key... Unsealing successful; data payload successfully restored to plaintext of the data object to be protected. The average relay pass-through latency is 15.2ms, the illegal access interception rate is 100.00%, and when the legitimate model is under critical perturbation conditions, the fingerprint Hamming distance increases to 19 bits, still within the fault tolerance range. Root seed reconstruction and hash verification pass, and the session key... Unsealing successful; data payload successfully restored to plaintext; average relay pass-through latency 15.3ms; unauthorized access interception rate 100.00%; under unauthorized version downgrade conditions, fingerprint Hamming distance is 52 bits, exceeding fault tolerance range; cryptographic hash value of candidate root seed obtained from root seed reconstruction is inconsistent with root seed commitment value, hash verification failed; session key... Unblocking was refused, data payload decryption was blocked, the average relay pass-through latency was 15.1ms, the illegal access interception rate was 100.00%, under the condition of model weight tampering, the fingerprint Hamming distance further reached 88 bits, root seed reconstruction and hash verification failed, and the session key... Unblocking was refused, data payload decryption was blocked, the average relay pass-through latency was 15.2ms, and the illegal access interception rate was 100.00%.

[0043] In Control Group 1, under the unauthorized version downgrade condition, the fingerprint Hamming distance was also 52 bits. However, this group did not verify the model fingerprint, and the static private key could still directly decrypt the session key. After the relay node performed decryption and repackaging, unauthorized decryption leakage occurred. The average relay pass-through latency was 25.8ms, and the illegal access interception rate was 0.00%. In Control Group 2, under the legal model critical perturbation condition, the fingerprint Hamming distance was 19 bits. Because the fuzzy extraction and reconstruction function was not used to correct bit flips, a mismatch occurred when directly comparing the online discrete fingerprint and the offline binary fingerprint, the session key refused to be decrypted, and the data payload decryption was interrupted. The average relay pass-through latency was 15.2ms. The illegal access interception rate was 100.00%. Control group 3 measured a 19-bit Hamming distance fingerprint under the same legal model critical perturbation condition, but its fault tolerance threshold was only 5 bits. After the fingerprint deviation exceeded the threshold, the session key refused to be decrypted, the data payload decryption was interrupted, the average relay pass-through delay was 15.1ms, and the illegal access interception rate was 100.00%. Control group 4 measured a 52-bit Hamming distance fingerprint under the unauthorized version downgrade condition. After its fault tolerance threshold was expanded to 40 bits, a false error correction was passed, which led to the session key being falsely decrypted and the decrypted payload being garbled. The average relay pass-through delay was 15.3ms, and the illegal access interception rate was 24.15%.

[0044] During the above test, the relay gateway only parses the public header and additional authentication data. Once routing is completed and the online discrete fingerprint of the legitimate model is within the fault tolerance range, the fuzzy extraction and reconstruction function corrects the bit flips caused by floating-point calculation fluctuations, restores the candidate root seed, and continues to execute session key desealing. When the online discrete fingerprint deviates from the offline binary fingerprint and exceeds the fault tolerance range due to model version downgrading or model weight tampering, the cryptographic hash value of the candidate root seed is inconsistent with the root seed commitment value, and the session key desealing and data payload decryption are terminated, thus keeping the decryption authorization bound to the actual running model state at the receiving end.

[0045] Example 3: To address the scenario where decryption capabilities may still be invoked even after model parameter weights have been copied to untrusted hardware nodes, a model identifier is deployed in the core data center. Version number is An LLM-Finance-V2 model instance was created, and a controlled area with a hardware security module was set up on the server. During offline registration, model parameter features were collected in a trusted baseline environment. Inner layer activation response characteristics and external behavioral output features Through feature fusion weight matrix Generating high-dimensional continuous model fingerprints With the gridding and quantization step size set to 0.05, the high-dimensional continuous model fingerprint is mapped to a 256-bit offline binary fingerprint. When mapping high-dimensional continuous features to binary strings, a random hyperplane projection matrix that maintains local sensitivity is used to compress the dimensionality of the quantized high-dimensional grid index vector, projecting it to a 256-dimensional scalar space. Then, a binary polarity decision is performed based on the sign relationship between the projection values ​​of each dimension and the zero value. When the value is greater than or equal to zero, it is encoded as a binary bit 1, and when it is less than zero, it is encoded as a binary bit 0, resulting in an offline binary fingerprint with a fixed length of 256 bits.

[0046] The registration and authorization server generates a 256-bit cryptographic root seed. And the cryptographic root seed is split into model fingerprint secret shares. Fixed secret share with hardware The hardware-defined secret share is written into the controlled area of ​​the target hardware security module and permanently stored. The model fingerprint secret share is compared with the offline binary fingerprint. Bind to generate public auxiliary data of length 384 bytes. In this embodiment, the hardware fixed secret share is randomly injected and burned into the hardware security module during initialization. After the registration and authorization server reads the hardware fixed secret share, it determines the model fingerprint secret share based on the bitwise XOR relationship between the cryptographic root seed and the hardware fixed secret share. This ensures that the original cryptographic root seed can be recovered by bitwise XORing the model fingerprint secret share and the hardware fixed secret share. Subsequently, the cryptographic root seed is calculated. The cryptographic hash digest yields the root seed commitment value. Derive the model public key using key derivation functions And it is published; throughout the offline registration process, the controlled area of ​​the hardware security module only stores the fixed secret share sM,2 of the hardware, without pre-setting or persistently storing the model private key. The assembly includes a 20-bit fault tolerance threshold and a remote proof strategy. public binding descriptor And published.

[0047] During the online data transmission phase, the client obtains the public binding descriptor. Then, for the 512-byte data object to be protected Using model public key Generate a 32-byte key to encapsulate ciphertext. With symmetric session key Combined with 12-byte random numbers timestamp Build 64-byte additional authentication data Then, the associated data authentication and encryption algorithm is called on the data object to be protected. Encryption, generating a 528-byte ciphertext data payload. The key-encapsulated ciphertext, data payload ciphertext, additional authentication data, and corresponding header fields are assembled into a transmission data packet with a total length of 688 bytes. It is then sent to the communication network, where the relay gateway parses the public header and additional authentication data to complete the addressing and transparent transmission. The encrypted data payload remains encrypted during the relay transmission.

[0048] The target server node receives the transmitted data packets. Then, within the controlled safety boundary, online feature vectors of the currently running model are collected. Online discrete fingerprints are generated using a gridded quantization step size of 0.05. and will combine online discrete fingerprints with public auxiliary data The input is a hardware security module, which calls a fuzzy extraction and reconstruction function within its internal security boundary to reconstruct the model fingerprint secret share based on the online discrete fingerprint and public auxiliary data. When the Hamming distance between the online discrete fingerprint and the offline binary fingerprint is within the 20-bit fault tolerance threshold, the reconstruction process corrects the corresponding bit flips and recovers the secret share of the model fingerprint. Subsequently, the hardware fixed secret share is read from the controlled area of ​​the hardware security module. The model fingerprint secret share Fixed secret share with hardware Perform bitwise XOR to reconstruct candidate root seeds .

[0049] The hardware security module calculates candidate root seeds internally within the chip. The cryptographic hash value, and the root seed commitment value in the public binding descriptor. Comparison; under conditions where both are consistent and the remote proof report meets the remote proof strategy in a trusted execution environment. At that time, within the controlled area of ​​the hardware security module, a private key is derived from the candidate root seed model. The derived model private key is stored in the controlled area, and the model private key is used inside the chip to decrypt the key-encapsulated ciphertext. Obtain the symmetric session key The symmetric session key is output to trusted memory within a controlled security boundary to decrypt the 528-byte data payload ciphertext. Restore the plaintext of the 512-byte data object to be protected. Throughout the above process, the model's private key remains within the controlled area of ​​the hardware security module.

[0050] When an attacker only copies the model parameter weights and runs the model on an unauthorized hardware node lacking the corresponding fixed secret share, even if the online discrete fingerprint can reconstruct the model fingerprint secret share, it cannot perform a bitwise XOR with the fixed secret share embedded in the target hardware security module to obtain the correct candidate root seed. When the number of bit flips in the online discrete fingerprint exceeds the fault tolerance threshold of 20 bits, it is also impossible to reconstruct the correct model fingerprint secret share. In both of these cases, the cryptographic hash value of the candidate root seed cannot form a consistent verification result with the root seed commitment value. The hardware security module terminates the session key desealing process and erases the intermediate temporary data, thereby blocking the decryption of data outside the controlled hardware environment.

[0051] Example 4: This example combines Figures 1 to 2 This paper describes the decryption authorization and secure data transmission method based on large model fingerprint binding, such as... Figure 1 As shown, in step S1, the sending end obtains the public binding descriptor from the receiving end. The public binding descriptor contains the model identifier, model public key, public auxiliary data, and root seed commitment value. The sending end determines the data object to be protected, encapsulates the session key with the model public key to generate key-encapsulated ciphertext, and uses the session key to encrypt the data object to be protected to generate data payload ciphertext. It then assembles a transmission data packet containing header fields, additional authentication data, public auxiliary data, key-encapsulated ciphertext, and data payload ciphertext and sends it to the communication network. In step S2, the relay gateway node parses the header fields and additional authentication data in the transmission data packet to complete routing and forwarding, while maintaining the data... According to the data packet transmitted in ciphertext state, in step S3, the server model node receives the data packet, extracts the online feature vector of the currently running model within the controlled security boundary and quantizes it to generate an online discrete fingerprint, and reconstructs the candidate root seed based on the online discrete fingerprint and public auxiliary data. In step S4, the server model node calculates the cryptographic hash value of the candidate root seed. When the cryptographic hash value is consistent with the root seed commitment value and the remote proof is passed, the session key is decrypted based on the candidate root seed derived model private key, and the data payload ciphertext is decrypted to obtain the plaintext of the data object to be protected. When the comparison is inconsistent, the decryption process is terminated and data processing is blocked.

[0052] like Figure 2As shown, the registration and authorization server transmits the public binding descriptor to the network signaling service system. The sending end obtains the public binding descriptor from the network signaling service system and sends the transmission data packet to the communication network containing the relay gateway node. The communication network transmits the transmission data packet to the server model node. The server model node contains hardware video memory and a host operating system configured with a controlled security boundary. The controlled security boundary is configured with a hardware security module controlled area, trusted memory, and a trusted execution environment. The hardware security module controlled area and trusted memory interact with each other. The hardware video memory is connected to the trusted execution environment through an encrypted bus. The communication network inputs the transmission data packet to the controlled security boundary.

[0053] Example 5: Before deploying the server-side model nodes, the server hardware platform and model instances within the controlled security boundary are... Perform initial baseline calibration by inputting a security challenge dataset containing 100 independent samples into the test environment. Model parameter features were collected 100 times consecutively. Inner layer activation response characteristics External behavior output features After feature fusion weight matrix Generate high-dimensional continuous model fingerprint sequences ,in, For the first The fingerprint of the continuous model after sampling. For model parameter features, For inner layer activation response characteristics, Output features for external behavior. The feature fusion weight matrix is ​​used; the variance envelope and mean shift of the eigenvalues ​​in each dimension are calculated; the perturbation envelope is calculated using floating-point numbers; the gridded quantization step size is set to 0.05; and a 256-bit offline binary fingerprint is generated. The fuzz extractor generation function is called to generate a 256-bit cryptographic root seed. With 384 bytes of common auxiliary data ,satisfy ,in, For generating functions for the fuzz extractor, For offline binary fingerprints, For cryptographic root seed, For public auxiliary data; for cryptographic root seeds Calculate the cryptographic hash digest to obtain the root seed commitment value. ,in, For cryptographic hash functions, during the offline calibration phase, the controlled area of ​​the hardware security module does not have a pre-installed model private key; the hardware metric value of the controlled security boundary, the kernel firmware hash, and the remote proof policy are bound together to generate a policy digest, and the kernel firmware hash and remote proof policy are also linked. Binding generation strategy summary As the verification baseline during online decryption authorization on the server side, a dual-grid smoothing buffer mechanism with overlapping translation intervals is used to handle continuous features located near the quantization boundary during the gridding quantization process. When continuous features fall into the critical region less than 10% of the step size from the quantization boundary, the secondary translation grid is called for secondary mapping, and the uncertain bits in the critical region are marked as known erase bits, so that the number of offline binary fingerprint bit flips caused by floating-point calculation perturbations is kept within the preset fault tolerance threshold.

[0054] When the server-side model node starts, it triggers environment metrics and status verification, and collects a remote proof report of the trusted execution environment. The report includes real-time hardware metrics of the controlled security boundary, combined with a policy summary. The hardware metrics and kernel firmware hashes are verified; meanwhile, online feature vectors are resampled within controlled security boundaries. Online discrete fingerprints are obtained through gridding and quantization. Call the fuzzy extraction and reconstruction function ,in, For fuzzy extraction and reconstruction functions, For online discrete fingerprints, For public auxiliary data, when the bit flips caused by ambient temperature and voltage disturbances in the online discrete fingerprint do not exceed the fault tolerance threshold... At bit depth, the original cryptographic root seed is restored based on the BCH error correction algorithm, making... ;exist Established and trusted execution environment remote proof report Satisfying remote proof strategy At that time, the hardware security module uses a key derivation function to derive the model private key within its internal security boundary. ,in, Derived function for key. For model identifier, For version number, The model's private key is always kept within the controlled area of ​​the hardware security module, which uses this private key to decrypt the 32-byte key-encapsulated ciphertext inside the chip. Export symmetric session key ,in, To decapsulate the function, For the model's private key, Encapsulate the ciphertext with the key; then output the symmetric session key to the trusted memory for decrypting the 528-byte data payload ciphertext. Obtain 512 bytes of plaintext data object to be protected. .

[0055] When the hardware platform is tampered with or the model weights are changed, resulting in the failure of remote proof in the trusted execution environment, or when the number of bit flips in the online discrete fingerprint exceeds 20 bits and the cryptographic hash value of the candidate root seed is inconsistent with the root seed commitment value, the server-side model node terminates the decryption process; at the same time, it writes the timestamp, the current session random number, the current model identifier, and the corresponding fault status code into the abnormal alarm signaling and sends it to the security audit system, and then erases the candidate root seed and other intermediate temporary data generated in this session.

[0056] During the fuzzy extraction process, the preferred error correction coding scheme is a shortened binary BCH code based on finite field construction, with its primitive polynomial order set to m=12. For the 256 information bits (corresponding to the cryptographic root seed sM), a check structure (check bit length of 240 bits) capable of correcting a maximum of t=20 bit mutations is set to generate a 496-bit error correction codeword. The common auxiliary data is generated by performing a code-offset binding operation on the codeword obtained by encoding the random cryptographic root seed through the BCH generation matrix and the offline binary fingerprint, and then encapsulated into a 384-byte standard structure after padding and alignment. During the online reconstruction stage, the operation is performed again with the online discrete fingerprint and decoded by the synthesizing operator decoder. The original cryptographic root seed is restored when the bit flip does not exceed 20 bits.

[0057] Example 6: After receiving the cross-node cascaded processing task, the master control agent node obtains the public binding descriptors of the first and second controlled agent nodes on the transmission link. and ,in, and For model identifier, and For version number, and For the model's public key, and For public auxiliary data, and The root seed commitment value, Position and The bit is the fault tolerance threshold. and For remote proof strategy, and For digital signatures, the master intelligent agent node employs multi-layered hybrid encapsulation logic, specifically targeting the model public key. and Encapsulate the ciphertext using a second key. With the second symmetric session key and the first key encapsulated ciphertext With the first symmetric session key ,in, A function to encapsulate a public key for a 512-byte data object to be protected. Control signaling to the second controlled intelligent agent node, invoking the associated data authentication and encryption algorithm to generate the second payload ciphertext. ,in, For authenticating encryption functions, This is the second additional authentication data. It is a random number. For timestamps, , which is the policy summary value; then... , The control signaling of the first controlled intelligent agent node is used as the inner payload, utilizing the first symmetric session key. Encryption generates the first payload ciphertext ,in, This is the first additional authentication data, used to assemble and transmit cascaded data packets. And send it to the first controlled intelligent agent node.

[0058] The first controlled intelligent agent node receives cascaded transmission data packets. Subsequently, online feature vectors of the currently loaded model are collected within the controlled safety boundary. Online discrete fingerprints are obtained through gridding and quantization. Slight disturbances in the operating environment can cause online discrete fingerprinting to fail. With offline binary fingerprints The Hamming distance satisfies ,in, The Hamming distance calculation function is used; the first controlled agent node calls the fuzzy extraction and reconstruction function. Correcting bit flipping yields the first candidate root seed. ,in, For fuzzy extraction and reconstruction functions, As the first public auxiliary data, in Established and the first hardware remote proof report Satisfying remote proof strategy At that time, the first model private key is derived using the key derivation function. ,in, The function is derived for the key; then the private key of the first model is used to decrypt the ciphertext encapsulated by the first key. Export the first symmetric session key ,in, To decapsulate the function, the first controlled agent node uses the first symmetric session key to decrypt the first payload ciphertext. It obtains the current level control signaling and downstream encapsulation structure, and assembles the downstream transmission data packets after completing local routing processing. And transmit it to the second controlled intelligent agent node.

[0059] The second controlled intelligent agent node receives data packets transmitted downstream. Subsequently, online feature vectors of the currently loaded model are collected within the controlled safety boundary. Online discrete fingerprints are obtained through gridding and quantization. Online discrete fingerprint With offline binary fingerprints The Hamming distance satisfies The second controlled agent node calls the fuzzy extraction and reconstruction function. The second candidate root seed was obtained. ,exist Establishment and Second Hardware Remote Proof Report Satisfying remote proof strategy At that time, export the private key of the second model. The second model private key is used to decrypt the ciphertext encapsulated by the second key. Obtain the second symmetric session key. And use the second symmetric session key to decrypt the second payload ciphertext. Restore the plaintext of the 512-byte data object to be protected. The inference engine of the second controlled agent node completes the computation.

[0060] When the first controlled agent node encounters unauthorized replacement, the Hamming distance between the online discrete fingerprint and the offline binary fingerprint reaches 74 bits and exceeds the fault tolerance threshold. The fuzzy extraction and reconstruction function outputs a pseudo-random error sequence. The cryptographic hash value of the candidate root seed does not match the committed value of the root seed. The unsealing process is interrupted in place at the first controlled agent node, and the first symmetric session key... Exporting will cease, and downstream data packets will stop being parsed and passed through.

[0061] The embodiments of this application have been described above with reference to the accompanying drawings. Unless otherwise specified, the embodiments and features in the embodiments of this application can be combined with each other. This application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit of this application and the scope of protection of this invention, and all of these forms are within the protection scope of this application.

Claims

1. A method for decryption authorization and secure data transmission based on large-model fingerprint binding, characterized in that, Includes the following steps: Step S1: The sending end obtains the public binding descriptor of the receiving end. The public binding descriptor contains the model identifier, the model public key, public auxiliary data, and the root seed commitment value. The sending end determines the data object to be protected, encapsulates the session key based on the model public key to generate key-encapsulated ciphertext, and uses the session key to encrypt the data object to be protected to generate data payload ciphertext. The sending end assembles a transmission data packet containing header fields, additional authentication data, public auxiliary data, key-encapsulated ciphertext, and data payload ciphertext and sends it to the communication network. In step S2, the relay gateway node parses the header field and additional authentication data in the transmitted data packet to complete the routing and forwarding, and transmits the transmitted data packet while keeping the data payload ciphertext encrypted. Step S3: The server-side model node receives the transmission data packet, extracts the online feature vector of the currently running model within the controlled security boundary, and quantizes it to generate an online discrete fingerprint. Based on the online discrete fingerprint and public auxiliary data, the candidate root seed is reconstructed. In step S4, the server-side model node calculates the cryptographic hash value of the candidate root seed. When the cryptographic hash value matches the root seed commitment value and the remote proof passes, the session key is decrypted based on the candidate root seed's derived model private key, and the data payload ciphertext is decrypted to obtain the plaintext of the data object to be protected. When the comparison is inconsistent, the decryption process is terminated and data processing is blocked.

2. The decryption authorization and secure data transmission method based on large model fingerprint binding according to claim 1, characterized in that, The process includes an offline registration step S201, where the registration and authorization server collects parameter features, internal layer activation response features, and external behavior output features of the target artificial intelligence model in a trusted environment, weighted and fused to generate a high-dimensional continuous model fingerprint, and performs gridded quantization on the high-dimensional continuous model fingerprint to generate an offline binary fingerprint; the fuzzy extraction generation logic is called to process the offline binary fingerprint to output the cryptographic root seed and public auxiliary data, the hash digest of the cryptographic root seed is calculated to generate the root seed commitment value, the model public key is derived based on the cryptographic root seed, and the public binding descriptor is assembled and published.

3. The decryption authorization and secure data transmission method based on large model fingerprint binding according to claim 1, characterized in that, Step S1 includes sub-step S11, where the sending end concatenates the model identifier, version number, random number, timestamp, and remote proof policy hash value to generate additional authentication data. The sending end uses an associated data authentication encryption algorithm to encrypt the data object to be protected based on the session key and additional authentication data to generate ciphertext for the data payload; After receiving the transmission data packet, the relay gateway node reads the header field and additional authentication data to complete the addressing and positioning, and then forwards the transmission data packet to the server model node without obtaining the session key.

4. The decryption authorization and secure data transmission method based on large model fingerprint binding according to claim 1, characterized in that, The server-side model node is configured with a key management security module; step S4 includes sub-step S41, where the server-side model node inputs the online discrete fingerprint and public auxiliary data into the key management security module; The key management security module completes candidate root seed reconstruction and cryptographic hash value verification within the internal security boundary. When the verification passes and the remote proof passes, the decryption gating authorization condition is triggered. The session key is desealed within the key management security module and output to the trusted memory, keeping the model private key within the hardware security boundary throughout the entire process.

5. The decryption authorization and secure data transmission method based on large model fingerprint binding according to claim 4, characterized in that, The key management security module includes at least one of a hardware security module, a key management service component, or a secure isolation zone within a trusted execution environment; when the key management security module is a hardware security module or a secure isolation zone within a trusted execution environment, the model private key is pre-set or dynamically generated in the controlled storage area inside the chip, and the key encapsulated ciphertext is directly decapsulated inside the chip. When the key management security module is a key management service component, the access control policy is triggered to allow access based on the consistency of the cryptographic hash value comparison of the candidate root seed, thereby releasing the decryption authorization for the current session.

6. The decryption authorization and secure data transmission method based on large model fingerprint binding according to claim 2, characterized in that, The offline registration step S201 includes: the registration authorization server splits the cryptographic root seed into a model fingerprint secret share and a hardware fixed secret share; the model fingerprint secret share is bound to the offline binary fingerprint to generate public auxiliary data, and the hardware fixed secret share is fixed in the target hardware security module; in step S4, the server model node reconstructs the model fingerprint secret share based on the online feature vector, and performs an XOR operation with the hardware fixed secret share read by the hardware security module to reconstruct the candidate root seed.

7. The decryption authorization and secure data transmission method based on large model fingerprint binding according to claim 1, characterized in that, In the multi-agent cascaded transmission scenario, step S1 includes sub-step S12, whereby the master intelligent agent node obtains the public binding descriptors of multiple controlled intelligent agent nodes on the transmission link, and uses multi-layer hybrid encapsulation logic to encapsulate control signaling and payload ciphertext layer by layer for the model public key corresponding to each level of controlled intelligent agent node to generate cascaded transmission data packets; after each level of controlled intelligent agent node receives the cascaded transmission data packets, after the local model features and hardware remote proof verification pass, it decrypts the control signaling of the current level and transmits the downstream ciphertext.

8. The decryption authorization and secure data transmission method based on large model fingerprint binding according to claim 1, characterized in that, After decrypting the plaintext of the data object to be protected in step S4, the following steps are included: Step S5, the server-side model node uses the plaintext of the data object to be protected as input to run inference calculations and obtain the output result; Step S6: The trusted execution environment of the server-side model node calls the internal signature private key to digitally sign the response data containing the model identifier, version number, random number, timestamp, hash digest of the transmitted data packet, and hash digest of the output result, generating a response data packet and returning it to the sender.

9. The decryption authorization and secure data transmission method based on large model fingerprint binding according to claim 1, characterized in that, Step S4 includes an exception handling sub-step S42. When the cryptographic hash value does not match the root seed commitment value, or the remote proof of the trusted execution environment fails, the server-side model node terminates the decryption process, sends an exception alarm signaling message containing a timestamp, random number, current model identifier, and fault status code to the security audit system, and erases the intermediate temporary data generated by the calculation of this session.

10. The decryption authorization and secure data transmission method based on large model fingerprint binding according to claim 3, characterized in that, Sub-step S11 includes more detailed step S111, whereby the sending end generates a one-time asymmetric key pair, calls the elliptic curve key negotiation algorithm to derive a symmetric session key from the model public key, and encapsulates the ciphertext with the temporary public key in the one-time asymmetric key pair as the key. The sending end constructs a binary data packet containing the protocol version number, model identifier, version number, random number, timestamp, key encapsulated ciphertext, data payload ciphertext, additional authentication data, and policy identifier as the transmission data packet, wherein the additional authentication data serves as transparent input verification data for the associated data authentication encryption algorithm.

Images