Encryption module

Abstract

To provide an encryption module making it possible to randomly access an encrypted learned model.SOLUTION: An encryption module includes encryption processing means, decryption processing means, and an address translation table. The encryption processing means includes padding data appending means that appends padding data to parameter data of an NN model, table writing means that writes information on the padding data, data encryption means that generates encryption data, and data writing means that writes the encryption data in a memory unit. The decryption processing means includes table reading means that reads the information on the padding data, data reading means that reads the encryption data from the memory unit, data decryption means that decrypts the encryption data, and padding data deleting means that deletes the padding data.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present invention relates to a cryptographic module, and more particularly to a cryptographic module for encrypting and decrypting neural network models. [Background technology]

[0002] Conventionally, inference processing devices that perform inference using neural networks have been known. In particular, so-called convolutional neural networks (CNNs) are often used in inference processing devices that perform image recognition.

[0003] In a convolutional neural network, input image data is sequentially subjected to processing in the intermediate layer and the fully connected layer, thereby obtaining a final inference result that recognizes the object contained in the image.

[0004] In the intermediate layer, multiple feature extraction processing layers are hierarchically connected, and in each processing layer, convolution processing, activation processing, and pooling processing are performed on input data input from the previous layer.

[0005] In this way, the intermediate layer repeats the processing in each processing layer to extract high-dimensional feature amounts contained in the input image data.

[0006] In the fully connected layer, the calculation results data from the intermediate layers are combined to obtain the final inference result.

[0007] In order to obtain the inference results desired from a convolutional neural network, the trained parameters such as weight coefficients and bias values ​​used in the calculations of these layers are important, and therefore these trained parameters must be highly confidential. Therefore, it is conceivable to encrypt the trained parameters on storage media to prevent them from being illegally obtained.

[0008] For example, Patent Document 1 discloses a method of inserting padding data according to the size of data to be encrypted and applying a block cipher. [Prior art documents] [Patent documents]

[0009] [Patent Document 1] Japanese Patent Application Laid-Open No. 2000-330872 Summary of the Invention [Problem to be solved by the invention]

[0010] However, inserting padding data as in the prior art disclosed in the above-mentioned patent document causes a mismatch between the data location of the trained parameters recognized by the inference processing device and the data location on the storage medium, making it difficult for the inference processing device to randomly access the trained parameters.

[0011] SUMMARY OF THE INVENTION It is therefore an object of the present invention to provide a cryptographic module that allows random access to learned parameters from an inference processing device. [Means for solving the problem]

[0012] In order to achieve the above object, the cryptographic module of the present invention comprises an encryption processing means for encrypting data and writing it to a storage device, a decryption processing means for reading data from the storage device and decrypting it, and an address conversion table, wherein the encryption processing means comprises: padding data adding means for adding padding data to parameter data of at least one layer of parameter data of an NN model composed of a neural network so that the parameter data group has a size that is an integer multiple of the encryption processing unit, thereby generating padded data; table writing means for writing information of the padding data added by the padding data adding means to the address conversion table; data encryption means for encrypting the padded data and generating encrypted data; and data writing means for writing the encrypted data to the storage device, and the decryption processing means comprises: table reading means for reading information of the padding data stored in the address conversion table, data reading means for reading the encrypted data from the storage device based on the information of the padding data read by the table reading means, data decryption means for decrypting the encrypted data and generating the padded data, and padding data deletion means for deleting the padding data from the padded data based on the information of the padding data. [Effects of the Invention]

[0013] According to the present invention, it is possible to provide a cryptographic module that enables random access to a trained model by making it possible to encrypt the trained parameters of each layer independently while making it possible to share padding data information between the encryption process and the decryption process. [Brief explanation of the drawings]

[0014] [Figure 1] FIG. 1 is a diagram illustrating a processing device including a cryptographic module according to a first embodiment. [Figure 2] FIG. 1 is a diagram illustrating an encryption processing device according to a first embodiment. [Figure 3]FIG. 2 is a diagram illustrating a neural network according to the first embodiment. [Figure 4] FIG. 10 is a diagram illustrating the operation of a padding data adding unit in the first embodiment. [Figure 5] FIG. 2 is a diagram illustrating an address conversion table according to the first embodiment. [Figure 6] 4 is a flowchart illustrating the operation of the first embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0015] Preferred embodiments of the present invention will now be described in detail with reference to the accompanying drawings. [Example]

[0016] FIG. 1 is a block diagram illustrating the configuration of an inference processing device 100 according to this embodiment.

[0017] The inference processing device 100 includes a chip 110, a ROM 120, and a RAM 130. The chip 110 is an LSI that performs inference processing, and executes inference by expanding the NN model and trained parameters configured by a neural network stored in the ROM 120 into the RAM 130. For the sake of explanation, the trained parameters stored in the ROM 120 are referred to as first trained parameters, and the trained parameters expanded into the RAM 130 are referred to as second trained parameters. Note that in this embodiment, the data in the ROM 120 is described as being encrypted using a first encryption algorithm. Therefore, the first trained parameters are encrypted using the first encryption algorithm. Furthermore, the second trained parameters in the RAM 130 are described as being encrypted using a second encryption algorithm. The first encryption algorithm and the second encryption algorithm may be the same encryption algorithm or different encryption algorithms.

[0018] The chip 110 includes a control unit 111 , an inference processing unit 112 , a cryptographic module 113 , a ROM controller 114 , and a RAM controller 115 .

[0019] The control unit 111 controls each unit in the chip 110 .

[0020] The inference processing unit 112 executes the inference processing using the NN model and the learned parameters.

[0021] The encryption module 113 encrypts the learned parameters that the control unit 111 reads from the ROM 120 via the ROM controller 114 using a second encryption algorithm. The encryption module 113 then writes the encrypted learned parameters as second learned parameters to the RAM 130 via the RAM controller 115. The encryption module 113 also decrypts the second learned parameters that were read from the RAM 130 via the RAM controller 115 according to the second encryption algorithm, and passes the decrypted learned parameters to the inference processing unit 112.

[0022] The ROM controller 114 controls the ROM 120 to read data from the ROM 120. At this time, the decryption process is performed in accordance with a first encryption algorithm. Note that in this embodiment, the ROM controller 114 performs the decryption in accordance with the first encryption algorithm, but this is not limiting, and the control unit 111 may perform the decryption, for example.

[0023] The RAM controller 115 controls the RAM 130 to write data to the RAM 130 and read data from the RAM 130 .

[0024] 2 is a block diagram for explaining the configuration of the encryption module 113 in this embodiment. The configurations with the same numbers as in FIG. 1 are the same as those explained in FIG. 1, so the explanation here will be omitted.

[0025] The encryption module 113 includes an encryption processing unit 210 , a decryption processing unit 220 , and an address translation table 230 .

[0026] The encryption processing unit 210 has a padding data adding unit 211, a table writing unit 212, a data encryption unit 213, and a data writing unit 214. The encryption processing unit 210 encrypts the learned parameters using a second encryption algorithm in response to a write access from the control unit 111, and outputs the encrypted parameters to the RAM controller 115.

[0027] The padding data adding unit 211 divides the input trained parameters into parameter information for each layer and adds padding data so that the data length of the parameter information for each layer becomes an integer multiple of the processing unit of the second encryption algorithm. The control unit 111 determines where the trained parameters will be separated into layers from the information of the NN model, and sets this before the trained parameters are input to the padding data adding unit 211.

[0028] The table writing unit 212 writes the data position and data size to which the padding data has been added by the padding data adding unit 211 into the address conversion table 230 .

[0029] The data encryption unit 213 encrypts the learned parameters to which the padding data has been added by the padding data addition unit 211 using a second encryption algorithm to generate second learned parameters.

[0030] The data writing unit 214 writes the second learned parameters encrypted by the data encryption unit 213 into the RAM 130 via the RAM controller 115 .

[0031] The decryption processing unit 220 has a data reading unit 221, a table reading unit 222, a data decoding unit 223, and a padding data deletion unit 224. The decryption processing unit 220 reads the second learned parameters from the RAM 130 via the RAM controller 115 in accordance with a read access from the inference processing unit 112. The decryption processing unit 220 further decrypts the read second learned parameters in accordance with a second encryption algorithm and outputs them to the inference processing unit 112.

[0032] The data reading unit 221 identifies the location in RAM 130 of the second learned parameter that has been read, using the read access from the inference processing unit 112 and the data position and data size of the padding data read by the table reading unit 222. Furthermore, the data reading unit 221 reads the corresponding second learned parameter from RAM 130 via the RAM controller 115.

[0033] The table reading unit 222 reads the data position and data size of the padding data from the address conversion table 230 .

[0034] The data decryption unit 223 decrypts the second learned parameters read by the data reading unit 221 using the second encryption algorithm.

[0035] A padding data deletion unit 224 deletes the padding data from the learned parameters to which the padding data decoded by the data decoding unit 223 has been added, based on the data position and data size of the padding data read by the table reading unit 222 .

[0036] The address conversion table 203 holds information on the data position and data size of the padding data written by the table writing unit 212 and outputs it to the table reading unit 222 .

[0037] FIG. 3 is a diagram for explaining an NN model formed by a neural network processed by the inference processing unit 112. As shown in FIG.

[0038] The NN model 300 is an overall image of the neural network that performs inference in the inference processing unit 112. The NN model 300 is composed of an input layer 301, intermediate layers 302, 303, and 304, and an output layer 305. The inference processing unit 112 performs inference processing based on the connection information of each layer indicated by the NN model 300 and learned parameters that include the weight coefficients and bias values ​​of each layer of the NN model 300. Because the learned parameters are relatively large data, the inference processing unit 112 performs calculations for each layer while appropriately reading out the learned parameters for each layer.

[0039] FIG. 4 is a diagram illustrating the operation of the padding data adding unit 212. As shown in FIG.

[0040] Trained parameters 411, 412, and 413 are trained parameters that contain the weight coefficients and bias values ​​of each layer. Trained parameter 411 is a trained parameter that contains the weight coefficients and bias values ​​from input layer 301 to hidden layer 302. Trained parameter 412 is a trained parameter that contains the weight coefficients and bias values ​​from hidden layer 302 to hidden layer 303. Trained parameter 413 is a trained parameter that contains the weight coefficients and bias values ​​from hidden layer 303 to hidden layer 304.

[0041] The processing unit 401 is the processing unit of the second encryption algorithm. In this embodiment, the processing unit 401 has a data length of 16 bytes. In the example shown in FIG. 4, the learned parameter 411 has a data length of four processing units 401 plus four bytes. Therefore, the padding data adding unit 211 adds padding data 421 to the learned parameter 411. As a result, the combined data length of the learned parameter 411 and the padding data 421 has a data length of exactly five processing units 401. Similarly, the padding data adding unit 211 adds padding data 422 to the learned parameter 412 and padding data 423 to the learned parameter 413.

[0042] 5 is a diagram illustrating data held in the address conversion table 203. FIG. 5 is a diagram illustrating the address conversion table generated from the operation result of the padding data adding unit 212 described with reference to FIG.

[0043] The left column of the address conversion table shown in Figure 5 indicates the offset position from the start address of the learned parameters. The right column of the address conversion table shown in Figure 5 indicates the total size of padding data from the start of the learned parameters to the offset position shown in the left column. From the address conversion table shown in Figure 5, it can be seen that a total of 4 bytes of padding data is added from the start of the learned parameters to offset 0x4C. Similarly, it can be seen that a total of 8 bytes of padding data is added from the start of the learned parameters to offset 0x98. Furthermore, it can be seen that a total of 12 bytes of padding data is added from the start of the learned parameters to offset 0xE4.

[0044] As a result, for example, when a read access to the address location of offset 0x4C is made to the data reading unit 221, it can be determined that the desired second learned parameter is located at the address location of 0x50, which is 0x4C plus 0x4.

[0045] 6 is a flowchart illustrating the operation of the control unit 111 from loading the NN model and learned parameters into the RAM 130 to starting the inference processing unit 112. The flowchart in FIG. 6 is executed by the control unit 111 after loading a program stored in the ROM 120 into the RAM 130.

[0046] In step S601, the control unit 111 reads out the NN model and the trained parameters from the ROM 120 via the ROM controller 114. As described with reference to Fig. 1, the NN model and the trained parameters in the ROM 120 are encrypted in advance according to a first encryption algorithm. This encryption is then decrypted by the ROM controller 114.

[0047] In step S602, the control unit 111 determines, from the information of the NN model, which position in the trained parameters is the data position that becomes the boundary between layers, and sets this in the padding data adding unit 211 in the encryption module 113.

[0048] In step S603, the control unit 111 loads the NN model and the trained parameters into the RAM 130. Here, the trained parameters are loaded into the RAM 130 via the encryption module 113.

[0049] In step S604, the control unit 111 starts the inference processing unit 112. After this step, the inference processing unit 112 reads the NN model from the RAM 130 and also reads the learned parameters from the RAM 130 via the encryption module 113 as appropriate, thereby executing the inference process.

[0050] As described above, in this embodiment, by adding padding data using the padding data adding unit 212, each learned parameter of each layer can be encrypted and decrypted independently. Furthermore, the address conversion table 203 can manage the shift in the storage position of the learned parameter caused by adding padding data. As a result, the learned parameters in the RAM 130 can be protected by encryption, while the learned parameters of the layer required by the inference processing unit 112 can be randomly read out.

[0051] Although the preferred embodiments of the present invention have been described above, the present invention is not limited to these embodiments, and various modifications and changes are possible within the scope of the gist of the present invention.

[0052] For example, the control unit 111 is configured to set the breaks between layers of learned parameters for the padding data adding unit 211, but this is not limiting. A model information analysis unit that analyzes hierarchical information of the NN model from information about the NN model may be provided before the padding data adding unit 211. In this configuration, the model information analysis unit determines the breaks between layers of learned parameters. This reduces the load on the control unit 111. [Explanation of symbols]

[0053] 100 Inference processing device 110 chips 111 Control Unit 112 Inference processing unit 113 Encryption Module 114 ROM controller 115 RAM Controller 120 ROM 130 RAM

Claims

1. encryption processing means for encrypting data and writing the data to a storage device; a decoding processing means for reading and decoding data from the storage device; an address translation table; The encryption processing means a padding data adding means for adding padding data to a group of parameter data of at least one layer among the parameter data of the NN model formed by the neural network so that the size of the group of parameter data is an integer multiple of the processing unit of encryption, thereby generating padded data; a table writing means for writing information on the padding data added by the padding data adding means into the address conversion table; data encryption means for encrypting the padded data to generate encrypted data; a data writing means for writing the encrypted data to the storage device, The decoding processing means a table reading means for reading information on the padding data stored in the address conversion table; data reading means for reading the encrypted data from the storage device based on the information of the padding data read by the table reading means; data decryption means for decrypting the encrypted data to generate the padded data; and a padding data deletion means for deleting the padding data from the padded data based on information about the padding data.

1. A cryptographic module comprising:

2. 2. The cryptographic module according to claim 1, wherein said data encryption means performs encryption processing for each predetermined size.

3. 3. The cryptographic module according to claim 1, wherein the information on the padding data is the position and size of the padding data.

4. 4. The cryptographic module according to claim 1, wherein the encryption processing means further comprises model information analysis means for analyzing the structure of each layer from hierarchical structure information indicating the structure of an NN model composed of a neural network, and for identifying the data positions of parameter data groups in at least one layer.

Images