Data processing method and apparatus, and readable medium and electronic device

Abstract

The present disclosure relates to a data processing method and apparatus, and a readable medium and an electronic device, so as to ensure the security of data and a model in a data processing process. The data processing method comprises: receiving a data processing task; determining target data that corresponds to the data processing task and a target first key that corresponds to the target data, wherein the target data is obtained by using a first key to encrypt data to be processed, and the target first key is obtained by using a first session key to encrypt the first key; by means of a target computing node, decrypting the target first key on the basis of the first session key, so as to obtain the first key, and decrypting the target data on the basis of the first key, so as to obtain the data to be processed, wherein the target computing node is run in a trusted execution environment; and determining a data processing result on the basis of a target model and the data to be processed, wherein the target model is obtained by means of decrypting an encrypted target model on the basis of a model key, the model key is stored in a key management service, and the key management service is run in the trusted execution environment.

Description

Data processing method, device, readable medium and electronic device

[0001] This application claims priority to Chinese Patent Application No. 202311036146.7 filed on August 16, 2023, and the contents of the above-mentioned Chinese patent application disclosure are hereby incorporated by reference in their entirety as a part of this application. Technical Field

[0002] Embodiments of the present disclosure relate to a data processing method, apparatus, readable medium, and electronic device. Background Art

[0003] Large language models (LLMs) have a wide range of application scenarios in the fields of artificial intelligence and natural language processing. Large language models involve large amounts of user data and model algorithms, so data and model security becomes particularly important.

[0004] During model fine-tuning or use, the corresponding model and data must be obtained for fine-tuning or inference. If the data and model are maliciously stolen during the acquisition process, this can lead to data and model leakage. Furthermore, when using clusters or cloud services for model fine-tuning or inference, the cluster or cloud service environment may be untrustworthy, and cluster nodes may also be susceptible to data and model leakage during data processing.

[0005] Summary of the Invention

[0006] In a first aspect, the present disclosure provides a data processing method, the method comprising:

[0007] Receive data processing tasks;

[0008] Determining target data corresponding to the data processing task and a target first key corresponding to the target data, wherein the target data is obtained by encrypting the data to be processed using a first key, and the target first key is obtained by encrypting the first key using a first session key, wherein the first session key is obtained by negotiation between a task processor of the data processing task and a key holder of the first key;

[0009] decrypting the target first key according to the first session key by a target computing node to obtain the first key, and decrypting the target data according to the first key to obtain the data to be processed, wherein the target computing node runs in a trusted execution environment; and

[0010] Determine a data processing result based on the target model and the data to be processed, wherein the target model is obtained by decrypting the encrypted target model based on a model key, the model key is stored in a key management service, and the key management service runs in the trusted execution environment.

[0011] In a second aspect, the present disclosure provides a data processing device, the data processing device comprising:

[0012] A receiving module, configured to receive data processing tasks;

[0013] a determination module configured to determine target data corresponding to the data processing task and a target first key corresponding to the target data, wherein the target data is obtained by encrypting the data to be processed using a first key, and the target first key is obtained by encrypting the first key using a first session key, and the first session key is obtained by negotiation between a task processor of the data processing task and a key holder of the first key;

[0014] a decryption module configured to decrypt the target first key according to the first session key through a target computing node to obtain the first key, and decrypt the target data according to the first key to obtain the data to be processed, wherein the target computing node runs in a trusted execution environment; and

[0015] The processing module is configured to determine a data processing result based on a target model and the data to be processed, wherein the target model is obtained by decrypting the encrypted target model based on a model key, the model key is stored in a key management service, and the key management service runs in the trusted execution environment.

[0016] In a third aspect, the present disclosure provides a computer-readable medium having a computer program stored thereon, wherein the computer program implements any of the methods described in the first aspect when executed by a processing device.

[0017] In a fourth aspect, the present disclosure provides an electronic device, comprising:

[0018] a storage device having a computer program stored thereon; and

[0019] A processing device is configured to execute the computer program in the storage device to implement any method described in the first aspect.

[0020] The above technical solution first receives a data processing task, then determines the target data corresponding to the data processing task and the target first key corresponding to the target data. The target computing node then decrypts the target first key using the first session key to obtain the first key, and then decrypts the target data using the first key to obtain the data to be processed. Finally, the data processing result is determined based on the target model and the data to be processed. The target data is encrypted using the first key, and the target model is decrypted using the encrypted target model using the model key stored in the key management service. Both the target computing node and the key management service operate in a trusted execution environment.

[0021] Using the above method, the first key for decrypting the target data is obtained through encrypted communication based on the first session key. The model key for decrypting the encrypted target model is stored in a trusted execution environment, and the decryption process is also performed in the trusted execution environment. In this way, in the process of obtaining data and models, even if the data and models are maliciously stolen, they cannot be decrypted. The subsequent data processing process is also performed in a trusted execution environment, thereby ensuring the security of the data and models.

[0022] Other features and advantages of the present disclosure will be described in detail in the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] The above and other features, benefits and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and that the originals and elements are not necessarily drawn to scale. In the drawings:

[0024] FIG1 is a flow chart of a data processing method according to an exemplary embodiment;

[0025] FIG2 is a schematic diagram of a flow chart of model reasoning according to an exemplary embodiment;

[0026] FIG3 is a schematic diagram of a flow chart of performing a fine-tuning task according to an exemplary embodiment;

[0027] FIG4 is a schematic diagram of a process of deploying an image file according to an exemplary embodiment;

[0028] FIG5 is a block diagram of a data processing device according to an exemplary embodiment; and

[0029] FIG6 is a block diagram of an electronic device according to an exemplary embodiment. DETAILED DESCRIPTION

[0030] The following describes embodiments of the present disclosure in more detail with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as limited to the embodiments described herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are for illustrative purposes only and are not intended to limit the scope of protection of the present disclosure.

[0031] It should be understood that the various steps described in the method embodiments of the present disclosure may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present disclosure is not limited in this respect.

[0032] As used herein, the term "including" and its variations are open-ended, i.e., "including but not limited to." The term "based on" means "based, at least in part, on." The term "one embodiment" means "at least one embodiment," the term "another embodiment" means "at least one additional embodiment," and the term "some embodiments" means "at least some embodiments." Other terms are defined in the following description.

[0033] It should be noted that the concepts of "first" and "second" mentioned in this disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0034] It should be noted that the modifications of "one" and "multiple" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, they should be understood as "one or more".

[0035] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0036] It is understandable that before using the technical solutions disclosed in the various embodiments of this disclosure, the type, scope of use, usage scenarios, etc. of the personal information involved in this disclosure should be informed to the user and the user's authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations.

[0037] For example, in response to a user's active request, a prompt message is sent to the user to clearly inform the user that the operation requested will require the acquisition and use of the user's personal information. This allows the user to independently choose whether to provide personal information to the electronic device, application, server, storage medium, or other software or hardware that performs the operations of the disclosed technical solution based on the prompt message.

[0038] As an optional but non-limiting implementation, in response to receiving a user's active request, the prompt information may be sent to the user in the form of a pop-up window, in which the prompt information may be presented in text form. Furthermore, the pop-up window may also contain a selection control for the user to select "agree" or "disagree" to provide personal information to the electronic device.

[0039] It is understandable that the above notification and user authorization process are merely illustrative and do not limit the implementation of the present disclosure. Other methods that comply with relevant laws and regulations may also be applied to the implementation of the present disclosure.

[0040] At the same time, it is understandable that the data involved in this technical solution (including but not limited to the data itself, the acquisition or use of the data) must comply with the requirements of relevant laws, regulations and relevant provisions.

[0041] During fine-tuning of a large language model, a pre-trained large language model can be used for fine-tuning (e.g., fine-tuning technology), and a specific training dataset can be used to further generate a large language model for a specific application. However, fine-tuning requires massive amounts of data and computing resources. This data may contain user information and sensitive data, and fine-tuning may require joint training based on multi-source data, posing the risk of data and model leakage. Furthermore, since LLMs have many model parameters, they can be fine-tuned using clusters or cloud services. However, the cluster or cloud service environment may be untrustworthy, and interactions between cluster nodes also pose the risk of data and model leakage.

[0042] Furthermore, after model fine-tuning is complete, there may be a risk of data and model leakage during the deployment of large language model applications. When large language model applications are deployed on third-party cloud platforms, model service providers must ensure that their core assets, such as models and all inference codes, are protected during deployment, upgrades, and maintenance, and are not leaked to anyone other than the model service provider. For customers using model inference services, large language models may leak user data. If this data is maliciously exploited or leaked to unauthorized parties, user data may be violated. Furthermore, the large language model used may not necessarily be the model content and version claimed by the model service provider. If the model provided by the model service provider is not the claimed model, poor model inference performance may result.

[0043] Federated learning is a technology that enables multi-party joint modeling of data without leaving the domain. Differential privacy can be added to federated learning to protect training data. However, differential privacy is complex in logic, resulting in high modification costs, implementation difficulties, and significant performance loss. It also fails to address the issue of untrusted cloud environments during service deployment. Alternatively, joint modeling can be achieved using multi-party secure computation or homomorphic encryption, achieving high security. However, this requires multi-party communication to ensure security, resulting in high communication volume and computational overhead, making it unsuitable for scenarios involving large parameters, such as large language models.

[0044] Alternatively, fine-tuning or using models through isolated domains or localized deployment can reduce the risk of data leakage to a certain extent, but high-privileged users or entities may still be able to steal data. The applicable scenarios are limited and the cloud infrastructure cannot be fully utilized to provide services.

[0045] The present disclosure provides a data processing method, apparatus, readable medium, and electronic device to address the aforementioned issues. It should be understood that the data processing method provided by the present disclosure is applicable not only to large language model applications but also to other data processing model applications requiring data protection, and the present disclosure does not impose any limitations thereto.

[0046] The following further explains the embodiments of the present disclosure with reference to the accompanying drawings.

[0047] FIG1 is a flow chart of a data processing method according to an exemplary embodiment of the present disclosure. Referring to FIG1 , the data processing method provided by the embodiment of the present disclosure includes:

[0048] S101: receiving a data processing task.

[0049] S102: Determine target data corresponding to the data processing task and a target first key corresponding to the target data.

[0050] The target data is obtained by encrypting the data to be processed with the first key, the target first key is obtained by encrypting the first key with the first session key, and the first session key is negotiated between the task processor of the data processing task and the key holder of the first key.

[0051] S103: The target computing node decrypts the target first key according to the first session key to obtain the first key, and decrypts the target data according to the first key to obtain data to be processed.

[0052] The target computing node runs in a trusted execution environment (TEE). It's important to note that a Trusted Execution Environment (TEE) is a hardware-based security technology that creates a secure computing environment isolated from the outside world by dividing it into secure and non-secure parts. This ensures the confidentiality and integrity of the data and code loaded within it. A TEE is isolated from the normal environment and offers a higher level of security, making it suitable for processing protected data.

[0053] S104: Determine the data processing result according to the target model and the data to be processed.

[0054] The target model is obtained by decrypting the encrypted target model based on the model key. The model key is stored in the key management service, and the key management service runs in the trusted execution environment.

[0055] Using the above method, the first key for decrypting the target data is obtained through encrypted communication based on the first session key. The model key for decrypting the encrypted target model is stored in a trusted execution environment, and the decryption process is also performed in the trusted execution environment. In this way, in the process of obtaining data and models, even if the data and models are maliciously stolen, they cannot be decrypted. The subsequent data processing process is also performed in a trusted execution environment, thereby ensuring the security of the data and models, and thus protecting data security.

[0056] It should be noted that data processing tasks include model fine-tuning tasks and model inference tasks. Before executing model fine-tuning tasks or model inference tasks, you need to deploy the model fine-tuning service or model inference service first.

[0057] In a possible manner, the key management service stores the file key and file key access policy of the encrypted image file, and the encrypted image file includes a first image file of the model fine-tuning service for executing the model fine-tuning task and / or a second image file of the model reasoning service for the target model. The data processing method provided by the embodiment of the present disclosure also includes: in response to a deployment command for the encrypted image file, requesting the file key from the key management service through the remote certification information of the proxy service, the remote certification information of the proxy service is used to verify the hardware environment and code logic of the proxy service; when the remote certification information of the proxy service matches the file key access policy, the key management service sends the file key to the proxy service; decrypts the encrypted image file according to the file key to obtain the target image file, and deploys the target image file to provide model fine-tuning service or model reasoning service.

[0058] For example, after the developer completes the development of the model fine-tuning code or model inference application, the code is packaged into a container image, that is, a first image file including the model fine-tuning service or a second image file including the model inference service. After encrypting the container image with a file key (also called an image key), the container can be deployed in a local environment or a cloud host node. If it is a cloud host node, it needs to run in a TEE environment, that is, the cloud host node is a TEE node, and the model fine-tuning service or model inference service can be deployed to multiple nodes, thereby improving system performance and preventing single points of failure.

[0059] In a possible manner, the data processing method provided by an embodiment of the present disclosure also includes: generating a second key in response to a remote attestation request of the key management service by the developer of the encrypted image file before requesting the file key from the key management service through the remote attestation information of the proxy service in response to a deployment command for the encrypted image file; returning the second key and the remote attestation information of the key management service to the developer, so that the developer verifies the hardware environment and code logic of the operation of the key management service based on the remote attestation information of the key management service, and if the verification passes, encrypting the file key by the second key, and sending the encrypted file key and file key access policy to the key management service for storage.

[0060] For example, referring to Figure 2, a developer sends an encrypted container image to a host (the device where the container image is to be deployed) or an accessible image repository (equivalent to storing the container image). The developer then initiates a remote attestation request to the key management service. Upon receiving the request, the key management service generates remote attestation information and sends it to the developer for verification.

[0061] For example, a developer initiates a remote attestation request to the key management service. The remote attestation request includes a random challenge value (client_nonce). After receiving the request, the key management service generates two pairs of asymmetric keys (enc_pk, enc_sk) and (sign_pk, sign_sk), and sends the following remote attestation information to the developer:

[0062] 1. enc_pk and sign_pk: enc_pk can be used by developers to encrypt data and sign_pk is used to verify signatures;

[0063] 2. signature: The signature obtained by encrypting client_nonce according to sign_sk.

[0064] 3. Proof: This includes the type and content of remote proof information, which may include hardware firmware information of the key management service, application measurement values, custom data, and signatures. Custom data includes verification information of enc_pk and sign_pk, which is used to prove that enc_pk is generated in the TEE, thereby ensuring the security of the key.

[0065] Through this remote attestation, developers can verify that the key management service is running in a secure hardware environment and that the code logic has not been tampered with. After enc_pk is generated in the TEE environment, it is used to encrypt the image key (using enc_pk as a secondary key) and then sent to the key management service. At the same time, a file key access policy is set to restrict file key usage to nodes within the TEE (or a specified local environment) and node metrics. This means that only specific applications deployed in a secure environment can use file keys.

[0066] Further, referring to Figure 2, a command to start the service (deploy the image file) is sent to the host machine. After receiving the command, the host machine first starts a trusted virtual machine that meets the preset configuration requirements and starts an Agent (agent service), where the hypervisor is a virtual machine monitor. The Agent generates remote proof information and requests to obtain the file key. After the key management service determines that the operating environment of the Agent and the virtual machine complies with the file key access policy through the remote proof information, the key management service and the Agent can negotiate a session key, and then securely send the file key through the session key. After the Agent obtains the file key, it can decrypt the image file and create a container, and then start the model fine-tuning service, and then execute the model fine-tuning task to perform model fine-tuning, or start the inference service application to provide model inference service. Based on the remote proof information generated by the Agent, the security of the host machine where the service is deployed can be verified, thereby ensuring the data security of the model fine-tuning code and model inference application during the service deployment process.

[0067] The following is an example to illustrate the process of performing model fine-tuning tasks.

[0068] In a possible embodiment, the data processing task is a model fine-tuning task. Determining target data corresponding to the data processing task and a target first key corresponding to the target data may include: reading the target data via a target computing node based on a data path carried in the data processing task, and requesting the target first key from a key management service. Determining a data processing result based on the target model and the data to be processed may include: executing the model fine-tuning task based on the data to be processed, and fine-tuning the target model based on the execution result of the model fine-tuning task to obtain a target fine-tuned model.

[0069] It should be understood that the model fine-tuning task may require model fine-tuning based on data provided by one or more data providers, that is, supporting unilateral modeling or joint modeling of multiple data sources, wherein the model fine-tuning task can be initiated by any data provider or authorized party. Each data provider can store the data (data to be processed) locally, and then after the model fine-tuning task is initiated, use the data key (first key) to encrypt the data to obtain encrypted data (target data), and then send the encrypted data to facilities such as message middleware. In this way, the data provider only needs to send the data once and does not need to be aware of the complexity of the cluster. Each data provider can also encrypt the data with the data key and send the encrypted data to the cloud service for storage to meet the requirements of high throughput and low latency, improve data reading and writing efficiency, and accelerate the model fine-tuning task. Therefore, the data path includes the access path of the message queue of the message middleware or the storage path in the cloud service, and this disclosure is not limited to this.

[0070] For example, the target computing node obtains encrypted data from the message middleware or cloud service corresponding to the data path, and then requests the target first key from the key management service (key holder). The key management service encrypts the data key based on the first session key to obtain the target first key and sends it to the target computing node. The target computing node decrypts the target first key using the first session key to obtain the data key, decrypts the encrypted data using the data key to obtain the data to be processed, and finally executes the model fine-tuning task based on the data to be processed, and fine-tunes the target model based on the execution result of the model fine-tuning task to obtain the target fine-tuned model. Since the data involved in model fine-tuning is encrypted when it is obtained, and the data key for decrypting the data is stored in the trusted execution environment, the security of the data during transmission and model fine-tuning can be guaranteed.

[0071] In addition, the model fine-tuning task may also carry other identification information such as the task number and the data provider name, so the corresponding encrypted data can also be found based on the task number and the data provider name. This disclosure does not impose any restrictions on this.

[0072] In a possible manner, requesting the target first key from the key management service may include: after the target computing node and the key management service establish a first secure channel through two-way remote certification based on their respective remote certification information, requesting the target first key from the key management service; wherein the remote certification information of the target computing node is used to verify the hardware environment and code logic in which the target computing node runs, the remote certification information of the key management service is used to verify the hardware environment and code logic in which the key management service runs, the key management service pre-stores the first key and the first key access policy, and the key management service is used to send the target first key to the target computing node when the first key access policy and the remote certification information of the target computing node match.

[0073] For example, obtaining the data key requires two-way remote attestation. The process of the developer initiating a remote attestation request to the key management service is a one-way remote attestation. Two-way remote attestation means that both parties perform a one-way remote attestation. This disclosure will not go into details here. The data key can only be used in a trusted execution environment. The trusted execution environment encrypts the memory to prevent high-authority entities or other malicious applications from stealing key information. Therefore, the hardware environment and code logic of the target computing node can be verified based on the remote attestation information of the target computing node. The remote attestation information based on the key management service is used to verify the hardware environment and code logic of the key management service. After establishing a secure channel through two-way remote attestation, the data key is encrypted and transmitted based on the first session key obtained through negotiation.

[0074] It should be understood that only computing nodes that have passed the two-way remote attestation can obtain the data key and decrypt the encrypted data. In this way, even if the target first key or encrypted data is intercepted, it cannot be decrypted, thereby ensuring the security of the data.

[0075] In a possible manner, the first key and the first key access policy in the key management service are obtained as follows: the key management service responds to a remote attestation request, and determines the second session key based on the remote attestation information of the key management service; based on the second session key, encrypted communication is performed with the data provider of the data to be processed, and the first key and the first key access policy are determined and saved based on the encrypted communication, wherein the first key is generated by the data provider or the key management service, and the first key access policy is generated by the data provider.

[0076] For example, as shown in Figure 3, a data provider requests remote attestation from a key management service to escrow the data key. The data provider initiates a remote attestation request and negotiates a second session key with the key management service through the remote attestation mechanism. The data key can be generated by either the data provider or the key management service, and then transmitted to the other party under the protection of the second session key. Furthermore, the data provider can also send a data key access policy to the key management service based on the second session key. For example, this policy can restrict the use of the data key to nodes within the TEE and information such as node metrics. This is not limited in this disclosure.

[0077] For example, the process of requesting remote attestation from the data provider to the key management service can refer to the process of the developer requesting remote attestation from the key management service mentioned above, and the present disclosure will not go into details here. The data provider determines that the key management service is running in a secure hardware environment (TEE) and the running logic has not been tampered with (by verifying the application measurement value) based on the remote attestation information, and determines that enc_pk is generated in the TEE environment. After that, encrypted communication is performed based on enc_pk (as the second session key). For example, the data provider can generate a data key and encrypt it with enc_pk and send it to the key management service, or receive a data key encrypted with enc_pk sent by the key management service. This ensures the storage security and transmission security of the data key, and thus ensures the security of the data.

[0078] In addition, enc_pk may not be used as the second session key. Instead, the data provider and the key management service perform encrypted communication based on enc_pk and then determine the second session key. This disclosure does not impose any restrictions on this.

[0079] In a possible embodiment, receiving a data processing task may include: receiving a model fine-tuning task via a central node. The data processing method provided by an embodiment of the present disclosure further includes: determining at least one target computing node for executing the model fine-tuning task based on task information of the model fine-tuning task, and distributing the model fine-tuning task to the at least one target computing node.

[0080] For example, the server node includes a key storage service, a central node, and a computing node. Referring to Figure 3, the model fine-tuning task is received through the central node. The central node selects one or more computing nodes in the cluster to perform the model fine-tuning task based on the data volume, model, and other task information of this model fine-tuning task, and sends the model fine-tuning task and the node information for executing this task to each computing node. The model fine-tuning task carries the task number, data provider name, model fine-tuning algorithm, hyperparameters, data path, and other information of this task. This disclosure does not limit this. The node information includes the node IP address, port, node role, and other information of the selected computing node, which is determined according to the specific needs and is not limited by this disclosure.

[0081] It should be understood that when there are multiple computing nodes, the central node can split the model fine-tuning task into multiple distributed tasks, and then distribute the multiple distributed tasks to multiple computing nodes to achieve distributed execution of the model fine-tuning task and improve the efficiency of model fine-tuning.

[0082] In a possible embodiment, the target computing node includes multiple target computing nodes, and the data processing method provided by an embodiment of the present disclosure further includes: before executing a model fine-tuning task based on the data to be processed, requesting a task node credential from a key management service through each target computing node. Executing the model fine-tuning task based on the data to be processed, and fine-tuning the target model based on the execution result of the model fine-tuning task to obtain a target fine-tuned model, may include: executing the model fine-tuning task based on the data to be processed through the multiple target computing nodes, and fine-tuning the target model based on the execution result of the model fine-tuning task to obtain the target fine-tuned model, wherein each target computing node performs encrypted communication with each other based on the task node credential to exchange relevant data of the model fine-tuning task.

[0083] For example, referring to Figure 3, each target compute node can establish a secure channel through two-way remote attestation with the key management service. It can then request the data key and task node credentials from the key management service, which then generates and issues the task node credentials. The task node credentials are used to authenticate each compute node and encrypt communication data when executing distributed tasks. This prevents unauthorized nodes from obtaining the data key to decrypt encrypted data, or from obtaining information about interactions between compute nodes, further reducing the risk of data leakage.

[0084] Among them, the type of task node certificate is related to the actual task and the communication method between nodes. For example, secure communication can be based on the TLS protocol (Transport Layer Security), and the task node certificate can be a CA certificate (Certificate Authority), node certificate, node key, etc. This disclosure does not impose any restrictions on this.

[0085] In a possible manner, the data processing method provided by an embodiment of the present disclosure also includes: after fine-tuning the target model according to the execution result of the model fine-tuning task to obtain the target fine-tuning model, encrypting the target fine-tuning model based on the model key, and saving the encrypted target fine-tuning model to the model repository; sending the model key and the model key access policy of the model key to the key management service for storage.

[0086] For example, as shown in Figure 3, the computing node encrypts the target model based on the model key to obtain the target fine-tuning model, and saves the target fine-tuning model to the model warehouse. Referring to the storage method of encrypted data, the target fine-tuning model can also be saved locally or in a cloud service, and this disclosure does not limit this. The model key is also hosted in a key management service. The model key can be a hardware-bound key generated by the computing node, or it can be generated and issued by the key management service. In addition, the model key access policy can be set when hosting the key, such as restricting the use of the model key to nodes that must be TEE nodes and node measurement values, etc., to ensure the security of the model when in use.

[0087] It should be noted that the above-mentioned model fine-tuning process can also be fine-tuned in a local environment, and this disclosure does not limit this.

[0088] The following is an example of the process of executing the model reasoning task. It should be noted that the computing node executing the model reasoning task and the computing node executing the model fine-tuning task can be the same computing node or different computing nodes, and this disclosure does not limit this.

[0089] In a possible embodiment, the data processing task is a model inference task. Determining the target data corresponding to the data processing task and the target first key corresponding to the target data may include: determining the target data and target first key carried in the model inference task, wherein the target first key is obtained by encrypting the first key using the public key of the first session key, and the first session key includes a public key and a private key. Decrypting the target first key using the first session key by the target computing node to obtain the first key may include: decrypting the target first key using the private key by the target computing node to obtain the first key. Determining the data processing result based on the target model and the data to be processed may include: performing model inference based on the target model and the data to be processed to obtain the model inference result.

[0090] For example, referring to Figure 4, a user initiates a model inference task through a client. The model inference task carries target data and a target first key. The first key can be encrypted using the public key of the first session key to obtain the target first key. The target computing node can decrypt the target first key using the private key of the first session key to obtain the first key. The target data is then decrypted using the first key to obtain the data to be processed. Finally, model inference is performed based on the target model and the data to be processed to obtain the model inference result. By encrypting the data to be processed and the first key, the security of data transmission is guaranteed.

[0091] In a possible manner, the data processing method provided by an embodiment of the present disclosure also includes: before receiving a model inference task sent by the client, in response to a remote certification request sent by the client, establishing a third secure channel between the target computing node and the client based on the remote certification information of the target computing node, and the remote certification information of the target computing node is used to verify the hardware environment and code logic in which the target computing node runs; sending the public key to the client through the third secure channel, so that the client encrypts the first key according to the public key to obtain the target first key.

[0092] For example, continuing to refer to Figure 4, when using the model inference service, the user first initiates a remote proof request through the client, and the computing node provides remote proof information to establish a secure channel with the client. For example, the computing node generates a pair of asymmetric keys (public key and private key) through a public key encryption algorithm, and sends the public key and remote proof information to the client. The remote proof information may include the measurement information of the inference service application, the measurement information of the model, the public key information, etc., which is determined according to the verification requirements, and this disclosure does not limit this. Through the remote proof information, the client can verify that the computing node is running in a secure hardware environment, and the code run by the computing node has not been tampered with, and a specific version of the model is loaded as required, and the public key is generated in a secure environment, and the computing node has a corresponding private key.

[0093] For example, when a user uses the model inference service, the data encryption method for communication between the client and the computing node can adopt the envelope encryption mode, that is, the client generates a random symmetric key (first key), uses the AES-GCM (Advanced Encryption Standard, Advanced Data Encryption Standard; Galois Counter Mode, symmetric algorithm mode) and other algorithms to encrypt the data to be processed with the symmetric key, and encrypts the symmetric key with the public key sent by the computing node during the remote proof process, and then sends the encrypted symmetric key and the encrypted data to be processed to the computing node. The computing node first uses its private key to decrypt and obtain the symmetric key, and then decrypts the data to be processed using the symmetric key. After executing the model inference to obtain the model inference result, it can also use the symmetric key to encrypt the model inference result and return it to the client.

[0094] It should be understood that when providing model inference services, information such as model metrics will be provided to the client. In this way, during actual use, the client can verify based on the provided model metrics and the model metrics in the remote attestation information to ensure that the model used in the model inference service is the model content and version claimed by the model service provider. Other verification processes such as node metrics, application metrics, and other remote attestation information can also refer to the model metric process, which will not be repeated in this disclosure.

[0095] For example, if there are multiple computing nodes providing model inference services, a scheduling service can also be provided, and the scheduling service can schedule the request to a certain computing node. Alternatively, a central node running in a trusted execution environment can schedule the request to a certain computing node. This disclosure does not impose any restrictions on this.

[0096] In a possible manner, the target model is obtained in the following manner: in response to the startup of the model inference service corresponding to the target model, the encrypted target model is obtained from the model repository through the target computing node; after the target computing node and the key management service perform two-way remote certification based on their respective remote certification information to establish a fourth security channel, the model key of the encrypted target model is obtained from the key management service, wherein the remote certification information of the target computing node is used to verify the hardware environment and code logic in which the target computing node runs, and the remote certification information of the key management service is used to verify the hardware environment and code logic in which the key management service runs; the encrypted target model is decrypted according to the model key to obtain the target model.

[0097] For example, continuing to refer to Figure 4, taking the large language model application as an example, after the large language model application is started, if the model is not directly packaged into the application, the computing node needs to first obtain the encrypted target model from the model warehouse, where the target computing node is the computing node that provides model inference services, and there can be multiple target computing nodes, that is, each target computing node obtains the encrypted target model and then decrypts it to obtain the target model.

[0098] For example, the process of two-way remote attestation between the above-mentioned target computing node and the key management service can refer to the process of two-way remote attestation in the embodiment of executing the model fine-tuning task, and the present disclosure will not go into details here. According to the two-way remote attestation, it is determined that the target computing node and the key management service are both running in a secure hardware environment (TEE) and the running logic has not been tampered with (by verifying the application metric value), and it is determined that enc_pk (the communication key used as the transmission model key) is generated in the TEE environment, and then encrypted communication is performed based on enc_pk, wherein enc_pk can be generated by the target computing node or by the key management service, and can be determined through negotiation. In addition, enc_pk may not be used as a communication key, but the target computing node and the key management service may perform encrypted communication based on enc_pk and then determine the communication key, and the present disclosure does not limit this.

[0099] After bidirectional remote attestation passes, the encrypted target model's model key is retrieved from the key management service. The encrypted target model is then decrypted using the model key to obtain the target model. If the model is packaged directly into the application, obtaining the encrypted target model is unnecessary. The subsequent steps are the same and will not be further detailed in this disclosure.

[0100] It should be understood that the target computing node and the key management service perform two-way remote attestation based on their respective remote attestation information. The specific content of the remote attestation information can be determined based on the information required for remote attestation. For example, the remote attestation information provided by the computing node needs to include information such as node measurement values, and the present disclosure does not impose any restrictions on this. And only computing nodes that have passed the two-way remote attestation can obtain the model key and decrypt the encrypted target model, thereby ensuring the security of the model. The remote attestation between the client and the target computing node can be a one-way remote attestation, that is, verifying the remote attestation information of the target computing node. The process can refer to the remote attestation process of one party in the above-mentioned two-way remote attestation process, and the present disclosure will not repeat it here.

[0101] In other words, if you are uploading data to a TEE node (including key management services and computing nodes), you need to verify the remote attestation information of the TEE node. If you need to obtain data from a TEE node, you need to perform two-way remote attestation. Remote attestation can verify that the TEE node's environmental security and operating logic have not been tampered with, ensuring the integrity of the service. In other words, when uploading data, ensure that the data will be stored in a secure service, and when obtaining data, verify the legitimacy of the data obtainer to ensure that the data will be used in a secure environment.

[0102] It should be noted that the target model in the model fine-tuning process can be the initial model provided by the model supplier, an open source model, or a model stored in a model repository that requires further fine-tuning. This disclosure does not impose any restrictions on this. If the target model is a model stored in the model repository (an encrypted stored model), it is necessary to obtain the corresponding model key for decryption. The process is similar to the process of obtaining the target model for model inference and will not be repeated in this disclosure.

[0103] In a possible manner, the data processing method provided by an embodiment of the present disclosure also includes: after establishing a fourth security channel through two-way remote certification by the target computing node and the key management service based on their respective remote certification information, requesting a storage key from the key management service, and determining a storage key access policy for the storage key, the storage key is used to encrypt and store relevant data of the target model during the model inference process.

[0104] For example, continuing to refer to Figure 4, the target computing node can also request a storage key from the key management service and set a storage key access policy. The storage key is generated by the key management service based on the hardware key of the key management service and is used for subsequent storage encryption operations of the computing node. This can avoid the scenario where the TEE node on which some computing nodes rely does not have a hardware key, and facilitates data synchronization between computing nodes. Of course, if the TEE node on which the computing node relies has a hardware key, the computing node can also generate a storage key based on the hardware key of the computing node, and this disclosure does not limit this.

[0105] For example, depending on the usage scenario of the model inference application, the target computing node can encrypt and store relevant data during the model inference process, such as model inference results, user data, or other intermediate data, using a storage key. Furthermore, the storage key has a corresponding storage key access policy, which can include application information and measurement values ​​of the key accessor. Therefore, it is possible to restrict specific applications from accessing the storage key to decrypt data and perform specific processing on the data. This ensures the data security of the relevant data during the model inference process and the data security during the use of the relevant data.

[0106] In a possible manner, determining the data processing result based on the target model and the data to be processed may include: after the central processor establishes a second secure channel with the graphics processor based on the remote certification information of the graphics processor, distributing the data to be processed and the data processing task to the graphics processor, and the remote certification information of the graphics processor is used to verify the hardware environment and code logic in which the graphics processor runs; executing the data processing task based on the data to be processed by the graphics processor, and sending the execution result of the data processing task to the central processor; determining the data processing result by the central processor based on the execution result of the data processing task.

[0107] For example, depending on the actual deployment of a TEE cluster, a computing node typically includes at least one central processing unit (CPU) and at least one graphics processing unit (GPU). TEE technology can be implemented on both the CPU and GPU. Using trusted CPUs and GPUs to perform data processing tasks can improve data processing efficiency. Different manufacturers provide different technical solutions for implementing TEE technology on CPUs or GPUs. This disclosure does not limit the technical solutions for implementing TEE technology.

[0108] For example, taking the execution of the model fine-tuning task as an example, the remote certification information of the CPU device can be obtained to determine whether the CPU environment is trustworthy. In the trusted CPU environment, the remote certification information of the GPU device can be obtained. After verifying the trustworthiness of the GPU through the remote certification mechanism, a secure channel is established, and the data to be processed and the model fine-tuning task (including the computing logic required for fine-tuning) are sent to the GPU. After the GPU executes the model fine-tuning task, the execution result is sent to the CPU, and the CPU obtains the target model based on the execution result of the model fine-tuning task. By executing the model fine-tuning task through the GPU, especially when multiple GPUs execute the model fine-tuning task, the efficiency of the model fine-tuning can be improved. And by verifying the CPU environment and the GPU environment, it can be ensured that the model fine-tuning is performed in a safe hardware environment, and the processing logic of the model fine-tuning has not been tampered with, thereby ensuring the security of the entire data processing link.

[0109] Accordingly, when performing model reasoning, trusted CPUs and GPUs can also be used to improve model reasoning efficiency. The usage process is similar to performing model fine-tuning tasks, and this disclosure will not go into details here.

[0110] The above method uses TEE technology to encrypt memory to provide a confidential hardware environment (i.e., TEE environment), thereby protecting the security of data and models during use and preventing high-privilege entities or other malicious applications from stealing protected data such as user data and large language models in memory. In addition, a secure channel can be established with the TEE node through a remote attestation mechanism to encrypt the data before transmitting it, ensuring the security of the data during transmission. In addition, through the remote attestation mechanism, it can be verified that the node is running in a secure TEE environment and the running code has not been tampered with, ensuring that the running logic and data processing process are in line with expectations, and ensuring that the model used in the model inference service is the model content and version claimed by the model service provider (verified based on the model measurement value).

[0111] In addition, data and models are encrypted during storage, and a key management service running in the TEE environment securely manages various keys and credentials, including data keys, model keys, storage keys, and file keys. This ensures that nodes using keys comply with key access policies, prevents malicious nodes from stealing keys, and further protects the security of data and models. Furthermore, during model fine-tuning, communication between distributed nodes is further reinforced (via task node credentials) to prevent data or model leaks from intermediate interaction information.

[0112] It should be understood that the encryption communication method, data encryption method, key generation algorithm and remote certification process mentioned in the embodiments of the present disclosure are only for illustrative purposes. Those skilled in the art can make adaptive adjustments based on actual needs. For example, the key can be a symmetric key or an asymmetric key, and the present disclosure does not limit this.

[0113] Based on the same inventive concept, the present disclosure provides a data processing device. Referring to FIG. 5 , the data processing device 500 includes: a receiving module 501 , a determining module 502 , a decrypting module 503 , and a processing module 504 .

[0114] The receiving module 501 is configured to receive a data processing task;

[0115] a determination module 502 configured to determine target data corresponding to the data processing task and a target first key corresponding to the target data, wherein the target data is obtained by encrypting the data to be processed using the first key, and the target first key is obtained by encrypting the first key using the first session key, wherein the first session key is obtained by negotiation between a task processor of the data processing task and a key holder of the first key;

[0116] a decryption module 503 configured to decrypt the target first key according to the first session key by the target computing node to obtain the first key, and decrypt the target data according to the first key to obtain the data to be processed, wherein the target computing node runs in a trusted execution environment;

[0117] The processing module 504 is configured to determine a data processing result based on a target model and data to be processed, wherein the target model is obtained by decrypting an encrypted target model based on a model key, and the model key is stored in a key management service, and the key management service runs in a trusted execution environment.

[0118] Optionally, the data processing task is a model fine-tuning task, and the determination module 502 is configured to:

[0119] Read the target data through the target computing node based on the data path carried in the data processing task, and request the target first key from the key management service;

[0120] The processing module 504 includes a fine-tuning module, which is configured to:

[0121] The model fine-tuning task is performed according to the data to be processed, and the target model is fine-tuned according to the execution result of the model fine-tuning task to obtain the target fine-tuning model.

[0122] Optionally, the determining module 502 is configured to:

[0123] After the target computing node and the key management service establish a first secure channel through bidirectional remote attestation based on their respective remote attestation information, request the target first key from the key management service;

[0124] Among them, the remote certification information of the target computing node is used to verify the hardware environment and code logic in which the target computing node runs, the remote certification information of the key management service is used to verify the hardware environment and code logic in which the key management service runs, the key management service pre-stores the first key and the first key access policy, and the key management service is used to send the target first key to the target computing node when the first key access policy matches the remote certification information of the target computing node.

[0125] Optionally, the first key and the first key access policy in the key management service are obtained in the following manner:

[0126] In response to the remote attestation request, the key management service determines, by the key management service, a second session key based on remote attestation information of the key management service;

[0127] Encrypted communication is performed with the data provider of the data to be processed according to the second session key, and a first key and a first key access policy are determined and saved based on the encrypted communication, wherein the first key is generated by the data provider or the key management service, and the first key access policy is generated by the data provider.

[0128] Optionally, the data processing device 500 further includes a storage module, which is configured to:

[0129] After fine-tuning the target model based on the execution results of the model fine-tuning task and obtaining the target fine-tuning model, the target fine-tuning model is encrypted based on the model key and the encrypted target fine-tuning model is saved to the model warehouse;

[0130] Send the model key and its model key access policy to the key management service for storage.

[0131] Optionally, the target computing node includes multiple target computing nodes, and the data processing device 500 further includes a node credential request module, which is configured to:

[0132] Before executing the model fine-tuning task based on the data to be processed, each target computing node requests the task node credentials from the key management service;

[0133] The fine-tuning module is configured as follows:

[0134] Multiple target computing nodes execute the model fine-tuning task according to the data to be processed, and fine-tune the target model according to the execution results of the model fine-tuning task to obtain the target fine-tuning model. Each target computing node communicates with each other encrypted according to the task node certificate to exchange relevant data of the model fine-tuning task.

[0135] Optionally, the receiving module 501 is configured to:

[0136] Receive model fine-tuning tasks through the central node;

[0137] The data processing device 500 further includes a distribution module, which is configured to:

[0138] At least one target computing node for executing the model fine-tuning task is determined according to the task information of the model fine-tuning task, and the model fine-tuning task is distributed to the at least one target computing node.

[0139] Optionally, the data processing task is a model inference task, and the determination module 502 is configured to:

[0140] Determine target data and a target first key carried in the model inference task, wherein the target first key is obtained by encrypting the first key with the public key of the first session key, and the first session key includes a public key and a private key;

[0141] The decryption module 503 is configured to:

[0142] Decrypting the target first key using the private key through the target computing node to obtain the first key;

[0143] The processing module 504 includes a reasoning module, which is configured to:

[0144] Model inference is performed based on the target model and the data to be processed to obtain the model inference result.

[0145] Optionally, the data processing device 500 further includes a first remote attestation module, which is configured to:

[0146] Before receiving the model inference task sent by the client, in response to the remote attestation request sent by the client, establishing a third secure channel between the target computing node and the client based on the remote attestation information of the target computing node, wherein the remote attestation information of the target computing node is used to verify the hardware environment and code logic running on the target computing node;

[0147] The public key is sent to the client through the third secure channel, so that the client encrypts the first key according to the public key to obtain the target first key.

[0148] Optionally, the target model is obtained by:

[0149] In response to the initiation of the model inference service corresponding to the target model, obtaining the encrypted target model from the model repository through the target computing node;

[0150] After establishing a fourth secure channel through bidirectional remote attestation between the target computing node and the key management service based on their respective remote attestation information, obtaining the encrypted model key of the target model from the key management service, wherein the remote attestation information of the target computing node is used to verify the hardware environment and code logic running on the target computing node, and the remote attestation information of the key management service is used to verify the hardware environment and code logic running on the key management service;

[0151] The encrypted target model is decrypted according to the model key to obtain the target model.

[0152] Optionally, the data processing device 500 further includes a storage key request module, which is configured to:

[0153] After establishing the fourth security channel through two-way remote attestation between the target computing node and the key management service based on their respective remote attestation information, a storage key is requested from the key management service, and a storage key access policy for the storage key is determined, wherein the storage key is used to encrypt and store relevant data of the target model during the model inference process.

[0154] Optionally, the processing module 504 is configured to:

[0155] After the central processor establishes a second secure channel with the graphics processor based on the remote attestation information of the graphics processor, the data to be processed and the data processing task are distributed to the graphics processor, wherein the remote attestation information of the graphics processor is used to verify the hardware environment and code logic of the graphics processor;

[0156] Executing data processing tasks based on the data to be processed by the graphics processor, and sending the execution results of the data processing tasks to the central processor;

[0157] The data processing result is determined by the central processing unit based on the execution result of the data processing task.

[0158] Optionally, the key management service stores a file key and a file key access policy of an encrypted image file, the encrypted image file including a first image file of a model fine-tuning service for performing a model fine-tuning task and / or a second image file of a model inference service for a target model. Optionally, the data processing device 500 further includes a deployment module, which is configured to:

[0159] In response to a deployment command for the encrypted image file, requesting a file key from a key management service through remote attestation information of the proxy service, wherein the remote attestation information of the proxy service is used to verify the hardware environment and code logic in which the proxy service runs;

[0160] When the remote attestation information of the proxy service matches the file key access policy, the key management service sends the file key to the proxy service.

[0161] Decrypt the encrypted image file according to the file key to obtain the target image file, and deploy the target image file to provide model fine-tuning service or model inference service.

[0162] Optionally, the data processing device 500 further includes a second remote attestation module, which is configured to:

[0163] generating a second key in response to a remote attestation request from the key management service by the developer of the encrypted image file before requesting the file key from the key management service through the remote attestation information of the proxy service in response to a deployment command for the encrypted image file;

[0164] The second key and the remote certification information of the key management service are returned to the developer, so that the developer can verify the hardware environment and code logic of the key management service based on the remote certification information of the key management service. If the verification is passed, the file key is encrypted by the second key, and the encrypted file key and file key access policy are sent to the key management service for storage.

[0165] Regarding the apparatus in the above embodiments, the specific manner in which each module performs operations has been described in detail in the data processing method provided in the above embodiments of the present disclosure, and will not be elaborated on here.

[0166] Based on the same concept, an embodiment of the present disclosure further provides a computer-readable medium on which a computer program is stored. When the computer program is executed by a processing device, the above-mentioned data processing method is implemented.

[0167] Based on the same concept, an embodiment of the present disclosure further provides an electronic device, including: a storage device and a processing device.

[0168] a storage device having a computer program stored thereon;

[0169] The processing device is configured to execute the computer program in the storage device to implement the above data processing method.

[0170] Reference is now made to FIG6 , which illustrates a schematic diagram of the structure of an electronic device 600 suitable for implementing embodiments of the present disclosure. The electronic devices in the embodiments of the present disclosure may include, but are not limited to, mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), and the like, as well as fixed terminals such as digital TVs and desktop computers. The electronic device illustrated in FIG6 is merely an example and should not limit the functionality or scope of use of the embodiments of the present disclosure.

[0171] As shown in Figure 6, the electronic device 600 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage device 608 into a random access memory (RAM) 603. Various programs and data required for the operation of the electronic device 600 are also stored in the RAM 603. The processing device 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0172] Typically, the following devices may be connected to the I / O interface 605: an input device 606 including, for example, a touch screen, a touchpad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 607 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 608 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 609. The communication device 609 may allow the electronic device 600 to communicate with other devices wirelessly or by wire to exchange data. Although FIG. 6 shows the electronic device 600 with various devices, it should be understood that not all of the devices shown are required to be implemented or present. More or fewer devices may alternatively be implemented or present.

[0173] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication device 609, or installed from the storage device 608, or installed from the ROM 602. When the computer program is executed by the processing device 601, the above-mentioned functions defined in the method of the embodiment of the present disclosure are performed.

[0174] It should be noted that the computer-readable medium mentioned above in the present disclosure may be a computer-readable signal medium or a computer-readable storage medium, or any combination of the two. A computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or component, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, device, or component. In the present disclosure, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, which carries computer-readable program code. Such a propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium that can transmit, propagate, or transport a program for use by or in conjunction with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium may be transmitted using any suitable medium, including but not limited to wires, optical cables, RF (radio frequency), etc., or any suitable combination thereof.

[0175] In some embodiments, communication can be performed using any currently known or later developed network protocol, such as HTTP (HyperText Transfer Protocol), and can be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or later developed network.

[0176] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0177] The above-mentioned computer-readable medium carries one or more programs. When the above-mentioned one or more programs are executed by the electronic device, the electronic device: receives a data processing request sent by the client, the data processing request includes target data encrypted by a first key and a target first key encrypted by a public key, the public key is generated by a first computing node running in a trusted execution environment and sent to the client, and the first computing node is also used to generate a private key corresponding to the public key; the first computing node decrypts the target first key according to the private key to obtain the first key, and decrypts the target data according to the first key to obtain the data to be processed; performs model inference on the data to be processed through the target model to obtain a model inference result, the target model is obtained by decrypting the encrypted target model based on the model key, the model key is stored in the key management service, and the key management service runs in the trusted execution environment.

[0178] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages, or a combination thereof, including, but not limited to, object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on the remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0179] The flowcharts and block diagrams in the accompanying drawings illustrate the possible implementation architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flowchart or block diagram can represent a module, program segment, or a part of code, and the module, program segment, or a part of code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order than that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of the boxes in the block diagram and / or flowchart, can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0180] The modules described in the embodiments of the present disclosure may be implemented in software or hardware, wherein the name of a module does not necessarily limit the module itself.

[0181] The functions described above herein may be performed, at least in part, by one or more hardware logic components. For example, and without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chip (SOCs), complex programmable logic devices (CPLDs), and the like.

[0182] In the context of the present disclosure, a machine-readable medium can be a tangible medium that can contain or store a program for use by or in conjunction with an instruction execution system, device or equipment. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium can include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0183] The above description is merely a preferred embodiment of the present disclosure and an illustration of the technical principles employed. Those skilled in the art should understand that the scope of disclosure involved in the present disclosure is not limited to the technical solutions formed by the specific combination of the above-mentioned technical features, but also includes other technical solutions formed by any combination of the above-mentioned technical features or their equivalents without departing from the above-mentioned disclosed concepts. For example, a technical solution formed by replacing the above-mentioned features with (but not limited to) technical features with similar functions disclosed in this disclosure.

[0184] In addition, although each operation is described in a specific order, this should not be understood as requiring these operations to be performed in the specific order shown or in a sequential order. Under certain circumstances, multitasking and parallel processing may be advantageous. Similarly, although some specific implementation details have been included in the above discussion, these should not be interpreted as limiting the scope of the present disclosure. Some features described in the context of a separate embodiment can also be implemented in a single embodiment in combination. On the contrary, the various features described in the context of a single embodiment can also be implemented in multiple embodiments individually or in any suitable sub-combination mode.

[0185] Although the subject matter has been described using language specific to structural features and / or methodological logical actions, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. Rather, the specific features and actions described above are merely example forms of implementing the claims. Regarding the apparatus in the above-described embodiments, the specific manner in which each module performs operations has been described in detail in the data processing method provided in the above-described embodiments of the present disclosure and will not be further elaborated here.

Claims

1. A data processing method, comprising: Receive data processing tasks; Determine target data corresponding to the data processing task and a target first key corresponding to the target data, wherein the target data is obtained by encrypting the data to be processed by a first key, and the target first key is obtained by encrypting the first key by a first session key, and the first session key is obtained by negotiation between a task processor of the data processing task and a key holder of the first key; decrypting the target first key according to the first session key by the target computing node to obtain the first key, and decrypting the target data according to the first key to obtain the data to be processed, wherein the target computing node runs in a trusted execution environment; and A data processing result is determined according to the target model and the data to be processed, wherein the target model is obtained by decrypting the encrypted target model based on a model key, the model key is stored in a key management service, and the key management service runs in the trusted execution environment.

2. The method according to claim 1, wherein: The data processing task is a model fine-tuning task, and determining target data corresponding to the data processing task and a target first key corresponding to the target data includes: Reading the target data based on the data path carried in the data processing task through the target computing node, and requesting the target first key from the key management service; Determining the data processing result according to the target model and the data to be processed includes: The model fine-tuning task is performed according to the data to be processed, and the target model is fine-tuned according to the execution result of the model fine-tuning task to obtain a target fine-tuning model.

3. The method according to claim 2, wherein: The requesting the target first key from the key management service includes: After the target computing node and the key management service perform two-way remote attestation to establish a first secure channel based on their respective remote attestation information, requesting the target first key from the key management service; The remote certification information of the target computing node is used to verify the operation of the target computing node. The remote attestation information of the key management service is used to verify the hardware environment and code logic in which the key management service runs, the key management service pre-stores the first key and the first key access policy, and the key management service is used to send the target first key to the target computing node when the first key access policy matches the remote attestation information of the target computing node.

4. The method according to claim 3, wherein: The first key and the first key access policy in the key management service are obtained in the following manner: In response to the remote attestation request, the key management service determines a second session key based on remote attestation information of the key management service; Encrypted communication is performed with the data provider of the data to be processed according to the second session key, and the first key and the first key access policy are determined and saved based on the encrypted communication, wherein the first key is generated by the data provider or the key management service, and the first key access policy is generated by the data provider.

5. The method according to claim 2, further comprising: After fine-tuning the target model according to the execution result of the model fine-tuning task to obtain the target fine-tuning model, encrypting the target fine-tuning model based on the model key, and saving the encrypted target fine-tuning model to the model warehouse; The model key and the model key access policy of the model key are sent to the key management service for storage.

6. The method according to claim 2, wherein: The target computing node includes a plurality of target computing nodes, and the method further includes: Before executing the model fine-tuning task according to the data to be processed, requesting a task node credential from the key management service through each of the target computing nodes; The performing of the model fine-tuning task according to the data to be processed, and fine-tuning the target model according to the execution result of the model fine-tuning task to obtain the target fine-tuning model, includes: The target computing nodes execute the model fine-tuning task according to the data to be processed, and fine-tune the target model according to the execution result of the model fine-tuning task to obtain the target model. The target computing nodes communicate with each other through encrypted communication based on the task node credentials to exchange relevant data of the model fine-tuning task.

7. The method according to claim 2, wherein: The receiving data processing task includes: Receiving the model fine-tuning task through a central node; The method further comprises: At least one target computing node for executing the model fine-tuning task is determined according to the task information of the model fine-tuning task, and the model fine-tuning task is distributed to the at least one target computing node.

8. The method according to any one of claims 1 to 7, wherein: The data processing task is a model reasoning task, and determining target data corresponding to the data processing task and a target first key corresponding to the target data includes: Determine the target data and the target first key carried in the model reasoning task, wherein the target first key is obtained by encrypting the first key with the public key of the first session key, and the first session key includes the public key and the private key; The decrypting the target first key according to the first session key by the target computing node to obtain the first key includes: Decrypting the target first key according to the private key through the target computing node to obtain the first key; Determining the data processing result according to the target model and the data to be processed includes: Model inference is performed according to the target model and the data to be processed to obtain a model inference result.

9. The method according to claim 8, further comprising: Before receiving the model inference task sent by the client, in response to the remote attestation request sent by the client, a third secure channel is established between the target computing node and the client based on the remote attestation information of the target computing node, wherein the remote attestation information of the target computing node is used to verify the hardware environment and code logic of the target computing node; The public key is sent to the client through the third secure channel, so that the client encrypts the first key according to the public key to obtain the target first key.

10. The method according to claim 8, wherein: The target model is obtained in the following way: In response to the start of the model reasoning service corresponding to the target model, obtaining the encrypted target model from the model repository through the target computing node; After establishing a fourth security channel through two-way remote attestation by the target computing node and the key management service based on their respective remote attestation information, obtaining the encrypted model key of the target model from the key management service, wherein the remote attestation information of the target computing node is used to verify the hardware environment and code logic in which the target computing node runs, and the remote attestation information of the key management service is used to verify the hardware environment and code logic in which the key management service runs; The encrypted target model is decrypted according to the model key to obtain the target model.

11. The method according to claim 10, further comprising: After the fourth security channel is established by performing two-way remote attestation between the target computing node and the key management service based on their respective remote attestation information, a storage key is requested from the key management service, and a storage key access policy for the storage key is determined, wherein the storage key is used to encrypt and store relevant data of the target model during the model reasoning process.

12. The method according to any one of claims 1 to 7, wherein: Determining the data processing result according to the target model and the data to be processed includes: After the central processor establishes a second secure channel with the graphics processor based on the remote attestation information of the graphics processor, the data to be processed and the data processing task are distributed to the graphics processor, wherein the remote attestation information of the graphics processor is used to verify the hardware environment and code logic of the graphics processor; executing the data processing task based on the data to be processed by the graphics processor, and sending the execution result of the data processing task to the central processor; The data processing result is determined by the central processing unit based on the execution result of the data processing task.

13. The method according to any one of claims 1 to 7, wherein: The key management service stores a file key and a file key access policy of an encrypted image file, wherein the encrypted image file includes a first image file of a model fine-tuning service for performing a model fine-tuning task and / or a second image file of a model reasoning service for the target model, The method further comprises: In response to a deployment command for the encrypted image file, requesting the file key from the key management service through remote attestation information of the proxy service, wherein the remote attestation information of the proxy service is used to verify the hardware environment and code logic of the running of the proxy service; When the remote attestation information of the proxy service matches the file key access policy, issuing the file key to the proxy service through the key management service; The encrypted image file is decrypted according to the file key to obtain a target image file, and the target image file is deployed to provide the model fine-tuning service or the model inference service.

14. The method according to claim 13, further comprising: Before requesting the file key from the key management service through remote attestation information of the proxy service in response to the deployment command for the encrypted image file, generating a second key in response to a remote attestation request from the developer of the encrypted image file to the key management service; The second key and the remote certification information of the key management service are returned to the developer, so that the developer can verify the hardware environment and code logic of the key management service based on the remote certification information of the key management service, and if the verification passes, encrypt the file key by the second key, and send the encrypted file key and the file key access policy to the key management service for storage.

15. A data processing device, comprising: A receiving module, configured to receive a data processing task; a determination module, configured to determine target data corresponding to the data processing task and a target first key corresponding to the target data, wherein the target data is obtained by encrypting the data to be processed by a first key, and the target first key is obtained by encrypting the first key by a first session key, and the first session key is obtained by negotiation between a task processor of the data processing task and a key holder of the first key; The decryption module is configured to decrypt the target computing node according to the first session key. decrypting the target data using a first key to obtain the first key, and decrypting the target data according to the first key to obtain the data to be processed, wherein the target computing node runs in a trusted execution environment; and The processing module is configured to determine a data processing result according to a target model and the data to be processed, wherein the target model is obtained by decrypting the encrypted target model based on a model key, the model key is stored in a key management service, and the key management service runs in the trusted execution environment.

16. A computer readable medium having a computer program stored thereon, wherein: When the computer program is executed by a processing device, the method according to any one of claims 1 to 14 is implemented.

17. An electronic device comprising: a storage device having a computer program stored thereon; as well as A processing device is configured to execute the computer program in the storage device to implement the method according to any one of claims 1 to 14.

Images