Data processing method and apparatus

Abstract

Provided in the embodiments of the present application are a data processing method and apparatus. The method comprises: encrypting a first key on the basis of a second key of a first device, so as to obtain a ciphertext of the first key, wherein the first key is used for encrypting a model, so as to obtain a ciphertext of the model; encrypting the second key on the basis of a hardware key of the first device, so as to obtain a ciphertext of the second key; and storing the ciphertext of the model, the ciphertext of the first key, and the ciphertext of the second key. In this way, a second key KEK is encrypted by means of a hardware key; and since a first key MK is encrypted using the second key KEK, and a model is then encrypted using the first key MK, the binding between the model and a device can be realized, so that unauthorized use of the model is prevented, thereby effectively improving the security of the model.

Description

Data processing method and device

[0001] The present application claims priority to the Chinese patent application No. 202411108396.1, filed on August 12, 2024, with the State Intellectual Property Office of China, and the Chinese patent application No. 202411108396.1 has the title of “Data processing method and device”, the whole content of which is incorporated herein by reference. TECHNICAL FIELD

[0002] The present application relates to the field of artificial intelligence (AI), and in particular, to a data processing method and device. BACKGROUND

[0003] Generally, the large model training process needs to transmit data to a central server or cloud for calculation, and then transmit the result back, which involves a large amount of data transmission and network delay. The large model all-in-one machine preinstalls the model in the server, which can realize the private deployment of the large model, provide high computing density and energy efficiency, and has agility and scalability, and can form a cluster through interconnection between the whole machines. It can not only meet the performance requirements of large model fine-tuning, but also realize the real-time inference requirements of the center, and balance performance and cost. However, the training of the large model requires large-scale data sets and huge computing resources, and the large model itself has high commercial value and knowledge property. Deploying high-value models in the all-in-one machine poses a risk of being misused or stolen.

[0004] In the actual deployment process of the model all-in-one machine, there are mainly three main bodies: the device provider, the model provider and the model customer. The device provider provides the model all-in-one machine software and hardware devices including AI accelerators to the model provider. The model provider, as the owner of high-value models, imports the large model into the model all-in-one machine and sells it to the model customer for use. During the use of the customer, as the holder of the model all-in-one machine, he may illegally copy the model assets and produce behaviors such as stealing and misusing the model. For example, the existing encryption technology protection scheme based on pure cryptography only considers protecting the model from the perspective of confidentiality, and still cannot provide effective protection of model asset security, such as intellectual property (IP) protection. Even if the model is encrypted, the model customer can directly copy the model file after obtaining the model all-in-one machine, and import it into other devices for running, and steal the model. SUMMARY

[0005] The present application discloses a data processing method and device, which can ensure that the model can only be loaded and run on the authorized AI hardware device.

[0006] In a first aspect, an embodiment of the present application provides a data processing method applied to a data processing system, the data processing system comprising a first device, the method can comprise:

[0007] encrypting the first key based on a second key of the first device to obtain ciphertext of the first key, wherein the first key is used to encrypt a model to obtain ciphertext of the model;

[0008] encrypting the second key based on a hardware key of the first device to obtain ciphertext of the second key;

[0009] storing the ciphertext of the model, the ciphertext of the first key and the ciphertext of the second key.

[0010] In the embodiment of the present application, the model is encrypted based on the first key, such as a model encryption key (MK), to obtain the ciphertext of the model. The first key MK is encrypted based on the second key, such as a key encryption key (KEK), to obtain the ciphertext of the first key MK. The second key KEK is encrypted based on the hardware key of the first device to obtain the ciphertext of the second key KEK. In this way, the second key KEK is encrypted by the hardware key. Since the second key KEK encrypts the first key MK, and the first key MK encrypts the model, the binding between the model and the device can be achieved, the misuse of the model can be effectively prevented, and the security of the model can be effectively improved.

[0011] The first key can be randomly generated. The feature value of the model includes a hash value of a model file, a model identifier, etc.

[0012] The hardware key can be a hardware unique key (HUK). The hardware unique key HUK is a security module that is built in a trusted computing node in the form of a hardware board card as a trusted base point to provide password support and policy protection. The second key KEK is encrypted by the hardware unique key HUK. Since the second key KEK encrypts the first key MK, and the first key MK encrypts the model, the binding between the model and the device can be achieved, and the misuse of the model can be effectively prevented.

[0013] In a possible implementation, the second key is obtained based on a feature value of the model.

[0014] In a possible implementation, the trusted application (TA) exclusive key encryption protection KEK is derived based on the hardware unique key HUK of the first device.

[0015] The hardware key can also be a hardware-generated key protected by the HUK. Of course, it can also be a multi-layer key protected by the hardware key.

[0016] In a possible implementation, the second key is encrypted based on a hardware key in a target AI accelerator in the first device to obtain ciphertext of the second key, and the target AI accelerator is an accelerator in the first device that has distributed the second key.

[0017] This example can realize authorization only for the target AI accelerator, thereby guaranteeing the security of the model.

[0018] In a possible implementation, the target AI accelerator in the first device is imported through a driver interface to authorize the target AI accelerator, so that authorization can be realized only for part of the AI accelerators in the first device.

[0019] In a possible implementation, a key field in the model is obtained.

[0020] The key field is encrypted based on the first key to obtain ciphertext of the model.

[0021] This example encrypts only the key field in the model, which can effectively reduce the performance overhead caused by the encrypted model compared with the full-amount encryption mode, and avoids the problem of too long model loading time while protecting the model file.

[0022] The key field is related to model information, model features, or the like.

[0023] In a possible implementation, the key field is at least one of an optimizer field, a parameter field, and a structure field.

[0024] In another possible implementation, the data processing system further includes a second device, and before the first key is encrypted based on the second key of the first device to obtain ciphertext of the first key, the ciphertext of the model sent by the second device is received.

[0025] This example encrypts the model by another device, and then sends the ciphertext of the model, the first key, and a feature value of the model to the first device. After obtaining the ciphertext of the model, the first key is further encrypted by the second key (derived based on the received feature value of the model) of the first device to obtain ciphertext of the first key, and the second key is encrypted based on a hardware key of the first device to obtain ciphertext of the second key.

[0026] In a second aspect, the embodiments of the present application provide a data processing method applied to a data processing system, the data processing system comprising a first device storing a ciphertext of a model, a ciphertext of a second key and a ciphertext of a first key, the method comprising:

[0027] decrypting the ciphertext of the second key based on a hardware key of the first device to obtain plaintext of the second key;

[0028] decrypting the ciphertext of the first key based on the plaintext of the second key to obtain plaintext of the first key;

[0029] decrypting the ciphertext of the model based on the plaintext of the first key to obtain plaintext of the model.

[0030] In the embodiments of the present application, the ciphertext of the second key KEK is decrypted based on the hardware key of the first device to obtain the plaintext of the second key KEK. The ciphertext of the first key MK is decrypted based on the second key KEK to obtain the plaintext of the first key, and then the ciphertext of the model is decrypted based on the first key MK to obtain the model. In this example, since the second key KEK is stored in the trusted area of the authorized AI accelerator and cannot be accessed by the outside world, the model client can only load and decrypt the model in the memory in the correct environment and cannot steal the model file content. On the other hand, the ciphertext model file needs to be decrypted before loading, and the decryption process will first verify whether the AI accelerator of the current all-in-one machine is an authorized device through challenge; only after the verification is passed, the decryption operation can be normally executed. Therefore, the model client cannot achieve model theft and other behaviors by replacing the AI accelerator hardware of the all-in-one machine.

[0031] In a possible implementation, the to-be-used accelerator of the first device is authenticated;

[0032] After the to-be-used accelerator is authenticated, the step of decrypting the ciphertext of the first key based on the plaintext of the second key to obtain the plaintext of the first key is performed.

[0033] In a possible implementation, the first accelerator is determined from the to-be-used accelerator of the first device;

[0034] The response content between the first accelerator and other accelerators except the first accelerator in the to-be-used accelerator is obtained;

[0035] The authentication result of the to-be-used accelerator is obtained based on the encryption key of the first accelerator and the response content.

[0036] In this example, whether the encryption key of the to-be-used accelerator is the same is verified by judging the response content to confirm whether the to-be-used accelerator is in an authorized state, so that the model cannot be used illegally.

[0037] In a possible implementation, the encrypted value returned by the accelerator other than the first accelerator is obtained, wherein the encrypted value returned by the accelerator other than the first accelerator is obtained by encrypting a preset value based on an encryption key of the other accelerator, and the preset value is sent by the first accelerator;

[0038] The encrypted value returned by the accelerator other than the first accelerator is decrypted based on the encryption key of the first accelerator to obtain the plaintext of the encrypted value returned by the accelerator other than the first accelerator.

[0039] In this example, whether the encryption keys of the to-be-used accelerators are the same can be determined through the challenge-response mode.

[0040] In a possible implementation, if the plaintexts of the encrypted values returned by the accelerators other than the first accelerator are the same as the preset values sent by the first accelerator, respectively, the authentication result of the to-be-used accelerators of the first device is passed.

[0041] In this example, if the authentication result of the to-be-used accelerators is passed, it indicates that the to-be-used accelerators are authorized accelerators, that is, belong to the target AI accelerator. Further, the ciphertext of the first key MK is decrypted based on the second key KEK to obtain the first key MK.

[0042] In a third aspect, a data processing apparatus is provided, comprising:

[0043] The processing module is configured to encrypt the first key based on the second key of the first device to obtain the ciphertext of the first key, wherein the first key is used to encrypt the model to obtain the ciphertext of the model, and the second key is obtained based on the feature value of the model.

[0044] The processing module is further configured to encrypt the second key based on the hardware key of the first device to obtain the ciphertext of the second key.

[0045] The storage module is configured to store the ciphertext of the model, the ciphertext of the first key, and the ciphertext of the second key.

[0046] In a possible implementation, the processing module is further configured to:

[0047] The second key is encrypted based on the hardware key in the target AI accelerator in the first device to obtain the ciphertext of the second key, and the target AI accelerator is the accelerator in the first device that issues the second key.

[0048] In a possible implementation, the processing module is further configured to:

[0049] Obtain the key field in the model.

[0050] The key field is encrypted based on the first key to obtain ciphertext of the model.

[0051] In a possible implementation, the key field is at least one of an optimizer field, a parameter field, and a structure field.

[0052] In another possible implementation, the apparatus further includes a receiving module configured to:

[0053] receive the ciphertext of the model.

[0054] In a possible implementation, the second key is obtained based on a feature value of the model.

[0055] In a fourth aspect, the present application provides a data processing apparatus, the apparatus storing ciphertext of a model, ciphertext of a second key, and ciphertext of a first key, the apparatus including:

[0056] a processing module configured to decrypt the ciphertext of the second key based on a hardware key of the apparatus to obtain plaintext of the second key, the second key being obtained based on a feature value of the model;

[0057] the processing module is further configured to decrypt the ciphertext of the first key based on the plaintext of the second key to obtain plaintext of the first key.

[0058] the processing module is further configured to decrypt the ciphertext of the model based on the plaintext of the first key to obtain plaintext of the model, the second key being obtained based on the feature value of the model.

[0059] In a possible implementation, the processing module is further configured to:

[0060] authenticate a to-be-used accelerator of the first device;

[0061] after the to-be-used accelerator is authenticated, the processing module is configured to decrypt the ciphertext of the first key based on the plaintext of the second key to obtain the plaintext of the first key.

[0062] In a possible implementation, the processing module is specifically configured to:

[0063] determine a first accelerator from the to-be-used accelerator of the first device;

[0064] obtain response content between the first accelerator and other accelerators in the to-be-used accelerator except the first accelerator;

[0065] obtain an authentication result of the to-be-used accelerator based on an encryption key of the first accelerator and the response content.

[0066] In a possible implementation, the processing module is specifically configured to:

[0067] obtain encrypted values returned by the accelerator other than the first accelerator, wherein the encrypted values returned by the accelerator other than the first accelerator are obtained by encrypting preset values sent by the first accelerator respectively based on an encryption key of the accelerator other than the first accelerator;

[0068] decrypt the encrypted values returned by the accelerator other than the first accelerator respectively based on the encryption key of the first accelerator to obtain plaintexts of the encrypted values returned by the accelerator other than the first accelerator.

[0069] In a possible implementation, if the plaintexts of the encrypted values returned by the accelerator other than the first accelerator are all the same as the preset values sent by the first accelerator, the authentication result of the accelerator to be used by the first device is passed.

[0070] In a fifth aspect, the present application provides a data processing apparatus, comprising a processor and a memory; wherein the memory is configured to store program code, and the processor is configured to invoke the program code to execute the method provided in any possible implementation of the first aspect or the method provided in any possible implementation of the second aspect.

[0071] In a sixth aspect, the present application provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the method provided in any possible implementation of the first aspect or the method provided in any possible implementation of the second aspect.

[0072] In a seventh aspect, the present application provides a computer program product, which, when running on a computer, causes the computer to execute the method provided in any possible implementation of the first aspect or the method provided in any possible implementation of the second aspect.

[0073] It can be understood that the apparatus of the third aspect, the apparatus of the fourth aspect, the apparatus of the fifth aspect, the computer storage medium of the sixth aspect or the computer program product of the seventh aspect are all configured to execute the method provided in any of the first aspect or the method provided in any possible implementation of the second aspect. Therefore, the beneficial effects that can be achieved are referred to the beneficial effects in the corresponding method, which will not be described here. BRIEF DESCRIPTION OF DRAWINGS

[0074] The drawings used in the embodiments of the present application are described below.

[0075] FIG. 1a is a schematic diagram of an architecture of a data processing system to which the embodiments of the present application are applicable;

[0076] FIG. 1b is a schematic diagram of another data processing system to which embodiments of the present application are applicable;

[0077] FIG. 2 is a schematic diagram of a model deployment workflow provided by embodiments of the present application;

[0078] FIG. 3 is a schematic diagram of a data processing method provided by embodiments of the present application;

[0079] FIG. 4 is a schematic diagram of a three-layer key architecture provided by embodiments of the present application;

[0080] FIG. 5 is a schematic diagram of another data processing method provided by embodiments of the present application;

[0081] FIG. 6 is a schematic diagram of a model usage workflow provided by embodiments of the present application;

[0082] FIG. 7 is a schematic diagram of a data processing apparatus provided by embodiments of the present application;

[0083] FIG. 8 is a schematic diagram of another data processing apparatus provided by embodiments of the present application;

[0084] FIG. 9 is a schematic diagram of yet another data processing apparatus provided by embodiments of the present application. DETAILED DESCRIPTION

[0085] Embodiments of the present application will be described below in conjunction with the accompanying drawings. The terms used in the implementation manner part of the embodiments of the present application are only used to explain the specific embodiments of the present application, and are not intended to limit the present application.

[0086] The system architecture of the embodiments of the present application will be described in detail below in conjunction with the accompanying drawings. Please refer to FIG. 1a, which is a schematic diagram of the architecture of a data processing system to which embodiments of the present application are applicable. The system includes a device provider 101, a model provider 102, and a model customer 103. Among them:

[0087] The device provider 101 is configured to provide an all-in-one machine device.

[0088] The model provider 102 is configured to import a model into the all-in-one machine device provided by the device provider 101. The process of importing the model corresponds to the deployment workflow described below, which will not be described in detail here.

[0089] The model customer 103 is configured to use the model all-in-one machine device provided by the model provider 102 and equipped with the model. Among them, the model all-in-one machine is a combination of software and hardware device, which integrates AI chips, AI platform software and various model algorithms, and can provide a complete set of model services. The process of using the model all-in-one machine corresponds to the usage workflow described below, which will not be described in detail here.

[0090] The model provider 102 authorizes the model client 103 to use the model. When a third party (or the model client 103) copies the model file in the model all-in-one machine and imports the model file into another device for running, based on the data processing method provided in the scheme, the model is bound with the device, so that the model cannot run on other unauthorized devices, the model is effectively prevented from being stolen, and the security of the model can be effectively improved.

[0091] Please refer to FIG. 1b, which is a schematic diagram of another data processing system to which the embodiments of the present application are applicable. The system includes a first device 1001 and a second device 1002. The first device 1001 can be a server, etc., and the second device can be a personal computer or a server, etc. The present scheme does not limit this.

[0092] The first device 1001 is configured to encrypt the first key based on a second key (such as a KEK) of the first device 1001 to obtain the ciphertext of the first key. The first key is used to encrypt the model to obtain the ciphertext of the model.

[0093] The first device 1001 is further configured to encrypt the second key based on a hardware key (such as a hardware unique key HUK) of the first device to obtain the ciphertext of the second key.

[0094] Further, the first device 1001 further stores the ciphertext of the model, the ciphertext of the first key, and the ciphertext of the second key.

[0095] The present scheme can protect the model file (hereinafter referred to as a model) stored in the first device and bind the model file with the hardware, so as to ensure that the model asset cannot be stolen by a third party in possession of the device, ensure that the model can only be loaded and run on an authorized AI hardware device, and prevent model theft (such as stealing the model content and loading the model on an unauthorized device and using the related services based on the model without authorization of the model asset holder).

[0096] Two implementation manners of the first device 1001 to obtain the ciphertext of the model provided in the present application will be introduced below in combination with FIG. 1b.

[0097] In one possible implementation manner, the second device 1002 encrypts the model based on a first key (such as MK) to obtain the ciphertext of the model. Further, the second device 1002 can import the ciphertext of the model into the first device 1001. The second device 1002 further imports the feature value of the model and the first key into the first device 1001.

[0098] In another possible implementation manner, the first device 1001 encrypts the model based on the first key to obtain the ciphertext of the model.

[0099] The architecture of the embodiments of the present application is described above, and the method of the embodiments of the present application is described in detail below.

[0100] Referring to FIG. 2, it is a schematic diagram of a model deployment workflow provided by the embodiments of the present application. As shown in FIG. 2, the device provider provides a model all-in-one machine to the model provider. The model provider imports the trained model into the model all-in-one machine.

[0101] The model all-in-one machine includes hardware such as a central processing unit (CPU) and one or more AI accelerators, and also includes a software image package (such as the image shown in FIG. 2). The AI accelerator is a kind of microprocessor or computing system specially used for hardware acceleration of artificial intelligence (especially artificial neural network, machine vision, machine learning, etc.). The CPU and the AI accelerator can be connected in communication through a PCIe interface.

[0102] The CPU in the model all-in-one machine is described below.

[0103] For example, the CPU includes a first host Host and a model running environment.

[0104] The first host Host can be used for model inference scenarios. The first host Host includes 1, an AI-agent Agent: mainly responsible for forwarding communication messages of an AI-cryptographic file system (CFS) and AI-client applications (CA). For the introduction of AI-CFS and AI-CA, please refer to the description below, which is not described in detail here. 2, an AI accelerator driver: used to drive the AI accelerator.

[0105] The model running environment can be used to run the model. The model running environment includes 1, an AI application (APP): including model ciphertext and MK ciphertext. 2, an AI-CFS: providing a dedicated file system for model loading. The AI-CFS will request the AI-Agent to encrypt and decrypt the model file when importing or loading the model, and the subsequent operation can be performed only after the encryption and decryption is successful. The encryption and decryption process is implemented in the file system and is transparent when used. 3, an AI framework: a set of standard interfaces, feature libraries and toolkits for AI algorithm model design, training and verification, which integrates algorithm encapsulation, data calling and computing resource usage, and also provides a development interface and an efficient execution platform for developers.

[0106] The AI accelerator in the model all-in-one machine is described below.

[0107] Exemplarily, the AI accelerator comprises a rich execution environment (REE) and a trusted execution environment (TEE). The rich execution environment REE is mainly used to run programs that are not high in security requirements. The REE comprises a second Host, which comprises an AI-CA and an AI accelerator driver. The AI-CA is an application running on the AI accelerator hardware, exposes an encryption and decryption interface to the first Host of the all-in-one machine, and is responsible for calling the accelerator trusted application to perform feasible root-related confidential operations. The trusted execution environment TEE is a secure area in the processing unit, which can guarantee the confidentiality and integrity of the programs and data therein. The TEE is an isolated execution environment, which can have secure functions such as isolated execution, integrity of the application program executed together with the TEE, and confidentiality of the assets thereof. The TEE is mainly used to run security-sensitive programs. The TEE comprises an AI-trusted application (TA), a secure storage, a device (D)-HUK, and a KEK. The AI-TA is a trusted application on the AI accelerator hardware, the confidentiality and integrity of which are protected by hardware, and is responsible for accessing the hardware unique key HUK and performing related confidential operations such as encryption and decryption. The hardware unique key HUK is a security module in the form of a hardware board card, which is built into the trusted computing node as a trusted base point to provide password support and policy protection.

[0108] The software image package in the model all-in-one machine is introduced below.

[0109] Exemplarily, the software image package is mainly used to deploy model inference service related software in the model all-in-one machine. The software image package comprises model ciphertext, MK ciphertext, and an AI-CFS. For this part, refer to the description above, which is not repeated here.

[0110] In combination with FIG. 2 and FIG. 1b, the model deployment workflow comprises:

[0111] (1) The second device obtains a container image comprising model ciphertext and model key MK (i.e., the image shown in FIG. 2) by using the AI-CFS, and imports the image and model feature value (not shown in the figure) into the first device.

[0112] Optionally, when encrypting the model, only the key field of the model is encrypted. The key field is related to model information, model features, etc. For this part, refer to the description of step 301 in the embodiment shown in FIG. 3, which is not repeated here.

[0113] Alternatively, the encryption of the model can be performed by the first device. For example, the first device encrypts the model based on a first key MK to obtain ciphertext of the model. The first device encrypts the first key based on a second key KEK to obtain ciphertext of the first key. For details, refer to the description of steps 301 and 302 in the embodiment shown in FIG. 3, which will not be repeated here.

[0114] (2) The first device selects a target AI accelerator and delivers the KEK to the selected target AI accelerator.

[0115] The KEK can be derived by the first device based on the imported model feature value when the second device imports the model feature value into the first device.

[0116] For example, the first device delivers the KEK to the secure storage of the TEE of the target AI accelerator. The selected AI accelerator can be part of the accelerators in the first device or all of the accelerators in the AI accelerator.

[0117] (3) The first device seals the storage of the KEK based on the HUK.

[0118] The AI-TA seals the storage of the KEK using the hardware unique key HUK and stores it in the AI accelerator.

[0119] (4) The first device encrypts and stores the model key MK.

[0120] For example, the MK is encrypted using the KEK, and the ciphertext of the MK is stored as ciphertext model header metadata. The first device stores the ciphertext of the model, the ciphertext of the MK, and the ciphertext of the KEK.

[0121] In this way, the model is encrypted based on the key MK, and the key MK is encrypted based on the KEK, which ensures the security of the model. At the same time, the ciphertext of the KEK is sealed and stored based on the hardware key such as the HUK, so that the hardware key in the AI accelerator encrypts and protects the model, ensuring that only authorized accelerators have the ability to decrypt and load the model. In this way, the model asset is bound to the AI accelerator hardware. Finally, by implementing a transparent model security protection file system, the model client can use the model on an authorized device while preventing the model asset from being stolen and misused. The model client cannot obtain the model content through malicious copying, and cannot arbitrarily replace an unauthorized AI accelerator on an all-in-one machine and run the model.

[0122] The above examples briefly introduce the model deployment. The data processing method provided in the embodiments of the present application is described below.

[0123] Referring to FIG. 3, a flowchart of a data processing method is shown. Optionally, the method can be applied to the first device 1001. As shown in FIG. 3, the data processing method can include steps 301-304. It should be understood that, for the convenience of description, the steps 301-304 are described in this order, and it is not intended to limit the execution of the steps in the above order. The embodiments of the present application do not limit the order of execution, the time of execution, the number of execution, etc. of one or more steps described above. Hereinafter, the execution subject of the steps 301-304 of the data processing method is taken as an example of the first device, and the present application is also applicable to other execution subjects. The steps 301-304 are as follows:

[0124] 301. The first device encrypts the model based on a first key to obtain ciphertext of the model.

[0125] The first key can be a model encryption key (MK). The first key can be randomly generated.

[0126] For example, the encryption processing can be performed by using an Advanced Encryption Standard (AES) algorithm. The encryption algorithm is only an example, and the present application is not limited thereto.

[0127] In one possible implementation, a key field in the model is obtained. The key field is related to model information, model features, etc. Then, the key field is encrypted based on the first key MK to obtain the ciphertext of the model.

[0128] For example, the key field includes at least one of a parameter field, a structure field, and an optimizer field. For example, the parameter field is a model field. The structure field is a field that changes based on the model. The optimizer field is an optimizer field.

[0129] In one possible implementation, the model includes a parameter field, a structure field, and an optimizer field, and the key field includes the parameter field and the structure field. Therefore, only the parameter field and the structure field are encrypted.

[0130] This example only encrypts the key field in the model. Compared with the full encryption method, the performance overhead caused by the encrypted model can be effectively reduced, and the problem of long model loading time can be avoided while protecting the model file.

[0131] It should be noted that the encryption of the model based on the first key MK can also be completed by the second device. The first key MK can be randomly generated externally when the second device encrypts the model. The present application is not limited thereto.

[0132] Specifically, when the encryption processing of the model based on the first key MK is completed by the second device, the second device generates the ciphertext of the model. Further, the ciphertext of the model and the feature value of the model and the first key are respectively imported into the first device.

[0133] 302, the first device encrypts the first key based on the second key to obtain the ciphertext of the first key.

[0134] The second key can be a key encryption key (KEK). The second key KEK can be generated based on the feature value of the model.

[0135] In a possible implementation, the second key KEK can be derived by the first device based on the feature value of the model when the model is imported into the first device. The feature value of the model includes a hash value of a model file, a model identifier, etc.

[0136] The encryption processing can refer to the description of step 301, which will not be repeated here.

[0137] In this example, the first key is further encrypted based on the second key KEK, which can improve the security of the model.

[0138] In a possible implementation, the first device distributes the second key KEK to a target AI accelerator in the first device, for example, through a driver interface to import the target AI accelerator in the first device to authorize the target AI accelerator. In this way, only part of the AI accelerators in the first device can be authorized.

[0139] In this example, only the target AI accelerator can be authorized, which ensures the security of the model.

[0140] 303, the first device encrypts the second key based on the hardware key of the first device to obtain the ciphertext of the second key.

[0141] The hardware key can be a hardware unique key HUK. The hardware unique key HUK is a security module that is built into a trusted computing node in the form of a hardware board card as a trusted base point to provide password support and policy protection. By encrypting the second key KEK with the hardware unique key HUK, since the second key KEK encrypts the first key MK, and the first key MK encrypts the model, the binding between the model and the device can be achieved, and the theft of the model can be effectively prevented.

[0142] In a possible implementation, the trusted application (TA) exclusive key encryption protection KEK is derived based on a hardware unique key HUK of the first device.

[0143] The hardware key can also be a hardware generated key protected by the HUK. Of course, it can also be a multi-layer key protected by the hardware key.

[0144] In a possible implementation, the second key KEK is encrypted based on a hardware key in a target AI accelerator in the first device to obtain ciphertext of the second key KEK.

[0145] Since the hardware key such as the HUK in each AI accelerator is different, when the target AI accelerator includes multiple accelerators, the second key KEK is encrypted based on the multiple accelerators respectively to obtain ciphertext of multiple second keys KEK.

[0146] In combination with FIG. 4, FIG. 4 shows a three-layer key architecture diagram. The model key MK (the first key) is responsible for encrypting the model; the key encryption key KEK (the second key) is responsible for encrypting the MK; the HUK is obtained based on the AI accelerator hardware characteristics to derive the TA exclusive key encryption protection KEK. In this way, the binding between the model and the device can be achieved, the model theft can be effectively prevented, and the security of the model can be effectively improved.

[0147] 304, the first device stores the ciphertext of the model, the ciphertext of the first key, and the ciphertext of the second key KEK.

[0148] In a possible implementation, the ciphertext of the second key KEK is stored in a trusted area of an authorized AI accelerator of the first device, and the ciphertext of the model and the ciphertext of the first key are stored in a central processing unit (CPU) of the first device.

[0149] By storing the ciphertext of the model, the ciphertext of the first key, and the ciphertext of the second key KEK, the model client 103 can use the model by decrypting the ciphertexts respectively, thereby preventing the model from being stolen.

[0150] In the embodiment of the present application, the model is encrypted based on the first key MK to obtain the ciphertext of the model. The first key MK is encrypted based on the second key KEK to obtain the ciphertext of the first key. The second key KEK is encrypted based on the hardware key of the first device to obtain the ciphertext of the second key KEK. In this way, the second key KEK is encrypted by the hardware key, and since the second key KEK encrypts the first key MK, and the first key MK encrypts the model, the binding between the model and the device can be achieved, the unauthorized use of the model can be effectively prevented, and the security of the model can be effectively improved.

[0151] The above examples introduce the model deployment process. The model usage process is introduced below.

[0152] Referring to FIG. 5, it is a flowchart of another data processing method provided by the embodiment of the present application. Optionally, the method can be applied to the first device 1001 described above. The data processing method shown in FIG. 5 can include steps 501-503. It should be understood that the present application is described in the order of 501-503 for the convenience of description, and is not intended to limit the execution in the above order. The embodiment of the present application does not limit the execution order, execution time, execution times, etc. of one or more steps described above. Hereinafter, the execution subject of steps 501-503 of the data processing method is taken as an example to describe the first device, and the present application is also applicable to other execution subjects. The first device stores the ciphertext of the model, the ciphertext of the second key, and the ciphertext of the first key, and steps 501-503 are as follows:

[0153] 501, the ciphertext of the second key KEK is decrypted based on the hardware key of the first device to obtain the plaintext of the second key KEK.

[0154] It can be understood that the decryption process corresponds to the encryption process described above, that is, the decryption algorithm and the encryption algorithm are the same, and the present application does not limit this.

[0155] 502, the ciphertext of the first key is decrypted based on the plaintext of the second key to obtain the plaintext of the first key.

[0156] In one possible implementation, before step 502, it further includes authenticating the to-be-used accelerator of the first device. After the to-be-used accelerator is authenticated, step 502 is performed.

[0157] The authentication can be understood as verifying whether the to-be-used accelerator of the first device is an authorized target AI accelerator.

[0158] In one possible implementation, the to-be-used accelerator is authenticated based on the encryption key of the to-be-used accelerator of the first device.

[0159] Optionally, the first accelerator is determined from the accelerators to be used in the first device.

[0160] For example, the first accelerator is the master authentication device. It can be any one of the accelerators to be used, and the present solution does not limit this.

[0161] Then, the response content between the first accelerator and each of the other accelerators to be used in the first device is obtained. Further, the authentication result of the accelerators to be used is obtained based on the encryption key of the first accelerator and the response content.

[0162] For example, when the number of the accelerators to be used is greater than 1, the master authentication device (the first accelerator) is selected, and then the encryption key of the master authentication device and the encryption key of the other slave authentication devices (the other accelerators to be used except the first accelerator) are loaded. Further, the master authentication device initiates a challenge to the other slave authentication devices to obtain the authentication result of the accelerators to be used.

[0163] In a possible implementation, the first accelerator sends a preset value to each of the other accelerators except the first accelerator. Then, the encrypted values returned by the other accelerators are obtained. The encrypted values returned by the other accelerators are obtained by encrypting the received preset values based on the encryption keys of the other accelerators, respectively. Further, the encrypted values returned by the other accelerators are decrypted based on the encryption key of the first accelerator to obtain the plaintext of the encrypted values returned by the other accelerators. If the plaintext of the encrypted values returned by the other accelerators is the same as the preset value sent by the first accelerator, the authentication result of the accelerators to be used in the first device is passed.

[0164] In this example, whether the encryption keys of the accelerators to be used are the same can be determined by the challenge-response mode, whether the accelerators to be used are in an authorized state is determined, and thus it is ensured that the model will not be used illegally.

[0165] For example, the first accelerator sends a random number to each of the other accelerators except the first accelerator, the other accelerators encrypt the received random numbers based on the encryption keys of the other accelerators, and return the encrypted random numbers to the first accelerator. Further, the first accelerator decrypts the received encrypted random numbers based on the encryption key of the first accelerator. If the decrypted random number is the same as the random number sent by the first accelerator, it indicates that the encryption key used by the other accelerators except the first accelerator is the same as the encryption key held by the first accelerator, that is, the authentication is passed.

[0166] It can be understood that the authentication passed the plurality of to-be-used accelerators belong to the target AI accelerator described above. That is, the target AI accelerator includes the first accelerator described above, and also includes other accelerators that pass the authentication.

[0167] Further, the ciphertext of the first key MK is decrypted based on the plaintext of the second key KEK to obtain the plaintext of the first key.

[0168] When the number of to-be-used accelerators is 1, the to-be-used accelerator is the master verification device (the first accelerator), and then the master verification device and other slave verification devices (0 other accelerators) load their encryption keys respectively. Further, the master verification device initiates a challenge to the other slave verification devices (0 other accelerators). It can be understood that in this case, the other slave verification devices (0 other accelerators) do not return the encrypted values. The authentication result is also regarded as passing the authentication.

[0169] In a possible implementation, when the number of to-be-used accelerators is 1, the to-be-used accelerator (the master verification device, i.e., the first accelerator) loads the second key KEK, and then decrypts the ciphertext of the first key MK based on the plaintext of the second key KEK to obtain the plaintext of the first key MK.

[0170] That is, when the number of to-be-used accelerators is 1, the encryption key of the to-be-used accelerator is the second key KEK, and the to-be-used accelerator can successfully decrypt the ciphertext of the first key MK.

[0171] It should be noted that when the number of to-be-used accelerators is 1, the authentication result is regarded as passing the authentication. When the ciphertext of the first key MK is decrypted, if the master verification device does not load the encryption key during the authentication, or the encryption key is not the second key KEK, the master verification device cannot obtain the plaintext of the first key MK.

[0172] The above examples introduce the authentication result as passing, and the following describes the authentication result as not passing.

[0173] When the number of to-be-used accelerators is greater than 1, in a possible implementation process, if the plaintexts of the encrypted values returned by the other accelerators are different from the preset values sent by the first accelerator respectively, the authentication result of the encryption key of the to-be-used accelerator of the first device is not passing.

[0174] For example, the first accelerator holds the second key, and the other accelerators do not hold the second key (i.e., unauthorized). In this case, the plaintexts of the encrypted values returned by the other accelerators are different from the preset values sent by the first accelerator. In a possible implementation, a prompt message is sent to indicate the AI accelerator whose authentication is not passing.

[0175] The scenario can also be, for example, that the first accelerator does not hold the second key, and the first accelerator fails to decrypt the encrypted value returned by the other accelerators (which can be all authorized or part of them), indicating that the authentication result is not passed.

[0176] When the authentication result of the accelerator to be used is not passed, it indicates that there is an unauthorized accelerator. In order to protect the security of the model file content, step 502 is not performed, and the data processing process ends.

[0177] 503, decrypt the ciphertext of the model based on the plaintext of the first key, to obtain the plaintext of the model.

[0178] Decrypt the ciphertext of the model based on the first key MK to obtain the model. Further, the first device can use the model.

[0179] In the embodiment of the application, the ciphertext of the second key KEK is decrypted based on the hardware key of the first device to obtain the plaintext of the second key KEK. The ciphertext of the first key MK is decrypted based on the second key KEK to obtain the plaintext of the first key, and then the ciphertext of the model is decrypted based on the first key MK to obtain the model. In this example, since the second key KEK is stored in the trusted area of the authorized AI accelerator and cannot be accessed by the outside world, the model client can only load and decrypt the model in the memory in the correct environment, and cannot steal the model file content. On the other hand, the ciphertext model file needs to be decrypted before loading, and the decryption process will first verify whether the AI accelerator of the current all-in-one machine is an authorized device through the challenge; only after the verification is passed, the decryption operation can be normally executed. Therefore, the model client cannot achieve model theft and other behaviors by replacing the AI accelerator hardware of the all-in-one machine.

[0180] Referring to FIG. 6, it is a schematic diagram of a model usage workflow provided by an embodiment of the application. For the framework shown in FIG. 6, refer to the description of the embodiment shown in FIG. 2, which will not be repeated here. In combination with FIG. 6 and FIG. 1b, the process can include:

[0181] (1) The first device requests to load the model.

[0182] When the model is started, the first device randomly selects an accelerator to be used as a main verification device, extracts the model header metadata MK ciphertext and the accelerator information to be used, and transmits them to the main verification device. Further, the first device initiates a request to load the model.

[0183] (2) The first device obtains the hardware key and extracts the second key.

[0184] For example, the first device obtains a hardware unique key HUK from the TEE.

[0185] The ciphertext of the second key is decrypted based on the HUK in the TEE to obtain the second key.

[0186] The main verification device and other accelerators to be used load their encrypted keys respectively.

[0187] (3) The first device performs accelerator authorization authentication based on the second key KEK.

[0188] For example, the main verification device initiates a challenge to other accelerators using KEK. When the number of accelerators to be used is greater than 1, if the encrypted keys of the other accelerators are the same as the encrypted key of the main verification device, it indicates that the authentication authorization is passed. When the number of accelerators to be used is 1, it is considered that the authentication is passed.

[0189] For details, refer to the description of step 502 in the embodiment shown in FIG. 5, which will not be repeated here.

[0190] (4) The first device obtains the first key MK and decrypts the ciphertext of the model, and then loads the model.

[0191] After the authentication is passed, the MK is decrypted in the TEE of the main verification device based on the second key, and the decrypted model is returned to the CPU.

[0192] In this example, since the second key KEK is stored in the trusted area of the authorized AI accelerator and cannot be accessed by the outside world, the model client can only load and decrypt the model in the correct environment and run it in the memory, and cannot steal the model file content. On the other hand, the ciphertext model file needs to be decrypted before loading, and the decryption process will first verify whether the AI accelerator of the all-in-one machine is an authorized device through the challenge; only after the verification is passed, the decryption operation can be normally executed. Therefore, the model client cannot achieve model theft and other behaviors by replacing the AI accelerator hardware of the all-in-one machine.

[0193] It should be noted that in each embodiment of the present application, if there is no special description and logical conflict, the terms and / or descriptions of each embodiment are consistent and can be mutually referenced. The technical features in different embodiments can be combined to form new embodiments according to their inherent logical relationship.

[0194] The above describes the method of the embodiments of the present application in detail. The apparatus of the embodiments of the present application is provided below. It can be understood that the division of multiple units or modules in each apparatus embodiment of the present application is only a logical division according to functions, and does not limit the specific structure of the apparatus. In a specific implementation, some of the function modules can be subdivided into more detailed function modules, and some of the function modules can be combined into one function module, but regardless of whether the function modules are subdivided or combined, the general process performed by the apparatus is the same. For example, some apparatuses include a receiving unit and a sending unit. In some designs, the sending unit and the receiving unit can also be integrated into a communication unit, which can implement the functions implemented by the receiving unit and the sending unit. Generally, each unit corresponds to a respective program code (or program instruction), and the respective program code of each unit, when running on a processor, causes the unit to be controlled by the processing unit to perform the corresponding process to implement the corresponding function.

[0195] The embodiments of the present application also provide an apparatus for implementing any of the above methods, for example, a data processing apparatus is provided, which includes a module (or means) for implementing each step performed by the first device in any of the above methods.

[0196] For example, referring to FIG. 7, which is a structural schematic diagram of a data processing apparatus provided by an embodiment of the present application. The data processing apparatus is used to implement the data processing method described above, for example, the data processing method shown in FIG. 2.

[0197] As shown in FIG. 7, the apparatus can include a processing module 701 and a storage module 702, specifically as follows:

[0198] The processing module 701 is configured to perform encryption processing on the first key based on a second key of the first device, to obtain ciphertext of the first key, wherein the first key is used to encrypt a model to obtain ciphertext of the model.

[0199] The processing module 701 is further configured to perform encryption processing on the second key based on a hardware key in the first device, to obtain ciphertext of the second key.

[0200] The storage module 702 is configured to store the ciphertext of the model, the ciphertext of the first key, and the ciphertext of the second key.

[0201] In a possible implementation, the processing module 701 is further configured to:

[0202] perform encryption processing on the second key based on a hardware key in a target AI accelerator in the first device, to obtain ciphertext of the second key, the target AI accelerator being an accelerator in the first device that has distributed the second key.

[0203] In a possible implementation, the processing module 701 is further configured to:

[0204] obtain a key field in the model;

[0205] encrypt the key field based on the first key to obtain ciphertext of the model.

[0206] In a possible implementation, the key field is at least one of an optimizer field, a parameter field, and a structure field.

[0207] In another possible implementation, the apparatus further includes a receiving module configured to:

[0208] receive the ciphertext of the model.

[0209] In a possible implementation, the second key is obtained based on a feature value of the model.

[0210] The above modules can refer to the descriptions of the foregoing embodiments, and thus repeated description is omitted here.

[0211] For example, referring to FIG. 8, which is a structural schematic diagram of another data processing apparatus provided by the embodiments of the present application. The data processing apparatus is configured to implement the foregoing data processing method, for example, the data processing method shown in FIG. 5.

[0212] As shown in FIG. 8, the apparatus stores ciphertext of a model, ciphertext of a second key, and ciphertext of a first key. The apparatus can include a processing module 801, which is specifically configured as follows:

[0213] The processing module 801 is configured to decrypt the ciphertext of the second key based on a hardware key of the apparatus to obtain plaintext of the second key, the second key being obtained based on a feature value of the model.

[0214] The processing module 801 is further configured to decrypt the ciphertext of the first key based on the plaintext of the second key to obtain plaintext of the first key.

[0215] The processing module 801 is further configured to decrypt the ciphertext of the model based on the plaintext of the first key to obtain plaintext of the model, the second key being obtained based on the feature value of the model.

[0216] In a possible implementation, the processing module 801 is further configured to:

[0217] authenticate a to-be-used accelerator of the first device;

[0218] After the to-be-used accelerator passes the authentication, the processing module is configured to decrypt the ciphertext of the first key based on the plaintext of the second key to obtain the plaintext of the first key.

[0219] In a possible implementation, the processing module 801 is specifically configured to:

[0220] determine a first accelerator from the accelerators to be used by the first device;

[0221] obtain response content between the first accelerator and other accelerators except the first accelerator from the accelerators to be used;

[0222] obtain the authentication result of the accelerators to be used by the first device based on the encryption key of the first accelerator and the response content.

[0223] In a possible implementation, the processing module 801 is specifically configured to:

[0224] obtain the encrypted values returned by the other accelerators except the first accelerator, wherein the encrypted values returned by the other accelerators are obtained by respectively encrypting preset values based on the encryption keys of the other accelerators, and the preset values are sent by the first accelerator;

[0225] respectively decrypt the encrypted values returned by the other accelerators based on the encryption key of the first accelerator, to obtain the plaintexts of the encrypted values returned by the other accelerators.

[0226] In a possible implementation, if the plaintexts of the encrypted values returned by the other accelerators are all the same as the preset values sent by the first accelerator, the authentication result of the accelerators to be used by the first device is passed.

[0227] The above modules can refer to the descriptions in the foregoing embodiments, and details are not described herein.

[0228] It should be understood that the division of each module in each of the above devices is only a logical functional division, and all or part of the modules can be integrated into one physical entity or physically separated when actually implemented. In addition, the modules in the data processing device can be implemented in the form of processor calling software; for example, the data processing device includes a processor, the processor is connected with a memory, the memory stores instructions, and the processor calls the instructions stored in the memory to implement any one of the above methods or to implement the functions of the modules of the device, wherein the processor is, for example, a general processor such as a central processing unit (CPU) or a microprocessor, and the memory is an internal memory of the device or an external memory of the device. Alternatively, the modules in the device can be implemented in the form of hardware circuit, and the functions of part or all of the units can be implemented by the design of the hardware circuit, which can be understood as one or more processors; for example, in one implementation, the hardware circuit is an application-specific integrated circuit (ASIC), and the functions of part or all of the units are implemented by the design of the logical relationship of the elements in the circuit; for example, in another implementation, the hardware circuit is a programmable logic device (PLD), and a field programmable gate array (FPGA) is taken as an example, which can include a large number of logic gate circuits, and the connection relationship between the logic gate circuits is configured by a configuration file, so as to implement the functions of part or all of the units. All modules of the above device can be implemented in the form of processor calling software, or all modules can be implemented in the form of hardware circuit, or part of the modules can be implemented in the form of processor calling software, and the remaining part can be implemented in the form of hardware circuit.

[0229] Referring to FIG. 9, a hardware structure schematic diagram of another data processing device provided by the embodiment of the application is shown. As shown in FIG. 9, the data processing device 900 (the device 900 can be specifically a computer device) includes a memory 901, a processor 902, a communication interface 903 and a bus 904. The memory 901, the processor 902 and the communication interface 903 are in communication connection with each other through the bus 904.

[0230] The memory 901 can be a read only memory (ROM), a static storage device, a dynamic storage device or a random access memory (RAM).

[0231] The memory 901 can store programs, and when the programs stored in the memory 901 are executed by the processor 902, the processor 902 and the communication interface 903 are configured to perform the steps of the data processing method of the embodiments of the present application.

[0232] The processor 902 is a circuit with signal processing capability. In one implementation, the processor 902 can be a circuit with instruction reading and running capability, such as a central processing unit (CPU), a microprocessor, a graphics processing unit (GPU) (which can be understood as a microprocessor), a digital signal processor (DSP), etc. In another implementation, the processor 902 can implement certain functions through a logic relationship of a hardware circuit, which is fixed or can be reconfigured. For example, the processor 902 is an ASIC or a programmable logic device (PLD) such as an FPGA. In the reconfigurable hardware circuit, the processor loads a configuration document to implement the hardware circuit configuration. It can be understood that the processor loads instructions to implement the functions of the above modules. In addition, it can also be a hardware circuit designed for artificial intelligence, which can be understood as an ASIC, such as a neural network processing unit (NPU), a tensor processing unit (TPU), a deep learning processing unit (DPU), etc. The processor 902 is configured to execute related programs to implement the functions required by the units in the data processing apparatus of the embodiments of the present application, or execute the data processing method of the method embodiments of the present application.

[0233] It can be seen that each module in the above apparatus can be one or more processors (or processing circuits) configured to implement the above method, such as a CPU, a GPU, an NPU, a TPU, a DPU, a microprocessor, a DSP, an ASIC, an FPGA, or a combination of at least two of these processor forms.

[0234] In addition, each module in the above apparatus can be integrated together or can be independently implemented. In one implementation, the modules are integrated together to form a system-on-a-chip (SOC). The SOC can include at least one processor for implementing any of the above methods or the functions of the modules of the apparatus. The at least one processor can be different, such as a CPU and an FPGA, a CPU and an artificial intelligence processor, a CPU and a GPU, etc.

[0235] The communication interface 903 uses a transceiving device such as, but not limited to, a transceiver to enable communication between the apparatus 900 and other devices or communication networks. For example, data can be acquired through the communication interface 903.

[0236] The bus 904 can include a path for communicating information between the various components (e.g., the memory 901, the processor 902, the communication interface 903) of the apparatus 900.

[0237] It should be noted that although the apparatus 900 shown in FIG. 9 only shows a memory, a processor, and a communication interface, in actual implementation, those skilled in the art should understand that the apparatus 900 also includes other devices necessary for normal operation. Meanwhile, according to specific needs, those skilled in the art should understand that the apparatus 900 can also include hardware devices for implementing other additional functions. In addition, those skilled in the art should understand that the apparatus 900 can also only include devices necessary for implementing the embodiments of the present application, and does not necessarily include all the devices shown in FIG. 9.

[0238] The embodiments of the present application also provide a computer readable storage medium, which stores instructions, and when the instructions run on a computer or a processor, cause the computer or the processor to perform one or more steps in any of the above methods.

[0239] The embodiments of the present application also provide a computer program product containing instructions. When the computer program product runs on a computer or a processor, it causes the computer or the processor to perform one or more steps in any of the above methods.

[0240] It should be understood that, in the description of the present application, unless otherwise specified, " / " represents that the objects before and after the " / " are in an "or" relationship, for example, A / B can represent A or B; wherein A, B can be singular or plural. And, in the description of the present application, unless otherwise specified, "multiple" means two or more than two. "At least one of the following" or the like means any combination of the items, including any combination of single or multiple items. For example, at least one of a, b, or c can represent: a, b, c, a-b, a-c, b-c, or a-b-c, wherein a, b, c can be single or multiple. In addition, in order to clearly describe the technical solutions of the embodiments of the present application, in the embodiments of the present application, the same items or similar items with basically the same function and role are distinguished by using "first", "second", etc. The skilled in the art can understand that "first", "second", etc. do not limit the quantity and execution order, and "first", "second", etc. do not necessarily mean different. At the same time, in the embodiments of the present application, "exemplary" or "for example" means to serve as an example, illustration or description. Any embodiment or design scheme described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as more preferred or more advantageous than other embodiments or design schemes. Rather, "exemplary" or "for example" is used to present the relevant concept in a specific manner, for understanding.

[0241] In several embodiments provided in the present application, it should be understood that the disclosed system, device and method can be implemented in other ways. For example, the division of the unit is only a logical function division, and actual implementation can have another division manner, for example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. The coupling or direct coupling or communication connection between the units shown or discussed can be indirect coupling or communication connection through some interfaces, devices or units, and can be electrical, mechanical or other forms.

[0242] The units described as separate components can or can not be physically separated, and the components shown as units can or can not be physical units, that is, they can be located in one place, or can be distributed on multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the embodiments of the present application.

[0243] In the above embodiments, all or part of the embodiments can be implemented by software, hardware, firmware or any combination thereof. When implemented by software, all or part of the embodiments can be implemented in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions according to the embodiments of the present application are generated. The computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable apparatus. The computer instructions can be stored in or transmitted by a computer readable storage medium. The computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center through a wired (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (such as infrared, wireless, microwave, etc.) manner. The computer readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server, data center, etc. integrated with one or more available media sets. The available medium can be a read-only memory (ROM), or a random access memory (RAM), or a magnetic medium, such as a floppy disk, a hard disk, a magnetic tape, a magnetic disk, or an optical medium, such as a digital versatile disc (DVD), or a semiconductor medium, such as a solid state disk (SSD), etc.

[0244] The above is only a specific implementation of the embodiments of the present application, but the protection scope of the embodiments of the present application is not limited thereto. Any change or replacement within the technical scope disclosed by the embodiments of the present application should be covered within the protection scope of the embodiments of the present application. Therefore, the protection scope of the embodiments of the present application should be subject to the protection scope of the claims.

Claims

1. A data processing method, characterized by, The method is applied to a data processing system comprising a first device, and comprises the following steps: encrypting a first key based on a second key of the first device to obtain ciphertext of the first key, wherein the first key is used to encrypt a model to obtain ciphertext of the model; encrypting the second key based on a hardware key of the first device to obtain ciphertext of the second key; storing the ciphertext of the model, the ciphertext of the first key, and the ciphertext of the second key.

2. The method of claim 1, wherein, The step of encrypting the second key based on the hardware key of the first device to obtain ciphertext of the second key comprises the following steps: encrypting the second key based on a hardware key in a target AI accelerator in the first device to obtain ciphertext of the second key, wherein the target AI accelerator is an accelerator in the first device that has been assigned the second key.

3. The method according to claim 1 or 2, characterized in that, The method further comprises the following steps: obtaining a key field in the model; encrypting the key field based on the first key to obtain the ciphertext of the model.

4. The method of claim 3, wherein, The key field is at least one of an optimizer field, a parameter field, and a structure field.

5. The method according to claim 1 or 2, characterized in that, The data processing system further comprises a second device, Before the step of encrypting the first key based on the second key of the first device to obtain ciphertext of the first key, the method further comprises the following steps: receiving ciphertext of a model sent by the second device.

6. The method according to any one of claims 1 to 5, characterized in that, The second key is obtained based on a feature value of the model.

7. A data processing method, characterized by, The method is applied to a data processing system comprising a first device, and the first device stores ciphertext of a model, ciphertext of a second key, and ciphertext of a first key, and the method comprises the following steps: decrypting the ciphertext of the second key based on a hardware key of the first device to obtain plaintext of the second key; decrypting the ciphertext of the first key based on the plaintext of the second key to obtain plaintext of the first key; decrypting the ciphertext of the model based on the plaintext of the first key to obtain plaintext of the model.

8. The method of claim 7, wherein, The method further comprises the following steps: authenticating a to-be-used accelerator of the first device; after the to-be-used accelerator passes the authentication, performing the step of decrypting the ciphertext of the first key based on the plaintext of the second key to obtain the plaintext of the first key.

9. The method of claim 8, wherein, The step of authenticating the to-be-used accelerator of the first device comprises the following steps: determining a first accelerator from the to-be-used accelerators of the first device; obtaining response content between the first accelerator and other accelerators in the to-be-used accelerators except the first accelerator; obtaining an authentication result of the to-be-used accelerators based on an encryption key of the first accelerator and the response content.

10. The method of claim 9, wherein, The step of obtaining the response content between the first accelerator and other accelerators in the to-be-used accelerators except the first accelerator comprises the following steps: obtain encrypted values returned by accelerators other than the first accelerator, wherein the encrypted values returned by the accelerators other than the first accelerator are obtained by encrypting preset values based on encryption keys of the accelerators other than the first accelerator respectively, and the preset values are sent by the first accelerator; decrypt the encrypted values returned by the accelerators other than the first accelerator based on the encryption key of the first accelerator to obtain plaintexts of the encrypted values returned by the accelerators other than the first accelerator.

11. The method of claim 10, wherein, If the plaintexts of the encrypted values returned by the accelerators other than the first accelerator are all the same as the preset values sent by the first accelerator, an authentication result of an accelerator to be used by the first device is passed.

12. A data processing apparatus, characterized by The apparatus comprises: a processing module configured to encrypt a first key based on a second key of a first device to obtain ciphertext of the first key, wherein the first key is used to encrypt a model to obtain ciphertext of the model; the processing module is further configured to encrypt the second key based on a hardware key of the first device to obtain ciphertext of the second key; a storage module configured to store the ciphertext of the model, the ciphertext of the first key, and the ciphertext of the second key.

13. The apparatus of claim 12, wherein, The processing module is further configured to: encrypt the second key based on a hardware key in a target AI accelerator in the first device to obtain ciphertext of the second key, wherein the target AI accelerator is an accelerator in the first device to which the second key is distributed.

14. The apparatus of claim 12 or 13, wherein, The processing module is further configured to: obtain a key field in the model; encrypt the key field based on the first key to obtain the ciphertext of the model.

15. The apparatus of claim 14, wherein, The key field is at least one of an optimizer field, a parameter field, and a structure field.

16. The apparatus of claim 12 or 13, wherein, The apparatus further comprises a receiving module configured to: receive the ciphertext of the model.

17. The apparatus of any one of claims 12 to 16, wherein, The second key is obtained based on a feature value of the model.

18. A data processing apparatus, characterized by The apparatus stores the ciphertext of the model, the ciphertext of the second key, and the ciphertext of the first key, and the apparatus comprises: a processing module configured to decrypt the ciphertext of the second key based on a hardware key of the apparatus to obtain plaintext of the second key; the processing module is further configured to decrypt the ciphertext of the first key based on the plaintext of the second key to obtain plaintext of the first key; the processing module is further configured to decrypt the ciphertext of the model based on the plaintext of the first key to obtain plaintext of the model, wherein the second key is obtained based on a feature value of the model.

19. The apparatus of claim 18, wherein, The processing module is further configured to: authenticate an accelerator to be used by the first device; after the authentication of the accelerator to be used passes, the processing module is configured to decrypt the ciphertext of the first key based on the plaintext of the second key to obtain the plaintext of the first key.

20. The apparatus of claim 19, wherein, The processing module is specifically configured to: determine a first accelerator from the accelerator to be used by the first device; obtain response content between the first accelerator and accelerators other than the first accelerator in the accelerator to be used by the first device respectively; An authentication result of the to-be-used accelerator is obtained based on the encryption key of the first accelerator and the response content.

21. The apparatus of claim 20, wherein, The processing module is specifically configured to: Obtain an encrypted value returned by an accelerator other than the first accelerator, wherein the encrypted value returned by the accelerator other than the first accelerator is obtained by encrypting a preset value based on an encryption key of the accelerator other than the first accelerator, and the preset value is sent by the first accelerator. Decrypt the encrypted value returned by the accelerator other than the first accelerator based on the encryption key of the first accelerator to obtain a plaintext of the encrypted value returned by the accelerator other than the first accelerator.

22. The apparatus of claim 21, wherein, If the plaintexts of the encrypted values returned by the accelerators are all the same as the preset value sent by the first accelerator, an authentication result of the to-be-used accelerator of the first device is passed.

23. A data processing apparatus, characterized by The apparatus comprises a processor and a memory, the processor is configured to execute a computer program or computer executable instructions stored in the memory, and / or through a logic circuit, so that the apparatus executes the method of any one of claims 1-6, or executes the method of any one of claims 7-11.

24. A computer-readable storage medium, characterized in that, The computer program is stored in the memory and is executed by the processor, so that the method of any one of claims 1-6 is implemented; or the method of any one of claims 7-11 is implemented.

25. A computer program product comprising instructions which, when executed on a processor, cause the method of any one of claims 1-6 to be implemented; or the method of any one of claims 7-11 to be implemented.

Images