JP2022085148A - Information processor, information processing system, and program - Google Patents

Abstract

To allow a safe usage of resources used for inference processing.SOLUTION: An information processor 10 includes a storage unit 11 and a processing unit 12. The storage unit 11 stores image data 20 of a container including an inference model 21 and a program module 22 used to execute the inference processing using the inference model 21. For example, the program module 22 includes at least one of a framework and a library used to execute the inference processing. The processing unit 12 generates encryption image data 40 by encrypting the image data 20 using a key 30.SELECTED DRAWING: Figure 1

Description

The present invention relates to an information processing apparatus, an information processing system and a program.

Currently, a system that performs inference processing using AI (Artificial Intelligence) is being used. When the inference process is requested, the information processing apparatus may cause an arithmetic unit suitable for the inference process to execute the inference process. The inference process is executed based on the inference model generated by machine learning. The inference model is sometimes called an AI model or a trained model. For example, an inference processing system has been proposed in which the processing load is appropriately distributed to a plurality of accelerators suitable for inference processing to efficiently perform inference processing.

By the way, one of the virtualization techniques in a computer is a technique called container-type virtualization. In container-type virtualization, a container that collects resources such as libraries used to execute software is defined as the software execution environment. For example, a computer starts a container on the kernel of an OS (Operating System) and executes software using the container.

Japanese Patent No. 6614373

Some arithmetic units that perform inference processing can use container-type virtualization. In this case, the information processing device includes the inference model in the image data of the container, and by invoking the container in the arithmetic unit based on the image data, the arithmetic unit can execute the inference processing by the inference model.

On the other hand, image data includes resources such as inference models and program modules used to execute inference processing. Therefore, if the image data is illegally acquired, the resources contained in the image data may be leaked.

In one aspect, it is an object of the present invention to provide information processing devices, information processing systems and programs that make the resources used for inference processing safely available.

In one aspect, an information processing device is provided. The information processing device has a storage unit and a processing unit. The storage unit stores the image data of the container including the inference model and the program module used for executing the inference process using the inference model. The processing unit generates encrypted image data by encrypting the image data using the first key.

Also, in one aspect, an information processing system is provided. The information processing system includes an arithmetic unit and an information processing device. The arithmetic unit is used for the inference model included in the container and the inference process by the inference model, and executes the inference process based on the program module included in the container. The information processing device acquires the encrypted image data in which the image data of the container is encrypted using the first key and the first key, and decrypts the encrypted image data using the first key. Generate image data with, and use the image data to start the container by the arithmetic unit.

Also, in one aspect, the program is provided.

On one side, it makes the resources used for inference processing safe to use.

It is a figure explaining the information processing apparatus of 1st Embodiment. It is a figure which shows the system example of the 2nd Embodiment. It is a figure which shows the hardware example of an information processing system. It is a figure which shows the functional example of the information processing system of a development environment. It is a figure which shows the functional example of the information processing system of an operating environment. It is a figure which shows the generation example of the image data of a container. It is a figure which shows the encryption example of image data. It is a figure which shows the management example of the encrypted image data. It is a figure which shows the decryption example of the encrypted image data. It is a flowchart which shows the example of the encryption process of image data. It is a flowchart which shows the management processing example of the encrypted image data. It is a flowchart which shows the deployment processing example.

Hereinafter, the present embodiment will be described with reference to the drawings.
[First Embodiment]
The first embodiment will be described.

FIG. 1 is a diagram illustrating an information processing apparatus according to the first embodiment.
The information processing device 10 has a storage unit 11 and a processing unit 12. The storage unit 11 may be a volatile storage device such as a RAM (Random Access Memory) or a non-volatile storage device such as an HDD (Hard Disk Drive) or a flash memory. The processing unit 12 is realized by a processor such as a CPU (Central Processing Unit). The processing unit 12 includes a GPU (Graphics Processing Unit), an MPU (Micro Processing Unit), a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), a PLD (Programmable Logic Device), or the like. Can include. A "processor" may also include a set of multiple processors (multiprocessors).

The storage unit 11 stores the image data 20 of the container. The image data 20 includes an inference model 21 and a program module 22. The inference model 21 is created by machine learning and is used for inference processing such as object detection by image recognition. The inference model 21 is information representing, for example, a neural network. In the inference model 21, parameters can be adjusted in the system of the development environment according to the specific operating environment of the introduction destination. The program module 22 includes, for example, at least one of the frameworks and libraries used to perform inference processing. By loading the image data 20 into the arithmetic unit that performs the inference processing, it is possible to start the container on the arithmetic unit and execute the inference processing according to the inference model 21. For example, the image data 20 created in the development environment is acquired by the processing unit 12 and stored in the storage unit 11.

The processing unit 12 generates encrypted image data 40 by encrypting the image data 20 using the key 30 (first key), and outputs the encrypted image data 40. As the encryption algorithm, for example, a common key encryption algorithm such as AES (Advanced Encryption Standard) is used.

The information processing apparatus 10 can distribute or store the encrypted image data 40 in the operating environment instead of the image data 20. For example, at the distribution destination of the encrypted image data 40, the encrypted image data 40 cannot be decrypted without the key 30. Therefore, even if only the encrypted image data 40 is leaked due to theft or the like, the possibility that the inference model 21 or the program module 22 is illegally used or falsified can be suppressed. In this way, the resources used for inference processing can be safely made available.

The inference model 21 included in the image data 20 may be encrypted in advance. In this case, the outflow of the inference model 21, which is an important component among the resources, can be further suppressed.

Further, it is conceivable that the information processing device 10 or the device to which the encrypted image data 40 and the key 30 are distributed is managed by increasing the confidentiality of the key 30. For example, the information processing device 10 may encrypt and manage the key 30 by using a key unique to its own device. The management of the unique key and the encryption processing using the unique key are executed by, for example, an encryption processing unit such as a TPM (Trusted Platform Module) included in the information processing apparatus 10. Similarly, the key 30 can be encrypted and managed by the device to which the encrypted image data 40 and the key 30 are distributed. As a result, even if the encrypted image data 40 and the encrypted key data in which the key 30 is encrypted leak out, it becomes difficult to decrypt the encrypted image data 40. In this way, the resources used for inference processing can be made available more safely.

[Second Embodiment]
Next, a second embodiment will be described.
FIG. 2 is a diagram showing a system example of the second embodiment.

The information processing systems 50 and 60 are connected to the network 70. The network 70 may be a LAN (Local Area Network), a WAN (Wide Area Network), the Internet, or the like.

The information processing system 50 is a development environment system for developing an inference model. The inference model may be called an AI model, an AI inference model, a learning model, or the like. The template data of the inference model is downloaded from the cloud server to the information processing system 50 via the Internet, for example. The information processing system 50 adjusts parameters in the operating environment for the downloaded template data, and creates an inference model suitable for the operating environment. The information processing system 50 includes an arithmetic unit used for developing an inference model.

The information processing system 60 is an operating environment system that performs inference processing based on the inference model created by the information processing system 50. The information processing system 60 includes an arithmetic unit used as an accelerator for inference processing. As an example of the arithmetic unit, JETSON (registered trademark) can be mentioned. Inference processing on the arithmetic unit in the operating environment is realized by using the technology of container-type virtualization. Software that realizes container-type virtualization includes, for example, Docker (registered trademark).

FIG. 3 is a diagram showing a hardware example of an information processing system.
The information processing system 50 includes a PCIe (Peripheral Component Interconnect Express, registered trademark) bridge controller 51, an information processing device 100, and arithmetic units 200, 200a.

The PCIe bridge controller 51 is a relay device that relays communication between the information processing device 100 and the arithmetic units 200, 200a. The information processing device 100 and the arithmetic units 200, 200a virtually perform IP (Internet Protocol) communication on the connection configuration by PCIe realized by the PCIe bridge controller 51. For example, the information processing apparatus 100 can transmit and receive data to and from the arithmetic units 200 and 200a, respectively.

The information processing apparatus 100 includes a processor 101, a RAM 102, an HDD 103, a TPM 104, a PCIe interface 105, an image signal processing unit 106, an input signal processing unit 107, a medium reader 108, and a NIC (Network Interface Card) 109.

The processor 101 executes the instruction of the program. The processor 101 is, for example, a CPU, GPU, MPU, DSP, ASIC, FPGA or PLD. Further, the processor may be a combination of two or more elements of CPU, GPU, MPU, DSP, ASIC, FPGA and PLD. The processor 101 loads at least a part of the programs and data stored in the HDD 103 into the RAM 102 and executes the program. The processor 101 may include a plurality of processor cores. Further, the information processing device 100 may have a plurality of processors. The processes described below may be performed in parallel using multiple processors or processor cores. Also, a set of multiple processors may be referred to as a "multiprocessor" or simply a "processor".

The RAM 102 is a main storage device that temporarily stores a program executed by the processor 101 and data used by the processor 101 for calculation. The information processing apparatus 100 may include a type of memory other than the RAM, or may include a plurality of memories.

The HDD 103 is an auxiliary storage device that stores software programs such as an OS, middleware, and application software, and data. The information processing device 100 may be provided with other types of storage devices such as a flash memory and an SSD (Solid State Drive), or may be provided with a plurality of non-volatile storage devices. For the OS of the information processing apparatus 100, for example, Windows (registered trademark) or other OS can be used.

The TPM 104 is a secure module that holds a unique key of the information processing apparatus 100 and performs encryption processing on data separately from the processor 101.
The PCIe interface 105 is an interface for connecting to the PCIe bridge controller 51. The information processing device 100 may include a plurality of PCIe interfaces.

The image signal processing unit 106 outputs an image to the display 71 connected to the information processing device 100 in accordance with a command from the processor 101. As the display 71, any kind of display such as a CRT (Cathode Ray Tube) display, a liquid crystal display (LCD: Liquid Crystal Display), a plasma display, and an organic EL (OEL: Organic Electro-Luminescence) display can be used.

The input signal processing unit 107 acquires an input signal from the input device 72 connected to the information processing device 100 and outputs the input signal to the processor 101. As the input device 72, a mouse, a touch panel, a touch pad, a pointing device such as a trackball, a keyboard, a remote controller, a button switch, or the like can be used. Further, a plurality of types of input devices may be connected to the information processing apparatus 100.

The medium reader 108 is a reading device that reads programs and data recorded on the recording medium 73. As the recording medium 73, for example, a magnetic disk, an optical disk, a magneto-optical disk (MO: Magneto-Optical disk), a semiconductor memory, or the like can be used. The magnetic disk includes a flexible disk (FD) and an HDD. Optical discs include CDs (Compact Discs) and DVDs (Digital Versatile Discs).

The medium reader 108, for example, copies a program or data read from the recording medium 73 to another recording medium such as the RAM 102 or the HDD 103. The read program is executed, for example, by the processor 101. The recording medium 73 may be a portable recording medium and may be used for distribution of programs and data. Further, the recording medium 73 and the HDD 103 may be referred to as a computer-readable recording medium.

NIC109 is an interface that is connected to the network 70 and communicates with other computers via the network 70. The NIC 109 is connected to a communication device such as a switch or a router by a cable.

The arithmetic unit 200 has a processor 201, a RAM 202, and a PCIe interface 203.
Processor 201 executes the instructions of the program. The processor 201 may be realized by, for example, a CPU, GPU, MPU, DSP, ASIC, FPGA or PLD, or may be a combination of two or more of these elements.

The RAM 202 is a main storage device that temporarily stores a program executed by the processor 201 and data used by the processor 201 for calculation.
The PCIe interface 203 is an interface for connecting to the PCIe bridge controller 51.

The arithmetic unit 200 may include a non-volatile memory for storing the OS executed by the arithmetic unit 200. For the OS of the arithmetic unit 200, for example, Ubuntu (registered trademark) or other OS can be used.

The arithmetic unit 200a is also realized by the same hardware as the arithmetic unit 200. The information processing system 60 also has an information processing device and one or more arithmetic units, and is realized by the same hardware as the information processing system 50. The information processing device and the arithmetic device in each of the information processing systems 50 and 60 may be connected via an IP network including an L2 switch, an L3 switch, a router, and the like. The information processing apparatus of the information processing apparatus 100 and the information processing system 60 is realized by, for example, a computer.

FIG. 4 is a diagram showing a functional example of an information processing system in a development environment.
The arithmetic unit 200 has a storage unit 210, a model encryption unit 220, and a container image generation unit 230. The storage area of the RAM 202 is used for the storage unit 210. The model encryption unit 220 and the container image generation unit 230 are realized by executing the program stored in the RAM 202 by the processor 201.

The storage unit 210 stores the inference model created in the development environment. The storage unit 210 stores data used for processing of the model encryption unit 220 and the container image generation unit 230.

The model encryption unit 220 generates an encryption inference model by encrypting the inference model with the model encryption key. For example, AES is used as the encryption algorithm. The model encryption unit 220 generates a model encryption key based on, for example, a password entered by the user. The model encryption unit 220 stores the encryption inference model and the model encryption key in the storage unit 210.

The container image generation unit 230 acquires the encryption inference model generated by the model encryption unit 220, and generates image data of the container including the encryption inference model. The image data includes a model decryption tool for decrypting the encrypted inference model and a model load script for loading the inference model contained in the image data on the container execution server. In addition, the image data includes a group of program modules such as libraries and frameworks used for data input / output for inference processing and processing start / execution. Here, the framework used for inference processing is abbreviated as inference FW (FrameWork). The container image generation unit 230 stores the image data in the storage unit 210.

The arithmetic unit 200a also has the same function as the arithmetic unit 200.
The information processing device 100 has a storage unit 110 and a processing unit 120. The storage area of the RAM 102 or the HDD 103 is used for the storage unit 110. The processing unit 120 is realized by the processor 101. The processing unit 120 has an image acquisition unit 121 and an image encryption unit 122. The image acquisition unit 121 and the image encryption unit 122 are realized by executing a program stored in the RAM 102 by the processor 101.

The storage unit 110 stores data used for processing by the processing unit 120.
The image acquisition unit 121 acquires the image data of the container generated by the arithmetic unit 200 and the model encryption key from the arithmetic unit 200 and stores them in the storage unit 110.

The image encryption unit 122 generates encrypted image data by encrypting the image data stored in the storage unit 110 with an image encryption key. For example, AES is used as the encryption algorithm. The image encryption unit 122 generates an image encryption key based on, for example, a password entered by the user. The image encryption unit 122 stores the encrypted image data and the image encryption key in the storage unit 110.

The encrypted image data and the encryption key for the image are distributed to the information processing system 60 in the operating environment by using a portable recording medium such as a USB (Universal Serial Bus) memory. Alternatively, the encrypted image data and the image encryption key may be distributed to the information processing system 60 via the network 70. Similarly, the model encryption key is also distributed to the information processing system 60.

FIG. 5 is a diagram showing a functional example of an information processing system in an operating environment.
The information processing system 60 includes an information processing device 300 and an arithmetic unit 400.
The information processing device 300 includes a storage unit 310, a processing unit 320, a device-specific key storage unit 330, and an encryption processing unit 340. A storage area such as a RAM or an HDD included in the information processing apparatus 300 is used for the storage unit 310. The processing unit 320 is realized by the processor included in the information processing apparatus 300. The processing unit 320 has an encrypted image management unit 321 and an image decryption unit 322 and a deployment unit 323. The encrypted image management unit 321 and the image decryption unit 322 and the deployment unit 323 are realized by executing the program stored in the RAM of the information processing device 300 by the processor of the information processing device 300. Further, the device-specific key storage unit 330 and the encryption processing unit 340 are realized by the TPM 304.

The storage unit 310 stores data used for processing by the processing unit 320. The data stored in the storage unit 310 includes the distributed encrypted image data, the image encryption key, and the management table for managing the model encryption key. However, the image encryption key is encrypted by TPM304 and managed by the management table as described later.

The encrypted image management unit 321 stores the encrypted image data distributed from the information processing system 50 and the model encryption key in the storage unit 310. Further, the encrypted image management unit 321 acquires the encrypted key data by encrypting the image encryption key distributed from the information processing system 50 by the TPM 304 using the device-specific key. The encrypted key data is data in which the image encryption key is encrypted with the device-specific key. For example, AES is used as the encryption algorithm. The encrypted image management unit 321 manages the correspondence between the encrypted image data, the image encryption key, and the model encryption key by using the management table.

When the encrypted image management unit 321 receives the image load command, the encrypted image management unit 321 reads out the encrypted image data specified by the command and the model encryption key from the storage unit 310 based on the management table. The encrypted image management unit 321 reads the encrypted image encryption key from the storage unit 310 and causes the encryption processing unit 340 to decrypt the encryption key. The encrypted image management unit 321 causes the image decryption unit 322 to decrypt the encrypted image data. The encrypted image management unit 321 provides the image data of the container obtained by decrypting the encrypted image data to the deployment unit 323 together with the encryption key for the model, and deploys the image data to the arithmetic unit 400 to the deployment unit 323. Instruct.

The image decryption unit 322 acquires the encrypted image data and the image encryption key from the encrypted image management unit 321 and decrypts the encrypted image data using the image encryption key to generate the image data of the container. do.

When the deployment unit 323 is instructed to deploy the image data by the encrypted image management unit 321, the deployment unit 323 transmits the image data and the encryption key for the model to the arithmetic unit 400, and the arithmetic unit 400 starts the container using the image data. Let me.

The device-specific key storage unit 330 stores the device-specific key generated based on the unique information held by the information processing device 300. The unique information of the information processing apparatus 300 may include a device identification number of the information processing apparatus 300, a MAC (Media Access Control) address, and the like. The device-specific key storage unit 330 is inaccessible from the processing unit 320. The TPM 304 has, for example, tamper resistance so that the device-specific key cannot be taken out from the outside of the TPM 304.

The encryption processing unit 340 holds the device-specific key in the device-specific key storage unit 330, and encrypts the image encryption key by using the device-specific key stored in the device-specific key storage unit 330. Generate finished key data. The device-specific key storage unit 330 may be considered to be included in the encryption processing unit 340.

The arithmetic unit 400 has a storage unit 410, a container execution unit 420, and an inference processing unit 430. The storage area of the RAM included in the arithmetic unit 400 is used for the storage unit 410. The container execution unit 420 and the inference processing unit 430 are realized by executing the program stored in the RAM of the arithmetic unit 400 by the processor included in the arithmetic unit 400.

The storage unit 410 stores data used for processing of the container execution unit 420 and the inference processing unit 430.
The container execution unit 420 starts executing the container based on the image data, and activates the inference processing unit 430. The container execution unit 420 obtains an inference model by decrypting the encryption inference model included in the image data by using the decryption tool and the encryption key for the model included in the image data. The container execution unit 420 loads the inference model on the RAM of the arithmetic unit 400 by the model load script, and starts the inference processing unit 430.

The inference processing unit 430 is realized by a group of program modules such as an inference model, an inference FW, and a library. The inference processing unit 430 executes inference processing according to an inference model such as object detection by image recognition.

When the information processing system 60 has another arithmetic unit, the other arithmetic unit also has the same function as the arithmetic unit 400.
For example, when Docker is used as a container-type virtualization mechanism, the information processing device 300 functions as a Docker client, and the arithmetic device 400 functions as a Docker server.

Next, an example of data processing in each device will be described. First, an example of generating container image data by the arithmetic unit 200 will be described.
FIG. 6 is a diagram showing an example of generating image data of a container.

The model encryption unit 220 acquires the inference model M1 and the password P1 input by the user. The model encryption unit 220 obfuscates the password P1 by processing it by, for example, a shift operation, and generates a model encryption key K1. The model encryption unit 220 generates an encryption inference model eM1 by encrypting the inference model M1 using the model encryption key K1. The model encryption unit 220 generates an error detection code such as a checksum for the inference model M1 in order to make it possible to confirm that the encryption inference model eM1 has been properly decrypted, and encrypts the model. It may be output together with the key K1.

The container image generation unit 230 acquires the encryption inference model eM1, the model decryption tool 81, the model load script 82, and the program module group 90. The program module group 90 includes a library 91 and an inference FW 92 used for inference processing. The container image generation unit 230 generates image data D1 of the container including the encryption inference model eM1, the model decryption tool 81, the model load script 82, and the program module group 90.

Next, an example of encrypting image data by the information processing apparatus 100 will be described.
FIG. 7 is a diagram showing an example of encryption of image data.
The image encryption unit 122 acquires the image data D1 generated by the arithmetic unit 200 and the password P2 input by the user. The image encryption unit 122 obfuscates the password P2 and generates the image encryption key K2 in the same manner as the model encryption unit 220. The image encryption unit 122 generates encrypted image data eD1 by encrypting the image data D1 using the image encryption key K2. The image encryption unit 122 may generate an error detection code such as a checksum for the image data D1 and output it together with the image encryption key K2.

The encrypted image data eD1 and the image encryption key K2 output by the information processing apparatus 100 are provided to the information processing apparatus 300. Further, the model encryption key K1 output by the arithmetic unit 200 is also provided to the information processing device 300.

Next, an example of managing encrypted image data by the information processing apparatus 300 will be described.
FIG. 8 is a diagram showing a management example of encrypted image data.
The information processing apparatus 300 acquires the image encryption key K2, the encrypted image data eD1, and the model encryption key K1.

The encryption image management unit 321 instructs the encryption processing unit 340 to encrypt the image encryption key K2. The encryption processing unit 340 uses the device-specific key stored in the device-specific key storage unit 330 to generate the image encryption key K2 and generate the encrypted key data eK2. The encryption processing unit 340 outputs the encrypted key data eK2 to the encryption image management unit 321. The encrypted image management unit 321 registers the encrypted key data eK2 in the management table 311 stored in the storage unit 310 in association with the encrypted image data eD1 and the model encryption key K1. The encrypted image management unit 321 erases the image encryption key K2.

The management table 311 has items of a model name, a version, encrypted key data, a model encryption key, and an encrypted image data name. The name of the inference model is registered in the item of model name. The version of the inference model is registered in the version item. The encrypted key data is registered in the encrypted key data item. The model encryption key is registered in the model encryption key item. The file name of the encrypted image data is registered in the item of the encrypted image data name.

For example, in the management table 311, the model name "ssd_model", the version "v2.0", the encrypted key data "xxxx", the model encryption key "BLOB_A", and the encrypted image data name "sample_image.tar.gz" are displayed. The record is registered. The image data name in the record is the file name of the encrypted image data eD1. For example, the file with the file name of the predetermined folder in the information processing apparatus 300 corresponds to the encrypted image data eD1. Further, the model name "ssd_model" and the version "v2.0" are examples of the identification information attached to the inference model M1. The model name "ssd_model" and the version "v2.0" may be input by the user of the information processing apparatus 300, or may be attached to the encrypted image data eD1 by the information processing apparatus 100 in plain text. Further, "xxxxxx" corresponds to the encrypted key data eK2. Further, "BLOB_A" corresponds to the model encryption key K1.

Records of other versions of the inference model whose inference model name is "ssd_model" and records related to other inference models are also registered in the management table 311.
The model encryption key may be managed separately from the management table 311 in association with the inference model. For example, the model encryption key may be stored in a storage unit other than the storage unit 310.

Next, an example of decryption of the encrypted image data eD1 by the information processing apparatus 300 will be described.
FIG. 9 is a diagram showing an example of decryption of encrypted image data.
The encrypted image management unit 321 accepts the input of the image load command C1. For example, the command C1 includes a load destination address "192.168.1.6", a model name "ssd_model", and a version "v2.0". It is assumed that the load destination address "192.168.1.6" is the IP address of the arithmetic unit 400.

The encrypted image management unit 321 reads the encrypted key data eK2, the model encryption key K1 and the encrypted image data eD1 from the storage unit 310 based on the command C1 and the management table 311.

The encrypted image management unit 321 outputs the encrypted key data eK2 to the encryption processing unit 340, and instructs the encryption processing unit 340 to decrypt the encrypted key data eK2. The encryption processing unit 340 generates an image encryption key K2 by decrypting the encrypted key data eK2 using the device-specific key stored in the device-specific key storage unit 330, and causes the encryption image management unit 321 to generate the encryption key K2. Output.

The encrypted image management unit 321 acquires the image encryption key K2 from the encryption processing unit 340, outputs the image encryption key K2 and the encrypted image data eD1 to the image decryption unit 322, and outputs the encrypted image data eD1 to the encrypted image data eD1. Instruct decryption. The image decoding unit 322 generates image data D1 by decrypting the encrypted image data eD1 using the image encryption key K2, and outputs the image data D1 to the encrypted image management unit 321.

The encrypted image management unit 321 outputs the image data D1 and the model encryption key K1 to the deployment unit 323, and instructs the arithmetic unit 400 to deploy the image data D1.
Next, the procedure of the encryption processing of the image data D1 by the information processing apparatus 100 will be described.

FIG. 10 is a flowchart showing an example of image data encryption processing.
(S10) The image encryption unit 122 acquires the image data D1 of the container generated by the arithmetic unit 200.

(S11) The image encryption unit 122 accepts the input of the password P1 by the user.
(S12) The image encryption unit 122 encrypts the image data D1 by using the image encryption key K2 based on the password P1. As a result, the encrypted image data eD1 is generated.

(S13) The image encryption unit 122 outputs the image encryption key K2 and the encrypted image data eD1.
The inference model included in the image data D1 of the container generated by the arithmetic unit 200 may be encrypted by the arithmetic unit 200 as described above.

Next, the procedure of the management process of the encrypted image data eD1 by the information processing apparatus 300 will be described.
FIG. 11 is a flowchart showing an example of management processing of encrypted image data.

(S20) The encrypted image management unit 321 acquires the encrypted image data eD1 and the image encryption key K2.
(S21) The encryption image management unit 321 instructs the encryption processing unit 340 of the TPM 304 to encrypt the image encryption key K2. The encryption processing unit 340 encrypts the image encryption key K2 with the device-specific key stored in the device-specific key storage unit 330 in the TPM 304, and generates the encrypted key data eK2.

(S22) The encrypted image management unit 321 associates the encrypted key data eK2 with the encrypted image data eD1 and registers it in the management table 311 stored in the storage unit 310.
Next, the procedure for deploying the image data D1 by the information processing apparatus 300 will be described.

FIG. 12 is a flowchart showing an example of deployment processing.
(S30) The encrypted image management unit 321 receives the image load command C1.

(S31) The encrypted image management unit 321 reads the encrypted image data eD1 and the encrypted key data eK2 from the storage unit 310 based on the parameters of the command C1 and the management table 311.

(S32) The encrypted image management unit 321 instructs the encryption processing unit 340 of the TPM 304 to decrypt the encrypted key data eK2. The encryption processing unit 340 decrypts the encrypted key data eK2 with the device-specific key stored in the device-specific key storage unit 330, and generates an image encryption key K2.

(S33) The encrypted image management unit 321 outputs the image encryption key K2 and the encrypted image data eD1 obtained in step S32 to the image decryption unit 322, and instructs the image decryption unit 322 to decrypt the encrypted image data eD1. The image decoding unit 322 decodes the encrypted image data eD1 with the image encryption key K2 and generates the image data D1.

(S34) The encrypted image management unit 321 instructs the deployment unit 323 to deploy the image data D1 obtained in step S33. The deployment unit 323 transmits the image data D1 to the arithmetic unit 400, and the arithmetic unit 400 starts the container based on the image data D1.

As described above, the image data D1 includes the encryption inference model eM1. Therefore, the information processing system 50 also provides the encryption image management unit 321 for the model encryption key K1. The encryption image management unit 321 stores and manages the model encryption key K1 in the storage unit 310, and provides the model encryption key K1 together with the image data D1 to the deployment unit 323. The deployment unit 323 transmits the image data D1 and the model encryption key K1 to the arithmetic unit 400, and the arithmetic apparatus 400 decrypts the encryption inference model eM1 included in the image data D1 by the model encryption key K1. , The inference model M1 is acquired.

The container execution unit 420 starts executing the container based on the image data D1 and activates the inference processing unit 430. The container execution unit 420 obtains an inference model M1 by decrypting the encryption inference model eM1 included in the image data D1 by using the model decryption tool 81 included in the image data D1 and the model encryption key K1. The container execution unit 420 loads the inference model M1 on the RAM of the arithmetic unit 400 by the model load script 82, and starts the inference processing unit 430. In this way, the inference processing using the library 91, the inference FW92, and the inference model M1 by the inference processing unit 430 can be executed.

Here, at the distribution destination of the encrypted image data eD1, the encrypted image data eD1 cannot be decrypted without the image encryption key K2. Therefore, even if only the encrypted image data eD1 is leaked due to theft or the like, it is possible to suppress the possibility that the inference model M1, the library 91, the inference FW92, and other program modules are illegally used or tampered with. In this way, the resources used for inference processing can be safely made available.

Further, the inference model M1 included in the image data D1 may be encrypted in advance. In this case, even if the encrypted image data eD1 and the image encryption key K2 are leaked, the inference model M1 cannot be decrypted without the model encryption key K1, so that the inference model M1 which is an important component among the resources is leaked. It is further suppressed.

Further, the information processing apparatus 300 can improve the confidentiality of the image encryption key K2 and manage it. Specifically, the information processing device 300 may encrypt and manage the image encryption key K2 by using the device-specific key unique to the information processing device 300. The device-specific key is held in the TPM304, and the encryption process using the device-specific key is executed by the TPM304. As a result, even if the encrypted image data eD1 and the encrypted key data eK2 are leaked, it becomes difficult to decrypt the encrypted image data eD1 by a device other than the information processing device 300. In this way, the resources used for inference processing can be made available more safely.

In the example of the second embodiment, the development environment and the operating environment have been described separately, but the development environment may also be used as the operating environment. For example, the information processing device 100 may have the functions of the storage unit 310, the processing unit 320, and the TPM 304, and the arithmetic units 200 and 200a act as the deployment destination of the image data D1 to start the container and execute the inference process. You may.

For example, the information processing apparatus 100 may have the following functions.
The storage unit 110 may store the image data D1 of the container including the inference model M1 and the program module used for executing the inference process using the inference model M1. The processing unit 120 may generate the encrypted image data eD1 by encrypting the image data D1 using the image encryption key K2 (first key).

This makes it possible to safely use the resources used for inference processing.
Further, the information processing device 100 holds a device-specific key (second key) unique to the information processing device 100 (own device), and encrypts the image encryption key K2 using the device-specific key. It may further have an encryption processing unit that generates the converted key data eK2. The encryption processing unit may be realized by TPM104. In this case, the processing unit 120 stores the encrypted image data eD1 in the storage unit 110, and stores the encrypted key data eK2 in the storage unit 110 in association with the identification information of the inference model M1 corresponding to the encrypted image data eD1. save.

As a result, the resources used for inference processing can be used more safely.
Then, when the identification information of the inference model M1 is designated, the processing unit 120 acquires the encrypted key data eK2 corresponding to the designated identification information from the storage unit 110. The processing unit 120 acquires the image encryption key K2 by decrypting the encrypted key data eK2 by the encryption processing unit of the information processing apparatus 100. The processing unit 120 generates image data D1 by decrypting the encrypted image data eD1 using the acquired image encryption key K2, and performs inference processing using the image data D1 in the arithmetic unit 200 or the arithmetic unit 200a. Start the container with.

In this way, by automatically performing a series of steps from decryption of the encrypted image data eD1 to startup of the container according to the designation of the identification information of the inference model M1, the user is given the image encryption key K2 and the device unique. It is possible to start inference processing with a simple operation without being aware of the existence of the key. Therefore, it is possible to provide an operating environment that is easy for the user to use.

Further, the inference model M1 included in the image data D1 before being encrypted may be encrypted using the model encryption key K1 (third key). In this case, the processing unit 120 outputs the model encryption key K1 to the arithmetic unit 200 or the arithmetic unit 200a that activates the container using the image data D1.

As a result, the possibility that the inference model M1, which is an important resource for inference processing, will leak out can be further suppressed. Further, in the arithmetic unit 200 or the arithmetic unit 200a, the encryption inference model eM1 included in the image data D1 can be appropriately decrypted by using the model encryption key K1.

The processing unit 120 acquires the image data D1 of the container including the inference model (encryption inference model eM1) encrypted using the model encryption key K1 (third key), and the image encryption key K2. The image data D1 may be encrypted using (the first key).

As a result, the possibility that the inference model M1, which is an important resource for inference processing, will leak out can be further suppressed.
Further, the information processing system 60 may have the following functions.

The arithmetic unit 400 is used for the inference model included in the container and the inference process by the inference model, and executes the inference process based on the program module included in the container. The information processing apparatus 300 acquires the encrypted image data eD1 and the image encryption key K2 in which the image data D1 of the container is encrypted using the image encryption key K2 (first key). The information processing apparatus 300 generates image data D1 by decrypting the encrypted image data eD1 using the image encryption key K2, and activates the container by the arithmetic unit 400 using the image data D1.

This makes it possible to safely use the resources used for inference processing.
The information processing device 300 holds a device-specific key (second key) unique to the information processing device 300 (own device), and has been encrypted by encrypting the image encryption key K2 using the device-specific key. It may further have an encryption processing unit 340 that generates key data eK2. The encryption processing unit 340 may be realized by the TPM 304. In this case, the information processing apparatus 300 stores the encrypted key data eK2 in the storage unit 310 in association with the identification information of the inference model M1 corresponding to the encrypted image data eD1.

As a result, the resources used for inference processing can be used more safely.
Then, when the identification information of the inference model M1 is designated, the information processing apparatus 300 acquires the encrypted key data eK2 corresponding to the designated identification information from the storage unit 310. The information processing apparatus 300 acquires the image encryption key K2 by decrypting the encrypted key data eK2 by the encryption processing unit 340. The information processing apparatus 300 generates image data D1 by decrypting encrypted image data eD1 using the acquired image encryption key K2, and uses the image data D1 to generate a container by an arithmetic apparatus 400 that performs inference processing. Start it.

In this way, by automatically performing a series of steps from decryption of the encrypted image data eD1 to startup of the container according to the designation of the identification information of the inference model M1, the user is given the image encryption key K2 and the device unique. It is possible to start inference processing with a simple operation without being aware of the existence of the key. Therefore, it is possible to provide an operating environment that is easy for the user to use.

Further, the inference model M1 included in the image data D1 may be encrypted using the model encryption key K1 (third key). In this case, the information processing apparatus 300 outputs the model encryption key K1 to the arithmetic unit 400 that activates the container using the image data D1.

As a result, the possibility that the inference model M1, which is an important resource for inference processing, will leak out can be further suppressed. Further, in the arithmetic unit 400, the encryption inference model eM1 included in the image data D1 can be appropriately decrypted by using the model encryption key K1.

The information processing system 50 may also have the same functions as the information processing system 60. For example, as described above, one information processing device generates encrypted image data eD1 by encrypting image data D1, manages encrypted image data eD1, decrypts encrypted image data eD1, and images to an arithmetic device. Data D1 deployment and may be performed.

By the way, the information processing of the first embodiment can be realized by causing the processing unit 12 to execute the program. Further, the information processing of the second embodiment can be realized by causing the processor 101 to execute the program. The program can be recorded on a computer-readable recording medium 73.

For example, the program can be distributed by distributing the recording medium 73 on which the program is recorded. Alternatively, the program may be stored in another computer and distributed via the network. For example, the computer may store (install) a program recorded on the recording medium 73 or a program received from another computer in a storage device such as RAM 102 or HDD 103, read the program from the storage device, and execute the program. good.

10 Information processing device 11 Storage unit 12 Processing unit 20 Image data 21 Inference model 22 Program module 30 Key 40 Encrypted image data

Claims (10)

A storage unit that stores image data of a container including an inference model and a program module used to execute an inference process using the inference model, and a storage unit.
A processing unit that generates encrypted image data by encrypting the image data using the first key,
Information processing device with. It further has an encryption processing unit that holds a second key unique to its own device and generates encrypted key data by encrypting the first key using the second key.
The processing unit stores the encrypted image data in the storage unit, and stores the encrypted key data in the storage unit in association with the identification information of the inference model corresponding to the encrypted image data.
The information processing apparatus according to claim 1. The processing unit
When the identification information of the inference model is specified, the encrypted key data corresponding to the designated identification information is acquired from the storage unit, and the encryption processing unit decrypts the encrypted key data. By doing so, the first key is obtained,
The image data is generated by decrypting the encrypted image data using the acquired first key, and the container is started by an arithmetic unit that performs the inference process using the image data.
The information processing apparatus according to claim 2. The inference model contained in the image data before being encrypted is encrypted using a third key.
The processing unit outputs the third key to the arithmetic unit.
The information processing apparatus according to claim 3. The processing unit acquires the image data of the container including the inference model encrypted using the third key.
The information processing apparatus according to claim 1. An arithmetic unit that executes the inference processing based on the inference model included in the container and the program module included in the container, which is used for the inference processing by the inference model.
By acquiring the encrypted image data encrypted by using the first key and the first key, and decrypting the encrypted image data by using the first key. An information processing device that generates the image data and activates the container by the arithmetic device using the image data.
Information processing system with. The information processing device is
It has an encryption processing unit that holds a second key unique to its own device and generates encrypted key data by encrypting the first key using the second key.
The encrypted key data is stored in the storage unit in association with the identification information of the inference model corresponding to the encrypted image data.
The information processing system according to claim 6. The information processing device is
When the identification information of the inference model is specified, the encrypted key data corresponding to the designated identification information is acquired from the storage unit, and the encryption processing unit decrypts the encrypted key data. By doing so, the first key is obtained,
The image data is generated by decrypting the encrypted image data using the acquired first key, and the container is started by the arithmetic unit using the generated image data.
The information processing system according to claim 7. The inference model included in the image data is encrypted using a third key, and is encrypted.
The information processing device outputs the third key to the arithmetic unit.
The information processing system according to claim 8. On the computer
Obtain the image data of the container including the inference model and the program module used to execute the inference process using the inference model.
Encrypted image data is generated by encrypting the image data using the first key.
A program that executes processing.

Images