KR102272928B1 - Operating method for machine learning model using encrypted data and apparatus based on machine learning model - Google Patents

Abstract

A machine learning model operating method using encrypted data includes the steps of: a computer device receiving input data; the computer device encrypting the input data; and the computer device inputting the encrypted input data into a machine learning model to obtain a result value. comprising the steps of creating The machine learning model is a model trained in advance using encrypted input data.

Description

A machine learning model operation method using encrypted data and a machine learning model-based device {OPERATING METHOD FOR MACHINE LEARNING MODEL USING ENCRYPTED DATA AND APPARATUS BASED ON MACHINE LEARNING MODEL}

The technology to be described below relates to a machine learning model operating technique.

Recently, in artificial intelligence, deep learning-based techniques are showing excellent performance in various fields. A shared cloud server creates a trained model, and a device using the model receives only the trained model through the network to perform AI-related services. For example, a device such as a personal mobile device or a smart car may generate a necessary result value using a learned model received from an external object.

However, if the parameters of the model are leaked in the shared environment, the AI system may malfunction by changing the AI model designed by a third party or providing the changed model. Alternatively, there is a risk that a third party may use malicious data to cause the artificial intelligence system to malfunction.

European Patent Publication No. EP3203679

Conventional machine learning models have limited methods to check the integrity of the model.

The technology to be described below is intended to provide a method of verifying a model using a signature imprinted on a machine learning model. The technology described below intends to provide a machine learning model that uses encrypted data as input data.

A machine learning model operating method using encrypted data includes the steps of: a computer device receiving input data; the computer device encrypting the input data; and the computer device inputting the encrypted input data into a machine learning model to obtain a result value. comprising the steps of creating

A machine learning model-based device using encrypted data includes a security key paired with a specific public key, an input device for receiving input data, a storage device for storing a machine learning model learned in advance using the encrypted data, and the security key and an arithmetic unit for encrypting the input data using , and generating a result value by inputting the encrypted input data to the machine learning model. The machine learning model is a model trained in advance using encrypted input data.

The technology to be described below verifies a machine learning model with an electronic signature technique to prevent forgery or falsification of the model itself. In addition, the technology described below can prevent data forgery or falsification by using a machine learning model that takes encrypted data as an input value. By applying the technology described below, it is possible to provide stable artificial intelligence services to autonomous vehicles and power grid systems, where safety is essential.

1 is an example of an artificial intelligence service based on machine learning.
2 is an example of an artificial intelligence system based on machine learning.
3 is an example of a service device.
4 is an example of a procedure flow diagram for a machine learning-based network service.
5 is an example of a procedure flow diagram for a machine learning-based device.

The technology to be described below may have various changes and may have various embodiments, and specific embodiments will be illustrated in the drawings and described in detail. However, this is not intended to limit the technology described below to specific embodiments, and it should be understood to include all changes, equivalents, or substitutes included in the spirit and scope of the technology described below.

Terms such as first, second, A, and B may be used to describe various components, but the components are not limited by the above terms, and only for the purpose of distinguishing one component from other components. used only as For example, a first component may be named as a second component, and similarly, a second component may also be named as a first component without departing from the scope of the technology to be described below. and/or includes a combination of a plurality of related listed items or any of a plurality of related listed items.

In terms of terms used herein, the singular expression should be understood to include the plural expression unless the context clearly dictates otherwise, and terms such as "comprises" refer to the described feature, number, step, operation, element. , parts or combinations thereof are to be understood, but not to exclude the possibility of the presence or addition of one or more other features or numbers, step operation components, parts or combinations thereof.

Prior to a detailed description of the drawings, it is intended to clarify that the classification of the constituent parts in the present specification is merely a division according to the main function that each constituent unit is responsible for. That is, two or more components to be described below may be combined into one component, or one component may be divided into two or more for each more subdivided function. In addition, each of the constituent units to be described below may additionally perform some or all of the functions of the other constituent units in addition to the main function it is responsible for, and may additionally perform some or all of the functions of the other constituent units. Of course, it may be carried out by being dedicated to it.

In addition, in performing the method or the method of operation, each process constituting the method may occur differently from the specified order unless a specific order is clearly described in context. That is, each process may occur in the same order as specified, may be performed substantially simultaneously, or may be performed in the reverse order.

The technology to be described below is applied to a device or system that provides a specific service using machine learning. Machine learning corresponds to a methodology for implementing the so-called artificial intelligence technology. In machine learning, various algorithms are being studied. Machine learning is meant to include various approaches such as deep learning, various artificial neural networks, reinforcement learning methods, and Bayesian networks. The techniques described below correspond to techniques applicable regardless of the type of algorithm.

Machine learning models are trained using training data in advance. In general, when we say machine learning model, we mean a model that has already been trained. A computer device provides a specific artificial intelligence service using a machine learning model. The computer device applies input data to the machine learning model and outputs certain result data (values). A computer device generally includes a storage medium for storing a program or a machine learning model, and a processor for executing the program or instructions. The computer device may be implemented as a programmable processor. The computer device may be physically implemented in various forms. For example, the computer device may be implemented in the form of a device used by an individual, such as a PC, a mobile device (smartphone, etc.), a wearable device, and the like. Also, the computer device may be implemented in the form of a server that provides a certain service in a network. In addition, the computer device may be implemented in the form of a device that performs a specific function (such as an automobile or an electronic product). Hereinafter, it will be described that a computer device provides a specific service using a machine learning model.

1 is an example of an artificial intelligence service based on machine learning.

1(A) is an example of providing an artificial intelligence service using a server existing on a network. The user terminal 10 generates or receives input data. The input data means a value input to a machine learning model such as a neural network. The service server 20 receives initial input data from the user terminal 10 . The service server 20 encrypts the input data, and inputs the encrypted input data to the machine learning model. The service server 20 transmits the output value of the machine learning model or information obtained by analyzing the output value to the user terminal 10 as result data. The model providing device 30 provides a machine learning model to the service server 20 . The model providing device 30 learns and generates a machine learning model in advance. The model providing device 30 is connected to a network and transmits a machine learning model. The model providing device 30 is operated by a business operator (provider) that provides an artificial intelligence service. The model providing device 30 may be a device such as a PC or a server.

1(B) is an example of a single device that provides an artificial intelligence service. 1(B) shows an automobile as an example. A device providing an artificial intelligence service is called a service device 50 . As described above, the model providing device 60 provides a machine learning model to the service device 50 . The machine learning model prepared by the model providing device 60 may be transmitted to the service device 50 through a wired or wireless network. Alternatively, the service device 50 may receive the machine learning model from a portable storage medium (USB, SD card, portable hard disk, etc.) through a wired interface. The service device 50 may receive a secret key for encryption from the key storage device 55 . 1(B), the key storage device 55 is illustrated as an example of a smart key of a car. In this case, when the user inserts the key storage device 55 into the service device 50 (car) or approaches the service device 50 , the security key may be wirelessly transmitted to the service device 50 . Furthermore, the service device 50 may retain the security key in a storage medium without a separate key storage device 55 . The service device 50 may encrypt specific data generated in the vehicle with a security key, and may generate specific result data by inputting the encrypted data into the machine learning model.

2 is an example of an artificial intelligence system 1000 based on machine learning. The artificial intelligence system 1000 includes a service device 100 and a model providing device 200 . 2 is an example of a service provision process using a machine learning model.

The service device 100 may correspond to the service server 20 or the service device 50 described above. In the service device 100 of FIG. 2 , an upper dotted line block is an accessible region. For example, the accessible area may be an area through which data or information can be input by being connected to an external network such as the Internet. In the service device 100 of FIG. 2 , a lower dotted line block is an inaccessible region. For example, the inaccessible area may be an intranet area that cannot be accessed from the outside.

The service device 100 includes an encryption unit 110 , a model unit 120 , a verification unit 130 , and an update unit 140 . FIG. 2 does not show all configurations for implementing the service device 100, but shows functional configurations for explanation. When the input data (data) is input, the encryption unit 110 encrypts the input data using the security key (sk). The security key means a key paired with the public key (pk ) in the public key encryption method. That is, the security key is basically a secret key that only the service device 100 and the model providing device 200 know.

The model unit 120 _{inputs the encrypted data E sk} (data) to the machine learning model and outputs a constant result value. The verification unit 130 verifies the integrity of the currently used model by verifying the electronic signature. That is, the verification unit 130 verifies whether the machine learning model is the original model provided by the model providing apparatus 200 . The verification unit 130 verifies the signature using the public key pk. The signature is information that can prove the integrity of the model, and may be in the form of being imprinted on the machine learning model. Here, imprint means that the signature is included in the machine learning model. At this time, the signature should be stored in a separate area that does not affect the function or performance of the machine learning model. Alternatively, the signature may be provided separately from the machine learning model. The signature is information encrypted using the security key ( sk ). The information used for the signature may vary. The update unit 140 transmits the machine learning model provided by the model providing device 200 to the model unit 130 .

The model providing apparatus 200 learns and generates a machine learning model used by the service apparatus 100 . The model providing apparatus 200 includes a key generator 210 and a model generator 220 . The key generator 210 generates a security key for encrypting input data input to the machine learning model. In addition, the key generator 210 may generate a public key corresponding to the security key. When the security key is prepared, the model generator 220 learns the machine learning model using data encrypted with the security key. When learning is completed, the model providing apparatus 200 provides the machine learning model to the service apparatus 100 . The model providing apparatus 200 may newly update the machine learning model currently used by the service apparatus 100 . In this case, the model providing apparatus 200 provides the updated model M (update) to the service apparatus 100 . The update unit 140 receives the model provided by the model providing device 200 , and provides the received model to the model unit 130 . In this case, the verification unit 130 may verify the new machine learning model.

3 is an example of a service device 300 . The service device 300 is a device that provides an artificial intelligence service using a machine learning model. The service device 300 is the aforementioned computer device. For example, the service device 300 may be the service server 20 or the service device 50 described with reference to FIG. 1 . 3 is an example illustrating a physical configuration of a service device. The service device 300 includes a communication device 310 , an input device 320 , a storage device 330 , and an arithmetic device 340 .

The communication device 310 receives certain information or data from an external object through a network. Also, the communication device 310 may transmit specific information generated by the service device 300 to an external object. For example, the communication device 310 may receive the machine learning model from the model providing device. The communication device 310 may receive a security key ( sk ) or a shared key ( pk ) from a model providing device or another object. The communication device 310 is a device supporting a wired or wireless communication protocol.

The input device 320 is a device that receives predetermined data. The input device 320 mainly corresponds to a device for receiving or acquiring input data input to the machine learning model. The input device 320 may be an interface device for receiving additional command information from the user. The input device 320 may be an interface device supporting internal communication of the device. For example, if it is a car, it may be a node constituting a bus and a communication interface.

The storage device 330 stores the machine learning model. The storage device 330 may additionally store an output value of the machine learning model, a security key, and the like.

The arithmetic unit 340 encrypts the input data with a security key. The computing device 340 generates specific information by inputting the encrypted input data to the machine learning model. In addition, the computing device 340 may verify the signature of the machine learning model with the public key. The computing device 340 may be responsible for the process of storing and installing a new machine learning model provided by the model providing device in the storage device 330 .

4 is an example of a flow diagram of a procedure 400 for a machine learning-based network service. 4 is an example of a service model as in FIG. 1(A). For convenience of explanation, the service device (service server) of FIG. 1A is taken as an example, and the same operation may be performed on other service devices.

4 shows three main operations. The block marked with A is the process of storing the machine learning model by the service device for the service. The block indicated by B is the process in which the service device provides a specific artificial intelligence service using a machine learning model. The block marked with C is the process of the service device updating the machine learning model. Each process will be described in order below.

The model providing device 30 generates a machine learning model ( 401 ). The model providing device 30 is prepared by learning the machine learning model using the data encrypted with the security key (sk). The model providing device 30 provides the prepared machine learning model to the service server 20 ( 402 ). The model providing device 30 generates an encrypted signature with a security key (sk). The model providing device 30 may store (imprint) the signature in the machine learning model. The model providing device 30 may provide a service server-specific machine learning model by using a different security key for each specific service server.

The service server 20 first verifies a signature (electronic signature) included in the machine learning model or transmitted simultaneously with the machine learning model ( 411 ). The service server 20 verifies the signature by decrypting the signature with the public key (pk). The service server 20 should retain reference data for verifying the signature in advance. The service server 20 performs verification by comparing the reference data with the data obtained by decrypting the signature. If the reference data and the data obtained by decrypting the signature are identical, the verification is successful. The service server 20 stores the machine learning model provided by the model providing device 30 ( 412 ).

The user terminal 10 inputs data ( 421 ). The user terminal 10 transmits input data to the service server 20 . The service server 20 may verify the electronic signature before using the machine learning model ( 431 ). If the verification is successful, the service server 20 encrypts the input data with the security key (sk) (441). The service server 20 applies the encrypted input data to the machine learning model ( 442 ). The service server 20 may transmit a result value output from the machine learning model to the user terminal 10 ( 443 ).

4 illustrates an example in which the user terminal 10 transmits input data. Unlike the flow of FIG. 4 , the service server 20 or another service device may directly receive input data or may receive input data from a separate device to perform the operation shown in FIG. 4 .

The model providing device 30 may update the machine learning model currently used by the service server 20 . For example, the model providing device 30 may generate a new security key and a shared key (451). In addition, the model providing device 30 generates by learning a machine learning model using the data encrypted with the new security key (452). The model providing device 30 transmits the updated new machine learning model to the service server 20 ( 453 ). In this case, the model providing device 30 may generate a signature encrypted with a new encryption key.

The service server 20 first verifies a signature (electronic signature) included in the machine learning model or transmitted simultaneously with the machine learning model ( 461 ). The service server 20 verifies the signature by decrypting the signature with the new public key. To this end, the service server 20 must acquire a new security key and a public key in advance. The service server 20 may receive a new security key and a public key from the model providing device 30 . The service server 20 performs verification by comparing the reference data with the data obtained by decrypting the signature. The service server 20 stores the new machine learning model provided by the model providing device 30 (462).

5 is an example of a procedure flow diagram 500 for a machine learning-based device. FIG. 5 is an example of a service model as shown in FIG. 1(B). For convenience of explanation, the service device 50 of FIG. 1B is taken as an example, and the same operation may be performed on other service devices.

5 shows three main operations. The block marked with A is the process of storing the machine learning model by the service device for the service. The block indicated by B is the process in which the service device provides a specific artificial intelligence service using a machine learning model. The block marked with C is the process of the service device updating the machine learning model. Each process will be described in order below.

The model providing device 60 generates a machine learning model ( 501 ). The model providing device 60 learns and prepares a machine learning model using data encrypted with the security key ( sk ). The model providing device 60 provides the prepared machine learning model to the service device 50 ( 502 ). The model providing device 60 generates an encrypted signature with a security key (sk). The model providing device 60 may store (imprint) the signature in the machine learning model. The model providing device 60 may provide a service device-specific machine learning model by using a different security key for each specific service device.

The service device 50 first verifies a signature (electronic signature) included in the machine learning model or transmitted simultaneously with the machine learning model ( 511 ). The service device 50 verifies the signature by decrypting the signature with the public key pk. The service device 50 must have reference data for verifying the signature in advance. The service device 50 performs verification by comparing the reference data with the data obtained by decrypting the signature. If the reference data and the data obtained by decrypting the signature are identical, the verification is successful. The service device 50 stores the machine learning model provided by the model providing device 60 ( 512 ).

The signature may be information capable of identifying the service device 50 . For example, the signature may include an identifier of the serving device or a unique serial number of the serving device. Alternatively, the signature may be a value obtained by hashing specific information. For example, the signature may include a hash value for an identifier of the service device or a hash value for a unique serial number of the service device.

For example, if the service device 50 is a car, the signature may include the serial number of the car. The service device 50 may store and retain its serial number in a storage medium during the manufacturing process.

Meanwhile, the service device 50 may already have a machine learning model specific to itself in the manufacturing process. For example, in a car manufacturing process, a car may store a machine learning model learned using data encrypted with a specific security key in a storage medium. In this case, the security key can also use information specific to a specific product (vehicle). For example, the security key may also be an identifier of a specific product, such as a serial number of a car, or information obtained by processing the identifier.

The model providing device 60 may transmit the security key and the public key generated by the machine learning model to the key storage device 55 ( 521 ). Although FIG. 5 shows a separate key storage device 55 , the model providing device 60 may directly transmit the security key and the public key to the service device 50 . Alternatively, the service device 50 may hold the security key and the public key in the storage medium during the manufacturing process without the security key and the public key transmission process.

The key storage device 55 stores the security key (522). The key storage device 55 transmits the security key to the service device 50 ( 531 ).

The service device 50 generates or obtains specific input data. For example, the service device 50 may receive input data from the outside or receive specific input data from a built-in sensor device. The service device 50 encrypts the input data with the security key (sk) (541). The service device 50 generates a constant result value by applying the encrypted input data to the machine learning model ( 542 ). The service device 50 may receive a shared key corresponding to the security key in advance in order to verify the machine learning model.

The model providing device 60 may update the machine learning model currently used by the service device 50 . For example, the model providing device 60 may generate a new security key and a shared key ( 551 ). The model providing device 60 transmits the new security key and the shared key to the key storage device 55 (552). Alternatively, unlike in FIG. 5 , the model providing device 60 may directly transmit a new security key to the service device 50 . The model providing device 60 may transmit a new public key to the service device 50 ( 553 ).

The model providing device 60 learns and generates a machine learning model using the data encrypted with the new security key ( 561 ). The model providing device 60 transmits the updated new machine learning model to the service device 50 ( 562 ). In this case, the model providing device 60 may generate a signature encrypted with a new encryption key.

The service device 50 first verifies a signature (electronic signature) included in the machine learning model or transmitted simultaneously with the machine learning model ( 571 ). The service device 50 verifies the signature by decrypting the signature with the new public key. To this end, the service device 50 must obtain a new security key and a public key in advance. The service device 50 performs verification by comparing the reference data with the data obtained by decrypting the signature. The service device 50 stores the new machine learning model provided by the model providing device 60 ( 572 ).

In addition, the machine learning model verification method and/or the machine learning model operating method as described above may be implemented as a program (or application) including an executable algorithm that can be executed in a computer. The program may be provided by being stored in a non-transitory computer readable medium.

The non-transitory readable medium refers to a medium that stores data semi-permanently, rather than a medium that stores data for a short moment, such as a register, cache, memory, etc., and can be read by a device. Specifically, the above-described various applications or programs may be provided by being stored in a non-transitory readable medium such as a CD, DVD, hard disk, Blu-ray disk, USB, memory card, ROM, and the like.

This embodiment and the drawings attached to this specification only clearly show a part of the technical idea included in the above-described technology, and within the scope of the technical idea included in the specification and drawings of the aforementioned technology, those skilled in the art can easily It will be apparent that all inferred modified examples and specific embodiments are included in the scope of the above-described technology.

10: user terminal
20: service server
30: model providing device
55: key storage device
50: service device
60: model providing device
100: service device
110: encryption unit
120: model part
130: verification unit
140: update unit
200: model providing device
210: key generator
220: model generation unit
300: machine learning based device
310: communication device
320: input device
330: storage device
340: arithmetic unit

Claims (12)

receiving input data by the computer device;
encrypting the input data by the computer device; and
Comprising the step of the computer device generating a result value by inputting the encrypted input data into a machine learning model,
The machine learning model uses encrypted data, which is a model learned in advance using encrypted input data,
The machine learning model includes an encrypted signature,
The computer device decrypts the signature encrypted using the security key with a specific public key, verifies the signature by comparing the decrypted data with reference data held in advance, and generates the result value only when the verification is successful, ,
The signature includes at least one of an identifier of the computer device or a device incorporating the computer device, a unique serial number of the computer device or a device incorporating the computer device, a hash value of the identifier, and a hash value of the serial number How to operate a machine learning model that includes. delete delete According to claim 1,
The computer device is a machine learning model operating method using encrypted data to encrypt the input data using the security key. delete According to claim 1,
The computer device is a machine learning model operating method using encrypted data for receiving the security key from a separate storage device through wireless or wired communication. According to claim 1,
The computer device verifies the new machine learning model received through the network through a signature that is simultaneously transmitted or added to the new machine learning model, and when the verification is successful, machine learning using encrypted data to store the new machine learning model How the model works. an input device for receiving input data and a security key paired with a specific public key;
a storage device for storing a machine learning model trained in advance using encrypted data; and
Comprising a computing device for encrypting the input data using the security key, and inputting the encrypted input data to the machine learning model to generate a result value,
The machine learning model includes an encrypted signature,
The computing device decrypts the signature encrypted using the security key with a specific public key, verifies the signature by comparing the decrypted data with the reference data held in advance, and generates the result value only when the verification is successful, ,
The signature is a machine learning model-based device using encrypted data including at least one of an identifier of a service device, a unique serial number of the service device, a hash value of the identifier, and a hash value of the serial number. delete 9. The method of claim 8,
The input device is a machine learning model-based device using encrypted data for receiving the security key from a separate storage device through wireless or wired communication. 9. The method of claim 8,
The input device receives the updated new machine learning model through the network,
The computing device verifies the signature added to the new machine learning model using the public key, and if the verification is successful, the machine learning model-based device using encrypted data to store the new machine learning model in the storage device. A computer-readable recording medium recording a program for executing a machine learning model operating method using the encrypted data according to any one of claims 1, 4, and 6 to 7 in a computer.

Images