WO2018233638A1 - Ai软件系统安全状态的确定方法及装置 - Google Patents

Ai软件系统安全状态的确定方法及装置 Download PDF

Info

Publication number
WO2018233638A1
WO2018233638A1 PCT/CN2018/092027 CN2018092027W WO2018233638A1 WO 2018233638 A1 WO2018233638 A1 WO 2018233638A1 CN 2018092027 W CN2018092027 W CN 2018092027W WO 2018233638 A1 WO2018233638 A1 WO 2018233638A1
Authority
WO
WIPO (PCT)
Prior art keywords
target object
module
real
security
time monitoring
Prior art date
Application number
PCT/CN2018/092027
Other languages
English (en)
French (fr)
Inventor
张建永
孙少杰
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2018233638A1 publication Critical patent/WO2018233638A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/44—Program or device authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
    • H04L9/3239—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements

Definitions

  • the present application relates to the field of Article Intelligence (AI) technology, and in particular, to a method and a device for determining a security state of an AI software system.
  • AI Article Intelligence
  • the operating system on the terminal provides a platform for the application software to run on the terminal, that is, the application software implements the function of the application software through modules deployed at various levels of the operating system, wherein modules configured at various levels of the operating system are configured.
  • the system is called the software system of the application software, such as the AI software system.
  • the AI software usually involves the processing of the user's personal privacy data during the running process.
  • the operating environment of the operating system is mainly an open Rich Operating Environment (REE), which results in deployment in the operating system.
  • REE Rich Operating Environment
  • the key components of the AI software system may face the threat of malware during the process of data processing. Therefore, in actual applications, it is necessary to determine the security status of key components in the AI software system, that is, to determine the security status of the AI software system. In order to protect the AI software system.
  • the Global Platform proposes a Trusted Execution Environment (TEE), that is, there are two parallel operating environments on the operating system, and the open REE And relatively closed TEE. Since the program executed in the TEE needs to be TEE signed and hashed, the program executed in the TEE can be secured. Therefore, in the related art, the key components in the AI software system are placed in the TEE, and the other components are executed in the REE to determine the security of the AI software system by the verification result of the key components executed in the TEE. State, thus achieving security protection for the AI software system. For example, FIG.
  • AI 1 is an AI software system based on an AI software framework, which includes an AI framework application programming interface (API), a model and key data files, an AI framework body, and a hardware abstraction.
  • Hardware Abstraction Layer (HAL) Hardware Abstraction Layer
  • algorithm support library hardware abstraction Layer
  • CPU central processing unit
  • GPU image processing unit
  • DSP digital signal processing
  • the model and key data files and AI framework body are the key components of the AI software system, so the model and key data files and AI framework body can be placed in the TEE, and other components are executed in the REE to achieve Security protection for AI software systems based on AI software framework.
  • the key components in the AI software system are placed in the TEE and the other components are still executed in the REE, resulting in a relatively decentralized deployment of the software frameworks that make up the AI software system.
  • the present application provides a method and a device for determining the security state of the AI software system.
  • the technical solution is as follows:
  • a method for determining a security state of an AI software system comprising:
  • the monitoring agent module in the AI software system determines a first digest value of the target object in the AI software system, where the first digest value is used to indicate security authentication information of the target object, where the AI is deployed
  • the operating environment of the operating system of the software system includes a rich operating environment REE and a trusted operating environment TEE, and the target object and the monitoring agent module are placed in the REE, and the target object is deployed in the AI software system. Any one of a plurality of modules on the operating system to be securely authenticated;
  • the monitoring agent module reports the first summary value to a real-time monitoring service module in the AI software system, where the real-time monitoring service module is placed in the TEE;
  • the real-time monitoring service module receives the first digest value
  • the real-time monitoring service module performs security authentication on the target object according to the first digest value to obtain an authentication result, where the authentication result is used to indicate a security status of the target object.
  • the target object to be securely authenticated is placed in the REE, and the target object is securely authenticated by the monitoring agent module placed in the REE and the real-time monitoring service module placed in the TEE to target the target object.
  • Protection that is, protection of the AI software system. Since the target object is executed in the REE, the deployment of the software framework that facilitates the software system is relatively concentrated without affecting security.
  • the real-time monitoring service module performs security authentication on the target object according to the first digest value to obtain an authentication result, including:
  • the real-time monitoring service module acquires a second digest value preset for the target object from a security key storage module in the AI software system, where the security key storage module is placed in the TEE;
  • the authentication result is the security authentication pass status
  • the authentication result is the security authentication fail status.
  • the real-time monitoring service module performs security authentication on the target object by determining whether the first digest value of the target object reported by the monitoring agent module is consistent with the second digest value preset for the target object. .
  • the method further includes:
  • the real-time monitoring service module acquires, from the security key storage module, a digital certificate preset for the target object;
  • the real-time monitoring service module verifies whether the digital certificate is legal according to the verification information in the digital certificate
  • the real-time monitoring service module triggers an operation of acquiring a second digest value preset for the target object from the security key storage module.
  • the real-time monitoring service module may first target the first digest value of the target object reported by the monitoring agent module and the second digest value preset for the target object. The validity of the digital certificate of the object preset is verified.
  • the method further includes:
  • the security key storage module stores a plurality of digital certificates, and the monitoring agent module reports the identifier of the digital certificate to the real-time monitoring service module when reporting the first digest value to the real-time monitoring service module.
  • Real-time monitoring service module ;
  • the real-time monitoring service module acquires, from the security key storage module, a digital certificate preset for the target object, including:
  • the real-time monitoring service module obtains the digital certificate corresponding to the identifier from the plurality of digital certificates stored by the security key storage module.
  • the monitoring agent module sets the digital certificate of the target object in order to facilitate the real-time monitoring service module to accurately obtain the digital certificate preset for the target object from the security key storage module.
  • the identifier is also reported to the real-time monitoring service module, so that the real-time monitoring service module obtains the digital certificate preset for the target object according to the identifier of the digital certificate of the target object.
  • the real-time monitoring service module after the real-time monitoring service module performs the security authentication on the target object to obtain the authentication result according to the first digest value, the real-time monitoring service module further includes:
  • the real-time monitoring service module sends an alarm request to the trusted user interface TUI in the AI software system, where the TUI is placed in the TEE;
  • the TUI receives the alarm request
  • the TUI displays alarm information for indicating to the user that the security authentication of the target object has not passed.
  • the real-time monitoring server module sends an alarm request to the TUI, so that the user can know the security state of the target object through the alarm information displayed by the TUI.
  • the real-time monitoring service module after the real-time monitoring service module performs the security authentication on the target object to obtain the authentication result according to the first digest value, the real-time monitoring service module further includes:
  • the real-time monitoring service module sends the authentication result to the monitoring agent module.
  • the real-time monitoring service module may further feed back the authentication result to the monitoring agent module placed in the REE.
  • the method further includes:
  • the monitoring agent module sends a termination request to the preset control module, where the termination request is used to instruct the preset control module to terminate the process of the target object,
  • the preset control module is a module deployed in the operating system and not belonging to the AI software system.
  • the monitoring agent module may perform corresponding operations according to the authentication result to perform security protection on the target object.
  • the method further includes:
  • the monitoring agent module obtains, from the cloud server, a digital certificate of the target object after the upgrade, where the digital certificate includes a digital signature and a digest value after the cloud server upgrades the target object;
  • the monitoring agent module sends the digital certificate of the target object after the upgrade to a security key storage module in the AI software system;
  • the security key storage module replaces the stored digital certificate of the target object with a digital certificate of the target object after the upgrade.
  • the data of the target object may be changed after the upgrade.
  • the security key storage module may update the digital certificate of the stored target object by using the above method to avoid the subsequent real-time monitoring service module according to the summary of the target object before the upgrade.
  • the value is subject to security certification, which causes the security certification to fail.
  • the target object includes a model and a key data file in the AI software system.
  • the AI software system is deployed in each module of the operating system, wherein the model and the key data files are relatively vulnerable to malware. Therefore, in the present application, the model and key data files in the AI software system can be used as Target object to achieve security protection of models and key data files in the AI software system.
  • a device for determining a security state of an AI software system in a second aspect, is provided, and the device for determining a security state of the AI software system has a function of implementing a behavior of determining a security state of an AI software system in the first aspect.
  • the determining device of the security state of the AI software system includes at least one module, and the at least one module is configured to implement a method for determining a security state of the AI software system provided by the first aspect.
  • a device for determining a security state of an AI software system includes a processor and a memory, and the memory is configured to store a determination of a security state of the AI software system.
  • the apparatus executes the program of the method for determining the security state of the AI software system provided by the above first aspect, and the data related to the method for determining the security state of the AI software system provided by the first aspect described above.
  • the processor is configured to execute a program stored in the memory.
  • the operating device of the storage device may further include a communication bus for establishing a connection between the processor and the memory.
  • a computer readable storage medium stores instructions that, when run on a computer, cause the computer to perform the security state of the AI software system described in the first aspect above Determine the method.
  • a computer program product comprising instructions which, when run on a computer, cause the computer to perform the method of determining the security state of the AI software system described in the first aspect above.
  • the monitoring agent module in the AI software system determines the first digest value of the target object, and reports the first digest value to the real-time monitoring service module, and the real-time monitoring service module performs security authentication on the target object to implement Secure the target object. Since the target object is executed in the REE, the deployment of the software framework that facilitates the software system is relatively concentrated without affecting security.
  • FIG. 1 is a schematic diagram of an AI software system based on an AI software framework provided by the related art
  • FIG. 2 is a schematic diagram of a platform architecture of an operating system based on the Trustzone technology provided by an embodiment of the present application;
  • FIG. 3 is a schematic diagram of an AI software system provided by an embodiment of the present application.
  • FIG. 4 is a schematic diagram of an intelligent dynamic behavior protection system provided by an embodiment of the present application.
  • FIG. 5 is a block diagram of a device for determining a security state of an AI software system according to an embodiment of the present application
  • FIG. 6 is a flowchart of a method for determining a security state of an AI software system according to an embodiment of the present application
  • FIG. 7 is a flowchart of another method for determining a security state of an AI software system according to an embodiment of the present application.
  • FIG. 8 is a schematic structural diagram of a terminal provided by an embodiment of the present application.
  • the digest value is obtained by calculating the specified data according to a preset function, and obtaining a value that can represent the uniqueness of the specified data, and the obtained value is the digest value of the specified data.
  • the changed specified data is recalculated by the preset function to obtain a digest value of the changed designated data, and the digest value of the changed specified data and the specified data before the change
  • the digest value is inconsistent. Therefore, the digest value can be used to indicate the security authentication information of the specified data, that is, the digest value of the specified data can be used to determine whether the specified data has been modified.
  • the preset function may be a preset hash function, that is, the specified data is calculated according to a preset hash function, and the obtained hash value is referred to as a digest value of the specified data.
  • a digital certificate refers to a series of data used in Internet communications to indicate the identity information of two communicating parties.
  • a digital certificate is usually issued by an authority such as a Certificate Authority (CA) center.
  • CA Certificate Authority
  • the CA Center issues a digital certificate for the software to indicate the identity information of the software.
  • Digital signature refers to encrypting the digest value of the specified data by using the private key in the asymmetric key pair.
  • the encrypted information is the digital signature of the specified data, and the device receiving the digital signature can adopt the asymmetric key.
  • the digital key of the pair decrypts the digital signature to obtain a digest value of the specified data.
  • Security authentication refers to a method for determining the security status of a specified object.
  • the specified object is securely authenticated, that is, whether the data corresponding to the specified object is modified or tampered with. Specifically, it can be implemented by verifying whether the data corresponding to the specified object is consistent with the data corresponding to when the software developer originally issued the specified object, that is, by verifying the integrity of the specified object to implement secure authentication of the specified object.
  • the operating environment of the operating system in which the AI software system is deployed includes REE and TEE. Therefore, before the AI software system provided by the embodiment of the present application is described, the operating environment includes REE and TEE.
  • the platform architecture of the operating system is introduced.
  • ARM Advanced RISC Machines
  • TrustZone technology provides an operating environment for the operating system of the terminal, including REE and TEE platform architecture.
  • FIG. 2 is a schematic diagram of a platform architecture 200 of an operating system based on the TrustZone technology according to an embodiment of the present application.
  • the platform architecture 200 of the operating system based on the TrustZone technology includes a Secure World and a Normal World.
  • the operating environment corresponding to the security world is TEE, and the non-secure world corresponds to the operation.
  • the environment is REE.
  • the hardware and software resources on the operating system are divided into security resources and common resources, and the security resources are placed in the security world, and ordinary resources are placed in the non-secure world.
  • the operating system of the AI software system provided by the embodiment of the present application is the operating system shown in FIG. 2, that is, the AI software system provided by the embodiment of the present application is a software system based on the TrustZone technology.
  • the AI software system 300 includes a non-secure world and a security world, and the operating environment of the non-secure world is REE, the left system of FIG.
  • the operating environment of the safe world is TEE, corresponding to the right system in Figure 3.
  • the AI framework API, model and key data files, AI framework body, HAL layer, algorithm support library, first kernel layer (Kernel) and monitoring agent module are deployed in the non-secure world.
  • the security world is deployed with a real-time monitor service, a trusted user interface (TUI), a TEE internal API, and a second kernel layer (Trust OS kernel). That is, the operating environment of the operating system deploying the AI software system includes REE and TEE, and the monitoring agent module is placed in the REE, the real-time monitoring service module is placed in the TEE, and the TUI is also placed in the TEE.
  • the first kernel layer is configured with a corresponding virtual device (Virtual devices) and a first communication driver module (Communication driver), and a second communication driver module and a security secret are deployed in the second kernel layer.
  • Key storage module Key storage
  • Each of the first kernel layer and the second kernel layer is a driver software module.
  • the first communication driver module and the second communication driver module are used to implement communication between the non-secure world and the secure world, that is, for any component included in the non-secure world, if the component wants to communicate with components in the secure world, It needs to be implemented by the first communication driver module and the second communication driver module.
  • the AI framework API, the model and the key data files, the AI framework body, the HAL layer, the algorithm support library, and the first kernel layer deployed in the non-secure world correspond to the related technical software system shown in FIG.
  • the components are identical, that is, in the embodiment of the present application, the components included in the AI software system shown in FIG. 1 are all placed in the REE. That is, compared with the AI software system shown in FIG. 1, the AI software system shown in FIG. 3 may not change the deployment of the software framework of the AI software system, but only on the basis of the AI software system shown in FIG.
  • a monitoring agent module, a real-time monitoring service module, a security key storage module, a TUI, and a first communication driver module and a second communication driver module are added.
  • any module that is deployed in the software system and is required to perform security authentication is called a target object, and the target object is placed in the REE.
  • the security protection of the target object is implemented by a monitoring agent module deployed in the non-secure world and a real-time monitoring service module deployed in the security world, that is, the monitoring agent module and the real-time monitoring service module are used for the target.
  • the object is secured.
  • the implementation process of the security protection of the target object by the monitoring agent module and the real-time monitoring service module will be described in detail in the embodiments provided below, and will not be described in detail herein.
  • the TUI deployed in the security world is used to display the security status of the target object.
  • the security key storage module deployed in the security world is used to store information needed for secure authentication of the target object, such as the digest value of the target object.
  • the TEE internal API deployed in the secure world is used to provide an interface between the non-secure world and the secure world.
  • the deployment of the software framework of the AI software system provided by the embodiment of the present application is relatively concentrated, so that the deployment of the software framework of the AI software system provided by the embodiment of the present application is relatively concentrated, so as to facilitate the AI software system. Platformization.
  • the key components in the AI software system are implemented in the TEE, and the embodiment of the present application can implement the security protection of the critical component while the key component is placed in the REE.
  • the AI framework body is placed in the REE, so that the AI framework body can fully utilize the rich computing resources of the REE side, and avoid placing the AI framework body in the TEE to affect the computing power of the AI framework body, so as to achieve Ensure the computing power and facilitate platform-based deployment while ensuring the security of the AI software system.
  • the embodiment of the present application is based on the AI software system shown in FIG. 3 above, and provides an intelligent dynamic behavior protection system.
  • the following embodiment will protect the intelligent dynamic behavior.
  • the architecture of the system is described in detail.
  • FIG. 4 is a schematic diagram of an intelligent dynamic behavior protection system 400 according to an embodiment of the present application.
  • the intelligent dynamic behavior protection system also includes a non-secure world and a security world, and the operating environment of the non-secure world is REE.
  • the operating environment of the safe world is TEE.
  • Application frameworks, runtime libraries, browser engines (WEBKIT), observers (Observer), model files, class libraries, and binaries (Bin &) are deployed in the non-secure world.
  • Lib files analyzer, monitoring agent module and first kernel layer.
  • the real-time monitoring service module, TUI, TEE internal API and second kernel layer are deployed in the security world.
  • the modules deployed in the first kernel layer are the same as the modules deployed in the first kernel layer in the AI software system shown in FIG. 3, and are not described in detail herein.
  • the modules deployed in the second kernel layer are the same as those deployed in the second kernel layer in the AI software system shown in FIG. 3, and will not be described in detail herein.
  • the application framework, runtime library, browser engine (WEBKIT), observer, model file, class library and binary file, analyzer and first kernel layer and existing one deployed in the non-secure world The corresponding components in the intelligent dynamic behavior protection system are identical. Refer to the related technical descriptions of related modules. That is, in the embodiment of the present application, all the components included in the existing intelligent dynamic behavior protection system are placed in the REE, and then the monitoring agent module is newly added on the basis of the existing intelligent dynamic behavior protection system.
  • the real-time monitoring service module, the security key storage module, the TUI, the first communication driver module, and the second communication driver module are used to securely protect any component deployed in the non-secure world.
  • the target object may be any one of a class library and a binary file and a model file, and may also include the class library and the binary file and the model file.
  • the manner in which the target object is securely protected by the intelligent dynamic behavior protection system shown in FIG. 4 can refer to the manner in which the target object is securely protected by the AI software system shown in FIG. 3, and will not be described in detail herein.
  • the embodiment of the present application provides a device 500 for determining the security status of the AI software system.
  • the AI software system is secure.
  • the state determining device 500 includes a monitoring agent module 501, a real-time monitoring service module 502, a TUI 503, and a security key storage module 504, which respectively correspond to the corresponding modules in FIG. 3 or FIG.
  • apparatus 500 of FIG. 5 can be equivalent to being part of the software system of FIG. 3 or 4.
  • the monitoring agent module 501 is the monitoring agent module in the AI software system shown in FIG. 3 or the intelligent dynamic behavior protection system shown in FIG. 4 described above.
  • the real-time monitoring service module 502 is the real-time monitoring service module in the AI software system shown in FIG. 3 or the intelligent dynamic behavior protection system shown in FIG. 4 described above.
  • the TUI 503 is the TUI in the AI software system shown in FIG. 3 described above or the intelligent dynamic behavior protection system shown in FIG. 4 described above.
  • the security key storage module 504 is the security key storage module in the AI software system shown in FIG. 3 or the intelligent dynamic behavior protection system shown in FIG. 4 described above.
  • the monitoring agent module 501, the real-time monitoring service module 502, the TUI 503, and the security key storage module 504 are configured to perform corresponding steps in the following embodiments, that is, the monitoring agent module 501, the real-time monitoring service module 502, the TUI 503, and the security.
  • the key storage module 504 provides a method for determining the security state of the AI software system according to the embodiment of the present application by performing the corresponding steps in the following embodiments. Therefore, the functions of the monitoring agent module 501, the real-time monitoring service module 502, the TUI 503, and the security key storage module 504 are not elaborated here.
  • the device for determining the security state of the AI software system is only illustrated by the division of the above functional modules. In actual applications, the foregoing functions may be allocated according to needs. Different functional modules are completed to complete the corresponding functions.
  • the device for determining the security state of the AI software system is the same as the embodiment of the method for determining the security state of the AI software system. The specific implementation process is described in the following method embodiments, and details are not described herein again.
  • the method for determining the security state of the AI software system is a method based on the determining device of the security state of the AI software system shown in FIG. 5.
  • the real-time monitoring service module performs security authentication on the target object by using the following two methods: First, performing security authentication on the target object directly according to the first digest value of the target object, The target object is securely authenticated according to the first summary value of the target object and the digital certificate preset for the target object.
  • First performing security authentication on the target object directly according to the first digest value of the target object
  • the target object is securely authenticated according to the first summary value of the target object and the digital certificate preset for the target object.
  • FIG. 6 is a method for determining a security state of an AI software system according to an embodiment of the present application. The method is applied to the security device determining device 500 of the AI software system shown in FIG. 5, and the method is used by the real-time monitoring service module 502 according to the method. In the scenario where the first digest value of the target object is securely authenticated to the target object, referring to FIG. 6, the method includes the following steps.
  • Step 601 The monitoring agent module 501 in the AI software system determines a first digest value of the target object in the AI software system.
  • the first digest value is used to indicate the security authentication information of the target object, that is, the first digest value can be used to determine whether the target object has been modified.
  • the target object refers to any module to be securely authenticated among a plurality of modules deployed in the operating system in the AI software system.
  • determining the first digest value of the target object may be implemented by: the monitoring agent module 501 determining data of the target object, and performing hash calculation on the data of the target object according to the preset hash function. And obtaining a hash value of the target object, and determining a hash value of the target object as the first digest value of the target object.
  • the monitoring agent module 501 may also determine the digest value of the target object by other means, as long as the obtained digest value can be used to determine whether the target object has been modified.
  • timing at which the monitoring agent module 501 determines the first digest value of the target object can be classified into the following two cases.
  • the monitoring agent module 501 can periodically determine the data of the target object, that is, periodically determine the first digest value of the target object. That is, the monitoring agent module 501 determines the data of the target object every preset period.
  • the preset time period is a preset time period.
  • the monitoring agent module 501 determines the first digest value of the target object when receiving the security authentication instruction for the target object.
  • the security authentication command for the target object may be triggered by the user through a preset operation, that is, the user may initiate the security authentication of the target object by using a preset operation.
  • the security authentication command for the target object may also be triggered by the monitoring agent module 501 when detecting that the AI application software corresponding to the AI software system has a service abnormality, or may be detected by the monitoring agent module 501. Triggered when the AI application is upgraded.
  • the models and key data files deployed in the non-secure world are usually the key components in the AI software system, so the model and key data files can be set to target.
  • the target object may also be other components in the AI software system, which is not specifically limited herein.
  • the target object may be at least one of a class library and a binary file and a model file.
  • Step 602 The monitoring agent module 501 reports the first digest value to the real-time monitoring service module 502 in the AI software system.
  • the monitoring agent module 501 may report the first digest value to the first digest value after the target object is determined.
  • the real-time monitoring service module 502 in the TEE facilitates the real-time monitoring service module 502 to securely authenticate the target object.
  • the monitoring agent module 501 reports the first digest value by using the first communication driver module deployed in the first kernel layer and the second communication driver module deployed in the second kernel layer.
  • the service module 502 is monitored in real time.
  • the monitoring agent module 501 may report the identifier of the target object to the real-time monitoring service module 502 when the first summary value is reported to the real-time monitoring service module 502.
  • the implementation process of the monitoring agent module 501 reporting the identifier of the target object to the real-time monitoring service module 502 and the monitoring agent module 501 reporting the first digest value to the real-time monitoring service module 502 are substantially the same.
  • Step 603 The real-time monitoring service module 502 receives the first digest value.
  • the real-time monitoring service module 502 receives the first digest value sent by the TEE internal API, and implements the monitoring agent module 501 to report the first digest value of the target object to the real-time monitoring service module 502.
  • the real-time monitoring service module 502 When the monitoring agent module 501 reports the identifier of the target object to the real-time monitoring service module 502, the real-time monitoring service module 502 also receives the identifier of the target object sent by the TEE internal API.
  • the real-time monitoring service module 502 When the real-time monitoring service module 502 receives the first digest value, the real-time monitoring service module 502 performs security authentication on the target object according to the first digest value to obtain an authentication result, where the authentication result is used to indicate the security status of the target object. Specifically, the real-time monitoring service module 502 performs security authentication on the target object to obtain an authentication result, which can be implemented by the following step 604.
  • Step 604 The real-time monitoring service module 502 acquires a second digest value preset for the target object from the security key storage module 504 in the AI software system, and determines whether the first digest value and the second digest value are consistent to obtain an authentication result.
  • the authentication result After determining whether the first digest value and the second digest value are consistent to obtain the authentication result, if the first digest value and the second digest value are consistent, the authentication result is a security authentication pass status; if the first digest value and the second digest are If the values are inconsistent, the authentication result is a failure status of the security authentication. That is, determining whether the first digest value and the second digest value are consistent to obtain an authentication result, specifically, if the first digest value and the second digest value are consistent, the authentication result is a security authentication pass status, that is, determining the The AI software system is in a security state; if the first digest value and the second digest value are inconsistent, the authentication result is a security authentication failure status, that is, the AI software system is determined to be in an insecure state.
  • the real-time monitoring service module 502 may record the authentication result by using a Boolean variable after obtaining the authentication result, that is, when the authentication result is a security authentication pass state, the authentication result is recorded as 1, and when the authentication result is a security authentication. When the status is not passed, the authentication result is recorded as 0.
  • the second digest value is a digest value configured in advance in the security key storage module 504 for the target object, that is, the second digest value is a digest value preset for the target object.
  • the second digest value preset for the target object is usually stored in the digital certificate preset for the target object, that is, the digital certificate preset for the target object includes the second digest value preset for the target object.
  • the software developer may upgrade the AI application software, and in the process of upgrading the AI application software, the data of the target object may be Therefore, in order to prevent the subsequent real-time monitoring service module 502 from performing security authentication according to the information of the target object before the upgrade, and the security authentication fails, the AI software system needs to update the information of the stored target object.
  • the implementation process of the AI software system to update the information of the stored target object may be: the monitoring agent module 501 obtains the upgrade from the cloud server. And a digital certificate of the target object, the digital certificate includes a digital signature and a digest value after the cloud server upgrades the target object, that is, the digital certificate is a digital certificate determined according to data of the target object after the upgrade.
  • the monitoring agent module 501 transmits the digital certificate of the target object after the upgrade to the security key storage module 504 in the AI software system.
  • the secure key storage module 504 replaces the stored digital certificate of the target object with the digital certificate of the target object after the upgrade.
  • the real-time monitoring service module 502 may perform security protection on the target object by performing a corresponding policy after performing security authentication on the target object, and specifically, performing security protection on the target object by executing the corresponding policy may be as follows: Step 605 and/or step 606 is implemented.
  • Step 605 The real-time monitoring service module 502 secures the target object through the TUI 503 of the AI software system.
  • the real-time monitoring service module 502 sends an alarm request to the TUI 503 in the AI software system, and the TUI 503 receives the alarm request and displays alarm information, which is used to indicate to the user.
  • the security certification of the target object failed.
  • the real-time monitoring service module 502 can also directly send the authentication result to the TUI 503.
  • the TUI 503 receives the authentication result, the corresponding operation is performed according to the authentication result. That is, when the authentication result is the security authentication failure status, the TUI 503 displays the alarm information; when the authentication result is the security authentication pass status, the authentication result is displayed to enable the user to know that the current target object is in a safe state.
  • the TUI 503 may also display the authentication result by using a preset identifier. That is, when the authentication result is that the security authentication fails, the first preset identifier is used to display the authentication result.
  • the second preset identifier is used to display the authentication result. For example, when the authentication result is that the security authentication fails, the red light identifier is used to display the authentication result.
  • the green light identifier is used to display the authentication result.
  • the authentication result sent by the real-time monitoring service module 502 to the TUI 503 is an authentication result recorded by using a Boolean variable. That is, when the TUI 503 receives the authentication result sent by the real-time monitoring service module 502, when the authentication result is 1, the TUI 503 determines that the authentication result is the security authentication pass status, and when the authentication result is 0, the TUI 503 determines the authentication result. The status of the security certification failed.
  • Step 606 The real-time monitoring service module 502 performs security protection on the target object through the monitoring agent module 501 of the AI software system.
  • the real-time monitoring service module 502 can send the authentication result to the monitoring agent module 501, that is, the real-time monitoring service module 502 deploys the second communication driver module in the second kernel layer.
  • the first communication driver module deployed in the first kernel layer sends the authentication result to the monitoring agent module 501.
  • the monitoring agent module 501 When the monitoring agent module 501 receives the authentication result fed back by the real-time monitoring service module 502, when the authentication result is the security authentication failure status, the monitoring agent module 501 can perform security protection on the target object by a preset operation.
  • the preset operation may be: the monitoring agent module 501 sends a termination request to the preset control module, where the termination request is used to instruct the preset control module to terminate the process of the target object, and the preset control module is deployed in the operation. A module in the system that does not belong to the AI software system.
  • the preset control module receives the termination request, the process of the current target object is terminated to secure the target object.
  • an operation of uninstalling the target object may also be performed to secure the target object.
  • the authentication result fed back by the real-time monitoring service module 502 to the monitoring agent module 501 is also an authentication result recorded by a Boolean variable.
  • the monitoring agent module 501 in the AI software system determines the first digest value of the target object, and reports the first digest value to the real-time monitoring service module 502, and the real-time monitoring service module 502 performs the target object.
  • Security certification to achieve security protection of the target object Since the target object is executed in the REE, the deployment of the software framework that facilitates the software system is relatively concentrated without affecting the security, thereby facilitating the platformization of the AI software system.
  • the key components in the AI software system are implemented in the TEE, and the embodiment of the present application can implement the security protection of the critical component while the key component is placed in the REE.
  • the AI framework body is placed in the REE, so that the AI framework body can fully utilize the rich computing resources of the REE side, and avoid placing the AI framework body in the TEE to affect the computing power of the AI framework body, so as to ensure The computing power and the facilitation of platform-based deployment ensure the security of the AI software system.
  • FIG. 7 is a method for determining a security state of an AI software system according to an embodiment of the present application. The method is applied to a device for determining a security state of an AI software system shown in FIG. 5, and the method is used for real-time monitoring service module 502 according to a target. In the scenario where the first summary value of the object and the digital certificate preset for the target object securely authenticate the target object, referring to FIG. 7, the method includes the following steps.
  • Step 701 The monitoring agent module 501 in the AI software system determines a first digest value of the target object in the AI software system.
  • step 701 For the implementation process of step 701, reference may be made to the implementation process of step 601 shown in FIG. 6, which is not described in detail herein.
  • Step 702 The monitoring agent module 501 reports the first digest value to the real-time monitoring service module 502 in the AI software system.
  • step 702 For the implementation process of step 702, reference may be made to the implementation process of step 602 shown in FIG. 6, which is not described in detail herein.
  • Step 703 The real-time monitoring service module 502 receives the first digest value.
  • step 703 can refer to the implementation process of step 603 shown in FIG. 6, and will not be described in detail herein.
  • the real-time monitoring service module 502 When the real-time monitoring service module 502 receives the first digest value, the real-time monitoring service module 502 performs security authentication on the target object according to the first digest value to obtain an authentication result, and the authentication result is also used to indicate the security status of the target object. . Specifically, the real-time monitoring service module 502 performs security authentication on the target object to obtain an authentication result, which may be implemented by the following step 704.
  • Step 704 The real-time monitoring service module 502 acquires a digital certificate preset for the target object from the security key storage module 504, and verifies whether the digital certificate is legal according to the verification information in the digital certificate.
  • the real-time monitoring service module 502 needs to verify the digital certificate of the target object before determining whether the first digest value and the second digest value are consistent to obtain the authentication result, and if the digital certificate of the target object is legal, The target object is securely authenticated by the following step 705 to obtain an authentication result.
  • the verification information in the digital certificate mainly includes a root public key and a digital signature.
  • the real-time monitoring service module 502 checks whether the digital certificate is legal according to the verification information in the digital certificate.
  • the real-time monitoring service module 502 can determine whether the root public key and the digital signature in the verification information are legal.
  • the real-time monitoring service module 502 determines that the root public key and the digital signature are both legal, it is determined to be the target object.
  • the digital certificate is legal.
  • the real-time monitoring service module 502 determines whether the root public key in the verification information is legal.
  • the real-time monitoring service module 502 determines the hash value of the root public key of the digital certificate of the target object, and determines the target object. Whether the hash value of the root public key of the digital certificate is consistent with the hash value of the pre-stored root public key. If the hash value of the root public key of the digital certificate of the target object does not match the hash value of the pre-stored root public key, it is determined that the root public key is invalid. If the hash value of the root public key of the digital certificate of the determined target object is consistent with the hash value of the pre-stored root public key, it is determined that the root public key is legal.
  • the real-time monitoring service module 502 determines whether the digital signature in the verification information is legal.
  • the process may be: verifying the digital signature in the digital certificate according to the root public key in the digital certificate preset for the target object. When the verification pass is passed, it is determined that the digital signature in the digital certificate is legal; when the verification is not passed, it is determined that the digital signature in the digital certificate is invalid.
  • the method for verifying the digital signature in the digital certificate according to the root public key in the digital certificate may refer to a public key infrastructure (PKI) certificate verification technology, which is not described in detail in this application. .
  • PKI public key infrastructure
  • the pre-stored root public key is usually stored in a One Time Programming (OTP) device of the terminal.
  • OTP One Time Programming
  • An OTP device is a write-once device for storing a root public key, and an OTP device is provided in any terminal that supports secure boot.
  • the digital certificate preset for the target object is included.
  • the software developer sets a corresponding identifier for each object, that is, in the digital certificate, the plurality of items need to be secured.
  • the identifier of the object is used to uniquely identify the object, for example, the identifier of the object may be Object 1, Object 2, Object 3, ..., Object n.
  • Table 1 is a format of a digital certificate provided by an embodiment of the present application.
  • the digital certificate includes a software version of the AI application software corresponding to the AI software system, a root public key of the digital certificate, and identifiers of multiple objects that need to be secured.
  • the implementation process of the real-time monitoring service module 502 acquiring the second digest value preset for the target object from the security key storage module 504 may be: determining, according to the received identifier of the target object, from the digital certificate.
  • the target object's identifier corresponds to the digest value, and the determined digest value determines the second digest value of the target object.
  • the monitoring agent module 501 is When the first summary value is reported to the real-time monitoring service module 502, the identifier of the digital certificate is also reported to the real-time monitoring service module 502.
  • the real-time monitoring service module 502 obtains the digital certificate corresponding to the identifier from the plurality of digital certificates stored by the security key storage module 504 when receiving the identifier of the digital certificate.
  • the digital certificate here is a digital certificate preset for the target object, and the identifier is an identifier of a digital certificate preset for the target object.
  • the correspondence between the digital certificate and the identifier of the digital certificate is stored in the security key storage module 504, and the real-time monitoring service module 502 receives the target object.
  • the identifier of the preset digital certificate is used, according to the correspondence relationship and the received identifier, a digital certificate preset for the target object can be obtained.
  • the AI software system needs to update the information of the stored target object, that is, update the digital certificate of the stored target object.
  • update the digital certificate of the stored target object For the implementation process of updating the digital certificate of the stored target object, reference may be made to step 604 in FIG. 6, which is not described in detail herein.
  • Step 705 When the digital certificate is legal, the real-time monitoring service module 502 acquires a second digest value preset for the target object from the security key storage module 504 in the AI software system, and determines the first digest value and the second digest. Whether the values are consistent to get the certification result.
  • step 705 can refer to the implementation process of step 604 shown in FIG. 6, and will not be described in detail herein.
  • the real-time monitoring service module 502 obtains the digital certificate preset for the target object from the security key storage module 504, and the real-time monitoring service module 502 verifies the digital certificate according to the verification information in the digital certificate. Whether the digital certificate is legal or not, the real-time monitoring service module 502 triggers the operation of step 604 in FIG. 6 above when the digital certificate is legal.
  • the target object may be securely protected by executing a corresponding policy. Specifically, by performing a corresponding policy to secure the target object, the following steps may be performed. 706 and/or step 707 is implemented.
  • Step 706 The real-time monitoring service module 502 secures the target object through the TUI 503 of the AI software system.
  • step 706 can refer to the implementation process of step 605 shown in FIG. 6, and will not be described in detail herein.
  • Step 707 The real-time monitoring service module 502 performs security protection on the target object through the monitoring agent module 501 of the AI software system.
  • step 707 can refer to the implementation process of step 606 shown in FIG. 6, and will not be described in detail herein.
  • the monitoring agent module 501 in the AI software system determines the first digest value of the target object, and reports the first digest value to the real-time monitoring service module 502, and the real-time monitoring service module 502 performs the target object.
  • Security certification to achieve security protection of the target object Since the target object is executed in the REE, the deployment of the software framework that facilitates the software system is relatively concentrated without affecting the security, thereby facilitating the platformization of the AI software system.
  • the key components in the AI software system are implemented in the TEE, and the embodiment of the present application can implement the security protection of the critical component while the key component is placed in the REE.
  • the AI framework body is placed in the REE, so that the AI framework body can fully utilize the rich computing resources of the REE side, and avoid placing the AI framework body in the TEE to affect the computing power of the AI framework body, so as to achieve Ensure the computing power and facilitate platform-based deployment while ensuring the security of the AI software system.
  • the present application further provides a terminal on which the operating system shown in FIG. 2 and the AI software system shown in FIG. 3 or FIG. 4 are deployed.
  • the intelligent dynamic behavior protection system is shown to enable the terminal to perform the determination method of the security state of the AI software system shown in FIG. 6 or FIG. 7 above.
  • FIG. 8 is a schematic structural diagram of a terminal 800 according to an embodiment of the present application.
  • the AI software system shown in FIG. 3 and the intelligent dynamic behavior protection system shown in FIG. 4 can be implemented by the terminal 800 shown in FIG.
  • the terminal includes at least one processor 801, a communication bus 802, a memory 803, and at least one communication interface 804.
  • the processor 801 can be a CPU, a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits for controlling the execution of the program of the present application.
  • ASIC application-specific integrated circuit
  • Communication bus 802 can include a path for communicating information between the components described above.
  • the memory 803 may be a read-only memory (ROM) or other type of static storage device that can store static information and instructions, a random access memory (RAM), or other information that can store information and instructions.
  • ROM read-only memory
  • RAM random access memory
  • Type of dynamic storage device or Electro Scientific Erasable Programmable Read-Only Memory (EEPROM), Compact Disc Read-Only Memory (CD-ROM) or other optical disc storage, optical disc Storage (including compact discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or capable of carrying or storing desired program code in the form of instructions or data structures and capable of being Any other medium accessed by the computer, but is not limited thereto.
  • the memory 803 can exist independently and is coupled to the processor 801 via a communication bus 802.
  • the memory 803 can also be integrated with the processor 801.
  • Communication interface 804 using any type of transceiver, for communicating with other devices or communication networks, such as Ethernet, Radio Access Network (RAN), Wireless Local Area Networks (WLAN), and the like.
  • RAN Radio Access Network
  • WLAN Wireless Local Area Networks
  • the processor 801 may include one or more CPUs, such as a CPU corresponding to the virtual device in FIG. 3 or FIG. 4, and may also include a GPU or a DSP.
  • the terminal described above may be a general purpose computer device or a special purpose computer device.
  • the computer device may be a desktop computer, a portable computer, a network server, a personal digital assistant (PDA), a mobile phone, a tablet computer, a wireless terminal device, a communication device, or an embedded device.
  • PDA personal digital assistant
  • the embodiments of the present application do not limit the type of computer equipment.
  • the memory 803 is used to store program code for executing the above method or software system embodiment scheme of the present application, and is executed by the processor 801.
  • the program code may form the device or AI software system mentioned in the previous embodiment.
  • the memory 803 is used to provide a storage area for each module such as the AI software system shown in FIG. 3 or the secure key storage module 504 in the intelligent dynamic behavior protection system shown in FIG.
  • the processor 801 is configured to execute program code stored in the memory 803.
  • One or more software modules such as those described in FIG. 5 may be included in the program code.
  • the AI software system shown in FIG. 3 or the intelligent dynamic behavior protection system shown in FIG. 4 can determine the security status of the corresponding software system through one or more software modules in the processor 801 and the program code in the memory 803. .
  • the AI software system may be implemented in the form of a computer program product.
  • the computer program product includes one or more computer instructions. When the computer instructions are loaded and executed on a computer, the processes or functions described in accordance with embodiments of the present application are generated in whole or in part.
  • the computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable device.
  • the computer instructions can be stored in a computer readable storage medium or transferred from one computer readable storage medium to another computer readable storage medium, for example, the computer instructions can be from a website site, computer, server or data center Transfer to another website site, computer, server, or data center by wire (eg, coaxial cable, fiber optic, Digital Subscriber Line (DSL)) or wireless (eg, infrared, wireless, microwave, etc.).
  • the computer readable storage medium can be any available media that can be accessed by a computer or a data storage device such as a server, data center, or the like that includes one or more available media.
  • the usable medium may be a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, a digital versatile disc (DVD)), or a semiconductor medium (for example, a solid state disk (SSD)). )Wait.
  • a magnetic medium for example, a floppy disk, a hard disk, a magnetic tape
  • an optical medium for example, a digital versatile disc (DVD)
  • DVD digital versatile disc
  • SSD solid state disk

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • Computer Hardware Design (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Storage Device Security (AREA)

Abstract

本申请公开了一种AI软件系统安全状态的确定方法及装置，属于人工智能技术领域。所述方法包括：AI软件系统中的监控代理模块确定目标对象的第一摘要值，并将第一摘要值上报给实时监控服务模块，由实时监控服务模块对该目标对象进行安全认证，以实现对该目标对象进行安全保护。由于目标对象置于REE中执行，有利于该软件系统的软件框架的部署相对集中，从而利于该AI软件系统的平台化。另外，相对于将关键性部件置于TEE中执行，置于REE的该关键性部件可以充分利用REE侧的丰富的计算资源，从而实现在保证关键性部件计算能力的同时，对该关键性部件进行安全保护。

Description

AI软件系统安全状态的确定方法及装置
本申请要求于2017年06月22日提交中华人民共和国国家知识产权局、申请号为201710481711.9、申请名称为“AI软件系统安全状态的确定方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及人工智能(Article Intelligence，AI)技术领域，特别涉及一种AI软件系统安全状态的确定方法及装置。
背景技术
终端上的操作系统为应用软件在终端上的运行提供平台，也即应用软件通过部署于操作系统各个层次上的模块实现该应用软件的功能，其中，将部署于操作系统各个层次上的模块构成的系统称为该应用软件的软件系统，如AI软件系统。需要说明的是，AI软件在运行过程中通常涉及到用户个人隐私数据的处理，但是目前操作系统的运行环境主要为开放式的富运行环境(Rich executing environment，REE)，导致部署在操作系统内的AI软件系统的关键性部件在进行数据处理的过程中可能面临恶意软件的威胁，因此，实际应用中需确定AI软件系统内的关键性部件的安全状态，也即确定AI软件系统的安全状态，以便于对AI软件系统进行安全保护。
针对REE带来的安全问题，全球平台组织(Global Platform，GP)提出一种可信运行环境(Trusted executing environment，TEE)，也即在操作系统上存在两种并行的运行环境，开放式的REE和相对封闭式的TEE。由于在TEE中执行的程序需要经过TEE的签名和哈希(Hash)校验，因此在TEE中执行的程序可以得到安全保护。所以相关技术中，将AI软件系统内的关键性部件置于TEE中执行，其他部件则置于REE中执行，以通过在TEE中执行的关键性部件的校验结果确定该AI软件系统的安全状态，从而实现对AI软件系统的安全保护。例如，图1为相关技术中的一种基于AI软件框架的AI软件系统，该AI软件系统包括AI框架应用协议接口(Application Programming Interface，API)、模型及关键数据文件、AI框架主体、硬件抽象层(Hardware Abstraction Layer，HAL)、算法支持库、以及中央处理单元(Central Processing Unit，CPU)、图像处理单元(Graphic Processing Unit，GPU)、数字信号处理器(digital signal processing，DSP)等计算加速引擎。其中，模型及关键数据文件和AI框架主体为该AI软件系统的关键性部件，因此可以将模型及关键数据文件和AI框架主体置于TEE中执行，其他部件则置于REE中执行，以实现对基于AI软件框架的AI软件系统的安全保护。然而，将AI软件系统中的关键性部件置于TEE中执行，而其他部件仍置于REE中执行，导致构成该AI软件系统的软件框架的部署相对分散。
发明内容
为了解决相关技术中在对AI软件系统进行安全保护时AI软件系统的软件框架的部署相对分散的问题，本申请提供了一种AI软件系统安全状态的确定方法及装置。所述技术方案如下：
第一方面，提供了一种AI软件系统安全状态的确定方法，所述方法包括：
所述AI软件系统中的监控代理模块确定所述AI软件系统中的目标对象的第一摘要值，所述第一摘要值用于指示所述目标对象的安全认证信息，其中，部署所述AI软件系统的操作系统的运行环境包括富运行环境REE和可信运行环境TEE，所述目标对象和所述监控代理模块置于所述REE中，所述目标对象为所述AI软件系统中部署在所述操作系统上的多个模块中的任一待进行安全认证的模块；
所述监控代理模块将所述第一摘要值上报给所述AI软件系统中的实时监控服务模块，所述实时监控服务模块置于所述TEE中；
所述实时监控服务模块接收所述第一摘要值；
所述实时监控服务模块根据所述第一摘要值，对所述目标对象进行安全认证以得到认证结果，所述认证结果用于指示所述目标对象的安全状态。
在本申请中，将待进行安全认证的目标对象置于REE中，通过置于REE中的监控代理模块和置于TEE中的实时监控服务模块，对目标对象进行安全认证，以对该目标对象进行保护，也即实现对该AI软件系统进行保护。由于目标对象置于REE中执行，在不影响安全性的同时，有利于该软件系统的软件框架的部署相对集中。
可选地，所述实时监控服务模块根据所述第一摘要值，对所述目标对象进行安全认证以得到认证结果，包括：
所述实时监控服务模块从所述AI软件系统中的安全密钥存储模块中获取为所述目标对象预置的第二摘要值，所述安全密钥存储模块置于所述TEE中；
判断所述第一摘要值和所述第二摘要值是否一致以得到认证结果；
如果所述第一摘要值和所述第二摘要值一致，则所述认证结果为所述安全认证通过状态；
如果所述第一摘要值和所述第二摘要值不一致，则所述认证结果为所述安全认证未通过状态。
具体地，在本申请中，实时监控服务模块对目标对象进行安全认证，是通过判断监控代理模块上报的目标对象的第一摘要值和为目标对象预置的第二摘要值是否一致来实现的。
可选地，所述实时监控服务模块从所述AI软件系统中的安全密钥存储模块中获取为所述目标对象预置的第二摘要值之前，还包括：
所述实时监控服务模块从所述安全密钥存储模块中获取为所述目标对象预置的数字证书；
所述实时监控服务模块根据所述数字证书中的校验信息校验所述数字证书是否合法；
当所述数字证书合法时，所述实时监控服务模块触发执行从所述安全密钥存储模块中获取为所述目标对象预置的第二摘要值的操作。
另外，为了进一步地加强目标对象的安全性，实时监控服务模块在判断监控代理模块上报的目标对象的第一摘要值和为目标对象预置的第二摘要值是否一致之前，可以先对为 目标对象预置的数字证书的合法性进行校验。
可选地，所述方法还包括：
所述安全密钥存储模块中存储有多个数字证书，所述监控代理模块在将所述第一摘要值上报给所述实时监控服务模块时，还将所述数字证书的标识上报给所述实时监控服务模块；
相应地，所述实时监控服务模块从所述安全密钥存储模块中获取为所述目标对象预置的数字证书，包括：
所述实时监控服务模块从所述安全密钥存储模块存储的多个数字证书中获取所述标识对应的数字证书。
当安全密钥存储模块中存储有多个数字证书时，为了便于实时监控服务模块从安全密钥存储模块中准确获取到为目标对象预置的数字证书，监控代理模块将目标对象的数字证书的标识也上报给实时监控服务模块，以便于实时监控服务模块根据该目标对象的数字证书的标识，获取为该目标对象预置的数字证书。
可选地，所述实时监控服务模块根据所述第一摘要值，对所述目标对象进行安全认证以得到认证结果之后，还包括：
当所述认证结果为所述安全认证未通过状态时，所述实时监控服务模块向所述AI软件系统中的可信用户界面TUI发送报警请求，所述TUI置于所述TEE中；
所述TUI接收所述报警请求；
所述TUI显示报警信息，所述报警信息用于向用户指示所述目标对象的安全认证未通过。
进一步地，为了便于用户及时了解该AI软件系统的安全状态，当安全认证未通过时，实时监控服务器模块向TUI发送报警请求，以使用户通过该TUI显示的报警信息了解目标对象的安全状态。
可选地，所述实时监控服务模块根据所述第一摘要值，对所述目标对象进行安全认证以得到认证结果之后，还包括：
所述实时监控服务模块将所述认证结果发送给所述监控代理模块。
进一步地，实时监控服务模块在确定出目标对象的认证结果之后，还可以将该认证结果反馈给置于REE中的监控代理模块。
可选地，所述实时监控服务模块将所述认证结果发送给所述监控代理模块之后，还包括：
当所述认证结果为所述安全认证未通过状态时，所述监控代理模块向预设控制模块发送终止请求，所述终止请求用于指示所述预设控制模块终止所述目标对象的进程，所述预设控制模块为部署于所述操作系统中且不属于所述AI软件系统的模块。
进一步地，监控代理模块在接收到实时监控服务器模块反馈的认证结果之后，可以根据该认证结果，执行相应地操作，以对目标对象进行安全保护。
可选地，所述方法还包括：
所述监控代理模块从云端服务器获取升级之后的目标对象的数字证书，所述数字证书包括所述云端服务器对所述目标对象升级之后的数字签名和摘要值；
所述监控代理模块将所述升级之后的目标对象的数字证书发送给所述AI软件系统中的 安全密钥存储模块；
所述安全密钥存储模块将已存储的所述目标对象的数字证书替换为所述升级之后的目标对象的数字证书。
由于升级之后的目标对象的数据可能发生改变，此时，安全密钥存储模块可以通过上述方法对存储的目标对象的数字证书进行更新，以避免后续实时监控服务模块根据升级前的目标对象的摘要值进行安全认证，而导致安全认证未通过。
可选地，所述目标对象包括所述AI软件系统中的模型及关键数据文件。
具体地，对于AI软件系统部署在操作系统的各个模块，其中，模型及关键数据文件比较容易面临恶意软件的威胁，因此，在本申请中，可以将AI软件系统中的模型及关键数据文件作为目标对象，以实现对该AI软件系统中的模型及关键数据文件的安全保护。
第二方面，提供了一种AI软件系统安全状态的确定装置，所述AI软件系统安全状态的确定装置具有实现上述第一方面中AI软件系统安全状态的确定方法行为的功能。所述AI软件系统安全状态的确定装置包括至少一个模块，该至少一个模块用于实现上述第一方面所提供的AI软件系统安全状态的确定方法。
第三方面，提供了一种AI软件系统安全状态的确定装置，所述AI软件系统安全状态的确定装置的结构中包括处理器和存储器，所述存储器用于存储支持AI软件系统安全状态的确定装置执行上述第一方面所提供的AI软件系统安全状态的确定方法的程序，以及存储用于实现上述第一方面所提供的AI软件系统安全状态的确定方法所涉及的数据。所述处理器被配置为用于执行所述存储器中存储的程序。所述存储设备的操作装置还可以包括通信总线，该通信总线用于该处理器与存储器之间建立连接。
第四方面，提供了一种计算机可读存储介质，所述计算机可读存储介质中存储有指令，当其在计算机上运行时，使得计算机执行上述第一方面所述的AI软件系统安全状态的确定方法。
第五方面，提供了一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行上述第一方面所述的AI软件系统安全状态的确定方法。
上述第二方面、第三方面、第四方面和第五方面所获得的技术效果与第一方面中对应的技术手段获得的技术效果近似，在这里不再赘述。
本申请提供的技术方案带来的有益效果是：
在本申请中，AI软件系统中的监控代理模块确定目标对象的第一摘要值，并将第一摘要值上报给实时监控服务模块，由实时监控服务模块对该目标对象进行安全认证，以实现对该目标对象进行安全保护。由于目标对象置于REE中执行，在不影响安全性的同时，有利于该软件系统的软件框架的部署相对集中。
附图说明
图1是相关技术提供的一种基于AI软件框架的AI软件系统示意图；
图2是本申请实施例提供的一种基于Trustzone技术的操作系统的平台架构示意图；
图3是本申请实施例提供的一种AI软件系统示意图；
图4是本申请实施例提供的一种智能动态行为防护系统示意图；
图5是本申请实施例提供的一种AI软件系统安全状态的确定装置框图；
图6是本申请实施例提供的一种AI软件系统安全状态的确定方法流程图；
图7是本申请实施例提供的另一种AI软件系统安全状态的确定方法流程图；
图8是本申请实施例提供的一种终端结构示意图。
具体实施方式
为使本申请的目的、技术方案和优点更加清楚，下面将结合附图对本申请实施方式作进一步地详细描述。
在对本申请实施例进行详细的解释说明之前，先对本申请实施例涉及的名字进行解释说明。
摘要值，是指将指定数据按照预设函数进行计算，得到可以代表该指定数据唯一性的值，得到的值即为该指定数据的摘要值。当该指定数据发生变化时，将变化后的指定数据通过该预设函数重新进行计算，得到变化后的指定数据的摘要值，此时变化后的指定数据的摘要值将和变化前该指定数据的摘要值不一致，因此，摘要值可以用于指示该指定数据的安全认证信息，也即通过该指定数据的摘要值，即可判断该指定数据是否被修改过。其中，该预设函数可以为预设哈希函数，也即将指定数据按照预设哈希函数计算，得到的哈希值称为该指定数据的摘要值。
数字证书，是指互联网通信中用于指示通信双方身份信息的一系列数据，数字证书通常是由权威机构如证书授权(Certificate Authority，CA)中心颁布的。例如，软件开发商在开发一个新的软件之后，CA中心为该软件颁布一个数字证书，以指示该软件的身份信息。
数字签名，是指采用非对称密钥对中的私钥将指定数据的摘要值进行加密，加密之后的信息即为该指定数据的数字签名，接收该数字签名的设备可以采用该非对称密钥对中的公钥对该数字签名进行解密，以得到该指定数据的摘要值。
安全认证，是指用于确定指定对象的安全状态的一种方法，通常对指定对象进行安全认证，也即，验证该指定对象对应的数据是否被修改或篡改过。具体地，可以通过验证该指定对象对应的数据和软件开发商最初发布该指定对象时对应的数据是否一致来实现，也即通过验证该指定对象的完整性来实现对该指定对象的安全认证。
值得注意的是，在本申请中，部署该AI软件系统的操作系统的运行环境包括REE和TEE，因此，在对本申请实施例提供的AI软件系统进行说明之前，先对运行环境包括REE和TEE的操作系统的平台架构进行介绍。
对于运行环境包括REE和TEE的操作系统的平台架构，ARM(Advanced RISC Machines)公司提供一种可信区域(TrustZone)技术，该TrustZone技术用于为终端的操作系统提供一种运行环境包括REE和TEE的平台架构。
图2为本申请实施例提供的基于TrustZone技术的操作系统的平台架构200示意图。如 图2所示，该基于TrustZone技术的操作系统的平台架构200包括安全世界(Secure World)和非安全世界(Normal World)，其中，安全世界对应的运行环境为TEE，非安全世界对应的运行环境为REE。将操作系统上的硬件及软件资源分为安全资源和普通资源，并将安全资源置于安全世界中，将普通资源置于非安全世界中。
下面对本申请实施例提供的AI软件系统的架构进行详细说明。需要说明的是，部署本申请实施例提供的AI软件系统的操作系统为图2所示的操作系统，也即，本申请实施例提供的AI软件系统是基于TrustZone技术的软件系统。
如图3所示，该AI软件系统300包括非安全世界和安全世界，非安全世界的运行环境为REE，图3的左侧系统。安全世界的运行环境为TEE，对应图3中的右侧系统。非安全世界中部署有AI框架API、模型及关键数据文件、AI框架主体、HAL层、算法支持库、第一内核层(Kernel)以及监控代理模块(monitor agent)。安全世界中部署有实时监控服务模块(Real-time monitor service)、可信用户界面(TUI)、TEE内部API和第二内核层(Trust OS kernel)。也即，部署该AI软件系统的操作系统的运行环境包括REE和TEE，且监控代理模块置于REE中，实时监控服务模块置于TEE中，TUI也置于TEE中。
其中，第一内核层中部署有通用CPU、GPU以及DSP等对应的虚拟设备(Virtual devices)和第一通信驱动模块(Communication driver)，第二内核层中部署有第二通信驱动模块和安全密钥存储模块(Key storage)。第一内核层和第二内核层中的各个模块都是驱动软件模块。第一通信驱动模块和第二通信驱动模块用于实现非安全世界和安全世界之间的通信，也即对于非安全世界包括的任一个部件，若该部件欲和安全世界中的部件进行通信，需通过第一通信驱动模块和第二通信驱动模块来实现。
需要说明的是，部署于非安全世界中的AI框架API、模型及关键数据文件、AI框架主体、HAL层、算法支持库以及第一内核层和图1所示的相关技术的软件系统中对应的部件完全相同，也即，在本申请实施例中，将图1所示的AI软件系统中包括各个的部件均置于REE中。也即，相对于图1所示的AI软件系统，图3所示的AI软件系统可以没有改变该AI软件系统的软件框架的部署，只是在图1所示的AI软件系统的基础上，新增了监控代理模块、实时监控服务模块、安全密钥存储模块、TUI和第一通信驱动模块和第二通信驱动模块。
由于将图1所示的AI软件系统中包括各个的部件均置于REE中，因此，需对图1所示的AI软件系统中的关键性部件进行安全保护，为了后续便于说明，将该AI软件系统中部署在操作系统上的多个模块中的任一需进行安全认证的模块称为目标对象，且目标对象置于REE中。
其中，对目标对象进行安全保护是通过部署于非安全世界中的监控代理模块和部署于安全世界中的实时监控服务模块来实现的，也即，监控代理模块和实时监控服务模块用于对目标对象进行安全保护。具体地，通过监控代理模块和实时监控服务模块对该目标对象进行安全保护的实现过程将在下面提供的实施例进行详细说明，在此先不做详细介绍。
另外，部署于安全世界中的TUI用于显示目标对象的安全状态。部署于安全世界中的安全密钥存储模块用于存储对目标对象进行安全认证所需的信息，如目标对象的摘要值。部署于安全世界中的TEE内部API用于为非安全世界与安全世界之间进行通信提供接口。
如图3所示，相对于相关技术中将AI软件系统中的关键性部件置于TEE中执行，本申请实施例提供的AI软件系统的软件框架的部署相对集中，从而利于该AI软件系统的平台化。另外，相对于相关技术中将AI软件系统中的关键性部件置于TEE中执行，本申请实施例可以实现在对该关键性部件进行安全保护的同时将该关键性部件置于REE中执行，如将AI框架主体置于REE中执行，以便于该关AI框架主体充分利用REE侧的丰富的计算资源，避免将AI框架主体置于TEE中而影响该AI框架主体的计算能力，以实现在保证计算能力和有利于平台化部署化的同时，保证该AI软件系统的安全性。
例如，该AI软件为智能动态行为防护软件时，本申请实施例基于上述图3所示的AI软件系统，还提供了一种智能动态行为防护系统，下述实施例将对该智能动态行为防护系统的架构进行详细说明。
图4是本申请实施例提供的一种智能动态行为防护系统400的示意图，如图4所示，该智能动态行为防护系统同样包括非安全世界和安全世界，非安全世界的运行环境为REE，安全世界的运行环境为TEE。非安全世界中部署有应用程序框架(Application framework)、运行时库(Runtime libraries)、浏览器引擎(WEBKIT)、观察器(Observer)、模型文件(Model File)、类库和二进制文件(Bin & lib files)、分析器(Analyzer)，监控代理模块和第一内核层。安全世界中部署有实时监控服务模块、TUI、TEE内部API和第二内核层。
其中，第一内核层中部署的模块和图3所示的AI软件系统中的第一内核层中部署的模块相同，在此不再详细说明。第二内核层中部署的模块和图3所示的AI软件系统中的第二内核层中部署的模块相同，在此同样不再详细说明。
需要说明的是，部署于非安全世界中的应用程序框架、运行时库、浏览器引擎(WEBKIT)、观察器、模型文件、类库和二进制文件、分析器和第一内核层和现有的智能动态行为防护系统中对应的部件完全相同，可参考相关技术关于相关模块的功能描述。也即，在本申请实施例中，将现有的智能动态行为防护系统中包括各个的部件均置于REE中，然后在现有的智能动态行为防护系统的基础上，新增监控代理模块、实时监控服务模块、安全密钥存储模块、TUI、第一通信驱动模块和第二通信驱动模块，以对部署在非安全世界中的任一部件进行安全保护。
也即，在图4所示的智能动态行为防护系统中，该目标对象可以为类库和二进制文件以及模型文件中的任一个，也可以同时包括该类库和二进制文件以及模型文件。
其中，通过图4所示的智能动态行为防护系统对目标对象进行安全保护的方式，可以参考通过图3所示的AI软件系统对目标对象进行安全保护的方式，在此不再详细说明。
基于图3所示的AI软件系统以及图4所示的智能动态行为防护系统，本申请实施例提供了一种AI软件系统安全状态的确定装置500，如图5所示，该AI软件系统安全状态的确定装置500包括监控代理模块501，实时监控服务模块502、TUI503和安全密钥存储模块504，这些模块分别对应图3或图4中的对应模块。因此，图5的装置500可以等效为是图3或图4中软件系统的一部分。
其中，监控代理模块501为上述图3所示的AI软件系统或上述图4所示的智能动态行为防护系统中的监控代理模块。实时监控服务模块502为上述图3所示的AI软件系统或上 述图4所示的智能动态行为防护系统中的实时监控服务模块。TUI503为上述图3所示的AI软件系统或上述图4所示的智能动态行为防护系统中的TUI。安全密钥存储模块504为上述图3所示的AI软件系统或上述图4所示的智能动态行为防护系统中的安全密钥存储模块。
具体地，监控代理模块501、实时监控服务模块502、TUI503和安全密钥存储模块504用于执行下述实施例中对应的步骤，也即监控代理模块501、实时监控服务模块502、TUI503和安全密钥存储模块504通过执行下述实施例中的对应的步骤，为本申请实施例提供一种AI软件系统安全状态的确定方法。所以，在此对该监控代理模块501、实时监控服务模块502、TUI503和安全密钥存储模块504的功能先不详细阐述。
需要说明的是，该AI软件系统安全状态的确定装置在进行AI软件系统安全状态的确定时，仅以上述各功能模块的划分进行举例说明，实际应用中，可以根据需要而将上述功能分配由不同的功能模块完成，以完成对应的功能。另外，该AI软件系统安全状态的确定装置与下述AI软件系统安全状态的确定方法实施例属于同一构思，其具体实现过程详见下述方法实施例，这里不再赘述。
接下来对图5所示的AI软件系统安全状态的确定装置进行AI软件系统安全状态的确定过程进行详细说明。也即，下述实施例提供的AI软件系统安全状态的确定方法为基于图5所示的AI软件系统安全状态的确定装置的方法。
需要说明的是，在本申请实施例中，实时监控服务模块对目标对象进行安全认证可以通过以下两种方式实现，一是直接根据该目标对象的第一摘要值对目标对象进行安全认证，二是同时根据目标对象的第一摘要值和为目标对象预置的数字证书对目标对象进行安全认证。接下来的实施例将分别对这两种情况进行详细说明。
图6是本申请实施例提供了一种AI软件系统安全状态确定方法，该方法应用于图5所示的AI软件系统安全状态的确定装置500，且该方法用于实时监控服务模块502直接根据该目标对象的第一摘要值对目标对象进行安全认证的场景中，参见图6，该方法包括以下步骤。
步骤601：AI软件系统中的监控代理模块501确定该AI软件系统中的目标对象的第一摘要值。
其中，第一摘要值用于指示目标对象的安全认证信息，也即，通过第一摘要值可以判断目标对象是否被修改过。另外，目标对象是指AI软件系统中部署在操作系统上的多个模块中的任一待进行安全认证的模块。
在一种可能的实现方式中，确定目标对象的第一摘要值的实现方式可以为：监控代理模块501确定目标对象的数据，并根据预设哈希函数对该目标对象的数据进行哈希计算，得到该目标对象的哈希值，将该目标对象的哈希值确定为该目标对象的第一摘要值。
需要说明的是，在本申请实施例中，监控代理模块501也可以通过其他方式确定该目标对象的摘要值，只要保证得到的摘要值可以用于判断目标对象是否被修改过即可。
另外，监控代理模块501确定目标对象的第一摘要值的时机可以分为以下二种情况。
(1)为了避免监控代理模块501实时确定目标对象的数据导致需处理的数据过于庞大，监控代理模块501可以周期性确定目标对象的数据，也即周期性地确定目标对象的第一摘要值，也即监控代理模块501每隔预设周期确定目标对象的数据。该预设时间周期为预先 设置的时间周期。
(2)监控代理模块501在接收到针对目标对象的安全认证指令时，确定目标对象的第一摘要值。其中，针对目标对象的安全认证指令可以由用户通过预设操作触发，也即用户可以通过预设操作主动发起对目标对象的安全认证。另外，该针对目标对象的安全认证指令也可以由监控代理模块501在检测到该AI软件系统对应的AI应用软件存在业务异常时触发，还可以由监控代理模块501在检测到该AI软件系统对应的AI应用软件进行升级时触发。
需要说明的是，对于图3所示的AI软件系统，部署于非安全世界中的模型及关键数据文件通常为该AI软件系统中的关键性部件，因此可以将该模型及关键数据文件设置为目标对象。当然，在本申请实施例中，该目标对象也可以为该AI软件系统中的其他部件，在此不做具体限定。
具体地，对于图4所示的智能动态行为防护系统，该目标对象可以为类库和二进制文件以及模型文件中的至少一个。
步骤602：监控代理模块501将第一摘要值上报给该AI软件系统中的实时监控服务模块502。
由于在TEE中执行的程序需进行安全认证，因此为了确定该目标对象的安全状态，监控代理模块501在确定出该目标对象的第一摘要值之后，可以将该第一摘要值上报给置于TEE中的实时监控服务模块502，以便于实时监控服务模块502对该目标对象进行安全认证。
具体地，如图3或图4所示，监控代理模块501通过部署于第一内核层中第一通信驱动模块和部署于第二内核层中的第二通信驱动模块将该第一摘要值上报给实时监控服务模块502。
另外，监控代理模块501在将第一摘要值上报给实时监控服务模块502时，还可以将该目标对象的标识上报给实时监控服务模块502。其中，监控代理模块501将该目标对象的标识上报给实时监控服务模块502的实现过程和监控代理模块501将第一摘要值上报给实时监控服务模块502的实现过程基本相同。
步骤603：实时监控服务模块502接收该第一摘要值。
实时监控服务模块502接收TEE内部API发送的第一摘要值，实现监控代理模块501将目标对象的第一摘要值上报给实时监控服务模块502。
当监控代理模块501将该目标对象的标识上报给实时监控服务模块502时，实时监控服务模块502还接收到TEE内部API发送的该目标对象的标识。
当实时监控服务模块502接收到该第一摘要值时，实时监控服务模块502根据该第一摘要值，对目标对象进行安全认证以得到认证结果，该认证结果用于指示目标对象的安全状态。具体地，实时监控服务模块502对该目标对象进行安全认证以得到认证结果可以通过下述步骤604来实现。
步骤604：实时监控服务模块502从AI软件系统中的安全密钥存储模块504中获取为目标对象预置的第二摘要值，判断第一摘要值和第二摘要值是否一致以得到认证结果。
在判断第一摘要值和第二摘要值是否一致以得到认证结果之后，如果第一摘要值和第二摘要值一致，则该认证结果为安全认证通过状态；如果第一摘要值和第二摘要值不一致，则该认证结果为安全认证未通过状态。也即，判断第一摘要值和第二摘要值是否一致以得 到认证结果，具体可以为：如果第一摘要值和第二摘要值一致，则该认证结果为安全认证通过状态，也即确定该AI软件系统为安全状态；如果第一摘要值和第二摘要值不一致，则该认证结果为安全认证未通过状态，也即确定该AI软件系统为不安全状态。
其中，实时监控服务模块502在得到认证结果之后，可以采用布尔变量记录该认证结果，也即，当该认证结果为安全认证通过状态时，记录该认证结果为1，当该认证结果为安全认证未通过状态时，记录该认证结果为0。
另外，第二摘要值是预先在安全密钥存储模块504中为目标对象配置的摘要值，也即该第二摘要值是为目标对象预置的摘要值。
需要说明的是，为目标对象预置的第二摘要值通常存储在为目标对象预置的数字证书中，也即为目标对象预置的数字证书包括为目标对象预置的第二摘要值。
值得注意的是，在初次安装该AI软件系统对应的AI应用软件之后，由于软件开发商可能会升级该AI应用软件，而在升级该AI应用软件的过程中，该目标对象的数据可能会被更改，因此，为了避免后续实时监控服务模块502仍根据升级前的目标对象的信息进行安全认证，而导致安全认证未通过，该AI软件系统需对存储的目标对象的信息进行更新。
当为目标对象预置的第二摘要值存储在目标对象的数字证书中时，该AI软件系统需对存储的目标对象的信息进行更新的实现过程可以为：监控代理模块501从云端服务器获取升级之后的目标对象的数字证书，该数字证书包括该云端服务器对该目标对象升级之后的数字签名和摘要值，也即该数字证书为根据升级之后的目标对象的数据确定的数字证书。监控代理模块501将该升级之后的目标对象的数字证书发送给该AI软件系统中的安全密钥存储模块504。安全密钥存储模块504将已存储的该目标对象的数字证书替换为该升级之后的目标对象的数字证书。
可选地，实时监控服务模块502在对目标对象进行安全认证之后，还可以通过执行相应的策略对目标对象进行安全保护，具体地，通过执行相应的策略对目标对象进行安全保护可以通过下述步骤605和/或步骤606来实现。
步骤605：实时监控服务模块502通过AI软件系统的TUI503对目标对象进行安全保护。
具体地，当该认证结果为安全认证未通过状态时，实时监控服务模块502向AI软件系统中的TUI503发送报警请求，TUI503接收该报警请求并显示报警信息，该报警信息用于向用户指示该目标对象的安全认证未通过。
当然，实时监控服务模块502也可以直接将该认证结果发送给TUI503。当TUI503接收到该认证结果时，根据该认证结果执行相应的操作。也即，当该认证结果为安全认证未通过状态时，TUI503显示该报警信息；当该认证结果为安全认证通过状态时，显示该认证结果，以使用户了解当前目标对象为安全状态。
另外，TUI503在接收到该认证结果时，也可以采用预设标识显示该认证结果。也即，当该认证结果为安全认证未通过状态时，采用第一预设标识显示该认证结果，当认证结果为安全认证通过状态时，采用第二预设标识显示该认证结果。例如，当该认证结果为安全认证未通过状态时，采用红灯标识显示该认证结果，当认证结果为安全认证通过状态时，采用绿灯标识显示该认证结果。
需要说明的是，当实时监控服务模块502采用布尔变量记录该认证结果时，实时监控 服务模块502向TUI503发送的认证结果是采用布尔变量记录的认证结果。也即，当TUI503接收到实时监控服务模块502发送的认证结果时，当该认证结果为1时，TUI503确定该认证结果为安全认证通过状态，当该认证结果为0时，TUI503确定该认证结果为安全认证未通过状态。
步骤606：实时监控服务模块502通过AI软件系统的监控代理模块501对目标对象进行安全保护。
实时监控服务模块502在得到该认证结果之后，实时监控服务模块502可以将该认证结果发送给监控代理模块501，也即实时监控服务模块502通过部署于第二内核层中第二通信驱动模块和部署于第一内核层中的第一通信驱动模块将该认证结果发送至监控代理模块501。
监控代理模块501在接收到实时监控服务模块502反馈的认证结果时，当该认证结果为安全认证未通过状态时，监控代理模块501可以通过预设操作对该目标对象进行安全保护。其中，该预设操作可以为：监控代理模块501向预设控制模块发送终止请求，该终止请求用于指示该预设控制模块终止该目标对象的进程，该预设控制模块为部署于该操作系统中且不属于该AI软件系统的模块。当预设控制模块接收到该终止请求时，终止当前目标对象的进程，以对该目标对象进行安全保护。
另外，当预设控制模块接收到该终止请求时，还可以执行卸载该目标对象的操作，以对该目标对象进行安全保护。
同样需要说明的是，当实时监控服务模块502采用布尔变量记录该认证结果时，实时监控服务模块502向监控代理模块501反馈的认证结果也是采用布尔变量记录的认证结果。
在本申请实施例中，AI软件系统中的监控代理模块501确定目标对象的第一摘要值，并将第一摘要值上报给实时监控服务模块502，由实时监控服务模块502对该目标对象进行安全认证，以实现对该目标对象进行安全保护。由于目标对象置于REE中执行，在不影响安全性的同时，有利于该软件系统的软件框架的部署相对集中，从而利于该AI软件系统的平台化。另外，相对于相关技术中将AI软件系统中的关键性部件置于TEE中执行，本申请实施例可以实现在对该关键性部件进行安全保护的同时将该关键性部件置于REE中执行，如将AI框架主体置于REE中执行，以便于该AI框架主体充分利用REE侧的丰富的计算资源，避免将AI框架主体置于TEE中而影响该AI框架主体的计算能力，以实现在保证计算能力和有利于平台化部署化的同时，保证该AI软件系统的安全性。
图7是本申请实施例提供了另一种AI软件系统安全状态确定方法，该方法应用于图5所示的AI软件系统安全状态的确定装置，且该方法用于实时监控服务模块502根据目标对象的第一摘要值和为目标对象预置的数字证书对目标对象进行安全认证的场景中，参见图7，该方法包括以下步骤。
步骤701：AI软件系统中的监控代理模块501确定该AI软件系统中的目标对象的第一摘要值。
其中，步骤701的实现过程可以参考图6所示的步骤601的实现过程，在此不再详细阐述。
步骤702：监控代理模块501将第一摘要值上报给该AI软件系统中的实时监控服务模 块502。
其中，步骤702的实现过程可以参考图6所示的步骤602的实现过程，在此不再详细阐述。
步骤703：实时监控服务模块502接收该第一摘要值。
其中，步骤703的实现过程可以参考图6所示的步骤603的实现过程，在此不再详细阐述。
当实时监控服务模块502接收到该第一摘要值时，实时监控服务模块502根据该第一摘要值，对目标对象进行安全认证以得到认证结果，该认证结果同样用于指示目标对象的安全状态。具体地，实时监控服务模块502对该目标对象进行安全认证以得到认证结果可以通过下述步骤704来实现。
步骤704：实时监控服务模块502从安全密钥存储模块504中获取为目标对象预置的数字证书，并根据该数字证书中的校验信息校验该数字证书是否合法。
也即，实时监控服务模块502在判断第一摘要值和第二摘要值是否一致以得到认证结果之前，需先对目标对象的数字证书进行验证，在目标对象的数字证书合法的情况下，再通过下述步骤705对目标对象进行安全认证以得到认证结果。
其中，数字证书中的校验信息主要包括根公钥(root public key)和数字签名，此时，实时监控服务模块502根据该数字证书中的校验信息校验该数字证书是否合法的实现过程可以为：实时监控服务模块502分别判断校验信息中的根公钥和数字签名是否合法，当实时监控服务模块502确定该根公钥和该数字签名均合法时，则确定为该目标对象预置的数字证书合法。
其中，实时监控服务模块502判断校验信息中的根公钥是否合法的实现过程可以为：实时监控服务模块502确定目标对象的数字证书的根公钥的哈希值，并判断该目标对象的数字证书的根公钥的哈希值和预先存储的根公钥的哈希值是否一致。如果该目标对象的数字证书的根公钥的哈希值和该预先存储的根公钥的哈希值不一致，则确定该根公钥不合法。如果该确定的目标对象的数字证书的根公钥的哈希值和该预先存储的根公钥的哈希值一致，则确定该根公钥合法。
实时监控服务模块502判断校验信息中的数字签名是否合法的实现过程可以为：根据为目标对象预置的数字证书中的根公钥，对该数字证书中的数字签名进行验签。当验签通过时，确定该数字证书中的数字签名合法；当验签不通过时，确定该数字证书中的数字签名不合法。其中，根据数字证书中的根公钥，对该数字证书中的数字签名进行验签可以参考公钥基础设施(Public Key Infrastructure，PKI)证书验签技术，本申请实施例在此不做详细介绍。
其中，预先存储的根公钥通常存储在终端的一次性写入(One Time Programming，OTP)设备中。OTP设备为用于存储根公钥的一种一次性写入设备，在任何支持安全启动的终端中都设置有OTP设备。
值得注意的是，实际应用中，软件开发商通常为一个应用软件预置一个数字证书，但是一个应用软件中可能存在多个需要进行安全保护的对象，因此，为目标对象预置的数字证书中可能存在为其他对象预置的摘要值，为了区分为不同对象预置的摘要值，软件开发商为每个对象设置有对应的标识，也即在数字证书中，存储有该多个需要进行安全保护的 对象的标识和为每个对象预置的摘要值。其中，对象的标识用于唯一标识该对象，例如该对象的标识可以为对象1、对象2、对象3、…、对象n。
例如，表1为本申请实施例提供的一种数字证书的格式。如表1所示，该数字证书包括该AI软件系统对应的AI应用软件的软件版本号(software version)，该数字证书的根公钥，多个需要进行安全保护的对象的标识和为每个需要进行安全保护的对象预置的哈希值，对该数字证书的数字签名等多个信息，以及该多个信息中每个信息的长度。
表1
信息名称 信息长度
软件版本号 32
根公钥 2048
… …
对象1的哈希值 256
对象2的哈希值 256
… …
对象n的哈希值 256
数字签名 2048
此时，实时监控服务模块502从安全密钥存储模块504中获取为目标对象预置的第二摘要值的实现过程可以为，根据接收到的该目标对象的标识，从该数字证书中确定与该目标对象的标识对应的摘要值，并将确定的摘要值确定该目标对象的第二摘要值。
另外，当安全密钥存储模块504中存储有多个数字证书时，为了便于实时监控服务模块502从该多个数字证书中准确获取为该目标对象预置的数字证书，监控代理模块501在将第一摘要值上报给实时监控服务模块502时，还将该数字证书的标识上报给实时监控服务模块502。实时监控服务模块502在接收到该数字证书的标识时，从安全密钥存储模块504存储的多个数字证书中获取该标识对应的数字证书。其中，此处的数字证书是为该目标对象预置的数字证书，标识是为该目标对象预置的数字证书的标识。
也即，对于该多个数字证书中的每个数字证书，在安全密钥存储模块504中存储有该数字证书和该数字证书的标识的对应关系，当实时监控服务模块502接收到为目标对象预置的数字证书的标识时，根据该对应关系和接收到的标识，可以获取为目标对象预置的数字证书。
同样值得注意的是，该AI软件系统需对存储的目标对象的信息进行更新，也即对存储的目标对象的数字证书进行更新。其中对存储的目标对象的数字证书进行更新的实现过程可以参考图6中的步骤604，在此不再详细说明。
步骤705：当该数字证书合法时，该实时监控服务模块502从AI软件系统中的安全密钥存储模块504中获取为目标对象预置的第二摘要值，判断第一摘要值和第二摘要值是否一致以得到认证结果。
其中，步骤705的实现过程可以参考图6所示的步骤604的实现过程，在此不再详细阐述。
也即，在本申请实施例中，实时监控服务模块502从安全密钥存储模块504中获取为目标对象预置的数字证书，实时监控服务模块502根据该数字证书中的校验信息校验该数 字证书是否合法，当该数字证书合法时，该实时监控服务模块502触发执行上述图6中的步骤604的操作。
同样地，实时监控服务模块502在对目标对象进行安全认证之后，还可以通过执行相应的策略对目标对象进行安全保护，具体地，通过执行相应的策略对目标对象进行安全保护可以通过下述步骤706和/或步骤707来实现。
步骤706：实时监控服务模块502通过AI软件系统的TUI503对目标对象进行安全保护。
其中，步骤706的实现过程可以参考图6所示的步骤605的实现过程，在此不再详细阐述。
步骤707：实时监控服务模块502通过AI软件系统的监控代理模块501对目标对象进行安全保护。
其中，步骤707的实现过程可以参考图6所示的步骤606的实现过程，在此不再详细阐述。
在本申请实施例中，AI软件系统中的监控代理模块501确定目标对象的第一摘要值，并将第一摘要值上报给实时监控服务模块502，由实时监控服务模块502对该目标对象进行安全认证，以实现对该目标对象进行安全保护。由于目标对象置于REE中执行，在不影响安全性的同时，有利于该软件系统的软件框架的部署相对集中，从而利于该AI软件系统的平台化。另外，相对于相关技术中将AI软件系统中的关键性部件置于TEE中执行，本申请实施例可以实现在对该关键性部件进行安全保护的同时将该关键性部件置于REE中执行，如将AI框架主体置于REE中执行，以便于该关AI框架主体充分利用REE侧的丰富的计算资源，避免将AI框架主体置于TEE中而影响该AI框架主体的计算能力，以实现在保证计算能力和有利于平台化部署化的同时，保证该AI软件系统的安全性。
本申请除了提供上述实施例中的AI软件系统和智能动态行为防护系统，还提供一种终端，该终端上部署有图2所示的操作系统，以及图3所示的AI软件系统或图4所示的智能动态行为防护系统，以使该终端可以执行上述图6或图7所示的AI软件系统安全状态的确定方法。
图8是本申请实施例提供的一种终端800结构示意图。图3所示AI软件系统和图4所示的智能动态行为防护系统可以通过图8所示的终端800来实现。参见图8，该终端包括至少一个处理器801，通信总线802，存储器803以及至少一个通信接口804。
处理器801可以是一个CPU，微处理器，特定应用集成电路(application-specific integrated circuit，ASIC)，或一个或多个用于控制本申请方案程序执行的集成电路。
通信总线802可包括一通路，在上述组件之间传送信息。
存储器803可以是只读存储器(read-only memory，ROM)或可存储静态信息和指令的其它类型的静态存储设备，随机存取存储器(random access memory，RAM))或者可存储信息和指令的其它类型的动态存储设备，也可以是电可擦可编程只读存储器(Electrically Erasable Programmable Read-Only Memory，EEPROM)、只读光盘(Compact Disc Read-Only Memory，CD-ROM)或其它光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其它磁存储设备、或者能够用于携带或存储具有 指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其它介质，但不限于此。存储器803可以是独立存在，通过通信总线802与处理器801相连接。存储器803也可以和处理器801集成在一起。
通信接口804，使用任何收发器一类的装置，用于与其它设备或通信网络通信，如以太网，无线接入网(RAN)，无线局域网(Wireless Local Area Networks，WLAN)等。
在具体实现中，作为一种实施例，处理器801可以包括一个或多个CPU，例如图3或图4中的虚拟设备对应的CPU，也可以包括GPU或DSP等。
上述的终端可以是一个通用计算机设备或者是一个专用计算机设备。在具体实现中，计算机设备可以是台式机、便携式电脑、网络服务器、掌上电脑(Personal Digital Assistant，PDA)、移动手机、平板电脑、无线终端设备、通信设备或者嵌入式设备。本申请实施例不限定计算机设备的类型。
其中，存储器803用于存储执行本申请以上方法或软件系统实施例方案的程序代码，并由处理器801来执行。该程序代码可以形成之前实施例所提到的装置或AI软件系统。例如，存储器803用于为图3中所示的AI软件系统或图4所示的智能动态行为防护系统中的安全密钥存储模块504等各个模块提供存储区域。处理器801用于执行存储器803中存储的程序代码。该程序代码中可以包括例如如图5所述的一个或多个软件模块。图3中所示的AI软件系统或图4所示的智能动态行为防护系统可以通过处理器801以及存储器803中的程序代码中的一个或多个软件模块，来确定对应的软件系统的安全状态。
在上述实施例中，AI软件系统的全部或部分都可以以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如：同轴电缆、光纤、数据用户线(Digital Subscriber Line，DSL))或无线(例如：红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质(例如：软盘、硬盘、磁带)、光介质(例如：数字通用光盘(Digital Versatile Disc，DVD))、或者半导体介质(例如：固态硬盘(Solid State Disk，SSD))等。
以上所述为本申请提供的实施例，并不用以限制本申请，凡在本申请的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本申请的保护范围之内。

Claims (18)

  1. 一种人工智能AI软件系统安全状态的确定方法，其特征在于，所述方法包括：
    所述AI软件系统中的监控代理模块确定所述AI软件系统中的目标对象的第一摘要值，所述第一摘要值用于指示所述目标对象的安全认证信息，其中，部署所述AI软件系统的操作系统的运行环境包括富运行环境REE和可信运行环境TEE，所述目标对象和所述监控代理模块置于所述REE中，所述目标对象为所述AI软件系统中部署在所述操作系统上的多个模块中的任一待进行安全认证的模块；
    所述监控代理模块将所述第一摘要值上报给所述AI软件系统中的实时监控服务模块，所述实时监控服务模块置于所述TEE中；
    所述实时监控服务模块接收所述第一摘要值；
    所述实时监控服务模块根据所述第一摘要值，对所述目标对象进行安全认证以得到认证结果，所述认证结果用于指示所述目标对象的安全状态。
  2. 如权利要求1所述的方法，其特征在于，所述实时监控服务模块根据所述第一摘要值，对所述目标对象进行安全认证以得到认证结果，包括：
    所述实时监控服务模块从所述AI软件系统中的安全密钥存储模块中获取为所述目标对象预置的第二摘要值，所述安全密钥存储模块置于所述TEE中；
    判断所述第一摘要值和所述第二摘要值是否一致以得到认证结果；
    如果所述第一摘要值和所述第二摘要值一致，则所述认证结果为所述安全认证通过状态；
    如果所述第一摘要值和所述第二摘要值不一致，则所述认证结果为所述安全认证未通过状态。
  3. 如权利要求2所述的方法，其特征在于，所述实时监控服务模块从所述AI软件系统中的安全密钥存储模块中获取为所述目标对象预置的第二摘要值之前，还包括：
    所述实时监控服务模块从所述安全密钥存储模块中获取为所述目标对象预置的数字证书；
    所述实时监控服务模块根据所述数字证书中的校验信息校验所述数字证书是否合法；
    当所述数字证书合法时，所述实时监控服务模块触发执行从所述安全密钥存储模块中获取为所述目标对象预置的第二摘要值的操作。
  4. 如权利要求3所述的方法，其特征在于，所述方法还包括：
    所述安全密钥存储模块中存储有多个数字证书，所述监控代理模块在将所述第一摘要值上报给所述实时监控服务模块时，还将所述数字证书的标识上报给所述实时监控服务模块；
    相应地，所述实时监控服务模块从所述安全密钥存储模块中获取为所述目标对象预置的数字证书，包括：
    所述实时监控服务模块从所述安全密钥存储模块存储的多个数字证书中获取所述标识对应的数字证书。
  5. 如权利要求1至4任一所述的方法，其特征在于，所述实时监控服务模块根据所述第一摘要值，对所述目标对象进行安全认证以得到认证结果之后，还包括：
    当所述认证结果为所述安全认证未通过状态时，所述实时监控服务模块向所述AI软件系统中的可信用户界面TUI发送报警请求，所述TUI置于所述TEE中；
    所述TUI接收所述报警请求；
    所述TUI显示报警信息，所述报警信息用于向用户指示所述目标对象的安全认证未通过。
  6. 如权利要求1至5任一所述的方法，其特征在于，所述实时监控服务模块根据所述第一摘要值，对所述目标对象进行安全认证以得到认证结果之后，还包括：
    所述实时监控服务模块将所述认证结果发送给所述监控代理模块。
  7. 如权利要求6所述的方法，其特征在于，所述实时监控服务模块将所述认证结果发送给所述监控代理模块之后，还包括：
    当所述认证结果为所述安全认证未通过状态时，所述监控代理模块向预设控制模块发送终止请求，所述终止请求用于指示所述预设控制模块终止所述目标对象的进程，所述预设控制模块为部署于所述操作系统中且不属于所述AI软件系统的模块。
  8. 如权利要求1至7任一所述的方法，其特征在于，所述方法还包括：
    所述监控代理模块从云端服务器获取升级之后的目标对象的数字证书，所述数字证书包括所述云端服务器对所述目标对象升级之后的数字签名和摘要值；
    所述监控代理模块将所述升级之后的目标对象的数字证书发送给所述AI软件系统中的安全密钥存储模块；
    所述安全密钥存储模块将已存储的所述目标对象的数字证书替换为所述升级之后的目标对象的数字证书。
  9. 如权利要求1至8任一所述的方法，其特征在于，所述目标对象包括所述AI软件系统中的模型及关键数据文件。
  10. 一种人工智能AI软件系统安全状态的确定装置，其特征在于，所述装置包括：监控代理模块和实时监控服务模块；
    所述监控代理模块，用于确定所述AI软件系统中的目标对象的第一摘要值，并将所述第一摘要值上报给所述实时监控服务模块，所述第一摘要值用于指示所述目标对象的安全认证信息，其中，部署所述AI软件系统的操作系统的运行环境包括富运行环境REE和可信运行环境TEE，所述目标对象和所述监控代理模块置于所述REE中，所述目标对象为所述AI软件系统中部署在所述操作系统上的多个模块中的任一待进行安全认证的模块，所述实时监控服务模块置于所述TEE中；
    所述实时监控服务模块，用于接收所述第一摘要值，并根据所述第一摘要值，对所述目标对象进行安全认证以得到认证结果，所述认证结果用于指示所述目标对象的安全状态。
  11. 如权利要求10所述的装置，其特征在于，所述实时监控服务模块，具体用于：
    从所述AI软件系统中的安全密钥存储模块中获取为所述目标对象预置的第二摘要值，所述安全密钥存储模块置于所述TEE中；
    判断所述第一摘要值和所述第二摘要值是否一致以得到认证结果；
    如果所述第一摘要值和所述第二摘要值一致，则所述认证结果为所述安全认证通过状态；
    如果所述第一摘要值和所述第二摘要值不一致，则所述认证结果为所述安全认证未通过状态。
  12. 如权利要求11所述的装置，其特征在于，所述实时监控服务模块，还用于：
    从所述安全密钥存储模块中获取为所述目标对象预置的数字证书；
    根据所述数字证书中的校验信息校验所述数字证书是否合法；
    当所述数字证书合法时，触发执行从所述安全密钥存储模块中获取为所述目标对象预置的第二摘要值的操作。
  13. 如权利要求12所述的装置，其特征在于，
    所述安全密钥存储模块中存储有多个数字证书，所述监控代理模块，还用于在将所述第一摘要值上报给所述实时监控服务模块时，还将所述数字证书的标识上报给所述实时监控服务模块；
    相应地，所述实时监控服务模块，具体用于：从所述安全密钥存储模块存储的多个数字证书中获取所述标识对应的数字证书。
  14. 如权利要求10至13任一所述的装置，其特征在于，
    所述实时监控服务模块，还用于当所述认证结果为所述安全认证未通过状态时，向所述AI软件系统中的可信用户界面TUI发送报警请求，所述TUI置于所述TEE中；
    所述TUI，用于接收所述报警请求，显示报警信息，所述报警信息用于向用户指示所述目标对象的安全认证未通过。
  15. 如权利要求10至14任一所述的装置，其特征在于，所述实时监控服务模块，还用于将所述认证结果发送给所述监控代理模块。
  16. 如权利要求6所述的装置，其特征在于，所述监控代理模块，还用于：
    当所述认证结果为所述安全认证未通过状态时，向预设控制模块发送终止请求，所述终止请求用于指示所述预设控制模块终止所述目标对象的进程，所述预设控制模块为部署于所述操作系统中且不属于所述AI软件系统的模块。
  17. 如权利要求10至16任一所述的装置，其特征在于，所述监控代理模块，还用于：
    从云端服务器获取升级之后的目标对象的数字证书，所述数字证书包括所述云端服务器对所述目标对象升级之后的数字签名和摘要值；
    将所述升级之后的目标对象的数字证书发送给所述AI软件系统中的安全密钥存储模块；
    相应地，所述安全密钥存储模块，用于将已存储的所述目标对象的数字证书替换为所述升级之后的目标对象的数字证书。
  18. 如权利要求10至17任一所述的装置，其特征在于，所述目标对象包括所述AI软件系统中的模型及关键数据文件。
PCT/CN2018/092027 2017-06-22 2018-06-20 Ai软件系统安全状态的确定方法及装置 WO2018233638A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710481711.9A CN109117625B (zh) 2017-06-22 2017-06-22 Ai软件系统安全状态的确定方法及装置
CN201710481711.9 2017-06-22

Publications (1)

Publication Number Publication Date
WO2018233638A1 true WO2018233638A1 (zh) 2018-12-27

Family

ID=64732802

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/092027 WO2018233638A1 (zh) 2017-06-22 2018-06-20 Ai软件系统安全状态的确定方法及装置

Country Status (2)

Country Link
CN (1) CN109117625B (zh)
WO (1) WO2018233638A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2022096982A1 (en) * 2020-11-06 2022-05-12 International Business Machines Corporation Sharing insights between pre and post deployment to enhance cloud workload security

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111949986B (zh) * 2020-02-19 2023-10-03 华控清交信息科技(北京)有限公司 业务处理方法、系统及存储介质

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20150113272A1 (en) * 2013-10-21 2015-04-23 Electronics And Telecommunications Research Institute Method and apparatus for authenticating and managing application using trusted platform module
CN105447406A (zh) * 2015-11-10 2016-03-30 华为技术有限公司 一种用于访问存储空间的方法与装置
CN105608344A (zh) * 2014-10-31 2016-05-25 江苏威盾网络科技有限公司 一种应用程序安全管理的系统与方法
US20170061419A1 (en) * 2015-08-28 2017-03-02 Samsung Electronics Co., Ltd. Payment information processing method and apparatus of electronic device
CN106603487A (zh) * 2016-11-04 2017-04-26 中软信息系统工程有限公司 一种基于cpu时空隔离机制对tls协议处理进行安全改进的方法
WO2017088135A1 (zh) * 2015-11-25 2017-06-01 华为技术有限公司 一种安全指示信息的配置方法及设备

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP2746981A1 (en) * 2012-12-19 2014-06-25 ST-Ericsson SA Trusted execution environment access control rules derivation
US20160379212A1 (en) * 2015-06-26 2016-12-29 Intel Corporation System, apparatus and method for performing cryptographic operations in a trusted execution environment
CN105468969B (zh) * 2015-11-19 2019-02-01 中科创达软件股份有限公司 一种提升杀毒应用程序安全性的方法及系统
CN105653978B (zh) * 2015-12-29 2018-07-24 北京握奇智能科技有限公司 一种提高tee命令执行速度的方法和系统
CN105656890B (zh) * 2015-12-30 2018-11-06 深圳数字电视国家工程实验室股份有限公司 一种基于tee和无线确认的fido认证器及系统及方法
CN106547618B (zh) * 2016-10-19 2019-10-29 沈阳微可信科技有限公司 通信系统和电子设备

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20150113272A1 (en) * 2013-10-21 2015-04-23 Electronics And Telecommunications Research Institute Method and apparatus for authenticating and managing application using trusted platform module
CN105608344A (zh) * 2014-10-31 2016-05-25 江苏威盾网络科技有限公司 一种应用程序安全管理的系统与方法
US20170061419A1 (en) * 2015-08-28 2017-03-02 Samsung Electronics Co., Ltd. Payment information processing method and apparatus of electronic device
CN105447406A (zh) * 2015-11-10 2016-03-30 华为技术有限公司 一种用于访问存储空间的方法与装置
WO2017088135A1 (zh) * 2015-11-25 2017-06-01 华为技术有限公司 一种安全指示信息的配置方法及设备
CN106603487A (zh) * 2016-11-04 2017-04-26 中软信息系统工程有限公司 一种基于cpu时空隔离机制对tls协议处理进行安全改进的方法

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2022096982A1 (en) * 2020-11-06 2022-05-12 International Business Machines Corporation Sharing insights between pre and post deployment to enhance cloud workload security
GB2615677A (en) * 2020-11-06 2023-08-16 Ibm Sharing insights between pre and post deployment to enhance cloud workload security
US11947444B2 (en) 2020-11-06 2024-04-02 International Business Machines Corporation Sharing insights between pre and post deployment to enhance cloud workload security

Also Published As

Publication number Publication date
CN109117625B (zh) 2020-11-06
CN109117625A (zh) 2019-01-01

Similar Documents

Publication Publication Date Title
US11296934B2 (en) Device provisioning system
EP3479282B1 (en) Targeted secure software deployment
CN108351937B (zh) 计算设备
US10885197B2 (en) Merging multiple compute nodes with trusted platform modules utilizing authentication protocol with active trusted platform module provisioning
US9686278B1 (en) Method and system for configuring computing devices
EP2913956B1 (en) Management control method and device for virtual machines
US9425965B2 (en) Cryptographic certification of secure hosted execution environments
KR102618665B1 (ko) 블록체인을 사용한 버전 이력 관리
KR101791768B1 (ko) 신뢰된 제공자에 의한 구성 및 검증
US9270467B1 (en) Systems and methods for trust propagation of signed files across devices
US11206141B2 (en) Merging multiple compute nodes with trusted platform modules utilizing provisioned node certificates
US10255089B2 (en) Self-deleting virtual machines
TW201516733A (zh) 用以核對ｕｅｆｉ認證變量變化之系統及方法
US10379894B1 (en) Lineage-based trust for virtual machine images
US11252193B2 (en) Attestation service for enforcing payload security policies in a data center
US10771462B2 (en) User terminal using cloud service, integrated security management server for user terminal, and integrated security management method for user terminal
US20230229758A1 (en) Automated persistent context-aware device provisioning
US11983275B2 (en) Multi-phase secure zero touch provisioning of computing devices
WO2018233638A1 (zh) Ai软件系统安全状态的确定方法及装置
US20200174995A1 (en) Measurement Update Method, Apparatus, System, Storage Media, and Computing Device
US11463481B2 (en) System and method for certificate-less security management of interconnected hybrid resources
US20230229779A1 (en) Automated ephemeral context-aware device provisioning
Jian et al. A New Method to Enhance Container with vTPM
CN114282208A (zh) 到可信执行环境的安全软件工作负载供应
CN114879980A (zh) 车载应用安装方法、装置、计算机设备、存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18820014

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 18820014

Country of ref document: EP

Kind code of ref document: A1