WO2022152071A1 - 数据处理方法、装置和系统 - Google Patents

数据处理方法、装置和系统 Download PDF

Info

Publication number
WO2022152071A1
WO2022152071A1 PCT/CN2022/070959 CN2022070959W WO2022152071A1 WO 2022152071 A1 WO2022152071 A1 WO 2022152071A1 CN 2022070959 W CN2022070959 W CN 2022070959W WO 2022152071 A1 WO2022152071 A1 WO 2022152071A1
Authority
WO
WIPO (PCT)
Prior art keywords
application module
security application
machine learning
learning model
preset
Prior art date
Application number
PCT/CN2022/070959
Other languages
English (en)
French (fr)
Inventor
吴彩娣
尉鲁飞
成亮
Original Assignee
阿里巴巴集团控股有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 阿里巴巴集团控股有限公司 filed Critical 阿里巴巴集团控股有限公司
Priority to US18/261,603 priority Critical patent/US20240080192A1/en
Publication of WO2022152071A1 publication Critical patent/WO2022152071A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0894—Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
    • H04L9/0897—Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage involving additional devices, e.g. trusted platform module [TPM], smartcard or USB
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G06F21/6245—Protecting personal data, e.g. for financial or medical purposes
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N20/00—Machine learning

Definitions

  • the present invention relates to the field of Internet technologies, and in particular, to a data processing method, device and system.
  • Trusted Execution Environment Trusted Execution Environment
  • TEE Trusted Execution Environment
  • independent operating system can ensure that sensitive data is stored, processed and protected in an isolated and trusted environment through hardware isolation, which is widely used in various security applications such as payments, fingerprinting, and digital rights management (DRM).
  • Machine learning Artificial intelligence, AI for short
  • AI artificial intelligence
  • the AI field faces more and more security problems, such as model theft, misleading inference results, and leakage of sensitive data.
  • model encryption, model decryption and reasoning need to be completed in a trusted execution environment, while considering the performance of running inference in TEE and the need for rich execution environments.
  • REE ich Execution Environment
  • the REE side obtains the requirements of different customers, and then adapts different inference frameworks in TEE, increasing the development workload of TEE.
  • Embodiments of the present invention provide a data processing method, device and system to at least solve the technical problem of poor TEE model computing pressure due to the need to adapt different reasoning frameworks in the TEE model according to different customer requirements in the related art.
  • a data processing method including: splitting a preset data processing module from a machine learning model to generate a security application module, wherein the security application module is used for inputting the machine learning model.
  • the data in the data is encrypted and calculated; the output value of the operation layer in the split machine learning model is used as the input value of the input security application module through the preset operator, and the input value is input to the security application module;
  • the input value is calculated in the subgraph in the isolated computing environment, and the calculation result is obtained; the calculation result is returned to the preset operator.
  • splitting the preset data processing module from the machine learning model, and generating the security application module includes: splitting the preset data processing module from the machine learning model by using a preset tool; generating the security application module according to the preset data processing module. application module.
  • generating the security application module according to the preset data processing module includes: optimizing and encrypting the preset data processing module through a heterogeneous acceleration mutator to obtain the security application module.
  • optimizing and encrypting the preset data processing module through the heterogeneous acceleration mutator, and obtaining the security application module includes: arranging the network structure in the machine learning model at the specified position of the security application module; specifying the security application module The location is encrypted to obtain the encrypted security application module.
  • using the preset operator to use the output value of the operation layer in the split machine learning model as the input value of the input safety application module, and inputting the input value to the safety application module includes: including the first operation in the operation layer.
  • the output value of the first operation layer in the split machine learning model is obtained through the preset operator; the output value is used as the input value of the input security application module; the input value is input to the security application module.
  • the subgraph calculation is performed in an isolated computing environment by the security application module according to the input value, and the calculation result obtained includes: detecting whether the split machine learning model has use authorization according to the input value; The latter machine learning model has the use authorization, or, when the machine learning model after detection does not need authorization, the security application module performs subgraph calculation in the isolated computing environment according to the input value, and obtains the calculation result; When the machine learning model does not have a license, stop the calculation.
  • performing the subgraph calculation in the isolated computing environment by the security application module according to the input value, and obtaining the calculation result includes: assigning a corresponding application program interface according to the input value, and performing the subgraph calculation in the isolated computing environment according to the input value. Calculate and get the calculation result.
  • returning the calculation result to the preset operator includes: in the case that the operation layer further includes the second operation layer, inputting the calculation result through the preset operator into the second in the split machine learning model. Operation layer; wherein, the first operation layer is located before the preset operator, and the second operation layer is located after the preset operator.
  • a data processing method is provided, which is applied to an artificial intelligence chip, including: the artificial intelligence chip splits a preset data processing module from a machine learning model to generate a security application module; artificial intelligence The chip obtains the output value of the operation layer in the split machine learning model through the preset operator as the input value of the input security application module, and inputs the input value to the security application module; the artificial intelligence chip performs the input value through the security application module. Encrypt the calculation, get the calculation result, and return the calculation result to the preset operator.
  • a data processing system including: a machine learning model, a preset tool, a first execution environment, and a second execution environment, wherein the machine learning model includes a preset data processing module, A preset data processing module is obtained by splitting the machine learning model through a preset tool, and the preset data processing module is configured in the first execution environment to generate a security application module; and the split machine learning model is configured in the second execution environment. environment; the second execution environment is used to collect data, the collected data is used as the input value of the security application module in the first execution environment, the input value is input into the security application module through the preset operator, and the preset operator is used to input the input value into the security application module.
  • a calculation result obtained by encrypting the input value by the security application module in the first execution environment is received.
  • a data processing apparatus including: a splitting module for splitting a preset data processing module from a machine learning model to generate a security application module, wherein the security application The module is used to encrypt and calculate the data in the input machine learning model; the input module is used to use the preset operator to take the output value of the operation layer in the split machine learning model as the input value of the input security application module, and use the preset operator as the input value of the input security application module.
  • the input value is input to the security application module; the acquisition module is used for performing subgraph calculation in an isolated computing environment through the security application module according to the input value to obtain the calculation result; the interaction module is used for returning the calculation result to the preset operator.
  • a non-volatile storage medium is also provided, wherein the non-volatile storage medium includes a stored program, wherein when the program runs, a device where the non-volatile storage medium is located is controlled Perform the above method.
  • processor wherein the processor is used for running a program, wherein the above method is executed when the program is running.
  • a security application module is generated by splitting a preset data processing module from the machine learning model, wherein the security application module is used to perform encrypted calculation on the data input into the machine learning model;
  • the sub takes the output value of the operation layer in the split machine learning model as the input value of the input safety application module, and inputs the input value to the safety application module; through the safety application module, the subgraph is performed in an isolated computing environment according to the input value.
  • FIG. 1 is a block diagram of a hardware structure of a computer terminal of a data processing method according to an embodiment of the present invention
  • FIG. 2 is a flowchart of a data processing method according to Embodiment 1 of the present invention.
  • FIG. 3 is a schematic diagram of acquiring a security application module in the data processing method according to Embodiment 1 of the present invention.
  • FIG. 4 is a schematic diagram of the interaction between the REE system and the TEE system in the data processing method according to Embodiment 1 of the present invention
  • FIG. 5 is a schematic flowchart of a data processing method according to Embodiment 2 of the present invention.
  • FIG. 6 is a schematic diagram of a data processing system according to Embodiment 3 of the present invention.
  • FIG. 7 is a schematic diagram of a data processing apparatus according to Embodiment 4 of the present invention.
  • TEE Trusted Execution Environment
  • TEE Trusted Execution Environment, independent operating system for storing, processing and protecting sensitive data
  • TA Trusted Application: security application, the application running inside the TEE;
  • AI Artificial intelligence: artificial intelligence
  • API Application Programming Interface
  • REE Row Execution Environment
  • a method embodiment of a data processing method is also provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and , although a logical order is shown in the flowcharts, in some cases steps shown or described may be performed in an order different from that herein.
  • FIG. 1 is a hardware structural block diagram of a computer terminal according to a data processing method according to an embodiment of the present invention.
  • the computer terminal 10 may include one or more (only one is shown in the figure) processor 102 (the processor 102 may include, but is not limited to, a processing device such as a microprocessor MCU or a programmable logic device FPGA) , a memory 104 for storing data, and a transmission module 106 for communication functions.
  • the structure shown in FIG. 1 is only a schematic diagram, which does not limit the structure of the above electronic device.
  • the computer terminal 10 may also include more or fewer components than shown in FIG. 1 , or have a different configuration than that shown in FIG. 1 .
  • the memory 104 may be used to store software programs and modules of application software, such as program instructions/modules corresponding to the data processing method in the embodiment of the present invention, the processor 102 executes various software programs and modules stored in the memory 104 by running the software programs and modules. Function application and data processing, that is, the data processing method for realizing the above application program.
  • Memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory.
  • memory 104 may further include memory located remotely from processor 102, which may be connected to computer terminal 10 through a network. Examples of such networks include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.
  • the transmission module 106 is used to receive or transmit data via a network.
  • a specific example of the above-mentioned network may include a wireless network provided by a communication provider of the computer terminal 10 .
  • the transmission module 106 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through the base station so as to communicate with the Internet.
  • the transmission module 106 may be a radio frequency (Radio Frequency, RF) module, which is used to communicate with the Internet in a wireless manner.
  • RF Radio Frequency
  • FIG. 2 is a flowchart of a data processing method according to Embodiment 1 of the present invention.
  • a data processing method provided by the embodiment of the present application, the specific steps are as follows:
  • Step S202 splitting a preset data processing module from the machine learning model to generate a security application module, wherein the security application module is used to perform encryption calculation on the data input in the machine learning model;
  • the machine learning model may be an AI model
  • the preset data processing module may be a part of the AI model used to calculate secret/sensitive parts.
  • FIG. 3 is according to Embodiment 1 of the present invention. Schematic diagram of obtaining the security application module in the data processing method of the above; as shown in Figure 3, the secret/sensitive part of the AI model is independently generated by the tool tool to generate a security application module (referred to as TA), and the AI model is divided into two parts.
  • TA security application module
  • the safety application module is applied to the TEE system independently from the AI model (that is, the IR subgraph in Figure 3 generates the TEE subgraph), and the AI module that does not contain the safety application module is applied to the REE system (i.e., in Figure 3 Subgraph replacement, generating REE model file), so as to save the overhead of TEE internal reasoning framework.
  • the configuration of the layers to be split is considered comprehensively.
  • a preset data processing module is split from the machine learning model, and generating a security application module includes: splitting a preset data processing module from the machine learning model by using a preset tool; processing according to the preset data. Modules generate safety application modules.
  • the preset tool is denoted as tool tool, and as shown in Figure 3 above, the tool splits the AI model, and directly compiles the model that needs to run on the TEE side to generate TA (that is, the security application module in the embodiment of the present application), And encrypt the text, rodata, data segment of TA or encrypt the configuration file.
  • the encryption key is related to the manufacturer's public key, ensuring that different manufacturers have different encryption keys.
  • the part (that is, the preset data processing module in the embodiment of the present application) in the AI model that is used to calculate the secret/sensitive part is divided by the preset tool tool, and according to the part used to calculate the secret/sensitive Partially generate TA.
  • generating the security application module according to the preset data processing module includes: optimizing and encrypting the preset data processing module through a heterogeneous acceleration mutator to obtain the security application module.
  • the heterogeneous acceleration compiler optimizes the secret/sensitive parts of the disassembled AI model, and finally compiles and generates binary instructions.
  • the tool is further used to calculate the secret/sensitive part to generate an encrypted TA.
  • TEE no longer integrates various inference frameworks, and the split model that needs to run in the TEE is compiled by an AI compiler to generate a TA in a unified format.
  • TEE internally implements unified composition and operator logic, and provides extended APIs for TA to call.
  • optimizing and encrypting the preset data processing module through the heterogeneous acceleration mutator, and obtaining the security application module includes: arranging the network structure in the machine learning model at the specified position of the security application module; specifying the security application module The location is encrypted to obtain the encrypted security application module.
  • this part of AI model parameters can be used as the rodata segment or data segment of TA or as a separate configuration file, and the network structure is reflected in the text segment of TA, the text segment of TA and rodata segment, data segment encryption or configuration file, and encrypt.
  • the encrypted TA or TA and configuration files are deployed on the device side. Encryption key guarantees vary from manufacturer to manufacturer.
  • the encrypted TA is signed by the manufacturer.
  • the text segment that is, the code segment
  • the text segment stores the program code, which has been determined before running (determined at compile time), and is usually read-only;
  • rodata segment read only data, that is, read-only data, constant area, rodata segment stores constant data
  • the data segment stores the initialized global variables.
  • Step S204 using the preset operator to use the output value of the operation layer in the split machine learning model as the input value of the input safety application module, and input the input value to the safety application module;
  • step S204 of the present application since a separate TA is generated to run in the TEE system, by configuring a custom operator (ie, the preset operator in the embodiment of the present application) in the REE system, REE Interact with the TA through the custom operator, wherein, in the process of interaction, all parts involving reasoning, secrets or sensitive parts run in the TEE system (that is, in a secure environment), and the custom operator runs in the TEE system.
  • the operation layer in the split machine model that is, as shown in Figure 3, the operation layer in the REE model, uses the output value of the REE operation layer as the input value of the security application module TA through a custom operator.
  • step S204 the output value of the operation layer in the split machine learning model is used as the input value of the input safety application module through the preset operator, and the input value is input to the safety application module.
  • the output value of the first operation layer in the split machine learning model is obtained through the preset operator; the output value is used as the input value of the input safety application module; the input value is input to the safety application module .
  • FIG. 4 shows the data processing method according to Embodiment 1 of the present invention.
  • the output value of the front layer of the model self-defined operator ie, the first operation layer in the embodiment of the present application
  • the model removed from the REE side is replaced by a custom operator.
  • the custom operator is responsible for interacting with the TEE.
  • the differences brought about by the introduction of hardware security are shielded and do not need to be changed.
  • Step S206 the security application module performs subgraph calculation in the isolated computing environment according to the input value to obtain the calculation result.
  • step S206 of the present application based on the input of the output value in the TA in step S204, the reasoning part in the REE system is run in the TEE system, and the TEE system generates the final calculation result.
  • the security application module performs the subgraph calculation in the isolated computing environment according to the input value, and the obtained calculation result includes: detecting whether the split machine learning model has use authorization according to the input value; The latter machine learning model has the use authorization, or, when the machine learning model after detection does not need authorization, the security application module performs subgraph calculation in the isolated computing environment according to the input value, and obtains the calculation result; When the machine learning model does not have a license, stop the calculation.
  • the TEE when the TEE internally calculates the first part of the model to be demolished, it checks the use authorization to determine whether the device has permission to use the model. Avoid separate checks on the REE side to be bypassed by attackers using authorization logic. If the model can be used without authorization, the license check in the TEE system (that is, whether the split machine learning model in the embodiment of the present application has the use authorization) can be ignored.
  • the sub-graph calculation is performed in the isolated computing environment by the security application module according to the input value, and the calculation result is obtained.
  • the calculation result includes: assigning a corresponding application program interface according to the input value, and according to the input value.
  • the subgraph calculation is carried out in the computing environment of the computer, and the calculation result is obtained.
  • the sec op0 in the REE uses the output of part 0 (the first operation layer in the embodiment of the present application) as the output of the TA in the TEE
  • the input of Op00 (operator), TEE outputs the calculation result of operator op0n through the calculation of operators op00-op0n, as the input of part2 (as shown in Figure 4, the second operation layer).
  • the first layer is split into the TEE system for calculation, and the first custom operator takes the input of the inference part as the TEE input.
  • the TEE loads the TA, decrypts the TA or decrypts the TA and the configuration file.
  • the basic logic of composition and operator is implemented in TEE.
  • the inference part of the model from the split REE system is calculated in the TEE, and the output of the REE side is received as the input of the TEE calculation.
  • the final result of the TEE output is used as the input of the subsequent network layers on the REE side, and the calculation results of the intermediate layer are not exposed.
  • a unified AI composition and operator interface are defined inside the TEE, which facilitates connection with the AI hardware acceleration chip.
  • Step S208 returning the calculation result to the preset operator.
  • returning the calculation result to the preset operator in step S208 includes: in the case that the operation layer further includes a second operation layer, inputting the calculation result into the second operation layer in the split machine learning model; wherein, The first operation layer is located before the preset operator, and the second operation layer is located after the preset operator.
  • the calculation result is used as the input of the subsequent operation layer.
  • the TA operation needs to be called again, the part to be calculated is input into the TA in the TEE system, and the TA calculates again, and the calculation result of the TA is calculated.
  • the next operation layer of the input REE system is used as the input of this operation layer to continue the calculation.
  • Part2 that is, the second operation layer in the embodiment of the present application
  • the inference part of Part2 is input into the operators Op10-Op1n of TA through the operator Sec Op1, and when the operator Op1n obtains the calculation result, it returns
  • the calculation result is used as the input of Part 4 (third operation layer) and the calculation is performed again.
  • the AI model in the embodiment of the present application when updated, only the model file on the REE side and the binary file or configuration file corresponding to the TA need to be updated.
  • the solutions provided in the embodiments of this application are applicable to different hardware carriers, such as intel sgx and arm trustzone, the model splitting is universal, the interaction mode of REE and TEE of the custom operator, the composition and calculation in TA format and TEE.
  • the sub-logic implementation is associated with the hardware carrier.
  • a security application module is generated by splitting a preset data processing module from the machine learning model, wherein the security application module is used to perform encrypted calculation on the data input into the machine learning model;
  • the sub takes the output value of the operation layer in the split machine learning model as the input value of the input safety application module, and inputs the input value to the safety application module; through the safety application module, according to the input value, the sub-graph is carried out in the isolated operation environment.
  • FIG. 5 is a schematic flowchart of the data processing method according to Embodiment 2 of the present invention, as shown in FIG. 5 , including:
  • Step S502 the artificial intelligence chip splits a preset data processing module from the machine learning model to generate a security application module
  • Step S504 the artificial intelligence chip obtains the output value of the operation layer in the split machine learning model through the preset operator as the input value of the input security application module, and inputs the input value to the security application module;
  • Step S506 the artificial intelligence chip encrypts and calculates the input value through the security application module, obtains the calculation result, and returns the calculation result to the preset operator.
  • the data processing method provided in the embodiment of the present application can be applied to an artificial intelligence chip, that is, an AI chip.
  • the processing module can be used to calculate the secret/sensitive part of the AI model, and the secret/sensitive part of the AI model can be independently calculated by the tool tool to generate a security application module (referred to as TA), and the AI model is divided into two parts , where the security application module is applied to the TEE system independently from the AI model, and the AI module that does not include the security application module is applied to the REE system, so as to save the overhead of the TEE internal reasoning framework.
  • TA security application module
  • the configuration of the layers to be split is considered comprehensively.
  • the disassembled AI model used for computing secret/sensitive parts is optimized by the heterogeneous acceleration compiler, and finally compiled to generate binary instructions, and the secret/sensitive parts used for computing secret/sensitive parts are further generated by the tool tool. Encrypted TA.
  • TEE no longer integrates various inference frameworks, and the split model that needs to run in the TEE is compiled by an AI compiler to generate a TA in a unified format.
  • TEE internally implements unified composition and operator logic, and provides extended APIs for TA to call.
  • this part of AI model parameters can be used as the rodata segment or data segment of TA or as a separate configuration file, and the network structure is reflected in the text segment of TA, the text segment of TA and rodata segment, data segment encryption or configuration file, and encrypt.
  • the encrypted TA or TA and configuration files are deployed on the device side. Encryption key guarantees vary from manufacturer to manufacturer.
  • the encrypted TA is signed by the manufacturer.
  • the custom operators are responsible for the front layer of the model custom operators in the REE system.
  • the output value of is input to TA in TEE.
  • the model removed from the REE side is replaced by a custom operator, which is responsible for interacting with the TEE.
  • a custom operator responsible for interacting with the TEE.
  • FIG. 6 is a schematic diagram of a data processing system according to Embodiment 3 of the present invention. As shown in FIG. 6 , the system includes: a machine learning model 61 , a preset tool 62.
  • the first execution environment 63 and the second execution environment 64 wherein the machine learning model 64 includes a preset data processing module, and the preset data processing module is obtained by splitting the machine learning model through the preset tool 62, and the preset data
  • the processing module is configured in the first execution environment 63 to generate a security application module; the split machine learning model is configured in the second execution environment 64; the second execution environment 64 is used to collect data, and the collected data is used as input
  • the input value of the security application module in the first execution environment 63 is input into the security application module through the preset operator 62, and the security application module in the first execution environment 63 receives the input value through the preset operator 62 to encrypt and calculate the input value obtained calculation result.
  • the machine model 61 in the data processing system provided by the embodiment of the present application is marked as AI
  • the preset tool is marked as tool
  • the first execution environment 63 is marked as TEE
  • the second execution environment 64 is marked as REE
  • the security application module is marked as TA
  • the preset operators in the REE are marked as SecOp0, SecOp1 . . .
  • the AI model is divided into two parts by the tool, wherein the part due to performing confidential calculation/sensitive calculation is configured in the TEE to generate TA; the rest of the AI model is configured in the REE, through the REE Collect data, take the collected data as the data to be kept secret, and input the operators Op00...Op0n and Op10...Op1n in the TA in the TEE through the preset operators SecOp0, SecOp1...
  • the output value of the first operation layer Part0 (that is, the data to be kept secret in the embodiment of the present application) is input to the operators Op00...Op0n in the TA in the TEE through the preset operator SecOp0.
  • the output value of Part2 is input to the operators Op10...Op1n in TA in the TEE through SecOp1. After Op1n outputs the calculation result, the calculation result is fed back to SecOp1 as the input value of Part4, and then Loop calculation.
  • FIG. 7 is a schematic diagram of a data processing apparatus according to Embodiment 4 of the present invention.
  • the processing device includes: a splitting module 72 for splitting a preset data processing module from the machine learning model to generate a security application module, wherein the security application module is used for encrypting the data input into the machine learning model; inputting The module 74 is used to use the output value of the operation layer in the split machine learning model as the input value of the input security application module through the preset operator, and input the input value to the security application module; the acquisition module 76 is used to pass The security application module performs subgraph calculation in the isolated computing environment according to the input value, and obtains the calculation result; the interaction module 78 is used for returning the calculation result to the preset operator.
  • a non-volatile storage medium is also provided, wherein the non-volatile storage medium includes a stored program, wherein when the program runs, a device where the non-volatile storage medium is located is controlled.
  • a processor is further provided, wherein the processor is used for running a program, wherein the method in the foregoing embodiment 1 or 2 is executed when the program is running.
  • Embodiments of the present invention also provide a storage medium.
  • the above-mentioned storage medium may be used to store the program code executed by the data processing method provided in the above-mentioned first embodiment.
  • the above-mentioned storage medium may be located in any computer terminal in a computer terminal group in a computer network, or in any mobile terminal in a mobile terminal group.
  • the storage medium is set to store program codes for performing the following steps: splitting a preset data processing module from the machine learning model to generate a security application module, wherein the security application module uses It is used to encrypt and calculate the data in the input machine learning model; the output value of the operation layer in the split machine learning model is used as the input value of the input security application module through the preset operator, and the input value is input to the security application module. ; The security application module performs subgraph calculation in the isolated computing environment according to the input value, and obtains the calculation result; returns the calculation result to the preset operator.
  • the storage medium is configured to store program codes for executing the following steps: splitting a preset data processing module from the machine learning model, and generating a security application module includes: using a preset tool A preset data processing module is split from the machine learning model; a security application module is generated according to the preset data processing module.
  • the storage medium is configured to store program codes for executing the following steps: generating the security application module according to the preset data processing module includes: transforming the preset data through the heterogeneous acceleration mutator The processing module is optimized and encrypted to obtain a secure application module.
  • the storage medium is configured to store program codes for executing the following steps: optimizing and encrypting the preset data processing module through the heterogeneous acceleration mutator, and obtaining the security application module includes:
  • the network structure in the learning model is configured in the specified position of the security application module; the specified position of the security application module is encrypted to obtain the encrypted security application module.
  • the storage medium is set to store program codes for executing the following steps: using a preset operator to use the output value of the operation layer in the split machine learning model as the input value of the security application module; Inputting the value, and inputting the input value to the security application module includes: in the case that the operation layer includes the first operation layer, obtaining the output value of the first operation layer in the split machine learning model through a preset operator; The value is taken as the input value to the safety application module; the input value is entered into the safety application module.
  • the storage medium is configured to store program codes for executing the following steps: performing subgraph calculation in an isolated computing environment by the security application module according to the input value, and obtaining the calculation result includes: : Detect whether the split machine learning model has use authorization based on the input value; when it is detected that the split machine learning model has use authorization, or, when the split machine learning model does not require authorization, the security application module is used according to the input value.
  • the subgraph is calculated in the isolated computing environment, and the calculation result is obtained; when it is detected that the split machine learning model does not have the use authorization, the calculation is stopped.
  • the storage medium is configured to store program codes for executing the following steps: performing subgraph calculation in an isolated computing environment according to the input value by the security application module, and obtaining the calculation result includes: according to the input value The corresponding application program interface is assigned to the value, and the subgraph calculation is performed in the isolated computing environment according to the input value, and the calculation result is obtained.
  • the storage medium is configured to store program codes for executing the following steps: returning the calculation result to the preset operator includes: when the operation layer further includes a second operation layer , the calculation result is input into the second operation layer in the split machine learning model through the preset operator; wherein, the first operation layer is located before the preset operator, and the second operation layer is located after the preset operator.
  • the units described as separate components may or may not be physically separated, and components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution in this embodiment.
  • each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit.
  • the above-mentioned integrated units may be implemented in the form of hardware, or may be implemented in the form of software functional units.
  • the integrated unit if implemented in the form of a software functional unit and sold or used as an independent product, may be stored in a computer-readable storage medium.
  • the technical solution of the present invention is essentially or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium , including several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention.
  • the aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk and other media that can store program codes .

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • Computer Security & Cryptography (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Hardware Design (AREA)
  • Physics & Mathematics (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Medical Informatics (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Artificial Intelligence (AREA)
  • Computer Vision & Pattern Recognition (AREA)
  • Data Mining & Analysis (AREA)
  • Evolutionary Computation (AREA)
  • Computing Systems (AREA)
  • Mathematical Physics (AREA)
  • Databases & Information Systems (AREA)
  • Stored Programmes (AREA)

Abstract

本发明公开了一种数据处理方法、装置和系统。其中，该方法包括：从机器学习模型中拆分出预设数据处理模块，生成安全应用模块，其中，安全应用模块用于对输入机器学习模型中的数据进行加密计算；通过预设算子将拆分后的机器学习模型中运算层的输出值作为输入安全应用模块的输入值，并将输入值输入至安全应用模块；通过安全应用模块依据输入值在隔离的运算环境中进行子图计算，得到计算结果；将计算结果返回预设算子。本发明解决了由于相关技术中在TEE模型中需要根据不同客户需求适配不同的推理框架，导致TEE模型运算压力差的技术问题。

Description

数据处理方法、装置和系统
本申请要求2021年01月15日递交的申请号为202110057899.0、发明名称为“数据处理方法、装置和系统”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及互联网技术领域，具体而言，涉及一种数据处理方法、装置和系统。
背景技术
可信执行环境(Trusted Execution Environment，简称TEE，可信执行环境、独立的操作系统)通过硬件的隔离，可确保在一个孤立、可信的环境中存储、处理和保护敏感数据，广泛用于各种安全应用，如支付、指纹和数字版权保护(Digital rights management，简称DRM)。机器学习(Artificial intelligence，简称AI)是利用大量的数据训练，然后将学习得到的结果用到后续的数据的决策/预测中去，目前已广泛应用于各种场景，如模式识别，计算机视觉，自动驾驶等。随着AI的广泛应用，AI领域所面临越来越多安全问题，如模型窃取，误导推理结果，泄漏敏感数据等。
在实际的AI应用中，为了保证安全性，例如模型安全，隐私安全，需要将模型加密，模型解密及推理在可信的执行环境中完成，同时考虑TEE中运行推理的性能以及对丰富执行环境(Rich Execution Environment，简称REE)侧原始应用的影响，其中，REE与TEE相对应。
在相关技术中，由于不同客户需求采用不同推理框架，REE侧获取不同客户的需求，进而在TEE中适配不同的推理框架，增加TEE的开发工作量。
针对上述由于相关技术中在TEE模型中需要根据不同客户需求适配不同的推理框架，导致TEE模型运算压力大的问题，目前尚未提出有效的解决方案。
发明内容
本发明实施例提供了一种数据处理方法、装置和系统，以至少解决由于相关技术中在TEE模型中需要根据不同客户需求适配不同的推理框架，导致TEE模型运算压力差的技术问题。
根据本发明实施例的一个方面，提供了一种数据处理方法，包括：从机器学习模型中拆分出预设数据处理模块，生成安全应用模块，其中，安全应用模块用于对输入机器学习模型中的数据进行加密计算；通过预设算子将拆分后的机器学习模型中运算层的输出值作为输入安全应用模块的输入值，并将输入值输入至安全应用模块；通过安全应用模块依据输入值在隔离的运算环境中进行子图计算，得到计算结果；将计算结果返回预设算子。
可选的，从机器学习模型中拆分出预设数据处理模块，生成安全应用模块包括：通过预设工具从机器学习模型中拆分出预设数据处理模块；依据预设数据处理模块生成安 全应用模块。
进一步地，可选的，依据预设数据处理模块生成安全应用模块包括：通过异构加速变异器将预设数据处理模块进行优化并加密，得到安全应用模块。
可选的，通过异构加速变异器将预设数据处理模块进行优化并加密，得到安全应用模块包括：将机器学习模型中的网络结构配置于安全应用模块的指定位置；对安全应用模块的指定位置进行加密，得到加密后的安全应用模块。
可选的，通过预设算子将拆分后的机器学习模型中运算层的输出值作为输入安全应用模块的输入值，并将输入值输入至安全应用模块包括：在运算层包括第一运算层的情况下，通过预设算子获取拆分后的机器学习模型中第一运算层的输出值；将输出值作为输入安全应用模块的输入值；将输入值输入至安全应用模块。
进一步地，可选的，通过安全应用模块依据输入值在隔离的运算环境中进行子图计算，得到计算结果包括：依据输入值检测拆分后的机器学习模型是否存在使用授权；当检测拆分后的机器学习模型存在使用授权，或，检测拆分后的机器学习模型无需授权时，通过安全应用模块依据输入值在隔离的运算环境中进行子图计算，得到计算结果；当检测拆分后的机器学习模型不存在使用授权时，停止计算。
可选的，通过安全应用模块依据输入值在隔离的运算环境中进行子图计算，得到计算结果包括：依据输入值分配对应的应用程序接口，并依据输入值在隔离的运算环境中进行子图计算，得到计算结果。
进一步地，可选的，将计算结果返回预设算子包括：在运算层还包括第二运算层的情况下，将计算结果通过预设算子输入拆分后的机器学习模型中的第二运算层；其中，第一运算层位于预设算子之前，第二运算层位于预设算子之后。
根据本发明实施例的另一个方面，提供了一种数据处理方法，应用于人工智能芯片，包括：人工智能芯片从机器学习模型中拆分出预设数据处理模块，生成安全应用模块；人工智能芯片通过预设算子获取拆分后的机器学习模型中运算层的输出值作为输入安全应用模块的输入值，并将输入值输入至安全应用模块；人工智能芯片通过安全应用模块对输入值进行加密计算，得到计算结果，并将计算结果返回预设算子。
根据本发明实施例的另一个方面，提供了一种数据处理系统，包括：机器学习模型、预设工具、第一执行环境和第二执行环境，其中，机器学习模型包含预设数据处理模块，通过预设工具从机器学习模型中拆分得到预设数据处理模块，将预设数据处理模块配置于第一执行环境，生成安全应用模块；并将拆分后的机器学习模型配置于第二执行环境；第二执行环境，用于采集数据，将采集到的数据作为输入第一执行环境中安全应用模块的输入值，通过预设算子将输入值输入安全应用模块，并通过预设算子接收第一执行环境中安全应用模块对输入值进行加密计算得到的计算结果。
根据本发明实施例的另一方面，还提供了一种数据处理装置，包括：拆分模块，用 于从机器学习模型中拆分出预设数据处理模块，生成安全应用模块，其中，安全应用模块用于对输入机器学习模型中的数据进行加密计算；输入模块，用于通过预设算子将拆分后的机器学习模型中运算层的输出值作为输入安全应用模块的输入值，并将输入值输入至安全应用模块；获取模块，用于通过安全应用模块依据输入值在隔离的运算环境中进行子图计算，得到计算结果；交互模块，用于将计算结果返回预设算子。
根据本发明实施例的另一方面，还提供了一种非易失性存储介质，其中，非易失性存储介质包括存储的程序，其中，在程序运行时控制非易失性存储介质所在设备执行上述方法。
根据本发明实施例的另一方面，还提供了一种处理器，其中，处理器用于运行程序，其中，程序运行时执行上述方法。
在本发明实施例中，通过从机器学习模型中拆分出预设数据处理模块，生成安全应用模块，其中，安全应用模块用于对输入机器学习模型中的数据进行加密计算；通过预设算子将拆分后的机器学习模型中运算层的输出值作为输入安全应用模块的输入值，并将输入值输入至安全应用模块；通过安全应用模块依据输入值在隔离的运算环境中进行子图计算，得到计算结果；将计算结果返回预设算子，达到了提升TEE运算能力的目的，从而实现了不再在TEE中集成各种推理框架，为需要运行在TEE中的TA提供对应的应用程序调用的技术效果，进而解决了由于相关技术中在TEE模型中需要根据不同客户需求适配不同的推理框架，导致TEE模型运算压力差的技术问题。
附图说明
此处所说明的附图用来提供对本发明的进一步理解，构成本申请的一部分，本发明的示意性实施例及其说明用于解释本发明，并不构成对本发明的不当限定。在附图中：
图1是本发明实施例的一种数据处理方法的计算机终端的硬件结构框图；
图2是根据本发明实施例一的数据处理方法的流程图；
图3是根据本发明实施例一的数据处理方法中获取安全应用模块的示意图；
图4是根据本发明实施例一的数据处理方法中REE系统与TEE系统之间交互的示意图；
图5是根据本发明实施例二的数据处理方法的流程示意图；
图6是根据本发明实施例三的数据处理系统的示意图；
图7是根据本发明实施例四的数据处理装置的示意图。
具体实施方式
为了使本技术领域的人员更好地理解本发明方案，下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本发明一部分的实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都应当属于本发明保 护的范围。
需要说明的是，本发明的说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的数据在适当情况下可以互换，以便这里描述的本发明的实施例能够以除了在这里图示或描述的那些以外的顺序实施。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或单元的过程、方法、系统、产品或设备不必限于清楚地列出的那些步骤或单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或单元。
本申请涉及的技术名词：
TEE(Trusted Execution Environment)：可信执行环境、独立的操作系统，用于存储、处理和保护敏感数据；
TA(Trusted Application):安全应用，运行在TEE内部的应用；
AI(Artificial intelligence):人工智能；
API(Application Programming Interface):应用程序编程接口；
REE(Rich Execution Environment)：丰富执行环境，与TEE相对。
实施例1
根据本发明实施例，还提供了一种数据处理方法的方法实施例，需要说明的是，在附图的流程图示出的步骤可以在诸如一组计算机可执行指令的计算机系统中执行，并且，虽然在流程图中示出了逻辑顺序，但是在某些情况下，可以以不同于此处的顺序执行所示出或描述的步骤。
本申请实施例一所提供的方法实施例可以在移动终端、计算机终端或者类似的运算装置中执行。以运行在计算机终端上为例，图1是本发明实施例的一种数据处理方法的计算机终端的硬件结构框图。如图1所示，计算机终端10可以包括一个或多个(图中仅示出一个)处理器102(处理器102可以包括但不限于微处理器MCU或可编程逻辑器件FPGA等的处理装置)、用于存储数据的存储器104、以及用于通信功能的传输模块106。本领域普通技术人员可以理解，图1所示的结构仅为示意，其并不对上述电子装置的结构造成限定。例如，计算机终端10还可包括比图1中所示更多或者更少的组件，或者具有与图1所示不同的配置。
存储器104可用于存储应用软件的软件程序以及模块，如本发明实施例中的数据处理方法对应的程序指令/模块，处理器102通过运行存储在存储器104内的软件程序以及模块，从而执行各种功能应用以及数据处理，即实现上述的应用程序的数据处理方法。存储器104可包括高速随机存储器，还可包括非易失性存储器，如一个或者多个磁性存储装置、闪存、或者其他非易失性固态存储器。在一些实例中，存储器104可进一步包括相对于处理器102远程设置的存储器，这些远程存储器可以通过网络连接至计算机终 端10。上述网络的实例包括但不限于互联网、企业内部网、局域网、移动通信网及其组合。
传输模块106用于经由一个网络接收或者发送数据。上述的网络具体实例可包括计算机终端10的通信供应商提供的无线网络。在一个实例中，传输模块106包括一个网络适配器(Network Interface Controller，NIC)，其可通过基站与其他网络设备相连从而可与互联网进行通讯。在一个实例中，传输模块106可以为射频(Radio Frequency，RF)模块，其用于通过无线方式与互联网进行通讯。
在上述运行环境下，本申请提供了如图2所示的数据处理方法。图2是根据本发明实施例一的数据处理方法的流程图。本申请实施例提供的一种数据处理方法，具体步骤如下：
步骤S202，从机器学习模型中拆分出预设数据处理模块，生成安全应用模块，其中，安全应用模块用于对输入机器学习模型中的数据进行加密计算；
本申请上述步骤S202中，在本申请实施例中机器学习模型可以为AI模型，预设数据处理模块可以为AI模型中用于计算涉密/敏感的部分，图3是根据本发明实施例一的数据处理方法中获取安全应用模块的示意图；如图3所示，通过工具tool将AI模型中计算涉密/敏感的部分独立出来生成安全应用模块(记作TA)，将AI模型分为两部分，其中，安全应用模块从AI模型中独立出来应用于TEE系统(即，图3中IR子图生成TEE子图)，不包含安全应用模块的AI模块应用于REE系统(即，图3中子图替换，生成REE模型文件)，以使得节省掉TEE内部推理框架的开销。根据安全性及性能要求综合考虑配置需拆分出来的层。
可选的，步骤S202中从机器学习模型中拆分出预设数据处理模块，生成安全应用模块包括：通过预设工具从机器学习模型中拆分出预设数据处理模块；依据预设数据处理模块生成安全应用模块。
其中，预设工具记作工具tool，结合上述图3所示，tool对AI模型进行拆分，将需要运行在TEE侧的模型直接编译生成TA(即本申请实施例中的安全应用模块),并对TA的text，rodata,data段加密或者对配置文件加密。加密密钥与厂商的公钥相关，保证不同厂商有不同的加密密钥。
具体的，通过预设工具tool将AI模型中用于计算涉密/敏感的部分(即，本申请实施例中的预设数据处理模块)进行拆分，依据该用于计算涉密/敏感的部分生成TA。
进一步地，可选的，依据预设数据处理模块生成安全应用模块包括：通过异构加速变异器将预设数据处理模块进行优化并加密，得到安全应用模块。
具体的，如图3所示，在本申请实施例中通过异构加速编译器将拆解出来的AI模型中的用于计算涉密/敏感的部分进行优化，最终编译生成二进制指令，通过工具tool进一步将用于计算涉密/敏感的部分生成加密后的TA。
需要说明的是，本申请实施例中区别于现有技术TEE内部不再集成各种推理框架，拆分出来的需要运行在TEE内的模型通过AI编译器编译生成统一格式的TA。TEE内部实现统一的构图和算子的逻辑，提供扩展的API供TA调用。
可选的，通过异构加速变异器将预设数据处理模块进行优化并加密，得到安全应用模块包括：将机器学习模型中的网络结构配置于安全应用模块的指定位置；对安全应用模块的指定位置进行加密，得到加密后的安全应用模块。
具体的，拆解出来的AI模型编译生成TA后，该部分AI模型参数可作为TA的rodata段或者data段或者作为单独的配置文件，网络结构反应在TA的text段，TA的text段及rodata段，data段加密或者配置文件，并进行加密。加密后的TA或者TA和配置文件部署在设备端。加密密钥保证每个厂商各不相同。加密后的TA由厂商签名。
其中，text段，即代码段，text段存放程序代码，运行前就已经确定(编译时确定)，通常为只读；
rodata段，read only data，即，只读数据，常量区，rodata段存储常量数据；
data段，存储已经初始化的全局变量。
步骤S204，通过预设算子将拆分后的机器学习模型中运算层的输出值作为输入安全应用模块的输入值，并将输入值输入至安全应用模块；
本申请上述步骤S204中，在本申请实施例中由于生成单独的TA运行于TEE系统，因此通过在REE系统中配置自定义算子(即，本申请实施例中的预设算子)，REE通过该自定义算子与TA进行交互，其中，在交互的过程中，所有涉及推理部分、涉密或敏感的部分是运行在TEE系统中(即，安全环境中)，自定义算子运行在REE中，拆分后的机器模型中的运算层，即，如图3所示，REE模型中的运算层，通过自定义算子将REE运算层的输出值作为安全应用模块TA的输入值。
可选的，步骤S204中通过预设算子将拆分后的机器学习模型中运算层的输出值作为输入安全应用模块的输入值，并将输入值输入至安全应用模块包括：在运算层包括第一运算层的情况下，通过预设算子获取拆分后的机器学习模型中第一运算层的输出值；将输出值作为输入安全应用模块的输入值；将输入值输入至安全应用模块。
具体的，基于图3中对AI模型的拆分，分为运行于TEE系统的部分和运行于REE系统的部分，在REE系统的部分，图4是根据本发明实施例一的数据处理方法中REE系统与TEE系统之间交互的示意图，如图4所示，通过在REE系统中插入(配置)自定义算子(记作Sec Op0，Sec Op1)，由自定义算子负责将REE系统中的模型自定义算子的前层(即，本申请实施例中的第一运算层)的输出值作为TEE的输入值，输入给TEE中的TA。
在本申请实施例中，通过自定义算子代替REE侧被拆走的模型，该自定义算子负责与TEE交互，对REE应用开发者而言，屏蔽引入硬件安全带来的差异，无需改变原始 REE侧应用。
步骤S206，通过安全应用模块依据输入值在隔离的运算环境中进行子图计算，得到计算结果。
本申请上述步骤S206中，基于步骤S204中将输出值输入TA，将REE系统中的推理部分在TEE系统中运行，由TEE系统生成最终的计算结果。
可选的，步骤S206中通过安全应用模块依据输入值在隔离的运算环境中进行子图计算，得到计算结果包括：依据输入值检测拆分后的机器学习模型是否存在使用授权；当检测拆分后的机器学习模型存在使用授权，或，检测拆分后的机器学习模型无需授权时，通过安全应用模块依据输入值在隔离的运算环境中进行子图计算，得到计算结果；当检测拆分后的机器学习模型不存在使用授权时，停止计算。
具体的，如图4所示，对于需要使用授权的模型，TEE内部计算第一个被拆进来的模型部分时，检查使用授权，判断该设备是否有权限使用该模型。避免在REE侧单独检查使用授权逻辑被攻击者绕过。如模型无需授权即可使用，TEE系统中的许可验证license check(即，本申请实施例中的检测拆分后的机器学习模型是否存在使用授权)则可忽略。
进一步地，可选的，通过安全应用模块依据输入值在隔离的运算环境中进行子图计算，得到计算结果，得到计算结果包括：依据输入值分配对应的应用程序接口，并依据输入值在隔离的运算环境中进行子图计算，得到计算结果。
具体的，如图4所示，REE中的sec op0(即，本申请实施例中的预设算子)将part 0(本申请实施例中的第一运算层)的输出作为TEE中TA中的Op00(算子)的输入，TEE通过算子op00-op0n的计算，将算子op0n的计算结果输出，作为part2的(如图4所示，第二运算层)输入。特殊的，当对用户输入数据保护的时候，第一层拆分到TEE系统中进行计算，则第一个自定义算子将推理部分输入作为TEE输入。
其中，在模型初始化段，第一个自定义算子初始化时，TEE加载TA，解密TA或者解密TA和配置文件。在TEE中实现构图，算子的基本逻辑，作为通用模块，对TA提供扩展的调用API。拆分REE系统出来的模型的推理部分在TEE中计算，接收REE侧的输出作为TEE计算的输入，TEE输出的最终结果，作为REE侧后续网络层的输入，中间层的计算结果不对外露出。
在本申请实施例中通过TEE内部定义统一的AI构图，算子接口，方便对接AI硬件加速芯片。
步骤S208，将计算结果返回预设算子。
可选的，步骤S208中将计算结果返回预设算子包括：在运算层还包括第二运算层的情况下，将计算结果输入拆分后的机器学习模型中的第二运算层；其中，第一运算层位于预设算子之前，第二运算层位于预设算子之后。
具体的，由于REE系统侧存在多层(Part0，Part2，Part4，……)，由于第一层的输出作为TEE系统侧的输入，并且大量的计算集中于TEE系统的TA侧，在得到TEE系统输出的计算结果后，将该计算结果作为后续运算层的输入，直至再有需要调用TA运算时，将待运算的部分输入TEE系统中的TA，由TA再次进行计算，并将TA的计算结果输入REE系统的下一运算层作为该运算层的输入继续进行计算。
例如，当Part2(即本申请实施例中的第二运算层)需要调用TA时，通过算子Sec Op1将Part2的推理部分输入TA的算子Op10-Op1n中，当算子Op1n得到计算结果返回REE系统时，将该计算结果作为Part4(第三运算层)的输入再次进行计算。
需要说明的是，本申请实施例中的AI模型更新时只需更新REE侧的模型文件及TA对应的二进制文件或者配置文件。并且本申请实施例提供的方案适用于不同的硬件载体，例如intel sgx和arm trustzone,模型拆分是通用的，自定义的算子的REE和TEE的交互方式，TA格式和TEE中构图与算子逻辑实现与硬件载体相关。
在本发明实施例中，通过从机器学习模型中拆分出预设数据处理模块，生成安全应用模块，其中，安全应用模块用于对输入机器学习模型中的数据进行加密计算；通过预设算子将拆分后的机器学习模型中运算层的输出值作为输入安全应用模块的输入值，并将输入值输入至安全应用模块；通过安全应用模块依据输入值在隔离的运算环境中进行子图计算，得到计算结果；将计算结果返回预设算子，达到了提升TEE运算能力的目的，从而实现了不再在TEE中集成各种推理框架，为需要运行在TEE中的TA提供对应的应用程序调用的技术效果，进而解决了由于相关技术中在TEE模型中需要根据不同客户需求适配不同的推理框架，导致TEE模型运算压力差的技术问题。
实施例2
根据本发明实施例的另一个方面，提供了一种数据处理方法，应用于人工智能芯片，图5是根据本发明实施例二的数据处理方法的流程示意图，如图5所示，包括：
步骤S502，人工智能芯片从机器学习模型中拆分出预设数据处理模块，生成安全应用模块；
步骤S504，人工智能芯片通过预设算子获取拆分后的机器学习模型中运算层的输出值作为输入安全应用模块的输入值，并将输入值输入至安全应用模块；
步骤S506，人工智能芯片通过安全应用模块对输入值进行加密计算，得到计算结果，并将计算结果返回预设算子。
综上，结合步骤S502至步骤S506，本申请实施例提供的数据处理方法可以应用于人工智能芯片，即，AI芯片，其中，在本申请实施例中机器学习模型可以为AI模型，预设数据处理模块可以为AI模型中用于计算涉密/敏感的部分，通过工具tool将AI模型中计算涉密/敏感的部分独立出来生成安全应用模块(记作TA)，将AI模型分为两部分，其中，安全应用模块从AI模型中独立出来应用于TEE系统，不包含安全应用模块的AI 模块应用于REE系统，以使得节省掉TEE内部推理框架的开销。根据安全性及性能要求综合考虑配置需拆分出来的层。
其中，通过异构加速编译器将拆解出来的AI模型中的用于计算涉密/敏感的部分进行优化，最终编译生成二进制指令，通过工具tool进一步将用于计算涉密/敏感的部分生成加密后的TA。
需要说明的是，本申请实施例中区别于现有技术TEE内部不再集成各种推理框架，拆分出来的需要运行在TEE内的模型通过AI编译器编译生成统一格式的TA。TEE内部实现统一的构图和算子的逻辑，提供扩展的API供TA调用。
具体的，拆解出来的AI模型编译生成TA后，该部分AI模型参数可作为TA的rodata段或者data段或者作为单独的配置文件，网络结构反应在TA的text段，TA的text段及rodata段，data段加密或者配置文件，并进行加密。加密后的TA或者TA和配置文件部署在设备端。加密密钥保证每个厂商各不相同。加密后的TA由厂商签名。
此外，在REE系统的部分，通过在REE系统中插入(配置)自定义算子(记作Sec Op0，Sec Op1)，由自定义算子负责将REE系统中的模型自定义算子的前层的输出值作为TEE的输入值，输入给TEE中的TA。
在本申请实施例中，通过自定义算子代替REE侧被拆走的模型，该自定义算子负责与TEE交互，对REE应用开发者而言，屏蔽引入硬件安全带来的差异，无需改变原始REE侧应用。
最终将REE系统中的推理部分在TEE系统中运行，由TEE系统生成最终的计算结果。
需要说明的是，对于前述的各方法实施例，为了简单描述，故将其都表述为一系列的动作组合，但是本领域技术人员应该知悉，本发明并不受所描述的动作顺序的限制，因为依据本发明，某些步骤可以采用其他顺序或者同时进行。其次，本领域技术人员也应该知悉，说明书中所描述的实施例均属于优选实施例，所涉及的动作和模块并不一定是本发明所必须的。
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到根据上述实施例的数据处理方法可借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件，但很多情况下前者是更佳的实施方式。基于这样的理解，本发明的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质(如ROM/RAM、磁碟、光盘)中，包括若干指令用以使得一台终端设备(可以是手机，计算机，服务器，或者网络设备等)执行本发明各个实施例所述的方法。
实施例3
根据本发明实施例的另一个方面，提供了一种数据处理系统，图6是根据本发明实 施例三的数据处理系统的示意图，如图6所示，包括：机器学习模型61、预设工具62、第一执行环境63和第二执行环境64，其中，机器学习模型64包含预设数据处理模块，通过预设工具62从机器学习模型中拆分得到预设数据处理模块，将预设数据处理模块配置于第一执行环境63，生成安全应用模块；并将拆分后的机器学习模型配置于第二执行环境64；第二执行环境64，用于采集数据，将采集到的数据作为输入第一执行环境63中安全应用模块的输入值，通过预设算子62将输入值输入安全应用模块，并通过预设算子62接收第一执行环境63中安全应用模块对输入值进行加密计算得到的计算结果。
具体的，如图6所示，本申请实施例提供的数据处理系统中的机器模型61标记为AI，预设工具标记为tool，第一执行环境63标记为TEE，第二执行环境64标记为REE，安全应用模块标记为TA，REE中的预设算子标记为SecOp0、SecOp1……。
在本申请实施例中，通过tool将AI模型分为两部分，其中，将由于执行保密计算/敏感计算的部分配置于TEE中，生成TA；将其余的AI模型部分配置于REE中，通过REE采集数据，将采集到的数据作为待保密数据，通过预设算子SecOp0、SecOp1……输入TEE中TA中的算子Op00…Op0n，以及Op10…Op1n；在具体执行计算的过程中，REE的第一运算层Part0的输出值(即，本申请实施例中的待保密数据)通过预设算子SecOp0输入TEE中TA中的算子Op00…Op0n，在Op0n输出计算结果后，将该计算结果反馈给SecOp0，作为Part2的输入值，Part2的输出值通过SecOp1输入TEE中TA中的算子Op10…Op1n，在Op1n输出计算结果后，将该计算结果反馈给SecOp1，作为Part4的输入值，进而循环计算。
实施例4
根据本发明实施例，还提供了一种用于实施上述数据处理方法的装置，图7是根据本发明实施例四的数据处理装置的示意图，如图7所示，本申请实施例提供的数据处理装置包括：拆分模块72，用于从机器学习模型中拆分出预设数据处理模块，生成安全应用模块，其中，安全应用模块用于对输入机器学习模型中的数据进行加密计算；输入模块74，用于通过预设算子将拆分后的机器学习模型中运算层的输出值作为输入安全应用模块的输入值，并将输入值输入至安全应用模块；获取模块76，用于通过安全应用模块依据输入值在隔离的运算环境中进行子图计算，得到计算结果；交互模块78，用于将计算结果返回预设算子。
实施例5
根据本发明实施例的另一方面，还提供了一种非易失性存储介质，其中，非易失性存储介质包括存储的程序，其中，在程序运行时控制非易失性存储介质所在设备执行上述实施例1或2中的方法。
实施例6
根据本发明实施例的另一方面，还提供了一种处理器，其中，处理器用于运行程序， 其中，程序运行时执行上述实施例1或2中的方法。
实施例7
本发明的实施例还提供了一种存储介质。可选地，在本实施例中，上述存储介质可以用于保存上述实施例一所提供的数据处理方法所执行的程序代码。
可选地，在本实施例中，上述存储介质可以位于计算机网络中计算机终端群中的任意一个计算机终端中，或者位于移动终端群中的任意一个移动终端中。
可选地，在本实施例中，存储介质被设置为存储用于执行以下步骤的程序代码：从机器学习模型中拆分出预设数据处理模块，生成安全应用模块，其中，安全应用模块用于对输入机器学习模型中的数据进行加密计算；通过预设算子将拆分后的机器学习模型中运算层的输出值作为输入安全应用模块的输入值，并将输入值输入至安全应用模块；通过安全应用模块依据输入值在隔离的运算环境中进行子图计算，得到计算结果；将计算结果返回预设算子。
可选地，在本实施例中，存储介质被设置为存储用于执行以下步骤的程序代码：从机器学习模型中拆分出预设数据处理模块，生成安全应用模块包括：通过预设工具从机器学习模型中拆分出预设数据处理模块；依据预设数据处理模块生成安全应用模块。
进一步地，可选地，在本实施例中，存储介质被设置为存储用于执行以下步骤的程序代码：依据预设数据处理模块生成安全应用模块包括：通过异构加速变异器将预设数据处理模块进行优化并加密，得到安全应用模块。
可选地，在本实施例中，存储介质被设置为存储用于执行以下步骤的程序代码：通过异构加速变异器将预设数据处理模块进行优化并加密，得到安全应用模块包括：将机器学习模型中的网络结构配置于安全应用模块的指定位置；对安全应用模块的指定位置进行加密，得到加密后的安全应用模块。
可选地，在本实施例中，存储介质被设置为存储用于执行以下步骤的程序代码：通过预设算子将拆分后的机器学习模型中运算层的输出值作为输入安全应用模块的输入值，并将输入值输入至安全应用模块包括：在运算层包括第一运算层的情况下，通过预设算子获取拆分后的机器学习模型中第一运算层的输出值；将输出值作为输入安全应用模块的输入值；将输入值输入至安全应用模块。
进一步地，可选地，在本实施例中，存储介质被设置为存储用于执行以下步骤的程序代码：通过安全应用模块依据输入值在隔离的运算环境中进行子图计算，得到计算结果包括：依据输入值检测拆分后的机器学习模型是否存在使用授权；当检测拆分后的机器学习模型存在使用授权，或，检测拆分后的机器学习模型无需授权时，通过安全应用模块依据输入值在隔离的运算环境中进行子图计算，得到计算结果；当检测拆分后的机器学习模型不存在使用授权时，停止计算。
可选地，在本实施例中，存储介质被设置为存储用于执行以下步骤的程序代码：通 过安全应用模块依据输入值在隔离的运算环境中进行子图计算，得到计算结果包括：依据输入值分配对应的应用程序接口，并依据输入值在隔离的运算环境中进行子图计算，得到计算结果。
进一步地，可选地，在本实施例中，存储介质被设置为存储用于执行以下步骤的程序代码：将计算结果返回预设算子包括：在运算层还包括第二运算层的情况下，将计算结果通过预设算子输入拆分后的机器学习模型中的第二运算层；其中，第一运算层位于预设算子之前，第二运算层位于预设算子之后。
上述本发明实施例序号仅仅为了描述，不代表实施例的优劣。
在本发明的上述实施例中，对各个实施例的描述都各有侧重，某个实施例中没有详述的部分，可以参见其他实施例的相关描述。
在本申请所提供的几个实施例中，应该理解到，所揭露的技术内容，可通过其它的方式实现。其中，以上所描述的装置实施例仅仅是示意性的，例如所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，单元或模块的间接耦合或通信连接，可以是电性或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本发明各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本发明的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可为个人计算机、服务器或者网络设备等)执行本发明各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、移动硬盘、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述仅是本发明的优选实施方式，应当指出，对于本技术领域的普通技术人员来说，在不脱离本发明原理的前提下，还可以做出若干改进和润饰，这些改进和润饰也应视为本发明的保护范围。

Claims (13)

  1. 一种数据处理方法，包括：
    从机器学习模型中拆分出预设数据处理模块，生成安全应用模块，其中，所述安全应用模块用于对输入所述机器学习模型中的数据进行加密计算；
    通过预设算子将拆分后的所述机器学习模型中运算层的输出值作为输入所述安全应用模块的输入值，并将所述输入值输入至所述安全应用模块；
    通过所述安全应用模块依据所述输入值在隔离的运算环境中进行子图计算，得到计算结果；
    将所述计算结果返回所述预设算子。
  2. 根据权利要求1所述的方法，其中，所述从机器学习模型中拆分出预设数据处理模块，生成安全应用模块包括：
    通过预设工具从所述机器学习模型中拆分出所述预设数据处理模块；
    依据所述预设数据处理模块生成所述安全应用模块。
  3. 根据权利要求2所述的方法，其中，所述依据所述预设数据处理模块生成所述安全应用模块包括：
    通过异构加速变异器将所述预设数据处理模块进行优化并加密，得到所述安全应用模块。
  4. 根据权利要求3所述的方法，其中，所述通过异构加速变异器将所述预设数据处理模块进行优化并加密，得到所述安全应用模块包括：
    将所述机器学习模型中的网络结构配置于所述安全应用模块的指定位置；
    对所述安全应用模块的指定位置进行加密，得到加密后的所述安全应用模块。
  5. 根据权利要求1所述的方法，其中，所述通过预设算子将拆分后的所述机器学习模型中运算层的输出值作为输入所述安全应用模块的输入值，并将所述输入值输入至所述安全应用模块包括：
    在所述运算层包括第一运算层的情况下，通过所述预设算子获取拆分后的所述机器学习模型中所述第一运算层的输出值；
    将所述输出值作为输入所述安全应用模块的输入值；
    将所述输入值输入至所述安全应用模块。
  6. 根据权利要求5所述的方法，其中，所述通过所述安全应用模块依据所述输入值在隔离的运算环境中进行子图计算，得到计算结果包括：
    依据所述输入值检测拆分后的所述机器学习模型是否存在使用授权；
    当检测拆分后的所述机器学习模型存在所述使用授权，或，检测拆分后的所述机器学习模型无需授权时，通过所述安全应用模块依据所述输入值在隔离的运算环境中进行子图计算，得到所述计算结果；
    当检测拆分后的所述机器学习模型不存在所述使用授权时，停止计算。
  7. 根据权利要求6所述的方法，其中，所述通过所述安全应用模块依据所述输入值在隔离的运算环境中进行子图计算，得到所述计算结果包括：
    依据所述输入值分配对应的应用程序接口，并依据所述输入值在隔离的运算环境中进行子图计算，得到所述计算结果。
  8. 根据权利要求7所述的方法，其中，所述将所述计算结果返回所述预设算子包括：
    在所述运算层还包括第二运算层的情况下，将所述计算结果通过所述预设算子输入拆分后的所述机器学习模型中的第二运算层；其中，所述第一运算层位于所述预设算子之前，所述第二运算层位于所述预设算子之后。
  9. 一种数据处理方法，应用于人工智能芯片，包括：
    所述人工智能芯片从机器学习模型中拆分出预设数据处理模块，生成安全应用模块；
    所述人工智能芯片通过预设算子获取拆分后的所述机器学习模型中运算层的输出值作为输入所述安全应用模块的输入值，并将所述输入值输入至所述安全应用模块；
    所述人工智能芯片通过所述安全应用模块对所述输入值进行加密计算，得到计算结果，并将所述计算结果返回所述预设算子。
  10. 一种数据处理系统，包括：
    机器学习模型、预设工具、第一执行环境和第二执行环境，其中，
    所述机器学习模型包含预设数据处理模块，通过所述预设工具从所述机器学习模型中拆分得到所述预设数据处理模块，将所述预设数据处理模块配置于所述第一执行环境，生成安全应用模块；并将拆分后的所述机器学习模型配置于所述第二执行环境；
    所述第二执行环境，用于采集数据，将采集到的所述数据作为输入所述第一执行环境中所述安全应用模块的输入值，通过预设算子将所述输入值输入所述安全应用模块，并通过所述预设算子接收所述第一执行环境中所述安全应用模块对所述输入值进行加密计算得到的计算结果。
  11. 一种数据处理装置，包括：
    拆分模块，用于从机器学习模型中拆分出预设数据处理模块，生成安全应用模块，其中，所述安全应用模块用于对输入所述机器学习模型中的数据进行加密计算；
    输入模块，用于通过预设算子将拆分后的所述机器学习模型中运算层的输出值作为输入所述安全应用模块的输入值，并将所述输入值输入至所述安全应用模块；
    获取模块，用于通过所述安全应用模块依据所述输入值在隔离的运算环境中进行子图计算，得到计算结果；
    交互模块，用于将所述计算结果返回所述预设算子。
  12. 一种非易失性存储介质，其中，所述非易失性存储介质包括存储的程序，其中，在所述程序运行时控制所述非易失性存储介质所在设备执行权利要求1所述方法。
  13. 一种处理器，其中，所述处理器用于运行程序，其中，所述程序运行时执行权 利要求1所述方法。
PCT/CN2022/070959 2021-01-15 2022-01-10 数据处理方法、装置和系统 WO2022152071A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US18/261,603 US20240080192A1 (en) 2021-01-15 2022-01-10 Data processing method, apparatus and system

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202110057899.0A CN114764501A (zh) 2021-01-15 2021-01-15 数据处理方法、装置和系统
CN202110057899.0 2021-01-15

Publications (1)

Publication Number Publication Date
WO2022152071A1 true WO2022152071A1 (zh) 2022-07-21

Family

ID=82364537

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/070959 WO2022152071A1 (zh) 2021-01-15 2022-01-10 数据处理方法、装置和系统

Country Status (3)

Country Link
US (1) US20240080192A1 (zh)
CN (1) CN114764501A (zh)
WO (1) WO2022152071A1 (zh)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110704850A (zh) * 2019-09-03 2020-01-17 华为技术有限公司 人工智能ai模型的运行方法和装置
CN110750801A (zh) * 2019-10-11 2020-02-04 矩阵元技术（深圳）有限公司 数据处理方法、装置、计算机设备和存储介质
US20200162256A1 (en) * 2018-07-03 2020-05-21 Royal Bank Of Canada System and method for anonymous location verification
CN111444528A (zh) * 2020-03-31 2020-07-24 海信视像科技股份有限公司 数据安全保护方法、装置及存储介质

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20200162256A1 (en) * 2018-07-03 2020-05-21 Royal Bank Of Canada System and method for anonymous location verification
CN110704850A (zh) * 2019-09-03 2020-01-17 华为技术有限公司 人工智能ai模型的运行方法和装置
CN110750801A (zh) * 2019-10-11 2020-02-04 矩阵元技术（深圳）有限公司 数据处理方法、装置、计算机设备和存储介质
CN111444528A (zh) * 2020-03-31 2020-07-24 海信视像科技股份有限公司 数据安全保护方法、装置及存储介质

Also Published As

Publication number Publication date
US20240080192A1 (en) 2024-03-07
CN114764501A (zh) 2022-07-19

Similar Documents

Publication Publication Date Title
CN111683071B (zh) 区块链的隐私数据处理方法、装置、设备以及存储介质
US10454902B2 (en) Techniques for secure data extraction in a virtual or cloud environment
CN101300583B (zh) 用于可信赖移动电话的简单可伸缩和可配置安全启动
CN113438289A (zh) 基于云计算的区块链数据处理方法及装置
CN109586963B (zh) 一种云仿真平台安全保障系统、服务器、终端以及方法
CN110414187B (zh) 模型安全交付自动化的系统及其方法
US11025415B2 (en) Cryptographic operation method, method for creating working key, cryptographic service platform, and cryptographic service device
CN104636679B (zh) 用于控制对加密数据的访问的方法和装置
EP3780483A1 (en) Cryptographic operation method, method for creating work key, and cryptographic service platform and device
CN105227565B (zh) 用于安卓系统的防逆向破解共享对象文件的方法和装置
CN105144189A (zh) 安全云数据库平台
KR20060018852A (ko) 랜덤 함수를 사용하는 실행의 증명
CN111949986B (zh) 业务处理方法、系统及存储介质
CN112989356A (zh) 空白安全芯片烧录方法、系统、空白安全芯片及存储介质
CN105718794A (zh) 基于vtpm对虚拟机进行安全保护的方法及系统
CN107016288A (zh) 可信执行环境
US20150195083A1 (en) Homomorphic cryptography modeling in support of privacy policies
CN103885784B (zh) 具有安全模块可插拔功能的Android平台构建方法
CN113282934B (zh) 数据处理方法及装置
CN105022965B (zh) 一种数据加密方法及装置
CN107220528A (zh) Java程序的保护与运行方法、装置和终端
WO2022152071A1 (zh) 数据处理方法、装置和系统
CN109949457B (zh) 智能门锁控制方法及相关装置
CN100550735C (zh) 多功能智能密钥设备及其安全控制的方法
CN110266699A (zh) 应用于区块链的抽奖数据上链方法及其设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22738952

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 18261603

Country of ref document: US

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 22738952

Country of ref document: EP

Kind code of ref document: A1