WO2023066205A1 - 模型数据发送方法、模型数据整合方法及装置 - Google Patents

模型数据发送方法、模型数据整合方法及装置 Download PDF

Info

Publication number
WO2023066205A1
WO2023066205A1 PCT/CN2022/125711 CN2022125711W WO2023066205A1 WO 2023066205 A1 WO2023066205 A1 WO 2023066205A1 CN 2022125711 W CN2022125711 W CN 2022125711W WO 2023066205 A1 WO2023066205 A1 WO 2023066205A1
Authority
WO
WIPO (PCT)
Prior art keywords
module
metric value
metric
application
model
Prior art date
Application number
PCT/CN2022/125711
Other languages
English (en)
French (fr)
Inventor
苏涛
Original Assignee
维沃移动通信有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 维沃移动通信有限公司 filed Critical 维沃移动通信有限公司
Publication of WO2023066205A1 publication Critical patent/WO2023066205A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G06F21/53—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by executing in a restricted environment, e.g. sandbox or secure virtual machine
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures

Definitions

  • the application belongs to the technical field of model data processing, and in particular relates to a model data sending method, a model data integration method and a device.
  • Federated learning technology is a distributed architecture training mechanism.
  • the user uses the data to train on the model of the local terminal (such as mobile phone, tablet computer, notebook, etc.), and the local terminal transmits the learned weight update amount to the server.
  • the server aggregates the weight update amounts sent by all terminals, the server model weight is updated, and the updated weight parameters are distributed to the terminals to update the terminal models.
  • Data and model poisoning refers to adding hidden doors that are difficult for humans to perceive in the training data during the model training process, such as: adding points of different colors arranged according to certain rules that cannot be seen by the naked eye in the picture; adding a paragraph in the voice
  • the ultrasonic method that meets certain rules, which is inaudible to the human ear, allows this part of the feature to be regarded as part of the sample feature during model training, which in turn leads to damage to the cloud-integrated model.
  • the purpose of the embodiment of the present application is to provide a model data sending method, model data integration method and device, which can solve the problem of adding hidden doors that are difficult or easy for humans to perceive in the training data during the model training process in the prior art, resulting in cloud integration.
  • the problem of corrupted models is to provide a model data sending method, model data integration method and device, which can solve the problem of adding hidden doors that are difficult or easy for humans to perceive in the training data during the model training process in the prior art, resulting in cloud integration.
  • the problem of corrupted models is to provide a model data sending method, model data integration method and device, which can solve the problem of adding hidden doors that are difficult or easy for humans to perceive in the training data during the model training process in the prior art, resulting in cloud integration.
  • the embodiment of the present application provides a method for sending model data, which is applied to a terminal, and the method includes:
  • the module metric value of the application module is obtained, and the module metric value is added to the in the root of trust protection space;
  • the server Based on the remote attestation method, send the root of trust information and the model data of the target model to the server, wherein the root of trust information is determined according to the device metric value, the application metric value and the module metric value of.
  • the embodiment of the present application provides a method for integrating model data, which is applied to a server, and the method includes:
  • root-of-trust information is determined according to device metric values, application metric values, and module metric values;
  • the model data is integrated.
  • the embodiment of the present application provides a device for sending model data, which is applied to a terminal, and the device includes:
  • the device metric value acquisition module is used to obtain the device metric value of each terminal module according to the execution sequence of each terminal module in the terminal after the terminal is started, and add the device metric value to the root of trust within the protected space;
  • An application metric acquisition module configured to measure the application metric of the target application before loading the target application related to the training of the target model, and add the application metric to the trusted root protection space ;
  • the module metric value obtaining module is used to obtain the module metric value of the application module according to the execution order of the application modules associated with the training of the target model in the target application program during the model training process, and adding the module metric to the root of trust protection space;
  • the trusted root information sending module is configured to send the trusted root information and the model data of the target model to the server based on a remote certification method, wherein the trusted root information is based on the device metric value, the application Metrics and the module metrics are determined.
  • the embodiment of the present application provides a model data integration device, which is applied to a server, and the device includes:
  • a model data receiving module configured to receive root-of-trust information and model data sent by the terminal, wherein the root-of-trust information is determined according to device metric values, application metric values, and module metric values;
  • a credibility determining module configured to determine the credibility of the model data based on the device metric, the application metric, and the module metric;
  • the model data integration module is configured to integrate the model data based on the credibility.
  • the embodiment of the present application provides an electronic device, the electronic device includes a processor, a memory, and a program or instruction stored in the memory and executable on the processor, and the program or instruction is executed by The processor implements the steps of the model data sending method described in the first aspect or the model data integration method described in the second aspect when executed.
  • the embodiment of the present application provides a readable storage medium, on which a program or instruction is stored, and when the program or instruction is executed by a processor, the model data transmission as described in the first aspect is realized method, or the steps of the model data integration method described in the second aspect.
  • the embodiment of the present application provides a chip, the chip includes a processor and a communication interface, the communication interface is coupled to the processor, and the processor is used to run programs or instructions, so as to implement the first aspect
  • the model data sending method described above, or the model data integration method described in the second aspect is used to run programs or instructions, so as to implement the first aspect
  • the model data sending method described above, or the model data integration method described in the second aspect is used to run programs or instructions, so as to implement the first aspect The model data sending method described above, or the model data integration method described in the second aspect.
  • an embodiment of the present application provides a computer program product, the program product is stored in a non-volatile storage medium, and the program product is executed by at least one processor to implement the computer program product described in the first aspect.
  • the embodiment of the present application provides an electronic device configured to execute the steps of the model data sending method described in the first aspect, or the data integration method described in the second aspect step.
  • the device measurement value of each terminal module is obtained according to the execution order of each terminal module in the terminal, and the device measurement value is added to the trusted root protection space.
  • the target application related to model training measure the application metric value of the target application and add the application metric value to the root of trust protection space.
  • the model training process according to the target application and the target model Train the execution sequence of the associated application modules, obtain the module measurement value of the application module, and add the module measurement value to the root of trust protection space, and send the root of trust information and model data of the target model to the server based on the remote certification method , wherein the root of trust information is determined according to device metric values, application metric values, and module metric values.
  • this method can prevent the loaded software modules (such as after being maliciously modified) from tampering with their own measurement values, reducing the risk of data and model poisoning attacks on the cloud when integrating model parameters. possibility.
  • Fig. 1 is a flow chart of the steps of a method for sending model data provided by an embodiment of the present application
  • FIG. 2 is a schematic diagram of establishing a trusted chain provided by an embodiment of the present application
  • FIG. 3 is a flow chart of the steps of a model data integration method provided in the embodiment of the present application.
  • FIG. 4 is a schematic structural diagram of a model data sending device provided in an embodiment of the present application.
  • FIG. 5 is a schematic structural diagram of a data integration device provided by an embodiment of the present application.
  • FIG. 6 is a schematic structural diagram of an electronic device provided in an embodiment of the present application.
  • FIG. 7 is a schematic structural diagram of another electronic device provided by an embodiment of the present application.
  • FIG. 1 it shows a flow chart of the steps of a method for sending model data provided by an embodiment of the present application.
  • the method for sending model data can be applied to a terminal.
  • the method for sending model data can include the following steps:
  • Step 101 After the terminal is started, according to the execution sequence of each terminal module in the terminal, obtain the device metric value of each terminal module, and add the device metric value into the trusted root protection space.
  • the embodiments of the present application can be applied to a scenario where all loaded software modules are measured by measurement modules in previous software modules before being loaded to prevent loaded software modules from tampering with their own measurement values.
  • the device metric value refers to a metric value obtained by measuring each terminal module in the terminal before execution, and the metric value can be used to indicate the probability that the terminal module is maliciously tampered with.
  • the device measurement value of each terminal module can be obtained according to the execution order of each terminal module in the terminal, and the device measurement value can be added to the trusted root protection space.
  • the terminal module can include: BIOS (Basic Input Output System, Basic Input Output System), boot loader, system kernel, and system service module.
  • BIOS Basic Input Output System
  • boot loader boot loader
  • system kernel system kernel
  • system service module system service module
  • the above step 101 may include:
  • Sub-step A1 After the terminal is started, based on the basic input output system BIOS, adding the first device metric value of the BIOS into the root of trust protection space.
  • the first device metric value refers to the metric value of the BIOS of the terminal, and the first device metric value may be used to indicate the probability that the BIOS is maliciously tampered with.
  • its own first device metric value may be added to the trusted root protection space based on the BIOS.
  • sub-step A2 After adding the first device metric value of the BIOS to the root of trust protection space through the basic input output system, sub-step A2 is performed.
  • Sub-step A2 Obtain a second device metric value of the boot loader of the terminal based on the BIOS, and add the second device metric value to the trusted root protection space.
  • the second device metric value refers to the metric value of the boot loader measured by the BIOS, and the second device metric value may be used to indicate the probability that the boot loader is maliciously tampered with.
  • the second device metric value of the boot loader of the terminal can be measured based on the measurement module of the BIOS, and the bootloader can be booted by the measurement module of the BIOS.
  • the loader's second device metric is added in the root of trust protection space.
  • sub-step A3 After adding the metric value of the second device to the root of trust protection space through the BIOS, sub-step A3 is performed.
  • Sub-step A3 Obtain a third device metric value of the system kernel of the terminal based on the boot loader, and add the third device metric value to the trusted root protection space.
  • the third device metric value refers to the metric value of the system kernel of the terminal, and the third device metric value may be used to indicate the probability that the system kernel is maliciously tampered with.
  • the third device metric value of the system kernel of the terminal can be measured based on the metric module of the boot loader, and then the third device metric value of the terminal system kernel can be measured by the metric module of the boot loader. Device metrics are added in the root of trust protection space.
  • Sub-step A4 is performed after the third device metric is added in the root of trust protection space by the bootloader.
  • Sub-step A4 Obtain a fourth device metric value of the system service module of the terminal based on the system kernel, and add the fourth device metric value into the trusted root protection space.
  • the fourth device metric value refers to the metric value of the system service module of the terminal, and the fourth device metric value may be used to indicate the probability that the system service module is maliciously tampered with.
  • the fourth device metric value of the system service module of the terminal can be obtained based on the metric module metric of the system kernel, and through the metric of the system kernel The module adds a fourth device metric to the root of trust protection space.
  • the above device measurement value acquisition scheme uses the previous loaded terminal device to measure the next loaded terminal device, thereby preventing the subsequent loaded terminal device from tampering with its own measurement value, resulting in possible
  • the chain of trust is broken, which reduces the possibility of data and model poisoning attacks on the cloud when integrating model parameters.
  • Step 102 is executed after the device metric values of each terminal module are acquired according to the execution sequence of each terminal module in the terminal, and the device metric values are added to the root of trust protection space.
  • Step 102 Before loading the target application program related to the training of the target model, measure the application metric value of the target application program, and add the application metric value into the trusted root protection space.
  • the target model refers to a model that is trained locally on the terminal.
  • the target model can be a text recognition model, a location recognition model, etc.
  • the specific type of the target model can be determined according to business requirements. This is not limited.
  • the target application program refers to the model related to the training of the target model, that is, the training of the target model is completed through the target application program.
  • the target application program may be one application program or multiple application programs. Specifically, the number of target application programs may be determined according to business requirements, which is not limited in this embodiment.
  • the application metric value refers to the metric value of the target application program for training the target model, and the application metric value can be used to indicate the probability that the target application program is maliciously tampered with.
  • the measurement value of the target application program that is, the application measurement value
  • the measurement value of the target application program can be obtained based on the measurement module in the last loaded system service module of each terminal module in the terminal.
  • the application measurement value of the target application program is measured by the measurement module in the system service module, the application measurement value can be added to the root of trust protection space through the measurement module.
  • the measurement value of the target application is measured by the previously loaded system service module, which can prevent the target application from modifying its own measurement value after the target application is loaded, resulting in possible
  • the chain of trust is broken, which increases the possibility that the cloud will be attacked by data and model poisoning when integrating model parameters.
  • step 103 After measuring the application measurement value of the target application program and adding the application measurement value to the root of trust protection space, step 103 is executed.
  • Step 103 In the process of model training, according to the execution order of the application modules associated with the training of the target model in the target application program, obtain the module measurement value of the application module, and calculate the module measurement value Added to the trusted root protection space.
  • the application module refers to the modules used in the process of training the target application program.
  • the application modules in the target application program may include: data collection module, data training module and data upload module.
  • the data collection module can be used For the collection of sample data for target model training
  • the data training module can be used as a module used in the process of target model training.
  • the data upload module refers to a module that uploads the model data of the target model to the server after the training of the target model is completed in the target application program.
  • the module metric value refers to the metric value of each application module in the target application program, and the module metric value can be used to indicate the probability that the application module is maliciously tampered with.
  • the module metric value of the application module can be obtained, and the module metric value can be added to the root of trust protection space.
  • step 103 may include:
  • Sub-step B1 In the process of model training, based on the measurement module of the target application, measure the first module measurement value of the data acquisition module of the target application program, and add the first module measurement value to in the root-of-trust protection space.
  • the data collection module refers to a module in the target application that collects model training samples when the target model is trained.
  • the first module metric value refers to the metric value of the data collection module in the target application program, and the first module metric value can be used to indicate the probability that the data collection module is maliciously modified.
  • the first thing to execute is the data acquisition module in the target application program.
  • the module measurement value of the data acquisition module can be obtained based on the measurement module measurement in the target application program, that is, the first A module metric.
  • the measurement module of the target application program can add the first module measurement value into the root of trust protection space.
  • sub-step B2 After adding the first module metric value into the root of trust protection space by the metric module of the target application program, sub-step B2 is executed.
  • Sub-step B2 Obtain a second module metric value of the model training module of the target application based on the data collection module, and add the second module metric value to the root of trust protection space.
  • the model training module refers to a module used to train the target model in the target application program.
  • the second module metric value refers to the metric value of the model training module in the target application program, and the second module metric value may be used to indicate the probability that the metric value of the model training module is maliciously modified.
  • the metric of the model training module can be obtained through the measurement of the data collection module value, which is the second module metric value.
  • the measurement value of the second module of the model training module After the measurement value of the second module of the model training module is obtained through the measurement of the data collection module, the measurement value of the second module can be added to the root of trust protection space through the data collection module.
  • sub-step B3 After adding the metric value of the second module into the root of trust protection space through the data acquisition module, sub-step B3 is executed.
  • Sub-step B3 Based on the model training module, measure and obtain a third module metric value of the model data upload module of the target application program, and add the third module metric value into the trusted root protection space.
  • the model data uploading module refers to a module in the target application program for uploading the model data of the target model to the server.
  • the third module metric value refers to the metric value of the model data uploading module, and the third module metric value can be used to indicate the probability that the model data uploading module is maliciously modified.
  • the measurement value of the model data upload module in the target application can be obtained through the model training module measurement, That is, the metric value of the third module. Furthermore, the metric value of the third module can be added to the root of trust protection space through the model training module.
  • the measurement value of the last loaded module is measured, which can prevent the loaded application module from modifying its own measurement value, resulting in The chain of trust is broken, which increases the possibility that the cloud will be attacked by data and model poisoning when integrating model parameters.
  • the establishment of the trusted chain is completed.
  • the measurement values of all loaded software modules are measured by the measurement modules in the previous software modules before they are loaded. And put the metric value into the protected storage space of the root of trust. This way prevents the loaded software module (for example, after being maliciously modified) from tampering with its own metric value, thus causing the chain of trust to be broken.
  • the data collection service, local training service and model parameter data upload service of federated learning on the terminal side are generally deployed in the user-side device in the form of upper-layer applications.
  • the application of the terminal-side device is measured by the system service, and the measured value is stored in the protected storage space in the root of trust.
  • the data in the trusted root can be shown in Table 1 below:
  • Step 104 is executed after obtaining the module metric value of the application module according to the execution order of the application modules associated with the training of the target model in the target application program, and adding the module metric value to the root of trust protection space.
  • Step 104 Send the root of trust information and the model data of the target model to the server based on the remote attestation method, wherein the root of trust information is based on the device metric value, the application metric value and the module Metrics are determined.
  • the chain of trust can be sent to the server based on remote attestation, that is, the root of trust information and the model data of the target model are sent to the server, wherein the root of trust information is the device measurement based on the above measurement value, application metric value and module metric value, after the server receives the trusted root information and model data sent by the terminal, the server can determine the credibility of the model data according to the device metric value, application metric value and module metric value, And the model data is integrated according to the credibility.
  • the root of trust information and model data can be encrypted based on the public and private keys issued by the server to obtain encrypted information, and the encrypted information can be sent to the server.
  • the user installs an application that uses federated learning for model training, and sends the certificate in the trusted root identity information to the cloud;
  • the cloud generates a random number, and encrypts the random number with the public key in the certificate in step 1 and sends it to the user terminal device;
  • the terminal device After the terminal device receives the random number encrypted by the public key, it decrypts the random number, and returns the random number to the cloud along with the data signature in the root-of-trust protected storage space;
  • the cloud After the cloud receives the random number for confirmation, it puts the certificate received in step 1 into its own database, and stores the software modules and measurement values loaded by the corresponding device in the database, including federated learning data collection and local training And the data upload module;
  • the cloud encrypts the latest version of the integrated model through the public key in the certificate, and sends the encrypted data to the user terminal device;
  • the user After receiving the encrypted data from the cloud, the user decrypts it with his own private key, and loads the decrypted integrated model into the AI business;
  • the federated learning collection module collects the private data, and interacts with the local training module to update the integrated model, generates model update parameters, and the model update parameters are exchanged for federated learning Data upload module.
  • the model data sending method provided by the embodiment of the present application obtains the device measurement value of each terminal module according to the execution sequence of each terminal module in the terminal after the terminal is started, and adds the device measurement value to the trusted root protection space, Before loading the target application related to the training of the target model, measure the application measurement value of the target application and add the application measurement value to the root of trust protection space.
  • the execution sequence of the application modules associated with the training of the target model obtain the module metric value of the application module, and add the module metric value to the root of trust protection space, based on the remote certification method, combine the root of trust information and the model of the target model
  • the data is sent to the server, wherein the root of trust information is determined based on the device metric, the application metric, and the module metric.
  • this method can prevent the loaded software modules (such as after being maliciously modified) from tampering with their own measurement values, reducing the risk of data and model poisoning attacks on the cloud when integrating model parameters. possibility.
  • FIG. 3 it shows a flow chart of the steps of a model data integration method provided by an embodiment of the present application.
  • the model data integration method can be applied to a server.
  • the model data integration method can include the following steps:
  • Step 301 Receive root-of-trust information and model data sent by the terminal, wherein the root-of-trust information is determined according to device metrics, application metrics, and module metrics.
  • the embodiments of the present application can be applied to a scenario in which the credibility of model data is determined in combination with root of trust information, and the model data is integrated and processed according to the credibility.
  • the server can obtain the corresponding trusted root information and model data according to the trusted chain, wherein the trusted root information is based on the device measurement value, application metric, and module metric.
  • the device metric value refers to a metric value obtained by measuring each terminal module in the terminal before execution, and the metric value can be used to indicate the probability that the terminal module is maliciously tampered with.
  • the application metric value refers to the metric value of the target application program for training the target model, and the application metric value can be used to indicate the probability that the target application program is maliciously tampered with.
  • the module metric value refers to the metric value of each application module related to model training (such as data acquisition module, model training module, model data upload module, etc.) in the target application program.
  • the module metric value can be used to indicate that the application module has been maliciously tampered with The probability.
  • step 302 After receiving the trusted root information and model data sent by the terminal, step 302 is executed.
  • Step 302 Determine the credibility of the model data based on the device metric value, the application metric value, and the module metric value.
  • the root of trust information After receiving the root of trust information and model data sent by the terminal, the root of trust information can be parsed to obtain device metrics, application metrics, and module metrics, and based on the device metrics, application metrics, and module The measurement value determines the credibility of the model data. Specifically, it can be described in detail in conjunction with the following specific implementation manners.
  • the above step 302 may include:
  • Sub-step D1 Determine whether the device metric value is within a first preset range, whether the application metric value is within a second preset range, and whether the module metric value is within a third preset range.
  • the first preset range refers to a preset numerical range corresponding to the device metric value.
  • the first preset range may be multiple numerical ranges, corresponding to the preset range corresponding to the BIOS, the preset range corresponding to the boot loader, the preset range corresponding to the system kernel, and the preset range corresponding to the system service module. Default range.
  • the second preset range refers to a preset numerical range corresponding to the application measurement value.
  • the second preset range can be one numerical range, or multiple numerical ranges. Specifically, it can be determined according to the number of application programs for training the target model.
  • the second preset range Quantity is not limited.
  • the third preset range refers to a preset numerical range corresponding to the module measurement value.
  • the third preset range may be a plurality of numerical ranges, corresponding to the preset range corresponding to the data acquisition module, the preset range corresponding to the model training module, and the preset range corresponding to the model data uploading module.
  • the device metric value After analyzing the root of trust information to obtain the device metric value, application metric value, and module metric value, it can be determined whether the device metric value is within the first preset range, whether the application metric value is within the second preset range, and whether the module metric value is within the second preset range. Whether the value is within the third preset range, so as to obtain the corresponding determination result of the measurement value.
  • Sub-step D2 Determine the credibility of the model data according to the determination results of the device metric value, the application metric value and the module metric value.
  • the determination result of the device metric value refers to a result of whether the device metric value is within a first preset range.
  • the determination result of the application metric value refers to the result of whether the application metric value is within the second preset range.
  • the determination result of the module metric value refers to a result of whether the module metric value is within the third preset range.
  • the credibility of the model data can be determined according to the determination results of the equipment metric value, application metric value and module metric value That is, when the device metric value determination result indicates that the device metric value is within the first preset range, the application metric value determination result indicates that the application metric value is within the second preset range, and the module metric value determination result indicates that the module metric value is within the third preset range.
  • the reliability of the model data is the highest; otherwise, when the device metric value determination result indicates that the device metric value is not within the first preset range, and the application metric value determination result indicates that the application metric value is not within the second preset range. If the determination result of the module metric value indicates that the module metric value is not within the third preset range, it is determined that the reliability of the model data is the lowest.
  • the method of determining the credibility is not limited to the above-mentioned methods. In practical applications, other methods can also be used to determine the credibility of the model data, for example, according to the device measurement value, application measurement value and module
  • the integrity of the metric value determines the credibility of the model data. Specifically, it can be determined whether the device metric value includes the metric value of the BIOS, the metric value of the boot loader, the metric value of the system kernel, and the metric value of the system service module.
  • the manner of determining the credibility of the model data may be determined according to business requirements, which is not limited in this embodiment.
  • Step 303 Based on the credibility, integrate the model data.
  • the model data can be integrated based on the credibility. Specifically, when the credibility of the model data is low, the model data can be discarded, or the integration process of the model data can be reduced.
  • the weight of the model can reduce the risk of negative impact of malicious model data on the integrated model, and reduce the possibility of poisoning the integrated model.
  • the model data integration method receives the trusted root information and model data sent by the terminal, wherein the trusted root information is determined according to the device metric value, application metric value and module metric value, based on the device metric value , Applying the measurement value and the module measurement value to determine the credibility of the model data, and integrating the model data based on the credibility.
  • the risk of negative impact of malicious model update parameters on the integration model can be reduced, and the risk of poisoning the integration model can be reduced. possibility.
  • the execution subject may be the model data sending device or the model data integration device, or the model data sending device or the model data integration device for executing The control module of the model data transmission method or the model data integration method.
  • the model data sending device and the model data integrating device provided in the embodiment of the present application are described by taking the model data sending device or the data integrating device executing the model data integrating method as an example.
  • FIG. 4 it shows a schematic structural diagram of a model data sending device provided by an embodiment of the present application.
  • the device can be applied to a terminal.
  • the model data sending device 400 may include:
  • the device metric value obtaining module 410 is configured to obtain the device metric value of each terminal module according to the execution sequence of each terminal module in the terminal after the terminal is started, and add the device metric value to the trusted inside the root protection space;
  • An application metric acquisition module 420 configured to measure the application metric of the target application before loading the target application related to the training of the target model, and add the application metric to the trusted root protection space Inside;
  • the module metric value obtaining module 430 is configured to obtain the module metric value of the application module according to the execution sequence of the application modules associated with the training of the target model in the target application program during the model training process, and adding said module metric to said root of trust protection space;
  • the trusted root information sending module 440 is configured to send the trusted root information and the model data of the target model to the server based on the remote certification method, wherein the trusted root information is based on the device metric value, the Determined by the application metric and the module metric.
  • the device metric value acquisition module includes:
  • the first device metric value adding unit is configured to add the first device metric value of the BIOS to the trusted root protection space based on the BIOS after the terminal is started;
  • the second device metric value adding unit is configured to measure and obtain the second device metric value of the boot loader of the terminal based on the BIOS, and add the second device metric value to the trusted root protection space. ;
  • a third device metric value adding unit configured to measure and obtain a third device metric value of the system kernel of the terminal based on the bootloader, and add the third device metric value to the trusted root protection space Inside;
  • the fourth device metric value adding unit is configured to measure and obtain the fourth device metric value of the system service module of the terminal based on the system kernel, and add the fourth device metric value to the trusted root protection space Inside.
  • the module metric value acquisition module includes:
  • the first module metric value acquisition unit is configured to measure and obtain the first module metric value of the data acquisition module of the target application program based on the metric module of the target application program during the model training process, and obtain the The first module metric value is added in the root of trust protection space;
  • the second module metric value acquisition unit is configured to measure and obtain the second module metric value of the model training module of the target application based on the data acquisition module, and add the second module metric value to the trusted inside the root protection space;
  • the third module metric value acquisition unit is configured to measure and obtain the third module metric value of the model data upload module of the target application based on the model training module, and add the third module metric value to the available Inside the trusted root protection space.
  • the trusted root information sending module includes:
  • An encrypted information acquisition unit configured to encrypt the trusted root information and the model data based on the public and private keys issued by the server to obtain encrypted information
  • An encrypted information sending unit configured to send the encrypted information to the server.
  • the model data sending device provided in the embodiment of the present application obtains the device measurement value of each terminal module according to the execution sequence of each terminal module in the terminal after the terminal is started, and adds the device measurement value to the trusted root protection space, Before loading the target application related to the training of the target model, measure the application measurement value of the target application and add the application measurement value to the root of trust protection space.
  • the execution sequence of the application modules associated with the training of the target model obtain the module metric value of the application module, and add the module metric value to the root of trust protection space, based on the remote certification method, combine the root of trust information and the model of the target model
  • the data is sent to the server, wherein the root of trust information is determined based on the device metric, the application metric, and the module metric.
  • this method can prevent the loaded software modules (such as after being maliciously modified) from tampering with their own measurement values, reducing the risk of data and model poisoning attacks on the cloud when integrating model parameters. possibility.
  • FIG. 5 it shows a schematic structural diagram of a model data integration device provided by an embodiment of the present application.
  • the model data integration device can be applied to a server.
  • the model data integration device 500 can include the following modules:
  • the model data receiving module 510 is configured to receive root-of-trust information and model data sent by the terminal, wherein the root-of-trust information is determined according to device metric values, application metric values, and module metric values;
  • a credibility determining module 520 configured to determine the credibility of the model data based on the device metric, the application metric, and the module metric;
  • the model data integration module 530 is configured to integrate the model data based on the credibility.
  • the credibility determination module includes:
  • a metric value determining unit configured to determine whether the device metric value is within a first preset range, whether the application metric value is within a second preset range, and whether the module metric value is within a third preset range ;
  • the second credibility determination unit is configured to determine the credibility of the model data according to the equipment metric value determination result, the application metric value determination result and the module metric value determination result.
  • model data integration module includes:
  • a model data integration unit configured to reduce the weight of the model data and integrate the model data after the weight reduction when the credibility is lower than the credibility threshold;
  • a model data discarding unit configured to discard the model data when the credibility is lower than a credibility threshold.
  • the model data integration device receives the root of trust information and model data sent by the terminal, wherein the root of trust information is determined according to the device metric value, application metric value and module metric value, based on the device metric value , Applying the measurement value and the module measurement value to determine the credibility of the model data, and integrating the model data based on the credibility.
  • the risk of negative impact of malicious model update parameters on the integration model can be reduced, and the risk of poisoning the integration model can be reduced. possibility.
  • the model data sending device or data integration device in the embodiment of the present application may be a device, or a component, an integrated circuit, or a chip in a terminal.
  • the device may be a mobile electronic device or a non-mobile electronic device.
  • the mobile electronic device may be a mobile phone, a tablet computer, a notebook computer, a handheld computer, a vehicle electronic device, a wearable device, an ultra-mobile personal computer (ultra-mobile personal computer, UMPC), a netbook or a personal digital assistant (personal digital assistant).
  • non-mobile electronic devices can be servers, network attached storage (Network Attached Storage, NAS), personal computer (personal computer, PC), television (television, TV), teller machine or self-service machine, etc., this application Examples are not specifically limited.
  • Network Attached Storage NAS
  • personal computer personal computer, PC
  • television television
  • teller machine or self-service machine etc.
  • the model data sending device or data integration device in the embodiment of the present application may be a device with an operating system.
  • the operating system may be an Android (Android) operating system, an ios operating system, or other possible operating systems, which are not specifically limited in this embodiment of the present application.
  • the model data sending device or the model data integration device provided in the embodiment of the present application can realize various processes realized by the method embodiment in FIG. 1 or FIG. 3 , and details are not repeated here to avoid repetition.
  • the embodiment of the present application further provides an electronic device 600, including a processor 601, a memory 602, and programs or instructions stored in the memory 602 and operable on the processor 601,
  • an electronic device 600 including a processor 601, a memory 602, and programs or instructions stored in the memory 602 and operable on the processor 601
  • the program or instruction is executed by the processor 601
  • each process of the above-mentioned model data sending device or model data integration method embodiment can be achieved, and the same technical effect can be achieved. To avoid repetition, details are not repeated here.
  • the electronic devices in the embodiments of the present application include the above-mentioned mobile electronic devices and non-mobile electronic devices.
  • FIG. 7 is a schematic diagram of a hardware structure of an electronic device implementing an embodiment of the present application.
  • the electronic device 700 includes, but is not limited to: a radio frequency unit 701, a network module 702, an audio output unit 703, an input unit 704, a sensor 705, a display unit 706, a user input unit 707, an interface unit 708, a memory 709, and a processor 710, etc. part.
  • the electronic device 700 can also include a power supply (such as a battery) for supplying power to various components, and the power supply can be logically connected to the processor 710 through the power management system, so that the management of charging, discharging, and function can be realized through the power management system. Consumption management and other functions.
  • a power supply such as a battery
  • the structure of the electronic device shown in FIG. 7 does not constitute a limitation to the electronic device.
  • the electronic device may include more or fewer components than shown in the figure, or combine some components, or arrange different components, and details will not be repeated here. .
  • the processor 710 is configured to obtain the device metric value of each terminal module according to the execution sequence of each terminal module in the terminal after the terminal is started, and add the device metric value to the root of trust In the protection space; before loading the target application program related to the training of the target model, measure the application metric value of the target application program, and add the application metric value to the root of trust protection space; During the training process, according to the execution order of the application modules associated with the training of the target model in the target application program, obtain the module metric value of the application module, and add the module metric value to the trusted In the root protection space; based on the remote certification method, send the root of trust information and the model data of the target model to the server, wherein the root of trust information is based on the device metric value, the application metric value and the determined by the module metrics described above.
  • this method prevents loaded software modules (such as after being maliciously modified) from tampering with their own measurement values, reducing the possibility of data and model poisoning attacks on the cloud when integrating model parameters sex.
  • the processor 710 is further configured to add the first device metric value of the BIOS to the root of trust protection space based on the basic input output system BIOS after the terminal is started; based on the BIOS , measure and obtain the second device metric value of the boot loader of the terminal, and add the second device metric value to the trusted root protection space; based on the boot loader, measure and obtain the terminal's A third device metric value of the system kernel, and adding the third device metric value into the root of trust protection space; based on the system kernel, measure the fourth device metric value of the system service module of the terminal , and adding the fourth device metric value into the trusted root protection space.
  • the processor 710 is further configured to obtain the first module metric value of the data acquisition module of the target application program based on the measurement module of the target application program during the model training process, and obtain the obtained The first module metric value is added in the trusted root protection space; based on the data collection module, the second module metric value of the model training module of the target application is measured, and the second module metric is value is added in the trusted root protection space; based on the model training module, measure the third module metric value of the model data upload module of the target application, and add the third module metric value to the within the root of trust protection space described above.
  • the processor 710 is further configured to encrypt the root of trust information and the model data based on the public and private keys issued by the server to obtain encrypted information; and send the encrypted information to the server.
  • the embodiment of this application encrypts the root of trust information based on the public and private keys issued by the server, so as to avoid the risk of tampering during the transmission of model data, and further reduce the risk of data and model poisoning attacks on the cloud when integrating model parameters. possibility.
  • the processor 710 is further configured to receive root-of-trust information and model data sent by the terminal, where the root-of-trust information is determined according to device metric values, application metric values, and module metric values; based on the The device metric value, the application metric value and the module metric value determine the credibility of the model data; based on the credibility, the model data is integrated.
  • the processor 710 is further configured to determine whether the device metric value is within a first preset range, whether the application metric value is within a second preset range, and whether the module metric value is within a third preset range. Within a preset range; determine the credibility of the model data according to the measurement result.
  • the processor 710 is further configured to reduce the weight of the model data and integrate the weighted model data when the credibility is lower than a credibility threshold; or in the If the reliability is lower than the reliability threshold, the model data is discarded.
  • the risk of negative impact of malicious model update parameters on the integration model is reduced, and the possibility of poisoning the integration model is reduced.
  • the input unit 704 may include a graphics processor (Graphics Processing Unit, GPU) 7041 and a microphone 7042, and the graphics processor 7041 is used for the image capture device (such as the image data of the still picture or video obtained by the camera) for processing.
  • the display unit 706 may include a display panel 7061, and the display panel 7061 may be configured in the form of a liquid crystal display, an organic light emitting diode, or the like.
  • the user input unit 707 includes a touch panel 7071 and other input devices 7072 .
  • the touch panel 7071 is also called a touch screen.
  • the touch panel 7071 may include two parts, a touch detection device and a touch controller.
  • Other input devices 7072 may include, but are not limited to, physical keyboards, function keys (such as volume control buttons, switch buttons, etc.), trackballs, mice, and joysticks, which will not be repeated here.
  • Memory 709 may be used to store software programs as well as various data, including but not limited to application programs and operating systems.
  • the processor 710 may integrate an application processor and a modem processor, wherein the application processor mainly processes an operating system, user interface, application program, etc., and the modem processor mainly processes wireless communication. It can be understood that the foregoing modem processor may not be integrated into the processor 710 .
  • the embodiment of the present application also provides a readable storage medium, on which a program or instruction is stored, and when the program or instruction is executed by a processor, each of the above-mentioned model data sending method or model data integration method embodiment is realized. process, and can achieve the same technical effect, in order to avoid repetition, it will not be repeated here.
  • the processor is the processor in the electronic device described in the above embodiments.
  • the readable storage medium includes computer readable storage medium, such as computer read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), magnetic disk or optical disk, etc.
  • the embodiment of the present application further provides a chip, the chip includes a processor and a communication interface, the communication interface is coupled to the processor, and the processor is used to run programs or instructions to implement the above-mentioned model data sending method or model
  • the processor is used to run programs or instructions to implement the above-mentioned model data sending method or model
  • chips mentioned in the embodiments of the present application may also be called system-on-chip, system-on-chip, system-on-a-chip, or system-on-a-chip.
  • the term “comprising”, “comprising” or any other variation thereof is intended to cover a non-exclusive inclusion such that a process, method, article or apparatus comprising a set of elements includes not only those elements, It also includes other elements not expressly listed, or elements inherent in the process, method, article, or device. Without further limitations, an element defined by the phrase “comprising a " does not preclude the presence of additional identical elements in the process, method, article, or apparatus comprising that element.
  • the scope of the methods and devices in the embodiments of the present application is not limited to performing functions in the order shown or discussed, and may also include performing functions in a substantially simultaneous manner or in reverse order according to the functions involved. Functions are performed, for example, the described methods may be performed in an order different from that described, and various steps may also be added, omitted, or combined. Additionally, features described with reference to certain examples may be combined in other examples.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Stored Programmes (AREA)
  • Storage Device Security (AREA)

Abstract

一种模型数据发送方法、模型数据整合方法及装置，属于模型数据处理领域。模型数据发送方法包括：在终端启动之后，依据终端内各个终端模块的执行顺序，获取各个终端模块的设备度量值，并将设备度量值添加于可信根保护空间内；在加载与目标模型的训练相关的目标应用程序之前，度量目标应用程序的应用度量值，并将应用度量值添加至可信根保护空间内；在进行模型训练的过程中，根据目标应用程序内与目标模型的训练关联的应用模块的执行顺序，获取应用模块的模块度量值，并将模块度量值添加至可信根保护空间内；基于远程证明方式，将可信根信息和目标模型的模型数据发送至服务器，其中，可信根信息是根据设备度量值、应用度量值和模块度量值确定的。

Description

模型数据发送方法、模型数据整合方法及装置
相关申请的交叉引用
本申请要求在2021年10月19日提交中国专利局、申请号为202111218242.4、名称为“模型数据发送方法、模型数据整合方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请属于模型数据处理技术领域，具体涉及一种模型数据发送方法、模型数据整合方法及装置。
背景技术
人工智能已经进入应用时代，能够帮助各行各业完成各类工作，提供多种服务。随着监管部门对隐私监管的升级以及用户隐私意识的增强，利用用户数据提供更高质量更全品类的AI业务的同时做好隐私保护工作已成为业界重点关注的问题。对此问题，现阶段业界普遍部署联邦学习方案增强对于用户隐私数据的保护。
联邦学习技术是一种分布式架构的训练机制。用户使用数据在本地终端(如手机、平板电脑、笔记本等)的模型上进行训练，本地终端将学习到的权重更新量传输给服务器。服务器将所有终端发来的权重更新量进行聚合后，对服务器模型权重进行更新，并将更新后的权重参数分发到终端更新终端模型。
在联邦学习的场景中，数据和模型投毒攻击非常典型，对于人工智能系统的破坏也非常大。数据和模型投毒是指在模型训练过程中，在训练数据中添加人类难以感知的暗门，如：在图片中添加肉眼无法看见的按一定规则排列且不同颜色的点；在语音中添加一段人耳听不见的满足一定规则的超声波的方法，让模型训练时，将这一部分特征当作样本特征的一部分等，进而导致云端整合的模型受损。
概述
本申请实施例的目的是提供一种模型数据发送方法、模型数据整合方法及装置，能够解决现有技术中在模型训练过程中，在训练数据中添加人类难易感知的暗门，导致云端整合的模型受损的问题。
第一方面，本申请实施例提供了一种模型数据发送方法，应用于 终端，该方法包括：
在所述终端启动之后，依据所述终端内各个终端模块的执行顺序，获取各个所述终端模块的设备度量值，并将所述设备度量值添加于可信根保护空间内；
在加载与目标模型的训练相关的目标应用程序之前，度量所述目标应用程序的应用度量值，并将所述应用度量值添加至所述可信根保护空间内；
在进行模型训练的过程中，根据所述目标应用程序内与所述目标模型的训练关联的应用模块的执行顺序，获取所述应用模块的模块度量值，并将所述模块度量值添加至所述可信根保护空间内；
基于远程证明方式，将可信根信息和所述目标模型的模型数据发送至服务器，其中，所述可信根信息是根据所述设备度量值、所述应用度量值和所述模块度量值确定的。
第二方面，本申请实施例提供了一种模型数据整合方法，应用于服务器，该方法包括：
接收终端发送的可信根信息和模型数据，其中，所述可信根信息是根据设备度量值、应用度量值和模块度量值确定的；
基于所述设备度量值、所述应用度量值和所述模块度量值，确定所述模型数据的可信度；
基于所述可信度，对所述模型数据进行整合处理。
第三方面，本申请实施例提供了一种模型数据发送装置，应用于终端，该装置包括：
设备度量值获取模块，用于在所述终端启动之后，依据所述终端内各个终端模块的执行顺序，获取各个所述终端模块的设备度量值，并将所述设备度量值添加于可信根保护空间内；
应用度量值获取模块，用于在加载与目标模型的训练相关的目标应用程序之前，度量所述目标应用程序的应用度量值，并将所述应用度量值添加至所述可信根保护空间内；
模块度量值获取模块，用于在进行模型训练的过程中，根据所述目标应用程序内与所述目标模型的训练关联的应用模块的执行顺序，获取所述应用模块的模块度量值，并将所述模块度量值添加至所述可信根保护空间内；
可信根信息发送模块，用于基于远程证明方式，将可信根信息和所述目标模型的模型数据发送至服务器，其中，所述可信根信息是根据所述设备度量值、所述应用度量值和所述模块度量值确定的。
第四方面，本申请实施例提供了一种模型数据整合装置，应用于服务器，该装置包括：
模型数据接收模块，用于接收终端发送的可信根信息和模型数据，其中，所述可信根信息是根据设备度量值、应用度量值和模块度量值确定的；
可信度确定模块，用于基于所述设备度量值、所述应用度量值和所述模块度量值，确定所述模型数据的可信度；
模型数据整合模块，用于基于所述可信度，对所述模型数据进行整合处理。
第五方面，本申请实施例提供了一种电子设备，该电子设备包括处理器、存储器及存储在所述存储器上并可在所述处理器上运行的程序或指令，所述程序或指令被所述处理器执行时实现如第一方面所述的模型数据发送方法，或第二方面所述的模型数据整合方法的步骤。
第六方面，本申请实施例提供了一种可读存储介质，所述可读存储介质上存储程序或指令，所述程序或指令被处理器执行时实现如第一方面所述的模型数据发送方法，或第二方面所述的模型数据整合方法的步骤。
第七方面，本申请实施例提供了一种芯片，所述芯片包括处理器和通信接口，所述通信接口和所述处理器耦合，所述处理器用于运行程序或指令，实现如第一方面所述的模型数据发送方法，或第二方面所述的模型数据整合方法。
第八方面，本申请实施例提供了一种计算机程序产品，所述程序产品被存储在非易失的存储介质中，所述程序产品被至少一个处理器执行以实现如第一方面所述的模型数据发送方法，或第二方面所述的模型数据整合方法的步骤。
第九方面，本申请实施例提供了一种电子设备，所述电子设备被配置成用于执行如第一方面所述的模型数据发送方法的步骤，或第二方面所述的数据整合方法的步骤。
在本申请实施例中，通过在终端启动之后，依据终端内各个终端 模块的执行顺序，获取各个终端模块的设备度量值，并将设备度量值添加于可信根保护空间内，在加载与目标模型的训练相关的目标应用程序之前，度量目标应用程序的应用度量值，并将应用度量值添加至可信根保护空间内，在进行模型训练的过程中，根据目标应用程序内与目标模型的训练关联的应用模块的执行顺序，获取应用模块的模块度量值，并将模块度量值添加至可信根保护空间内，基于远程证明方式，将可信根信息和目标模型的模型数据发送至服务器，其中，可信根信息是根据设备度量值、应用度量值和模块度量值确定的。本申请实施例通过在终端启动到应用被加载的过程中，所有被加载的软件模块在被加载之前，其度量值被它之前的软件模块中的度量模块进行度量，并将度量值放入可信根的受保护存储空间中，此种方式可以防止被加载的软件模块(如被恶意修改后)对自身的度量值进行篡改，降低了云端在整合模型参数时受到数据和模型投毒攻击的可能性。
附图说明
图1为本申请实施例提供的一种模型数据发送方法的步骤流程图；
图2为本申请实施例提供的一种建立可信链的示意图；
图3为本申请实施例提供的一种模型数据整合方法的步骤流程图；
图4为本申请实施例提供的一种模型数据发送装置的结构示意图；
图5为本申请实施例提供的一种数据整合装置的结构示意图；
图6为本申请实施例提供的一种电子设备的结构示意图；
图7为本申请实施例提供的另一种电子设备的结构示意图。
详细描述
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚地描述，显然，所描述的实施例是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员获得的所有其他实施例，都属于本申请保护的范围。
本申请的说明书和权利要求书中的术语“第一”、“第二”等是用于区别类似的对象，而不用于描述特定的顺序或先后次序。应该理解这样使用的数据在适当情况下可以互换，以便本申请的实施例能够以除了在这里图示或描述的那些以外的顺序实施，且“第一”、“第二”等所区分的对象通常为一类，并不限定对象的个数，例如第一对象可以是一个，也可以是多个。此外，说明书以及权利要求中“和/或”表示所连接对象的至少其中之一，字符“/”，一般 表示前后关联对象是一种“或”的关系。
下面结合附图，通过具体的实施例及其应用场景对本申请实施例提供的模型数据发送方法进行详细地说明。
参照图1，示出了本申请实施例提供的一种模型数据发送方法的步骤流程图，该模型数据发送方法可以应用于终端，如图1所示，该模型数据发送方法可以包括如下步骤：
步骤101：在所述终端启动之后，依据所述终端内各个终端模块的执行顺序，获取各个所述终端模块的设备度量值，并将所述设备度量值添加于可信根保护空间内。
本申请实施例可以应用于通过在所有被加载的软件模块在被加载之前，被它之前的软件模块中的度量模块进行度量以防止被加载的软件模块对自身的度量值进行篡改的场景中。
设备度量值是指终端内各个终端模块在执行之前被度量得到的度量值，该度量值可以用于指示终端模块被恶意篡改的概率。
在本实施例中，在终端启动之后，可以依据终端内各个终端模块的执行顺序，获取各个终端模块的设备度量值，并将设备度量值添加于可信根保护空间内，在本示例中，终端模块可以包括：BIOS(基本输入输出系统，Basic Input Output System)、启动加载器、系统内核、系统服务模块，在获取设备度量值时，可以按照被加载的终端模块的执行顺序，由前一被加载的终端模块度量后一被加载的终端模块的度量值，具体地，可以结合图2和下述具体实现方式进行详细描述。
在本申请的一种具体实现方式中，上述步骤101可以包括：
子步骤A1：在所述终端启动之后，基于基本输入输出系统BIOS，将所述BIOS的第一设备度量值添加至所述可信根保护空间内。
在本实施例中，第一设备度量值是指终端的BIOS的度量值，该第一设备度量值可以用于指示BIOS被恶意篡改的概率。
在终端启动之后，可以基于BIOS将自身的第一设备度量值添加至可信根保护空间内。
在通过基本输入输出系统将BIOS的第一设备度量值添加至可信根保护空间之后，执行子步骤A2。
子步骤A2：基于所述BIOS，度量得到所述终端的启动加载器的第二设备度量值，并将所述第二设备度量值添加于所述可信根保护空间内。
第二设备度量值是指由BIOS度量的启动加载器的度量值，该第二设备度量值可以用于指示启动加载器被恶意篡改的概率。
在通过BIOS将自身的第一设备度量值添加于可信根保护空间内之后，则可以基于BIOS的度量模块度量终端的启动加载器的第二设备度量值，并通过该BIOS的度量模块将启动加载器的第二设备度量值添加于可信根保护空间内。
在通过BIOS将第二设备度量值添加于可信根保护空间之后，执行子步骤A3。
子步骤A3：基于所述启动加载器，度量得到所述终端的系统内核的第三设备度量值，并将所述第三设备度量值添加于所述可信根保护空间内。
第三设备度量值是指终端的系统内核的度量值，该第三设备度量值可以用于指示系统内核被恶意篡改的概率。
在通过BIOS将第二设备度量值添加于可信根保护空间之后，可以基于启动加载器的度量模块度量终端的系统内核的第三设备度量值，进而可以通过启动加载器的度量模块将第三设备度量值添加于可信根保护空间内。
在通过启动加载器将第三设备度量值添加于可信根保护空间内之后，执行子步骤A4。
子步骤A4：基于所述系统内核，度量得到所述终端的系统服务模块的第四设备度量值，并将所述第四设备度量值添加于所述可信根保护空间内。
第四设备度量值是指终端的系统服务模块的度量值，该第四设备度量值可以用于指示系统服务模块被恶意篡改的概率。
在通过启动加载器将第三设备度量值添加于可信根保护空间内之后，则可以基于系统内核的度量模块度量得到终端的系统服务模块的第四设备度量值，并通过该系统内核的度量模块将第四设备度量值添加于可信根保护空间内。
本申请实施例提供的上述设备度量值获取方案，通过前一被加载的终端设备度量下一被加载的终端设备，从而可以避免后一被加载的终端设备对自身的度量值进行篡改，导致可信链断裂，降低了云端在整合模型参数时受到数据和模型投毒攻击的可能性。
在依据终端内各个终端模块的执行顺序获取各个终端模块的设备度量值，并将设备度量值添加于可信根保护空间内之后，执行步骤102。
步骤102：在加载与目标模型的训练相关的目标应用程序之前，度量所 述目标应用程序的应用度量值，并将所述应用度量值添加至所述可信根保护空间内。
目标模型是指在终端本地进行训练的模型，在本示例中，目标模型可以为文本识别模型、位置识别模型等，具体地，对于目标模型的具体类型可以根据业务需求而定，本实施例对此不加以限制。
目标应用程序是指与目标模型的训练相关的模型，即通过目标应用程序完成目标模型的训练。在本示例中，目标应用程序可以为一个应用程序，也可以为多个应用程序，具体地，对于目标应用程序的数量可以根据业务需求而定，本实施例对此不加以限制。
应用度量值是指训练目标模型的目标应用程序的度量值，该应用度量值可以用于指示目标应用程序被恶意篡改的概率。
在加载于目标模型的训练相关的目标应用程序之前，则可以基于终端内各个终端模块中最后一个被加载的系统服务模块内的度量模块，度量得到目标应用程序的度量值，即应用度量值。
在通过系统服务模块内的度量模块度量得到目标应用程序的应用度量值之后，则可以通过该度量模块将该应用度量值添加于可信根保护空间内。
本申请实施例通过在加载目标应用程序之前，通过前一被加载的系统服务模块度量目标应用程序的度量值，可以避免加载目标应用程序之后，目标应用程序对自身的度量值进行修改，造成可信链断裂从而增加云端在整合模型参数时受到数据和模型投毒攻击的可能性。
在度量目标应用程序的应用度量值，并将应用度量值添加至可信根保护空间内之后，执行步骤103。
步骤103：在进行模型训练的过程中，根据所述目标应用程序内与所述目标模型的训练关联的应用模块的执行顺序，获取所述应用模块的模块度量值，并将所述模块度量值添加至所述可信根保护空间内。
应用模块是指在训练目标应用程序的过程中采用的模块，在本示例中，目标应用程序内的应用模块可以包括：数据采集模块、数据训练模块以及数据上传模块，其中，数据采集模块可以用于进行目标模型训练的样本数据的采集，数据训练模块可以用于进行目标模型训练的过程中使用的模块。数据上传模块是指在目标应用程序内完成目标模型的训练之后，将目标模型的模型数据上传至服务器的模块。
模块度量值是指目标应用程序内各个应用模块的度量值，该模块度量值 可以用于指示应用模块被恶意篡改的概率。
在进行模型训练的过程中，可以根据目标应用程序内与目标模型的训练关联的应用模块的执行顺序，获取应用模块的模块度量值，并将模块度量值添加于可信根保护空间内。具体地，可以结合下述具体实现方式进行详细描述。
在本申请的另一种具体实现方式中，上述步骤103可以包括：
子步骤B1：在进行模型训练的过程中，基于所述目标应用程序的度量模块，度量得到所述目标应用程序的数据采集模块的第一模块度量值，并将所述第一模块度量值添加于所述可信根保护空间内。
在本实施例中，数据采集模块是指在对目标模型进行训练时采集模型训练样本的目标应用程序内的模块。
第一模块度量值是指目标应用程序内的数据采集模块的度量值，该第一模块度量值可以用于指示数据采集模块被恶意修改的概率。
在进行模型训练的过程中，首先执行的是目标应用程序内的数据采集模块，在加载数据采集模块之前，可以基于目标应用程序内的度量模块度量得到该数据采集模块的模块度量值，即第一模块度量值。
在度量得到数据采集模块的第一模块度量值之后，则可以通过目标应用程序的度量模块将第一模块度量值添加于可信根保护空间内。
在通过目标应用程序的度量模块将第一模块度量值添加于可信根保护空间内之后，执行子步骤B2。
子步骤B2：基于所述数据采集模块，度量得到所述目标应用程序的模型训练模块的第二模块度量值，并将所述第二模块度量值添加于所述可信根保护空间内。
模型训练模块是指目标应用程序内的用于对目标模型进行训练的模块。
第二模块度量值是指目标应用程序内的模型训练模块的度量值，该第二模块度量值可以用于指示模型训练模块的度量值被恶意修改的概率。
在通过目标应用程序的度量模块将第一模块度量值添加于可信根保护空间内之后，则可以在目标应用程序内的模型训练模块被加载之前，通过数据采集模块度量得到模型训练模块的度量值，即第二模块度量值。
在通过数据采集模块度量得到模型训练模块的第二模块度量值之后，则可以通过数据采集模块将第二模块度量值添加于可信根保护空间内。
在通过数据采集模块将第二模块度量值添加于可信根保护空间内之后， 执行子步骤B3。
子步骤B3：基于所述模型训练模块，度量得到所述目标应用程序的模型数据上传模块的第三模块度量值，并将所述第三模块度量值添加于所述可信根保护空间内。
模型数据上传模块是指目标应用程序内的用于将目标模型的模型数据上传至服务器的模块。
第三模块度量值是指模型数据上传模块的度量值，该第三模块度量值可以用于指示模型数据上传模块被恶意修改的概率。
在通过数据采集模块将第二模块度量值添加于可信根保护空间内之后，在模型数据上传模块被加载之前，可以通过模型训练模块度量得到目标应用程序内的模型数据上传模块的度量值，即第三模块度量值，进而，可以通过模型训练模块将第三模块度量值添加于可信根保护空间内。
本申请实施例通过在目标应用程序内的与目标模型训练关联的应用模块在加载之前，被上一加载的模块进行度量值度量，可以避免被加载的应用模块将自身的度量值进行修改，造成可信链断裂从而增加云端在整合模型参数时受到数据和模型投毒攻击的可能性。
通过上述步骤即完成了可信链的建立，在设备启动到应用被加载的过程中，所有被加载的软件模块在被加载之前，其度量值被它之前的软件模块中的度量模块进行度量，并将度量值放入可信根的受保护存储空间中。这样的方式防止被加载的软件模块(如被恶意修改后)对自己的度量值进行篡改，而导致可信链断裂。
终端侧的联邦学习的数据采集业务和本地训练业务以及模型参数数据上传业务一般是以上层应用的方式部署于用户端侧设备中。在进行终端侧设备可信链建立的过程中，终端侧设备应用被系统服务进行度量，并将度量值存储于可信根中受保护存储空间中。当设备的可信链建成之后，可信根中的数据可以如下表1所示：
表1：
Figure PCTCN2022125711-appb-000001
通过上述表1可知，可信根中受保护存储空间内存有端侧设备由设备启动开始所有加载的软件模块的名称和对应的度量值。
在根据目标应用程序内与目标模型的训练关联的应用模块的执行顺序获取应用模块的模块度量值，并将模块度量值添加至可信根保护空间内之后，执行步骤104。
步骤104：基于远程证明方式，将可信根信息和所述目标模型的模型数据发送至服务器，其中，所述可信根信息是根据所述设备度量值、所述应用度量值和所述模块度量值确定的。
在建立上述可信链之后，则可以基于远程证明方式将可信链发送至服务器，即将可信根信息和目标模型的模型数据发送至服务器，其中，可信根信息是根据上述度量的设备度量值、应用度量值和模块度量值，在服务器接收到终端发送的可信根信息和模型数据之后，则可以由服务器根据设备度量值、应用度量值和模块度量值确定模型数据的可信度，并根据可信度对模型数据进行整合。具体地，可以基于服务器下发的公私钥对可信根信息和模型数据进行加密，以得到加密信息，并发送加密信息至服务器。
对于上述过程可以结合下述步骤进行详细描述。
1、用户安装使用联邦学习的进行模型训练的应用，将可信根身份信息中的证书发送给云端；
2、云端产生随机数，并将该随机数使用步骤1证书中的公钥进行加密发送给用户终端设备；
3、终端设备接收到被公钥加密的随机数后，将随机数进行解密，并将随机数伴随可信根受保护存储空间中的数据签名后返回给云端；
4、云端接收到随机数进行确认后，将步骤1收到的证书放入自身的数据库中，并将对应的设备加载的软件模块和度量值存储于数据库中，包括联邦学习数据采集，本地训练以及数据上传模块；
5、云端将最新版本的整合模型通过证书中公钥加密，并将加密后数据发往用户终端设备；
6、用户在接受到云端加密数据后，使用自己的私钥进行解密，并将解密后的整合模型加载到该AI业务；
7、当用户使用该AI业务时，产生对应的隐私数据，联邦学习采集模块对该隐私数据进行采集，并交往本地训练模块对整合模型进行更新，产生模型更新参数，模型更新参数被交往联邦学习数据上传模块。
本申请实施例提供的模型数据发送方法，通过在终端启动之后，依据终端内各个终端模块的执行顺序，获取各个终端模块的设备度量值，并将设备度量值添加于可信根保护空间内，在加载与目标模型的训练相关的目标应用程序之前，度量目标应用程序的应用度量值，并将应用度量值添加至可信根保护空间内，在进行模型训练的过程中，根据目标应用程序内与目标模型的训练关联的应用模块的执行顺序，获取应用模块的模块度量值，并将模块度量值添加至可信根保护空间内，基于远程证明方式，将可信根信息和目标模型的模型数据发送至服务器，其中，可信根信息是根据设备度量值、应用度量值和模块度量值确定的。本申请实施例通过在终端启动到应用被加载的过程中，所有被加载的软件模块在被加载之前，其度量值被它之前的软件模块中的度量模块进行度量，并将度量值放入可信根的受保护存储空间中，此种方式可以防止被加载的软件模块(如被恶意修改后)对自身的度量值进行篡改，降低了云端在整合模型参数时受到数据和模型投毒攻击的可能性。
参照图3，示出了本申请实施例提供的一种模型数据整合方法的步骤流程图，该模型数据整合方法可以应用于服务器，如图3所示，该模型数据整合方法可以包括如下步骤：
步骤301：接收终端发送的可信根信息和模型数据，其中，所述可信根 信息是根据设备度量值、应用度量值和模块度量值确定的。
本申请实施例可以应用于结合可信根信息确定模型数据的可信度，并根据可信度对模型数据进行整合处理的场景中。
在终端通过上述实施例建立可信链并将可信链发送至服务器之后，则可以由服务器根据可信链获取到相应的可信根信息和模型数据，其中，可信根信息是根据设备度量值、应用度量值和模块度量值确定的。
设备度量值是指终端内各个终端模块在执行之前被度量得到的度量值，该度量值可以用于指示终端模块被恶意篡改的概率。
应用度量值是指训练目标模型的目标应用程序的度量值，该应用度量值可以用于指示目标应用程序被恶意篡改的概率。
模块度量值是指目标应用程序内与模型训练相关的各个应用模块(如数据采集模块、模型训练模块、模型数据上传模块等)的度量值，该模块度量值可以用于指示应用模块被恶意篡改的概率。
在接收到终端发送的可信根信息和模型数据之后，执行步骤302。
步骤302：基于所述设备度量值、所述应用度量值和所述模块度量值，确定所述模型数据的可信度。
在接收到终端发送的可信根信息和模型数据之后，则可以对可信根信息进行解析，以得到设备度量值、应用度量值和模块度量值，并基于设备度量值、应用度量值和模块度量值确定模型数据的可信度，具体地，可以结合下述具体实现方式进行详细描述。
在本申请的一种具体实现方式中，上述步骤302可以包括：
子步骤D1：确定所述设备度量值是否处于第一预设范围内、所述应用度量值是否处于第二预设范围内，及所述模块度量值是否处于第三预设范围内。
第一预设范围是指设备度量值对应的预设数值范围。在本示例中，第一预设范围可以为多个数值范围，分别对应于BIOS对应的预设范围，启动加载器对应的预设范围，系统内核对应的预设范围，以及系统服务模块对应的预设范围。
第二预设范围是指应用度量值对应的预设数值范围。在本示例中，第二预设范围可以为一个数值范围，也可以为多个数值范围，具体地，可以根据训练目标模型的应用程序的数量而定，本实施例对于第二预设范围的数量不加以限制。
第三预设范围是指模块度量值对应的预设数值范围。第三预设范围可以为多个数值范围，分别对应于数据采集模块对应的预设范围，模型训练模块对应的预设范围，模型数据上传模块对应的预设范围。
在解析可信根信息得到设备度量值、应用度量值和模块度量值之后，则可以确定设备度量值是否处于第一预设范围内、应用度量值是否处于第二预设范围内，及模块度量值是否处于第三预设范围内，以得到相应的度量值确定结果。
子步骤D2：根据设备度量值的确定结果、应用度量值的确定结果和模块度量值的确定结果，确定所述模型数据的可信度。
设备度量值的确定结果是指设备度量值是否处于第一预设范围内的结果。
应用度量值的确定结果是指应用度量值是否处于第二预设范围内的结果。
模块度量值的确定结果是指模块度量值是否处于第三预设范围内的结果。
在得到设备度量值的确定结果、应用度量值的确定结果和模块度量值的确定结果之后，则可以根据设备度量值确定结果、应用度量值确定结果和模块度量值确定结果确定模型数据的可信度，即在设备度量值确定结果指示设备度量值处于第一预设范围内、应用度量值确定结果指示应用度量值处于第二预设范围内、模块度量值确定结果指示模块度量值处于第三预设范围内时，则确定模型数据的可信度最高，反之，在设备度量值确定结果指示设备度量值未处于第一预设范围内、应用度量值确定结果指示应用度量值未处于第二预设范围内、模块度量值确定结果指示模块度量值未处于第三预设范围内时，则确定模型数据的可信度最低等。
当然，在具体实现中，对于可信度的确定方式不仅限于上述方式，在实际应用中，还可以采用其它方式确定模型数据的可信度，例如，可以根据设备度量值、应用度量值和模块度量值的完整度确定模型数据的可信度，具体地，可以确定设备度量值是否包含BIOS的度量值、启动加载器的度量值、系统内核的度量值以及系统服务模块的度量值，确定应用度量值是否包含训练目标模型的全部应用程序的度量值，以及确定模块度量值中是否包含训练目标模型的目标应用程序内的全部应用模块的度量值等，以此确定模型数据的可信度，对于确定模型数据的可信度的方式可以根据业务需求而定，本实 施例对此不加以限制。
步骤303：基于所述可信度，对所述模型数据进行整合处理。
在确定模型数据的可信度之后，则可以基于可信度对模型数据进行整合处理，具体地，当模型数据的可信度为低时，可以丢弃该模型数据，或者降低该模型数据在整合模型时的权重，达到降低恶意模型数据对于整合模型造成负面影响的风险，降低对整合模型投毒的可能性。
本申请实施例提供的模型数据整合方法，通过接收终端发送的可信根信息和模型数据，其中，可信根信息是根据设备度量值、应用度量值和模块度量值确定的，基于设备度量值、应用度量值和模块度量值确定模型数据的可信度，并基于可信度对模型数据进行整合处理。本申请实施例通过丢弃可信度低的模型更新参数，或者降低该模型更新参数在整合模型时的权重，达到降低恶意模型更新参数对于整合模型造成负面影响的风险，降低对整合模型投毒的可能性。
需要说明的是，本申请实施例提供的模型数据发送或模型数据整合方法，执行主体可以为模型数据发送装置或模型数据整合装置，或者该模型数据发送装置或模型数据整合装置中的用于执行模型数据发送方法或模型数据整合方法的控制模块。本申请实施例中以模型数据发送装置或数据整合装置执行模型数据整合方法为例，说明本申请实施例提供的模型数据发送装置和模型数据整合装置。
参照图4，示出了本申请实施例提供的一种模型数据发送装置的结构示意图，该装置可以应用于终端，如图4所示，该模型数据发送装置400可以包括：
设备度量值获取模块410，用于在所述终端启动之后，依据所述终端内各个终端模块的执行顺序，获取各个所述终端模块的设备度量值，并将所述设备度量值添加于可信根保护空间内；
应用度量值获取模块420，用于在加载与目标模型的训练相关的目标应用程序之前，度量所述目标应用程序的应用度量值，并将所述应用度量值添加至所述可信根保护空间内；
模块度量值获取模块430，用于在进行模型训练的过程中，根据所述目标应用程序内与所述目标模型的训练关联的应用模块的执行顺序，获取所述应用模块的模块度量值，并将所述模块度量值添加至所述可信根保护空间内；
可信根信息发送模块440，用于基于远程证明方式，将可信根信息和所述目标模型的模型数据发送至服务器，其中，所述可信根信息是根据所述设备度量值、所述应用度量值和所述模块度量值确定的。
可选地，所述设备度量值获取模块包括：
第一设备度量值添加单元，用于在所述终端启动之后，基于基本输入输出系统BIOS，将所述BIOS的第一设备度量值添加至所述可信根保护空间内；
第二设备度量值添加单元，用于基于所述BIOS，度量得到所述终端的启动加载器的第二设备度量值，并将所述第二设备度量值添加于所述可信根保护空间内；
第三设备度量值添加单元，用于基于所述启动加载器，度量得到所述终端的系统内核的第三设备度量值，并将所述第三设备度量值添加于所述可信根保护空间内；
第四设备度量值添加单元，用于基于所述系统内核，度量得到所述终端的系统服务模块的第四设备度量值，并将所述第四设备度量值添加于所述可信根保护空间内。
可选地，所述模块度量值获取模块包括：
第一模块度量值获取单元，用于在进行模型训练的过程中，基于所述目标应用程序的度量模块，度量得到所述目标应用程序的数据采集模块的第一模块度量值，并将所述第一模块度量值添加于所述可信根保护空间内；
第二模块度量值获取单元，用于基于所述数据采集模块，度量得到所述目标应用程序的模型训练模块的第二模块度量值，并将所述第二模块度量值添加于所述可信根保护空间内；
第三模块度量值获取单元，用于基于所述模型训练模块，度量得到所述目标应用程序的模型数据上传模块的第三模块度量值，并将所述第三模块度量值添加于所述可信根保护空间内。
可选地，所述可信根信息发送模块包括：
加密信息获取单元，用于基于所述服务器下发的公私钥对所述可信根信息和所述模型数据进行加密，得到加密信息；
加密信息发送单元，用于发送所述加密信息至所述服务器。
本申请实施例提供的模型数据发送装置，通过在终端启动之后，依据终端内各个终端模块的执行顺序，获取各个终端模块的设备度量值，并将设备 度量值添加于可信根保护空间内，在加载与目标模型的训练相关的目标应用程序之前，度量目标应用程序的应用度量值，并将应用度量值添加至可信根保护空间内，在进行模型训练的过程中，根据目标应用程序内与目标模型的训练关联的应用模块的执行顺序，获取应用模块的模块度量值，并将模块度量值添加至可信根保护空间内，基于远程证明方式，将可信根信息和目标模型的模型数据发送至服务器，其中，可信根信息是根据设备度量值、应用度量值和模块度量值确定的。本申请实施例通过在终端启动到应用被加载的过程中，所有被加载的软件模块在被加载之前，其度量值被它之前的软件模块中的度量模块进行度量，并将度量值放入可信根的受保护存储空间中，此种方式可以防止被加载的软件模块(如被恶意修改后)对自身的度量值进行篡改，降低了云端在整合模型参数时受到数据和模型投毒攻击的可能性。
参照图5，示出了本申请实施例提供的一种模型数据整合装置的结构示意图，该模型数据整合装置可以应用于服务器，如图5所示，该模型数据整合装置500可以包括如下模块：
模型数据接收模块510，用于接收终端发送的可信根信息和模型数据，其中，所述可信根信息是根据设备度量值、应用度量值和模块度量值确定的；
可信度确定模块520，用于基于所述设备度量值、所述应用度量值和所述模块度量值，确定所述模型数据的可信度；
模型数据整合模块530，用于基于所述可信度，对所述模型数据进行整合处理。
可选地，所述可信度确定模块包括：
度量值确定单元，用于确定所述设备度量值是否处于第一预设范围内、所述应用度量值是否处于第二预设范围内，及所述模块度量值是否处于第三预设范围内；
第二可信度确定单元，用于根据设备度量值确定结果、应用度量值确定结果和模块度量值确定结果，确定所述模型数据的可信度。
可选地，所述模型数据整合模块包括：
模型数据整合单元，用于在所述可信度低于可信度阈值的情况下，降低所述模型数据的权重，并对降低权重后的模型数据进行整合；
模型数据丢弃单元，用于在所述可信度低于可信度阈值的情况下，丢弃所述模型数据。
本申请实施例提供的模型数据整合装置，通过接收终端发送的可信根信 息和模型数据，其中，可信根信息是根据设备度量值、应用度量值和模块度量值确定的，基于设备度量值、应用度量值和模块度量值确定模型数据的可信度，并基于可信度对模型数据进行整合处理。本申请实施例通过丢弃可信度低的模型更新参数，或者降低该模型更新参数在整合模型时的权重，达到降低恶意模型更新参数对于整合模型造成负面影响的风险，降低对整合模型投毒的可能性。
本申请实施例中的模型数据发送装置或数据整合装置可以是装置，也可以是终端中的部件、集成电路、或芯片。该装置可以是移动电子设备，也可以为非移动电子设备。示例性的，移动电子设备可以为手机、平板电脑、笔记本电脑、掌上电脑、车载电子设备、可穿戴设备、超级移动个人计算机(ultra-mobile personal computer，UMPC)、上网本或者个人数字助理(personal digital assistant，PDA)等，非移动电子设备可以为服务器、网络附属存储器(Network Attached Storage，NAS)、个人计算机(personal computer，PC)、电视机(television，TV)、柜员机或者自助机等，本申请实施例不作具体限定。
本申请实施例中的模型数据发送装置或数据整合装置可以为具有操作系统的装置。该操作系统可以为安卓(Android)操作系统，可以为ios操作系统，还可以为其他可能的操作系统，本申请实施例不作具体限定。
本申请实施例提供的模型数据发送装置或模型数据整合装置能够实现图1或图3的方法实施例实现的各个过程，为避免重复，这里不再赘述。
可选地，如图6所示，本申请实施例还提供一种电子设备600，包括处理器601，存储器602，存储在存储器602上并可在所述处理器601上运行的程序或指令，该程序或指令被处理器601执行时实现上述模型数据发送装置或模型数据整合方法实施例的各个过程，且能达到相同的技术效果，为避免重复，这里不再赘述。
需要说明的是，本申请实施例中的电子设备包括上述所述的移动电子设备和非移动电子设备。
图7为实现本申请实施例的一种电子设备的硬件结构示意图。
该电子设备700包括但不限于：射频单元701、网络模块702、音频输出单元703、输入单元704、传感器705、显示单元706、用户输入单元707、接口单元708、存储器709、以及处理器710等部件。
本领域技术人员可以理解，电子设备700还可以包括给各个部件供电的 电源(比如电池)，电源可以通过电源管理系统与处理器710逻辑相连，从而通过电源管理系统实现管理充电、放电、以及功耗管理等功能。图7中示出的电子设备结构并不构成对电子设备的限定，电子设备可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件布置，在此不再赘述。
其中，处理器710，用于在所述终端启动之后，依据所述终端内各个终端模块的执行顺序，获取各个所述终端模块的设备度量值，并将所述设备度量值添加于可信根保护空间内；在加载与目标模型的训练相关的目标应用程序之前，度量所述目标应用程序的应用度量值，并将所述应用度量值添加至所述可信根保护空间内；在进行模型训练的过程中，根据所述目标应用程序内与所述目标模型的训练关联的应用模块的执行顺序，获取所述应用模块的模块度量值，并将所述模块度量值添加至所述可信根保护空间内；基于远程证明方式，将可信根信息和所述目标模型的模型数据发送至服务器，其中，所述可信根信息是根据所述设备度量值、所述应用度量值和所述模块度量值确定的。
本申请实施例通过在终端启动到应用被加载的过程中，所有被加载的软件模块在被加载之前，其度量值被它之前的软件模块中的度量模块进行度量，并将度量值放入可信根的受保护存储空间中，此种方式防止被加载的软件模块(如被恶意修改后)对自身的度量值进行篡改，降低了云端在整合模型参数时受到数据和模型投毒攻击的可能性。
可选地，处理器710，还用于在所述终端启动之后，基于基本输入输出系统BIOS，将所述BIOS的第一设备度量值添加至所述可信根保护空间内；基于所述BIOS，度量得到所述终端的启动加载器的第二设备度量值，并将所述第二设备度量值添加于所述可信根保护空间内；基于所述启动加载器，度量得到所述终端的系统内核的第三设备度量值，并将所述第三设备度量值添加于所述可信根保护空间内；基于所述系统内核，度量得到所述终端的系统服务模块的第四设备度量值，并将所述第四设备度量值添加于所述可信根保护空间内。
可选地，处理器710，还用于在进行模型训练的过程中，基于所述目标应用程序的度量模块，度量得到所述目标应用程序的数据采集模块的第一模块度量值，并将所述第一模块度量值添加于所述可信根保护空间内；基于所述数据采集模块，度量得到所述目标应用程序的模型训练模块的第二模块度量值，并将所述第二模块度量值添加于所述可信根保护空间内；基于所述模 型训练模块，度量得到所述目标应用程序的模型数据上传模块的第三模块度量值，并将所述第三模块度量值添加于所述可信根保护空间内。
可选地，处理器710，还用于基于所述服务器下发的公私钥对所述可信根信息和所述模型数据进行加密，得到加密信息；发送所述加密信息至所述服务器。
本申请实施例基于服务器下发的公私钥对可信根信息进行加密，从而可以避免在模型数据传输过程中被篡改的风险，进一步降低了云端在整合模型参数时受到数据和模型投毒攻击的可能性。
可选地，处理器710，还用于接收终端发送的可信根信息和模型数据，其中，所述可信根信息是根据设备度量值、应用度量值和模块度量值确定的；基于所述设备度量值、所述应用度量值和所述模块度量值，确定所述模型数据的可信度；基于所述可信度，对所述模型数据进行整合处理。
可选地，处理器710，还用于确定所述设备度量值是否处于第一预设范围内、所述应用度量值是否处于第二预设范围内，及所述模块度量值是否处于第三预设范围内；根据度量值确定结果，确定所述模型数据的可信度。
可选地，处理器710，还用于在所述可信度低于可信度阈值的情况下，降低所述模型数据的权重，并对降低权重后的模型数据进行整合；或者在所述可信度低于可信度阈值的情况下，丢弃所述模型数据。
本申请实施例通过丢弃该模型更新参数，或者降低该模型更新参数在整合模型时的权重，达到降低恶意模型更新参数对于整合模型造成负面影响的风险，降低对整合模型投毒的可能性。
应理解的是，本申请实施例中，输入单元704可以包括图形处理器(Graphics Processing Unit，GPU)7041和麦克风7042，图形处理器7041对在视频捕获模式或图像捕获模式中由图像捕获装置(如摄像头)获得的静态图片或视频的图像数据进行处理。显示单元706可包括显示面板7061，可以采用液晶显示器、有机发光二极管等形式来配置显示面板7061。用户输入单元707包括触控面板7071以及其他输入设备7072。触控面板7071，也称为触摸屏。触控面板7071可包括触摸检测装置和触摸控制器两个部分。其他输入设备7072可以包括但不限于物理键盘、功能键(比如音量控制按键、开关按键等)、轨迹球、鼠标、操作杆，在此不再赘述。存储器709可用于存储软件程序以及各种数据，包括但不限于应用程序和操作系统。处理器710可集成应用处理器和调制解调处理器，其中，应用处理器主要处理操作系统、 用户界面和应用程序等，调制解调处理器主要处理无线通信。可以理解的是，上述调制解调处理器也可以不集成到处理器710中。
本申请实施例还提供一种可读存储介质，所述可读存储介质上存储有程序或指令，该程序或指令被处理器执行时实现上述模型数据发送方法或模型数据整合方法实施例的各个过程，且能达到相同的技术效果，为避免重复，这里不再赘述。
其中，所述处理器为上述实施例中所述的电子设备中的处理器。所述可读存储介质，包括计算机可读存储介质，如计算机只读存储器(Read-Only Memory，ROM)、随机存取存储器(Random Access Memory，RAM)、磁碟或者光盘等。
本申请实施例另提供了一种芯片，所述芯片包括处理器和通信接口，所述通信接口和所述处理器耦合，所述处理器用于运行程序或指令，实现上述模型数据发送方法或模型数据整合方法实施例的各个过程，且能达到相同的技术效果，为避免重复，这里不再赘述。
应理解，本申请实施例提到的芯片还可以称为系统级芯片、系统芯片、芯片系统或片上系统芯片等。
需要说明的是，在本文中，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、物品或者装置不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、物品或者装置所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括该要素的过程、方法、物品或者装置中还存在另外的相同要素。此外，需要指出的是，本申请实施方式中的方法和装置的范围不限按示出或讨论的顺序来执行功能，还可包括根据所涉及的功能按基本同时的方式或按相反的顺序来执行功能，例如，可以按不同于所描述的次序来执行所描述的方法，并且还可以添加、省去、或组合各种步骤。另外，参照某些示例所描述的特征可在其他示例中被组合。
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到上述实施例方法可借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件，但很多情况下前者是更佳的实施方式。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分可以以计算机软件产品的形式体现出来，该计算机软件产品存储在一个存储介质(如ROM/RAM、 磁碟、光盘)中，包括若干指令用以使得一台终端(可以是手机，计算机，服务器，或者网络设备等)执行本申请各个实施例所述的方法。
上面结合附图对本申请的实施例进行了描述，但是本申请并不局限于上述的具体实施方式，上述的具体实施方式仅仅是示意性的，而不是限制性的，本领域的普通技术人员在本申请的启示下，在不脱离本申请宗旨和权利要求所保护的范围情况下，还可做出很多形式，均属于本申请的保护之内。

Claims (14)

  1. 一种模型数据发送方法，应用于终端，其中，包括：
    在所述终端启动之后，依据所述终端内各个终端模块的执行顺序，获取各个所述终端模块的设备度量值，并将所述设备度量值添加于可信根保护空间内；
    在加载与目标模型的训练相关的目标应用程序之前，度量所述目标应用程序的应用度量值，并将所述应用度量值添加至所述可信根保护空间内；
    在进行模型训练的过程中，根据所述目标应用程序内与所述目标模型的训练关联的应用模块的执行顺序，获取所述应用模块的模块度量值，并将所述模块度量值添加至所述可信根保护空间内；
    基于远程证明方式，将可信根信息和所述目标模型的模型数据发送至服务器，其中，所述可信根信息是根据所述设备度量值、所述应用度量值和所述模块度量值确定的。
  2. 根据权利要求1所述的方法，其中，所述在所述终端启动之后，依据所述终端内各个终端模块的执行顺序，获取各个所述终端模块的设备度量值，并将所述设备度量值添加于可信根保护空间内，包括：
    在所述终端启动之后，基于基本输入输出系统BIOS，将所述BIOS的第一设备度量值添加至所述可信根保护空间内；
    基于所述BIOS，度量得到所述终端的启动加载器的第二设备度量值，并将所述第二设备度量值添加于所述可信根保护空间内；
    基于所述启动加载器，度量得到所述终端的系统内核的第三设备度量值，并将所述第三设备度量值添加于所述可信根保护空间内；
    基于所述系统内核，度量得到所述终端的系统服务模块的第四设备度量值，并将所述第四设备度量值添加于所述可信根保护空间内。
  3. 根据权利要求1所述的方法，其中，所述在进行模型训练的过程中，根据所述目标应用程序内与所述目标模型的训练关联的应用模块的执行顺序，获取所述应用模块的模块度量值，并将所述模块度量值添加至所述可信根保护空间内，包括：
    在进行模型训练的过程中，基于所述目标应用程序的度量模块， 度量得到所述目标应用程序的数据采集模块的第一模块度量值，并将所述第一模块度量值添加于所述可信根保护空间内；
    基于所述数据采集模块，度量得到所述目标应用程序的模型训练模块的第二模块度量值，并将所述第二模块度量值添加于所述可信根保护空间内；
    基于所述模型训练模块，度量得到所述目标应用程序的模型数据上传模块的第三模块度量值，并将所述第三模块度量值添加于所述可信根保护空间内。
  4. 根据权利要求1所述的方法，其中，所述基于远程证明方式，将可信根信息和所述目标模型的模型数据发送至服务器，包括：
    基于所述服务器下发的公私钥对所述可信根信息和所述模型数据进行加密，得到加密信息；
    发送所述加密信息至所述服务器。
  5. 一种模型数据整合方法，应用于服务器，其中，包括：
    接收终端发送的可信根信息和模型数据，其中，所述可信根信息是根据设备度量值、应用度量值和模块度量值确定的；
    基于所述设备度量值、所述应用度量值和所述模块度量值，确定所述模型数据的可信度；
    基于所述可信度，对所述模型数据进行整合处理。
  6. 根据权利要求5所述的方法，其中，所述基于所述设备度量值、所述应用度量值和所述模块度量值，确定所述模型数据的可信度，包括：
    确定所述设备度量值是否处于第一预设范围内、所述应用度量值是否处于第二预设范围内，及所述模块度量值是否处于第三预设范围内；
    根据设备度量值的确定结果、应用度量值的确定结果和模块度量值的确定结果，确定所述模型数据的可信度。
  7. 根据权利要求5所述的方法，其中，所述基于所述可信度，对 所述模型数据进行整合处理，包括：
    在所述可信度低于可信度阈值的情况下，降低所述模型数据的权重，并对降低权重后的模型数据进行整合；或者
    在所述可信度低于可信度阈值的情况下，丢弃所述模型数据。
  8. 一种模型数据发送装置，应用于终端，其中，包括：
    设备度量值获取模块，用于在所述终端启动之后，依据所述终端内各个终端模块的执行顺序，获取各个所述终端模块的设备度量值，并将所述设备度量值添加于可信根保护空间内；
    应用度量值获取模块，用于在加载与目标模型的训练相关的目标应用程序之前，度量所述目标应用程序的应用度量值，并将所述应用度量值添加至所述可信根保护空间内；
    模块度量值获取模块，用于在进行模型训练的过程中，根据所述目标应用程序内与所述目标模型的训练关联的应用模块的执行顺序，获取所述应用模块的模块度量值，并将所述模块度量值添加至所述可信根保护空间内；
    可信根信息发送模块，用于基于远程证明方式，将可信根信息和所述目标模型的模型数据发送至服务器，其中，所述可信根信息是根据所述设备度量值、所述应用度量值和所述模块度量值确定的。
  9. 一种模型数据整合装置，应用于服务器，其中，包括：
    模型数据接收模块，用于接收终端发送的可信根信息和模型数据，其中，所述可信根信息是根据设备度量值、应用度量值和模块度量值确定的；
    可信度确定模块，用于基于所述设备度量值、所述应用度量值和所述模块度量值，确定所述模型数据的可信度；
    模型数据整合模块，用于基于所述可信度，对所述模型数据进行整合处理。
  10. 一种电子设备，其中，包括处理器，存储器及存储在所述存储器上并可在所述处理器上运行的程序或指令，所述程序或指令被所述处理器执行时实现如权利要求1-4任一项所述的模型数据发送方法 的步骤，或权利要求5-7任一项所述的模型数据整合方法的步骤。
  11. 一种可读存储介质，其中，所述可读存储介质上存储程序或指令，所述程序或指令被处理器执行时实现如权利要求1-4任一项所述的模型数据发送方法的步骤，或权利要求5-7任一项所述的数据整合方法的步骤。
  12. 一种芯片，其中，所述芯片包括处理器和通信接口，所述通信接口和所述处理器耦合，所述处理器用于运行程序或指令，实现如权利要求1-4任一项所述的模型数据发送方法的步骤，或权利要求5-7任一项所述的数据整合方法的步骤。
  13. 一种计算机程序产品，其中，所述程序产品被存储在非易失的存储介质中，所述程序产品被至少一个处理器执行以实现如权利要求1-4任一项所述的模型数据发送方法的步骤，或权利要求5-7任一项所述的数据整合方法的步骤。
  14. 一种电子设备，其特征在于，所述电子设备被配置成用于执行如权利要求1-4任一项所述的模型数据发送方法的步骤，或权利要求5-7任一项所述的数据整合方法的步骤。
PCT/CN2022/125711 2021-10-19 2022-10-17 模型数据发送方法、模型数据整合方法及装置 WO2023066205A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202111218242.4A CN113961911A (zh) 2021-10-19 2021-10-19 模型数据发送方法、模型数据整合方法及装置
CN202111218242.4 2021-10-19

Publications (1)

Publication Number Publication Date
WO2023066205A1 true WO2023066205A1 (zh) 2023-04-27

Family

ID=79464607

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/125711 WO2023066205A1 (zh) 2021-10-19 2022-10-17 模型数据发送方法、模型数据整合方法及装置

Country Status (2)

Country Link
CN (1) CN113961911A (zh)
WO (1) WO2023066205A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113961911A (zh) * 2021-10-19 2022-01-21 维沃移动通信有限公司 模型数据发送方法、模型数据整合方法及装置

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101515316A (zh) * 2008-02-19 2009-08-26 北京工业大学 一种可信计算终端及可信计算方法
CN103795717A (zh) * 2014-01-23 2014-05-14 中国科学院计算技术研究所 一种云计算平台完整性证明方法及其系统
CN109522721A (zh) * 2017-09-19 2019-03-26 中国科学院沈阳自动化研究所 一种基于tpm的工业控制可信嵌入式平台的启动方法
CN112836130A (zh) * 2021-02-20 2021-05-25 四川省人工智能研究院(宜宾) 一种基于联邦学习的上下文感知推荐系统及方法
CN113487042A (zh) * 2021-06-28 2021-10-08 海光信息技术股份有限公司 一种联邦学习方法、装置及联邦学习系统
CN113961911A (zh) * 2021-10-19 2022-01-21 维沃移动通信有限公司 模型数据发送方法、模型数据整合方法及装置

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101515316A (zh) * 2008-02-19 2009-08-26 北京工业大学 一种可信计算终端及可信计算方法
CN103795717A (zh) * 2014-01-23 2014-05-14 中国科学院计算技术研究所 一种云计算平台完整性证明方法及其系统
CN109522721A (zh) * 2017-09-19 2019-03-26 中国科学院沈阳自动化研究所 一种基于tpm的工业控制可信嵌入式平台的启动方法
CN112836130A (zh) * 2021-02-20 2021-05-25 四川省人工智能研究院(宜宾) 一种基于联邦学习的上下文感知推荐系统及方法
CN113487042A (zh) * 2021-06-28 2021-10-08 海光信息技术股份有限公司 一种联邦学习方法、装置及联邦学习系统
CN113961911A (zh) * 2021-10-19 2022-01-21 维沃移动通信有限公司 模型数据发送方法、模型数据整合方法及装置

Also Published As

Publication number Publication date
CN113961911A (zh) 2022-01-21

Similar Documents

Publication Publication Date Title
CN111612168B (zh) 一种机器学习任务的管理方法以及相关装置
US9678741B2 (en) Multiple system images for over-the-air updates
US9558358B2 (en) Random number generator in a virtualized environment
US8832461B2 (en) Trusted sensors
CN103180862B (zh) 用于服务器耦合的恶意软件防止的系统和方法
WO2017118412A1 (zh) 一种更新密钥的方法、装置和系统
CN108920366B (zh) 一种子应用调试方法、装置及系统
EP2397959B1 (en) System and method for N-ary locality in a security co-processor
US9998488B2 (en) Protection system including machine learning snapshot evaluation
US20130185548A1 (en) Multiple System Images for Over-The-Air Updates
US10187359B2 (en) Secure message transmission apparatus and processing method thereof
CN110447215B (zh) 应用软件恶意行为的动态告警方法和终端
CN112989430A (zh) 完整性校验方法、装置、终端设备及验证服务器
US8700895B1 (en) System and method for operating a computing device in a secure mode
CN108475304B (zh) 一种关联应用程序和生物特征的方法、装置以及移动终端
CN113821803B (zh) 安全架构系统、安全管理方法和计算设备
US11768939B2 (en) Authentication in an update mode of a mobile device
CN111181909B (zh) 一种身份信息的获取方法及相关装置
WO2023066205A1 (zh) 模型数据发送方法、模型数据整合方法及装置
CN104573437B (zh) 信息认证方法、装置和终端
CN109271779A (zh) 一种安装包检测方法、终端设备及服务器
KR102526959B1 (ko) 전자 장치 및 그의 동작 방법
US10216941B2 (en) Method of distributing application with security features and method of operating the application
CN108537040B (zh) 电信诈骗木马程序拦截方法、装置、终端及存储介质
KR102177203B1 (ko) 악성 코드 탐지 방법 및 컴퓨터 판독 가능한 저장매체

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22882811

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE