WO2023078161A1 - 模型的运行 - Google Patents

模型的运行 Download PDF

Info

Publication number
WO2023078161A1
WO2023078161A1 PCT/CN2022/128036 CN2022128036W WO2023078161A1 WO 2023078161 A1 WO2023078161 A1 WO 2023078161A1 CN 2022128036 W CN2022128036 W CN 2022128036W WO 2023078161 A1 WO2023078161 A1 WO 2023078161A1
Authority
WO
WIPO (PCT)
Prior art keywords
model
tee
data
terminal device
basic
Prior art date
Application number
PCT/CN2022/128036
Other languages
English (en)
French (fr)
Inventor
顾婉玉
郑显义
辛知
郭栗
万小飞
Original Assignee
支付宝(杭州)信息技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 支付宝(杭州)信息技术有限公司 filed Critical 支付宝(杭州)信息技术有限公司
Publication of WO2023078161A1 publication Critical patent/WO2023078161A1/zh
Priority to US18/400,166 priority Critical patent/US20240232331A9/en

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G06F21/53—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by executing in a restricted environment, e.g. sandbox or secure virtual machine
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/04—Architecture, e.g. interconnection topology
    • G06N3/045—Combinations of networks
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/602—Providing cryptographic facilities or services
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/08—Learning methods

Definitions

  • One or more embodiments of this specification relate to communication technology, and in particular to a method and device for running a model.
  • AI artificial intelligence
  • machine learning a large number of models will be established and used to complete a series of calculations.
  • One or more embodiments of this specification describe a model running method and device, which can improve the safety of model running.
  • a method for running a model includes: splitting the original model to obtain a basic model and a TEE (Trusted Execution Environment, Trusted Execution Environment) model;
  • the data of the TEE model is sent to the terminal device, so that the REE (Rich Execution Environment, Rich Execution Environment) in the terminal device runs the data of the basic model, and the TEE in the terminal device runs the TEE The model's data.
  • the splitting of the original model includes at least one of the following: splitting the original model according to a preset split ratio; splitting the first M layers in the neural network used by the original model into In the basic model, the last N layers are split into the TEE model; wherein, the total number of layers of the neural network is M plus N; the original model is split according to the size of the running space of the TEE in the terminal device.
  • the sending the data of the basic model and the data of the TEE model to the terminal device includes: sending the data of the basic model to the REE in the terminal device; sending the data of the TEE model through the TEE dedicated The channel is delivered to the TEE in the terminal device.
  • the TEE model After the TEE model is obtained, and before the data of the TEE model is sent to the terminal device, it further includes: encrypting the TEE model according to the pre-acquired encryption key to obtain the encrypted model; the data of the TEE model includes: encryption model.
  • the sending the data of the basic model and the data of the TEE model to the terminal device includes: encapsulating the encryption model into a TEE operator; generating a remodeling operation according to the basic model and the TEE operator model; delivering the remodeling model to the REE in the terminal device.
  • a method for running a model includes: receiving data of the basic model and data of the TEE model; wherein, the data of the basic model and the data of the TEE model are disassembled from the original model obtained after scoring; running the base model through REE; running the TEE model through TEE.
  • the receiving the data of the basic model and the data of the TEE model includes: the REE receives the data of the basic model; and the TEE receives the data of the TEE model through a TEE dedicated channel.
  • the data of the TEE model includes: an encrypted model generated after encrypting the TEE model.
  • the receiving the data of the basic model and the data of the TEE model includes: REE receives the remodeling model; the remodeling model is generated according to the basic model and the TEE operator encapsulated by the encryption model;
  • Basic model including: REE runs the basic model in the remodeling model; said running the TEE model through TEE includes: when REE runs to the TEE operator in the remodeling model, if the TEE operator cannot be recognized, then the The TEE operator is sent to the TEE; the TEE decapsulates the TEE operator to obtain the encrypted model; the TEE decrypts the encrypted model according to the pre-obtained decryption key to obtain the TEE model; the TEE runs the TEE model.
  • the TEE model after running the TEE model through the TEE, it further includes: the TEE outputs the feature vector obtained after running the TEE model to the outside of the TEE; or, the TEE obtains the recognition result according to the feature vector obtained after running the TEE model, and the This recognition result is output to the outside of the TEE.
  • a model running device which includes: a model remodeling module configured to split the original model to obtain a basic model and a TEE model; a model delivery module configured to convert the basic model
  • the data and the data of the TEE model are sent to the terminal device, so that the REE in the terminal device runs the data of the basic model, and the TEE in the terminal device runs the data of the TEE model.
  • a model running device which includes: a receiving module configured to receive data of the basic model and data of the TEE model; wherein, the data of the basic model and the data of the TEE model are obtained after splitting the original model; REE, configured to run the basic model; TEE, configured to run the TEE model.
  • a computing device including a memory and a processor, wherein executable code is stored in the memory, and when the processor executes the executable code, the method described in any embodiment of this specification is implemented. method.
  • the model operation method and device provided in the embodiments of this specification split the model into a basic model part and a TEE model part on the server side.
  • the basic model is run by the REE
  • the TEE model is run by the TEE. Because TEE builds a trusted execution environment in the terminal device, it can guarantee the security of TEE model runtime. At the same time, since the complete original model is not put into the TEE for operation, even if many original models are installed in the terminal equipment, the running pressure of the TEE can be reduced.
  • FIG. 1 is a schematic diagram of a system architecture applied by an embodiment of the present specification.
  • Fig. 2 is a flowchart of a method for implementing model running on the server side in an embodiment of the present specification.
  • Fig. 3 is a schematic diagram of a method for implementing model running in an embodiment of the present specification.
  • Fig. 4 is a flowchart of a method for implementing model operation on the terminal device side in an embodiment of the present specification.
  • Fig. 5 is a schematic structural diagram of a model running device in an embodiment of the present specification.
  • Fig. 6 is a schematic structural diagram of a model running device in another embodiment of the present specification.
  • the system architecture mainly includes a server and a terminal device.
  • the terminal device may be any device located on the user side, such as a mobile phone, a computer, and an Internet of Things terminal device such as an outdoor advertising machine based on the Internet of Things or an automatic vending device based on the Internet of Things.
  • Servers and terminal devices interact through the network.
  • the network may include various connection types, such as wires, wireless communication links, or fiber optic cables.
  • the core idea of this specification is: on the server side, split the model into the basic model part and the TEE model part.
  • the basic model is run by the REE
  • the TEE model is run by the TEE. Because TEE builds a trusted execution environment in the terminal device, it can guarantee the security of TEE model runtime. At the same time, since the complete original model is not put into the TEE operation, even if many original models are installed in the terminal equipment, the running pressure of the TEE can be reduced.
  • Embodiments are first provided for processing on the server side.
  • Fig. 2 is a flowchart of a method for implementing model running on the server side in an embodiment of the present specification.
  • the execution subject of this method is the running device of the model.
  • the device may be located in a server. It can be understood that the method can also be executed by any device, device, platform, or device cluster that has computing and processing capabilities.
  • the method includes: Step 201: Split the original model to obtain the basic model and the TEE model.
  • Step 203 Send the data of the basic model and the data of the TEE model to the terminal device, so that the REE in the terminal device runs the data of the basic model, and the TEE in the terminal device runs the Data for the TEE model described above.
  • step 201 the server splits the original model to obtain the basic model and the TEE model.
  • a TEE can provide a secure enclave within an end device, ensuring that sensitive data is stored, processed and protected in an isolated, trusted environment. Therefore, in order to improve the security when running the model in the terminal device, it can be considered to put the model into the TEE in the terminal device to run.
  • the number of models downloaded in terminal devices is also increasing, such as models for face recognition, risk assessment models, user shopping behavior statistics models, and so on. If a large number of models that the terminal device needs to run are put into the TEE to run, it will cause excessive operating pressure on the TEE and reduce the processing performance of the terminal device. Therefore, it can be considered to split the original model into two parts.
  • the basic model part is run by the general environment in the terminal device, that is, REE, and the TEE model part is run by the TEE in the terminal device, so as to improve the efficiency of running the model in the terminal device. Safety, and can reduce the operating pressure of the TEE in the terminal equipment. Therefore, in this step 201, an original model can be split in the server in an offline manner.
  • step 201 there are at least three ways to implement step 201 as follows: Way 1: Split the original model according to a preset split ratio.
  • the preset split ratio is equal to half of the base model and half of the TEE model
  • the first half of the original model file can be divided into two parts according to the file size, and the first half of the original model can be used as the basic model.
  • the second half of the original model serves as a TEE model.
  • other splitting methods are also possible. For example, according to the size of the original model file, the middle 1/3 part of the original model is used as the basic model, and the first 1/3 part and the rear 1/3 part of the original model are used as the TEE model. wait.
  • Method 2 split the first M layers of the neural network used by the original model into a basic model, and split the last N layers into a TEE model; wherein, the total number of layers of the neural network is M plus N. Wherein, both M and N are positive integers.
  • a primitive model is usually implemented using a neural network.
  • a neural network consists of multiple layers.
  • convolutional neural network includes: input layer, convolutional layer, activation function, pooling layer, and fully connected layer.
  • the later layer is usually more likely to involve the parameter adjustment of the neural network during the training process, and the greater its contribution to the original model, that is, the higher the security requirements . Therefore, in one embodiment of this specification, the number of layers of the neural network used by the original model can be divided into M plus N layers in the second way, and the first M layers have relatively low security requirements, so the first M layers are relatively low.
  • the M layer can be used as the basic model; the latter N layer usually involves parameter adjustment, and has relatively high requirements for security. Therefore, the latter N layer can be used as the TEE model.
  • Method 3 Split the original model according to the size of the running space of the TEE in the terminal device.
  • the third method can be adopted, according to the size of the running space of the TEE in the terminal device, the original model is split, so that the split TEE model meets the requirements of the size of the running space of the TEE. required to be able to run in the TEE.
  • any two or three of the above three manners may also be used in combination.
  • the original model is split by considering the size of the operating space in the terminal device and the number of the last N layers involved in parameter adjustment in the neural network of the original model.
  • step 203 the server sends the data of the basic model and the data of the TEE model to the terminal device, so that the REE in the terminal device runs the data of the basic model, and the TEE in the terminal device TEE runs the TEE model on the data.
  • step 203 includes at least the following implementation manners: Mode A, direct distribution respectively.
  • the server sends the data of the split basic model directly to the REE in the terminal device, and directly sends the data of the split TEE model to the TEE of the terminal device through a dedicated channel with the TEE.
  • the server sends the data of the split basic model and the encrypted model obtained after encrypting the TEE model to REE.
  • the server is the REE that directly delivers the original model to the terminal device. Therefore, in order to minimize changes to the service distribution logic, the method B can be adopted.
  • Step 301 The server encrypts the TEE model according to the pre-obtained encryption key to obtain the encrypted model.
  • the TEE model can be encrypted, and the relevant data of the encrypted model can be sent to REE, so as to avoid the leakage of TEE model in REE and further improve the security of model operation.
  • this step 301 may use a symmetric encryption algorithm for encryption.
  • the server can be made to obtain the encryption key in advance, and the TEE in the terminal device can be made to obtain the decryption key.
  • the acquisition method may be static acquisition, for example, the server and the TEE have pre-agreed on a key.
  • the acquisition method can also be a dynamic acquisition method, such as generating a key by the server and sending the key to the TEE through a dedicated channel with the TEE.
  • Step 303 the server encapsulates the encrypted model into a TEE operator.
  • This step 303 is to change the encrypted model obtained after the TEE model is encrypted into an operator, so that the two parts of the split model can be recombined into a remodeling model, and the original business logic will
  • This remodeling model is delivered to the REE of the terminal device, so that the REE cannot perceive changes to the original model. That is to say, at the service link level, how the server delivers it and how the REE executes the received model has not changed. This reduces the changes to the overall business implementation logic, making the solution easier to implement.
  • Step 305 The server generates a remodeling model according to the basic model and the TEE operator.
  • the basic model and the TEE model each include at least one operator. For example, there are 3 operators in the basic model, and there are 3 operators, after the TEE model is encrypted and encapsulated into a TEE operator, the TEE model will appear as 1 operator to the outside world.
  • a remodeling model is generated by using the 3 operators included in the basic model and the encapsulated TEE operator, and the remodeling model represents 4 operators for the REE.
  • the basic model and the TEE operator can be sequentially assembled according to the splitting sequence in step 201 to generate a remodeling model.
  • the first half and the second half of the original model file are sequentially split into the basic model and the TEE model, then in this step 305, the basic model is followed by the TEE operator, Generate the reshape model.
  • Step 307 the server delivers the remodeling model to the REE in the terminal device.
  • Adopting method B the advantages of delivering the remodeling model to the REE of the terminal device are: first, as mentioned above, the remodeling model is delivered to the REE of the terminal device, so that the REE cannot perceive changes to the original model, and That is to say, at the business link level, how the server delivers and how the REE executes the received model has not changed, thereby reducing changes to the overall business implementation logic and making the solution easier to implement; secondly, a model includes multiple Operators, each operator has a sequence of execution.
  • the remodeling model needs to be sent to the REE, and the REE uniformly executes the remodeling model, then It can be guaranteed that the execution order of each operator in the reshaped model is the same as that of each operator in the original model.
  • the following provides an embodiment for the processing on the terminal device side.
  • Fig. 4 is a flow chart of a method for implementing model running on the terminal device side in one embodiment of this specification.
  • the execution subject of this method is the running device of the model.
  • the device may be located in the terminal device. It can be understood that the method can also be executed by any device, device, platform, or device cluster that has computing and processing capabilities.
  • the method includes: step 401: receiving the data of the basic model and the data of the TEE model; wherein, the data of the basic model and the data of the TEE model are obtained after splitting the original model; step 403 : Run the basic model through REE; Step 405: Run the TEE model through TEE.
  • step 401 the data of the basic model and the data of the TEE model are received.
  • the server adopts the method A in the above step 203, then, in this step 401, the REE in the terminal device receives the data of the basic model, and the TEE in the terminal device uses the TEE dedicated The channel receives the data of the TEE model.
  • the server adopts the method B in the above-mentioned step 203, then, in this step 401, the REE in the terminal device receives the remodeling model, and the remodeling model includes the basic model and according to The TEE operator encapsulated by the encryption model of the TEE model.
  • step 403 the base model is run through REE.
  • REE after REE receives the remodeling model, it will regard the remodeling model as an "original model”, and execute each operator in the remodeling model in sequence, so that the basic model can run smoothly.
  • step 405 the TEE model is run through the TEE.
  • Step 4051 During the process of executing the reshaping model, the REE cannot recognize the TEE after executing the TEE operator included in the remodeling operator.
  • the process of obtaining the TEE operator includes: encrypting the TEE model and encapsulating the encrypted model.
  • the TEE operator is in the form of an operator, it is not a normal operator and is encrypted inside. Therefore, REE cannot recognize the TEE operator.
  • REE can run according to the execution order of operators in the reshaping model, but cannot recognize the TEE model, which meets the business requirements.
  • Step 4053 REE sends the TEE operator to TEE.
  • REE calls the external proxy CA (Certificate Authority, electronic visa agency), and the CA sends the TEE operator to the TEE.
  • CA Certificate Authority, electronic visa agency
  • the REE can take the running result of the basic model as the input of the TEE operator, and send the running result of the basic model together with the TEE operator to the TEE.
  • Step 4055 The TEE decapsulates the TEE operator to obtain an encrypted model.
  • Step 4057 The TEE decrypts the encrypted model according to the pre-obtained decryption key to obtain the TEE model.
  • step 4057 For the method for the TEE to obtain the decryption key in step 4057, refer to the relevant description of step 301 in the foregoing embodiments.
  • Step 4059 TEE runs the TEE model.
  • the server sends the remodeling model reshaped according to the original model (the execution order of the operators included in it is the same).
  • REE runs a part of the original model, that is, the basic model
  • TEE runs the other part of the original model.
  • One part is the TEE model, which can not only ensure the safety of the TEE model running in the TEE, but also eliminate the need to put all the complete original models into the TEE, which reduces the operating pressure of the TEE.
  • an output result is obtained, which is the output result of the original model.
  • the TEE needs to provide the output result to the outside, for example, return it to the server via the REE, so that the server can make judgments and decisions about related services based on the output result.
  • the output results provided by the TEE include at least the following two forms.
  • Form 1 A direct result of the original model.
  • the immediate result is usually a feature vector.
  • the TEE can output the feature vector obtained after running the TEE model to the outside of the TEE.
  • Form 2 Indirect results derived from direct results of the original model.
  • the direct result of the neural network used by the model is the feature vector. If the feature vector is directly provided to the outside, then, in some scenarios, some advanced attackers may reverse the structure and parameters of the neural network used by the model through the feature vector, resulting in model leakage. Therefore, in order to further improve the safety of model operation, TEE can also not output the feature vector, but obtain a recognition result based on the feature vector, such as a classification probability value, score value, etc., and then TEE outputs the recognition result to The outside of the TEE. Because TEE outputs lower-dimensional user-recognizable recognition results to the outside, it further avoids model leakage and further improves security.
  • a device for running a model is provided.
  • the device 500 can be set in a server, including: a model remodeling module 501 configured to split the original model to obtain the basis model and TEE model; the model sending module 502 is configured to send the data of the basic model and the data of the TEE model to the terminal device, so that the REE in the terminal device runs the data of the basic model, and the TEE in the terminal device Run the TEE model on the data.
  • the above-mentioned model reshaping module 501 is configured to perform at least one of the following: split the original model according to a preset split ratio; use the neural network used by the original model The first M layers in the above are split into the basic model, and the back N layers are split into the TEE model; wherein, the back N layers involve parameter adjustment, and the total number of layers of the neural network is M plus N; according to the terminal equipment The size of the running space of the TEE in the original model is split.
  • the model sending module 502 is configured to execute: sending the data of the basic model to the REE in the terminal device; sending the data of the encrypted model between the TEE and the The dedicated channel issued to the TEE in the terminal device.
  • the above-mentioned model reshaping module 501 may also be configured to: encrypt the TEE model according to the pre-acquired encryption key to obtain the encrypted model; correspondingly, the data of the TEE model , including: encryption model.
  • the model reshaping module 501 is configured to perform: encapsulating the encryption model into a TEE operator; generating a reshaping model according to the basic model and the TEE operator; corresponding Specifically, the above-mentioned model sending module 502 is configured to execute: sending the remodeling model to the REE in the terminal device.
  • a model running device is proposed.
  • the apparatus 600 may be set in a terminal device, including: a receiving module 601 configured to receive data of a basic model and data of a TEE model; wherein, the data of the basic model and the data of the TEE model are obtained after splitting the original model; REE 602 configured to run the basic model; TEE 603 configured to run the TEE model.
  • the receiving module 601 includes: a first receiving submodule, set in REE 602, configured to receive the data of the basic model sent by the server; a second receiving submodule, set in TEE603 , configured to receive the encrypted model data sent by the server through the TEE dedicated channel.
  • the data of the TEE model includes: data of an encrypted model generated after encrypting the TEE model.
  • the receiving module 601 is set in the REE and is configured to receive the reshaping model; the reshaping model is generated according to the TEE operator encapsulated by the basic model and the encryption model; corresponding Specifically, the REE 602 is configured to execute: run the basic model in the remodeling model; when the REE runs to the TEE operator in the remodeling model, if the TEE operator cannot be recognized, then send the TEE operator to the TEE; Specifically, the TEE 603 is configured to execute: the TEE decapsulates the TEE operator to obtain the encrypted model; the TEE decrypts the encrypted model according to the pre-obtained decryption key to obtain the TEE model; the TEE runs the TEE model.
  • TEE 603 is further configured to execute: output the feature vector obtained after running the TEE model to the outside of the TEE; or obtain the recognition result according to the feature vector obtained after running the TEE model, and use the The recognition result is output to the outside of TEE.
  • An embodiment of the present specification provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed in a computer, the computer is instructed to execute the method in any one of the embodiments in the specification.
  • An embodiment of this specification provides a computing device, including a memory and a processor, wherein executable code is stored in the memory, and when the processor executes the executable code, the implementation of any one of the embodiments in the specification is implemented. method.
  • the structure shown in the embodiment of the present specification does not constitute a specific limitation on the device of the embodiment of the present specification.
  • the above-mentioned apparatus may include more or less components than those shown in the illustrations, or combine certain components, or separate certain components, or arrange different components.
  • the illustrated components may be realized in hardware, software, or a combination of software and hardware.
  • each embodiment in this specification is described in a progressive manner, the same and similar parts of each embodiment can be referred to each other, and each embodiment focuses on the differences from other embodiments.
  • the description is relatively simple, and for relevant parts, please refer to part of the description of the method embodiment.
  • the functions described in the present invention may be implemented by hardware, software, pendants or any combination thereof.
  • the functions may be stored on or transmitted over as one or more instructions or code on a computer-readable medium.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Hardware Design (AREA)
  • General Health & Medical Sciences (AREA)
  • Health & Medical Sciences (AREA)
  • Computational Linguistics (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Artificial Intelligence (AREA)
  • Biomedical Technology (AREA)
  • Biophysics (AREA)
  • Data Mining & Analysis (AREA)
  • Evolutionary Computation (AREA)
  • Molecular Biology (AREA)
  • Computing Systems (AREA)
  • Mathematical Physics (AREA)
  • Bioethics (AREA)
  • Storage Device Security (AREA)
  • Telephonic Communication Services (AREA)

Abstract

本说明书实施例提供了模型的运行方法和装置。在方法中，对原始模型进行拆分，得到基础模型以及TEE(Trusted Execution Environment)模型（201）；将基础模型的数据以及TEE模型的数据下发到终端设备，以使终端设备中的REE(Rich Execution Environment)运行基础模型的数据，且终端设备中的TEE运行TEE模型的数据（203）。本说明书能够提高模型运行的安全性。

Description

模型的运行 技术领域
本说明书一个或多个实施例涉及通信技术，尤其涉及模型的运行方法和装置。
背景技术
在人工智能(Artificial Intelligence，AI)及机器学习等技术中，会建立大量的模型，并利用模型来完成一系列的计算处理。
随着隐私保护与效率的要求，越来越多的模型不再被部署在服务器中，而被下发到终端设备中运行。但是，终端设备的运行环境相对开放，模型在终端设备上运行，则会面临更多的被逆向与窃取的风险，从而大大降低了模型的安全性，甚至导致整个***的安全受到威胁。
发明内容
本说明书一个或多个实施例描述了模型的运行方法和装置，能够提高模型运行的安全性。
根据第一方面，提供了一种模型的运行方法，其中，包括：对原始模型进行拆分，得到基础模型以及TEE(Trusted Execution Environment，可信执行环境)模型；将所述基础模型的数据以及所述TEE模型的数据下发到终端设备，以使所述终端设备中的REE(Rich Execution Environment，富执行环境)运行所述基础模型的数据，且所述终端设备中的TEE运行所述TEE模型的数据。
其中，所述对原始模型进行拆分，包括如下中的至少一项：根据预设的拆分比例对原始模型进行拆分；将所述原始模型使用的神经网络中的前M层拆分为所述基础模型，后N层拆分为所述TEE模型；其中，所述神经网络的总层数为M加N；根据终端设备中TEE的运行空间的大小，对原始模型进行拆分。
所述将所述基础模型的数据以及所述TEE模型的数据下发到终端设备，包括：将所述基础模型的数据下发到终端设备中的REE；将所述TEE模型的数据通过TEE专用通道下发到终端设备中的TEE。
在得到TEE模型之后，并在将TEE模型的数据下发到终端设备之前，进一步包括：根据预先获取的加密密钥，对TEE模型进行加密，得到加密模型；所述TEE模型的数据，包括：加密模型。
所述将所述基础模型的数据以及所述TEE模型的数据下发到终端设备，包括：将所 述加密模型封装成TEE算子；根据所述基础模型以及所述TEE算子，生成重塑模型；将所述重塑模型下发到所述终端设备中的REE。
根据第二方面，提供了一种模型的运行方法，其中，包括：接收基础模型的数据以及TEE模型的数据；其中，所述基础模型的数据以及所述TEE模型的数据是对原始模型进行拆分之后得到的；通过REE运行所述基础模型；通过TEE运行所述TEE模型。
所述接收基础模型的数据以及TEE模型的数据，包括：由所述REE接收基础模型的数据；有所述TEE通过TEE专用通道接收所述TEE模型的数据。
所述TEE模型的数据，包括：对所述TEE模型加密后生成的加密模型。
所述接收基础模型的数据以及TEE模型的数据，包括：REE接收重塑模型；该重塑模型根据所述基础模型以及所述加密模型封装出的TEE算子生成；所述通过REE运行所述基础模型，包括：REE运行该重塑模型中的基础模型；所述通过TEE运行所述TEE模型，包括：REE运行到重塑模型中的TEE算子时，无法识别该TEE算子，则将该TEE算子发送给TEE；TEE对TEE算子解封装，得到所述加密模型；TEE根据预先得到的解密密钥对所述加密模型进行解密，得到TEE模型；TEE运行该TEE模型。
其中，在所述通过TEE运行所述TEE模型之后，进一步包括：TEE将运行TEE模型后得到的特征向量输出到TEE的外部；或者，TEE根据运行TEE模型后得到的特征向量获取识别结果，将该识别结果输出到TEE的外部。
根据第三方面，提供了一种模型的运行装置，其中，包括：模型重塑模块，配置为对原始模型进行拆分，得到基础模型以及TEE模型；模型下发模块，配置为将基础模型的数据以及TEE模型的数据下发到终端设备，以使所述终端设备中的REE运行基础模型的数据，且终端设备中的TEE运行TEE模型的数据。
根据第四方面，提供了一种模型的运行装置，其中，包括：接收模块，配置为接收基础模型的数据以及TEE模型的数据；其中，所述基础模型的数据以及所述TEE模型的数据是对原始模型进行拆分之后得到的；REE，配置为运行所述基础模型；TEE，配置为运行所述TEE模型。
根据第五方面，提供了一种计算设备，包括存储器和处理器，所述存储器中存储有可执行代码，所述处理器执行所述可执行代码时，实现本说明书任一实施例所述的方法。
本说明书实施例提供的模型的运行方法及装置，在服务器侧，将模型进行拆分，拆分出基础模型部分以及TEE模型部分。相应地，在终端设备侧，由REE运行基础模型，由TEE运行TEE模型。因为TEE在终端设备中构建了一个可信执行环境，因此能够保证TEE模型运行时的安全性。同时，由于不是将完整的原始模型放入TEE运行，因此， 即使终端设备中安装了众多的原始模型，也能够减轻TEE的运行压力。
附图说明
为了更清楚地说明本说明书实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图是本说明书的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1是本说明书一个实施例所应用的***架构的示意图。
图2是本说明书一个实施例中在服务器侧实现模型运行的方法的流程图。
图3是本说明书一个实施例中实现模型运行的方法的示意图。
图4是本说明书一个实施例中在终端设备侧实现模型运行的方法流程图。
图5是本说明书一个实施例中模型运行装置的结构示意图。
图6是本说明书另一个实施例中模型运行装置的结构示意图。
具体实施方式
如前所述，模型在终端设备上部署及运行时，会面临更多的被逆向与窃取的风险，从而大大降低了模型的安全性。
下面结合附图，对本说明书提供的方案进行描述。
为了方便对本说明书的理解，首先对本说明书所应用的***架构进行描述。如图1中所示，该***架构主要包括服务器及终端设备。其中，终端设备可以是任意一种位于用户侧的设备，比如手机、电脑以及物联网终端设备比如基于物联网的室外广告投放机或基于物联网的自动售卖设备等。服务器及终端设备通过网络交互。其中，网络可以包括各种连接类型，例如有线、无线通信链路或者光纤电缆等。
参见图1，本说明书的核心思想是：在服务器侧，将模型进行拆分，拆分出基础模型部分以及TEE模型部分。相应地，在终端设备侧，由REE运行基础模型，由TEE运行TEE模型。因为TEE在终端设备中构建了一个可信执行环境，因此能够保证TEE模型运行时的安全性。同时，由于不是将完整的原始模型放入TEE运行，因此，即使终端设备中安装了众多的原始模型，也能够减轻TEE的运行压力。
下面用不同的实施例对服务器侧的处理以及终端设备侧的处理分别进行说明。
首先针对服务器侧的处理提供实施例。
图2是本说明书一个实施例中在服务器侧实现模型运行的方法的流程图。该方法的执行主体为模型的运行装置。该装置可以位于服务器中。可以理解，该方法也可以通过 任何具有计算、处理能力的装置、设备、平台、设备集群来执行。参见图2，该方法包括：步骤201：对原始模型进行拆分，得到基础模型以及TEE模型。
步骤203：将所述基础模型的数据以及所述TEE模型的数据下发到终端设备，以使所述终端设备中的REE运行所述基础模型的数据，且所述终端设备中的TEE运行所述TEE模型的数据。
下面结合具体实施例说明图2中每一个步骤的处理。
首先对于步骤201，服务器对原始模型进行拆分，得到基础模型以及TEE模型。
TEE可以在终端设备中提供一个安全区域，确保敏感数据在隔离、可信的环境中存储、处理和保护。因此，为了提高在终端设备中运行模型时的安全性，可以考虑将模型放入终端设备中的TEE进行运行。但是，目前，随着终端设备处理事务的不断增加，终端设备中下载的模型的数量也越来越多，比如进行人脸识别的模型、风险评估模型、用户购物行为统计模型等等。如果将终端设备需要运行的数量众多的模型均放入TEE中运行，那么则会导致TEE的运行压力过大，降低终端设备的处理性能。因此，可以考虑将原始模型拆分为两部分，基础模型部分由终端设备中的通用环境即REE运行，而TEE模型部分由终端设备中的TEE运行，从而既能提高在终端设备中运行模型的安全性，又能减轻终端设备中TEE的运行压力。因此，在本步骤201中，可以以离线方式在服务器中对一个原始模型进行拆分。
在本说明书的一个实施例中，本步骤201至少存在如下的三种实现方式：方式一、根据预设的拆分比例对原始模型进行拆分。
比如，预设的拆分比例为基础模型与TEE模型各占一半，那么采用方式一时，则可以将原始模型文件按照文件大小分为前后两部分，可以将原始模型的前半部分作为基础模型，将原始模型的后半部分作为TEE模型。当然，也可以有其他的拆分方式，比如按照原始模型文件的大小，将原始模型的中间1/3部分作为基础模型，将原始模型的前1/3部分及后1/3部分作为TEE模型等。
方式二、将原始模型使用的神经网络中的前M层拆分为基础模型，后N层拆分为TEE模型；其中，神经网络的总层数为M加N。其中，M和N均为正整数。
一个原始模型通常采用神经网络实现。神经网络包括多个层。比如卷积神经网络(CNN)包括：输入层、卷积层、激活函数、池化层、全连接层。在神经网络的各个层中，通常越靠后的层越可能涉及到该神经网络在训练过程中的参数调整，其对于该原始模型的贡献越大，也就是说，对安全性的要求越高。因此，在本说明书的一个实施例中，可以采用方式二将原始模型使用的神经网络的层数依次划分为M加N层，前M层因为 对安全性的要求相对较低，因此，该前M层可以作为基础模型；后N层通常涉及参数调整，对安全性的要求相对较高，因此，该后N层可以作为TEE模型。
方式三、根据终端设备中TEE的运行空间的大小，对原始模型进行拆分。
终端设备中之前可能会下载有数量众多的模型，那么在TEE中需要运行的模型的数量也会众多。因此，每当终端设备需要下载新的模型时，需要考虑终端设备中TEE的运行空间的大小，以便保证TEE的运行。因此，在本说明书的一个实施例中，可以采用方式三，根据终端设备中TEE的运行空间的大小，对原始模型进行拆分，以使得拆分出的TEE模型满足该TEE的运行空间大小的要求，从而能够在TEE中运行。
在本说明书的实施例中，上述三种方式中的任意两种或者三种也可以结合使用。比如，结合上述方式二和方式三，同时考虑终端设备中运行空间的大小、原始模型的神经网络中涉及参数调整的后N层的数量，来对原始模型进行拆分。
接下来在步骤203中，服务器将基础模型的数据以及所述TEE模型的数据下发到终端设备，以使所述终端设备中的REE运行所述基础模型的数据，且所述终端设备中的TEE运行所述TEE模型的数据。
步骤203的具体实现过程包括至少如下的实现方式：方式A、直接各自分发。
服务器将拆分出的基础模型的数据直接下发到终端设备中的REE，并将拆分出的TEE模型的数据通过与TEE之间的专用通道，直接下发到终端设备的TEE。
方式B、加密后统一分发。
服务器将拆分出的基础模型的数据以及TEE模型加密后得到的加密模型统一下发到REE。
在原有的业务下发逻辑中，服务器是将原始模型直接下发到终端设备中的REE。因此，为了尽可能的减少对业务下发逻辑的改动，可以采用该方式B。
参见图3，基于方式B，步骤203的一种具体实现过程包括：步骤301：服务器根据预先获取的加密密钥，对TEE模型进行加密，得到加密模型。
在后续过程中，因为会将TEE模型相关的数据也发送到终端设备中的REE。如果发送明文形式的TEE模型，那么，可能会造成TEE模型在REE中的泄露。因此，为了提高安全性，可以对TEE模型进行加密，并将得到的加密模型的相关数据发给REE，从而避免TEE模型在REE中的泄露，进一步提高模型运行的安全性。
在本说明书的一个实施例中，本步骤301可以采用对称加密算法进行加密。
可以预先使服务器获取加密密钥，使终端设备中的TEE获取解密密钥。获取的方法可以是静态获取，比如，服务器跟TEE预先约定好一个密钥。获取的方法也可以是动 态获取方法，比如由服务器生成密钥，并通过与TEE之间的专用通道，将密钥发给TEE。
步骤303：服务器将加密模型封装成TEE算子。
本步骤303的目的是：将TEE模型加密后得到的加密模型从形式上更改为一个算子，从而能够将拆分出的两部分模型重新组合成一个重塑模型，并按照原有业务逻辑将该一个重塑模型下发给终端设备的REE，使得REE感知不到对原始模型的改动，也就是说，在业务链路层面，服务器如何下发，REE如何执行接收到的模型都没有改变，从而减少了对整体业务实现逻辑的改动，使得方案更容易实现。
步骤305：服务器根据基础模型以及TEE算子，生成重塑模型。
在前述步骤中，在将原始模型拆分成基础模型及TEE模型之后，基础模型及TEE模型中则分别都包括了至少一个算子，比如，基础模型中有3个算子，TEE模型中有3个算子，在将该TEE模型加密并封装成一个TEE算子后，TEE模型对外则表现为1个算子。这样，经过本步骤305的处理，是利用基础模型中包括的3个算子以及封装后的1个TEE算子，生成了一个重塑模型，重塑模型对REE表现为4个算子。
在本步骤305中，可以按照步骤201中的拆分顺序，来顺序组装基础模型以及TEE算子从而生成重塑模型。比如，在步骤201中，是将原始模型文件的前半部分、后半部分依次拆分为基础模型及TEE模型，那么在本步骤305中，也是按照基础模型在前TEE算子在后的顺序，生成重塑模型。
步骤307：服务器将重塑模型下发到终端设备中的REE。
采用方式B，将重塑模型下发到终端设备中的REE的好处在于：首先，如前所述，重塑模型下发给终端设备的REE，使得REE感知不到对原始模型的改动，也就是说，在业务链路层面，服务器如何下发，REE如何执行接收到的模型都没有改变，从而减少了对整体业务实现逻辑的改动，使得方案更容易实现；其次，一个模型中包括多个算子，各个算子之间有执行上的先后顺序。为了保证终端设备针对拆分后的两部分模型仍然能够执行原始模型中各算子的执行顺序，即进行时序控制，则需要将重塑模型下发到REE，REE统一执行该重塑模型，则可以保证重塑模型中各个算子的执行顺序与原始模型中各个算子的执行顺序相同。
下面针对终端设备侧的处理提供实施例。
图4是本说明书一个实施例中在终端设备侧实现模型运行的方法的流程图。该方法的执行主体为模型的运行装置。该装置可以位于终端设备中。可以理解，该方法也可以通过任何具有计算、处理能力的装置、设备、平台、设备集群来执行。参见图4，该方法包括：步骤401：接收基础模型的数据以及TEE模型的数据；其中，所述基础模型的 数据以及所述TEE模型的数据是对原始模型进行拆分之后得到的；步骤403：通过REE运行所述基础模型；步骤405：通过TEE运行所述TEE模型。
下面分别对图4中的每一个步骤进行说明。
首先对于步骤401，接收基础模型的数据以及TEE模型的数据。
参见上述对服务器侧处理的各个实施例，如果服务器采用上述步骤203中的方式A，那么，在本步骤401中，终端设备中的REE接收基础模型的数据，并且终端设备中的TEE通过TEE专用通道接收TEE模型的数据。
参见上述对服务器侧处理的各个实施例，如果服务器采用上述步骤203中的方式B，那么，在本步骤401中，终端设备中的REE接收重塑模型，该重塑模型包括了基础模型以及根据TEE模型的加密模型所封装出的TEE算子。
接下来，在步骤403中，通过REE运行基础模型。
对应于上述方式B，REE接收到重塑模型之后，会将该重塑模型视为一个“原始模型”，并依次执行该重塑模型中的各个算子，从而可以顺利运行基础模型。
接下来，在步骤405中，通过TEE运行TEE模型。
对应于上述方式B，参见图3，本步骤405的具体实现过程可以包括：步骤4051：REE在执行重塑模型的过程中，当执行到该重新模型包括的TEE算子之后，无法识别该TEE算子。
在重塑模型中，TEE算子的得到过程包括：对TEE模型加密，对加密模型进行封装。虽然TEE算子表现为一个算子的形式，但是并非一个正常的算子，并且内部进行了加密，因此，REE无法识别该TEE算子。
可见，REE既能够按照重塑模型中算子的执行顺序进行运行，又无法识别TEE模型，满足了业务要求。
步骤4053：REE将该TEE算子发送给TEE。
这里，REE调用对外的代理CA(Certificate Authority，电子签证机关)，由CA将TEE算子发送到TEE内部。
这里，REE可以将基础模型的运行结果作为TEE算子的输入，并将该基础模型的运行结果与TEE算子一起发给TEE。
步骤4055：TEE对TEE算子解封装，得到加密模型。
步骤4057：TEE根据预先得到的解密密钥对加密模型进行解密，得到TEE模型。
本步骤4057中TEE得到解密密钥的方法可以参见上述实施例中对步骤301的相关描述。
步骤4059：TEE运行该TEE模型。
至此，则实现了服务器下发根据原始模型重塑的重塑模型(其包括的算子的执行顺序相同)，终端设备中由REE运行原始模型的一部分即基础模型，由TEE运行原始模型的另一部分即TEE模型，既能保证在TEE中运行的TEE模型的安全性，又无需将完整原始模型全部放入TEE，减轻了TEE的运行压力。
在本说明书的一个实施例中，在TEE运行TEE模型之后，会得到输出结果，该输出结果是原始模型的输出结果。TEE需要将该输出结果提供给外部，比如经由REE返回给服务器，从而使得服务器能够根据该输出结果进行相关业务的判断和决策。
在本说明书的一个实施例中，TEE对外提供的输出结果包括至少如下两种形式。
形式1：原始模型的直接结果。
对于模型使用的神经网络，得到的直接结果通常为一个特征向量。TEE可以将运行TEE模型后得到的该特征向量输出到TEE的外部。
形式2：根据原始模型的直接结果得到的间接结果。
模型使用的神经网络得到的直接结果为特征向量。如果将该特征向量直接提供给外部，那么，在某些场景下，有可能会出现某些高级攻击者通过该特征向量反推出模型使用的神经网络的结构及参数，从而导致模型泄露。因此，为了进一步提高模型运行的安全性，TEE也可以不输出该特征向量，而是根据该特征向量获取一个识别结果，比如一个分类的概率值，分数值等，然后TEE将该识别结果输出到TEE的外部。因为TEE输出到外部的是更低维度的用户可识别的识别结果，因此进一步避免了模型泄露，进一步提高了安全性。
在本说明书的一个实施例中，提供了一种模型的运行装置，参见图5，该装置500可以设置在服务器中，包括：模型重塑模块501，配置为对原始模型进行拆分，得到基础模型以及TEE模型；模型下发模块502，配置为将基础模型的数据以及TEE模型的数据下发到终端设备，以使所述终端设备中的REE运行基础模型的数据，且终端设备中的TEE运行TEE模型的数据。
在本说明书装置的一个实施例中，上述模型重塑模块501被配置为执行如下中的至少一项：根据预设的拆分比例对原始模型进行拆分；将所述原始模型使用的神经网络中的前M层拆分为所述基础模型，后N层拆分为所述TEE模型；其中，后N层涉及参数调整，且所述神经网络的总层数为M加N；根据终端设备中TEE的运行空间的大小，对原始模型进行拆分。
在本说明书装置的一个实施例中，模型下发模块502被配置为执行：将所述基础模 型的数据下发到所述终端设备中的REE；将所述加密模型的数据通过与TEE之间的专用通道下发到所述终端设备中的TEE。
在本说明书装置的一个实施例中，上述模型重塑模块501还可以被配置为执行：根据预先获取的加密密钥，对TEE模型进行加密，得到加密模型；相应地，所述TEE模型的数据，包括：加密模型。
在本说明书装置的一个实施例中，上述模型重塑模块501被配置为执行：将所述加密模型封装成TEE算子；根据所述基础模型以及所述TEE算子，生成重塑模型；相应地，上述模型下发模块502被配置为执行：将重塑模型下发到终端设备中的REE。
在本说明书的一个实施例中，提出了一种模型的运行装置。参见图6，该装置600可以被设置在终端设备中，包括：接收模块601，配置为接收基础模型的数据以及TEE模型的数据；其中，所述基础模型的数据以及所述TEE模型的数据是对原始模型进行拆分之后得到的；REE 602，配置为运行所述基础模型；TEE 603，配置为运行所述TEE模型。
在本说明书装置的一个实施例中，接收模块601包括：第一接收子模块，被设置在REE 602中，配置为接收服务器发来的基础模型的数据；第二接收子模块，被设置在TEE603中，配置为通过TEE专用通道接收服务器发来的加密模型的数据。
在本说明书装置的一个实施例中，TEE模型的数据包括：对所述TEE模型加密后生成的加密模型的数据。
在本说明书装置的一个实施例中，接收模块601被设置在REE中，被配置为接收重塑模型；该重塑模型根据所述基础模型以及所述加密模型封装出的TEE算子生成；相应地，REE 602被配置为执行：运行该重塑模型中的基础模型；REE运行到重塑模型中的TEE算子时，无法识别该TEE算子，则将该TEE算子发送给TEE；相应地，TEE 603被配置为执行：TEE对TEE算子解封装，得到所述加密模型；TEE根据预先得到的解密密钥对所述加密模型进行解密，得到TEE模型；TEE运行该TEE模型。
在本说明书装置的一个实施例中，TEE 603进一步被配置为执行：将运行TEE模型后得到的特征向量输出到TEE的外部；或者，根据运行TEE模型后得到的特征向量获取识别结果，将该识别结果输出到TEE的外部。
本说明书一个实施例提供了一种计算机可读存储介质，其上存储有计算机程序，当所述计算机程序在计算机中执行时，令计算机执行说明书中任一个实施例中的方法。
本说明书一个实施例提供了一种计算设备，包括存储器和处理器，所述存储器中存储有可执行代码，所述处理器执行所述可执行代码时，实现执行说明书中任一个实施例 中的方法。
可以理解的是，本说明书实施例示意的结构并不构成对本说明书实施例的装置的具体限定。在说明书的另一些实施例中，上述装置可以包括比图示更多或者更少的部件，或者组合某些部件，或者拆分某些部件，或者不同的部件布置。图示的部件可以以硬件、软件或者软件和硬件的组合来实现。
上述装置、***内的各模块之间的信息交互、执行过程等内容，由于与本说明书方法实施例基于同一构思，具体内容可参见本说明书方法实施例中的叙述，此处不再赘述。
本说明书中的各个实施例均采用递进的方式描述，各个实施例之间相同相似的部分互相参见即可，每个实施例重点说明的都是与其他实施例的不同之处。尤其，对于装置实施例而言，由于其基本相似于方法实施例，所以描述的比较简单，相关之处参见方法实施例的部分说明即可。
本领域技术人员应该可以意识到，在上述一个或多个示例中，本发明所描述的功能可以用硬件、软件、挂件或它们的任意组合来实现。当使用软件实现时，可以将这些功能存储在计算机可读介质中或者作为计算机可读介质上的一个或多个指令或代码进行传输。
以上所述的具体实施方式，对本发明的目的、技术方案和有益效果进行了进一步详细说明，所应理解的是，以上所述仅为本发明的具体实施方式而已，并不用于限定本发明的保护范围，凡在本发明的技术方案的基础之上，所做的任何修改、等同替换、改进等，均应包括在本发明的保护范围之内。

Claims (13)

  1. 一种模型的运行方法，其中，包括：
    对原始模型进行拆分，得到基础模型以及可信执行环境TEE模型；
    将所述基础模型的数据以及所述TEE模型的数据下发到终端设备，以使所述终端设备中的富执行环境REE运行所述基础模型的数据，且所述终端设备中的TEE运行所述TEE模型的数据。
  2. 根据权利要求1所述的方法，其中，所述对原始模型进行拆分，包括如下中的至少一项：
    根据预设的拆分比例对原始模型进行拆分；
    将所述原始模型使用的神经网络中的前M层拆分为所述基础模型，后N层拆分为所述TEE模型；其中，所述神经网络的总层数为M加N；
    根据终端设备中TEE的运行空间的大小，对原始模型进行拆分。
  3. 根据权利要求1所述的方法，其中，
    所述将所述基础模型的数据以及所述TEE模型的数据下发到终端设备，包括：
    将所述基础模型的数据下发到终端设备中的REE；
    将所述TEE模型的数据通过TEE专用通道下发到终端设备中的TEE。
  4. 根据权利要求1所述的方法，其中，
    在得到TEE模型之后，并在将TEE模型的数据下发到终端设备之前，进一步包括：根据预先获取的加密密钥，对TEE模型进行加密，得到加密模型；
    所述TEE模型的数据，包括：加密模型。
  5. 根据权利要求4所述的方法，其中，
    所述将所述基础模型的数据以及所述TEE模型的数据下发到终端设备，包括：
    将所述加密模型封装成TEE算子；
    根据所述基础模型以及所述TEE算子，生成重塑模型；
    将所述重塑模型下发到所述终端设备中的REE。
  6. 一种模型的运行方法，其中，包括：
    接收基础模型的数据以及可信执行环境TEE模型的数据；其中，所述基础模型的数据以及所述TEE模型的数据是对原始模型进行拆分之后得到的；
    通过富执行环境REE运行所述基础模型；
    通过TEE运行所述TEE模型。
  7. 根据权利要求6所述的方法，其中，
    所述接收基础模型的数据以及TEE模型的数据，包括：
    由所述REE接收基础模型的数据；
    有所述TEE通过TEE专用通道接收所述TEE模型的数据。
  8. 根据权利要求6所述的方法，其中，
    所述TEE模型的数据，包括：对所述TEE模型加密后生成的加密模型。
  9. 根据权利要求8所述的方法，其中，
    所述接收基础模型的数据以及TEE模型的数据，包括：REE接收重塑模型；该重塑模型根据所述基础模型以及所述加密模型封装出的TEE算子生成；
    所述通过REE运行所述基础模型，包括：REE运行该重塑模型中的基础模型；
    所述通过TEE运行所述TEE模型，包括：
    REE运行到重塑模型中的TEE算子时，无法识别该TEE算子，则将该TEE算子发送给TEE；
    TEE对TEE算子解封装，得到所述加密模型；
    TEE根据预先得到的解密密钥对所述加密模型进行解密，得到TEE模型；
    TEE运行该TEE模型。
  10. 根据权利要求6至9中任一所述的方法，其中，在所述通过TEE运行所述TEE模型之后，进一步包括：
    TEE将运行TEE模型后得到的特征向量输出到TEE的外部；
    或者，
    TEE根据运行TEE模型后得到的特征向量获取识别结果，将该识别结果输出到TEE的外部。
  11. 一种模型的运行装置，其中，包括：
    模型重塑模块，配置为对原始模型进行拆分，得到基础模型以及可信执行环境TEE模型；
    模型下发模块，配置为将基础模型的数据以及TEE模型的数据下发到终端设备，以使所述终端设备中的富执行环境REE运行基础模型的数据，且终端设备中的TEE运行TEE模型的数据。
  12. 一种模型的运行装置，其中，包括：
    接收模块，配置为接收基础模型的数据以及可信执行环境TEE模型的数据；其中，所述基础模型的数据以及所述TEE模型的数据是对原始模型进行拆分之后得到的；
    富执行环境REE，配置为运行所述基础模型；
    TEE，配置为运行所述TEE模型。
  13. 一种计算设备，包括存储器和处理器，所述存储器中存储有可执行代码，所述处理器执行所述可执行代码时，实现权利要求1-10中任一项所述的方法。
PCT/CN2022/128036 2021-11-06 2022-10-27 模型的运行 WO2023078161A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US18/400,166 US20240232331A9 (en) 2021-11-06 2023-12-29 Model running methods and apparatuses

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202111309418.7 2021-11-05
CN202111309418.7A CN114091653B (zh) 2021-11-06 2021-11-06 模型的运行方法和装置

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US18/400,166 Continuation US20240232331A9 (en) 2021-11-06 2023-12-29 Model running methods and apparatuses

Publications (1)

Publication Number Publication Date
WO2023078161A1 true WO2023078161A1 (zh) 2023-05-11

Family

ID=80299098

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/128036 WO2023078161A1 (zh) 2021-11-06 2022-10-27 模型的运行

Country Status (3)

Country Link
US (1) US20240232331A9 (zh)
CN (1) CN114091653B (zh)
WO (1) WO2023078161A1 (zh)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114091653B (zh) * 2021-11-06 2024-07-16 支付宝(杭州)信息技术有限公司 模型的运行方法和装置
CN118102475A (zh) * 2022-11-28 2024-05-28 索尼集团公司 用于模型推理的电子设备、方法和存储介质

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20200082279A1 (en) * 2018-09-11 2020-03-12 Synaptics Incorporated Neural network inferencing on protected data
CN111786955A (zh) * 2020-06-05 2020-10-16 三星电子（中国）研发中心 用于保护模型的方法和装置
US20210165883A1 (en) * 2018-08-14 2021-06-03 Huawei Technologies Co., Ltd. Artificial intelligence ai processing method and ai processing apparatus
CN113553204A (zh) * 2021-09-16 2021-10-26 支付宝(杭州)信息技术有限公司 一种数据传输方法及装置
CN113569265A (zh) * 2021-09-16 2021-10-29 支付宝(杭州)信息技术有限公司 一种数据处理方法、***及装置
CN114091653A (zh) * 2021-11-06 2022-02-25 支付宝(杭州)信息技术有限公司 模型的运行方法和装置

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102624870A (zh) * 2012-02-01 2012-08-01 北京航空航天大学 基于智能优化算法的云制造计算资源可重构配置方法
EP3541313B1 (en) * 2016-11-16 2023-05-10 Navix International Limited Estimators for ablation effectiveness
CN109960582B (zh) * 2018-06-19 2020-04-28 华为技术有限公司 在tee侧实现多核并行的方法、装置及***
US11436343B2 (en) * 2019-12-31 2022-09-06 Arm Limited Device, system, and method of policy enforcement for rich execution environment
CN111275202B (zh) * 2020-02-20 2023-08-11 济南大学 一种面向数据隐私保护的机器学习预测方法及***
CN112947935B (zh) * 2021-02-26 2024-08-13 上海商汤智能科技有限公司 运算方法及装置、电子设备和存储介质

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20210165883A1 (en) * 2018-08-14 2021-06-03 Huawei Technologies Co., Ltd. Artificial intelligence ai processing method and ai processing apparatus
US20200082279A1 (en) * 2018-09-11 2020-03-12 Synaptics Incorporated Neural network inferencing on protected data
CN111786955A (zh) * 2020-06-05 2020-10-16 三星电子（中国）研发中心 用于保护模型的方法和装置
CN113553204A (zh) * 2021-09-16 2021-10-26 支付宝(杭州)信息技术有限公司 一种数据传输方法及装置
CN113569265A (zh) * 2021-09-16 2021-10-29 支付宝(杭州)信息技术有限公司 一种数据处理方法、***及装置
CN114091653A (zh) * 2021-11-06 2022-02-25 支付宝(杭州)信息技术有限公司 模型的运行方法和装置

Also Published As

Publication number Publication date
CN114091653B (zh) 2024-07-16
US20240232331A9 (en) 2024-07-11
CN114091653A (zh) 2022-02-25
US20240134965A1 (en) 2024-04-25

Similar Documents

Publication Publication Date Title
WO2023078161A1 (zh) 模型的运行
CN108235806B (zh) 安全访问区块链的方法、装置、***、存储介质及电子设备
CN112199701B (zh) 调用合约的方法及装置
CN107682159B (zh) 一种智能终端的可信应用管理方法和可信应用管理***
US20180183593A1 (en) Location aware cryptography
US10110575B2 (en) Systems and methods for secure data exchange
CN112487103B (zh) 一种基于区块链智能合约的深度学习数据集可信共享***
CN107204850A (zh) 一种轻量级车联网安全通信方法
CN113347206A (zh) 一种网络访问方法和装置
CN105208041B (zh) 基于hook的云存储应用加密数据包破解方法
WO2023029447A1 (zh) 模型保护方法、装置、设备、***以及存储介质
CN115150821A (zh) 离线包的传输、存储方法及装置
CN113572604A (zh) 一种发送密钥的方法、装置、***及电子设备
CN111953716B (zh) 消息通讯方法、***、计算机设备及存储介质
CN111144878A (zh) 指令生成方法与指令生成装置
CN111431922A (zh) 物联网数据加密传输方法及***
CN114338179A (zh) 页面加密方法、页面解密方法、装置、终端和服务器
CN111865602B (zh) 一种智慧能源服务***异构终端多方认证方法及***
CN111400743B (zh) 基于区块链网络的事务处理方法、装置、电子设备和介质
CN111901335A (zh) 基于中台的区块链数据传输管理方法及***
CN107222473A (zh) 在传输层对api服务数据进行加解密的方法及***
CN112565156A (zh) 信息注册方法、装置和***
CN114422588B (zh) 安全自治实现***及边缘物联代理对终端接入认证的方法
CN116961973A (zh) 数据传输方法、装置、电子设备及计算机可读存储介质
CN115086048A (zh) 数据处理方法、装置、电子设备及可读存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22889186

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE