I want my models to be accessible only by my programs. How do I encrypt and decrypt my model when I run inference on it? Is there any existing technology that is widely used?
$\begingroup$
$\endgroup$
1
-
1$\begingroup$ It's not really possible. If your program runs on the users' machines, they will have access to the encryption keys (as your program will have them). You can make it hard, but if someone is determined enough, they will be able to crack it. I wouldn't waste time on encrypting it. $\endgroup$– Oliver MasonCommented May 22, 2019 at 8:11
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
While @Oliver Mason's comment is correct, and your proposed method won't provide perfect security, you can still protect your models at rest, so that they are stored encrypted in the memory, and your software feed the key at runtime to decrypt it.
On whatever DL inference engine that you have, once it supports loading the model from a buffer (e.g. void*) rather than a file path, you can do the following: read the encrypted model, decrypt it into a buffer, and initialize your neural network model from the decrypted buffer. OpenVino supports loading the model from a buffer.
For encrypt / decrypt the model, any framework such as OpenSSL, or even tiny-AES, can work.
Mentioning again, how to store and use the key is something that should be handled carefully, and a user with sufficient knowledge can read the model and the keys at runtime from the application's memory.
