JP7501149B2 - Secure component, device, server, computer program and machine learning method - Google Patents

Description

The present invention relates to a secure component, a device, a server, a computer program, and a machine learning method.

In recent years, IoT has become widespread, and terminal equipment (called edge devices) at the site can send collected data to a server, and the server can generate a trained model by performing machine learning using the collected data. In addition, the server can perform judgment processing and prediction processing using the data sent from the edge device and the trained model, and provide the judgment results, prediction results, etc. to the edge device.

Recently, "edge AI" has been attracting attention, in which a trained model of artificial intelligence (AI) is implemented in an edge device, and the edge device performs judgment processing, prediction processing, and the like. Patent Document 1 discloses a system in which data acquired by an edge device is sent to a server, and machine learning is performed on both the edge device and the server.

Patent No. 6267840

However, edge devices may be installed in locations accessible to third parties or may be unmanned. For this reason, if important information such as the results of machine learning are stored on an edge device, there is a risk that such important information may be obtained illegally. Furthermore, communication costs increase as the amount of data sent from the edge device to the server increases.

The present invention has been made in consideration of the above circumstances, and aims to provide a secure component, device, server, computer program, and machine learning method that can protect the learning results obtained by machine learning and reduce communication costs.

A secure component according to an embodiment of the present invention includes an acquisition unit that acquires data collected by a device, a first encryption unit that encrypts learned parameters obtained by machine learning using the data acquired by the acquisition unit, and a transmission unit that transmits the learned parameters encrypted by the first encryption unit to a first server.

The device according to the embodiment of the present invention includes the above-mentioned secure component.

A server according to an embodiment of the present invention includes a receiving unit that receives encrypted trained parameters from a secure component, a decrypting unit that decrypts the encrypted trained parameters received by the receiving unit, and a generating unit that generates a trained model based on the trained parameters decrypted by the decrypting unit and a required algorithm.

A computer program according to an embodiment of the present invention causes a computer to execute a process of acquiring data collected by a device, encrypting learned parameters obtained by machine learning using the acquired data, and transmitting the encrypted learned parameters to a server.

A computer program according to an embodiment of the present invention causes a computer to execute a process of receiving encrypted trained parameters from a secure component, decrypting the received encrypted trained parameters, and generating a trained model based on the decrypted trained parameters and a required algorithm.

In a machine learning method according to an embodiment of the present invention, a secure component acquires data collected by a device, encrypts learned parameters obtained by machine learning using the acquired data, and transmits the encrypted learned parameters to a server.

The present invention makes it possible to protect the learning results obtained through machine learning and reduce communication costs.

FIG. 1 is a schematic diagram illustrating an example of a configuration of a machine learning system according to an embodiment. FIG. 1 is a block diagram showing an example of the configuration of an IoT device. FIG. 2 is a block diagram showing an example of a configuration of a server. FIG. 1 is a schematic diagram illustrating an example of machine learning using a neural network. FIG. 1 is an explanatory diagram illustrating an example of a usage scene of a trained model. FIG. 11 is a schematic diagram showing an example of a method for determining whether or not a trained model can be transmitted. 11 is a flowchart showing an example of a processing procedure in the first aspect. 13 is a flowchart illustrating an example of a processing procedure in the case of a second aspect. 13 is a flowchart illustrating an example of a processing procedure in the case of a third aspect. 13 is a flowchart showing an example of a procedure of a learning process in a secure element. 13 is a flowchart showing an example of an inference processing procedure in a secure element.

The present invention will be described below with reference to the drawings showing an embodiment of the present invention. FIG. 1 is a schematic diagram showing an example of the configuration of a machine learning system according to the present embodiment. The machine learning system includes a plurality of IoT devices 50 (three in the example of FIG. 1). The IoT devices 50 are, for example, devices that are equipped with an OS and can operate independently, and correspond to the "things" in the "Internet of Things" (IoT). The IoT devices 50 include a SoC (System on Chip) as the device body, and a secure element as a secure component. Details of the IoT devices 50 will be described later.

The IoT device 50 is connected to an apparatus 10. The apparatus 10 is also called an edge device, and may be any device capable of collecting or generating data such as audio data, video data, or data such as position, length, time, speed, acceleration, pressure, temperature, energy, or electrical quantity. For example, the apparatus 10 includes devices capable of collecting or generating data such as various sensors, measuring instruments, cameras, automobile parts, vehicle detectors on roads, production equipment (industrial machinery), home appliances, POS terminals, smartphones, and wearable devices.

The example in FIG. 1 illustrates a form in which one device 10 is connected to one IoT device 50, a form in which multiple devices 10 (three in FIG. 1) are connected to one IoT device 50, and a form in which the IoT device 50 has the functions of the device 10. Each IoT device 50 can acquire data collected by the device 10. Also, the IoT device 50 can collect data by itself. Each IoT device 50 can be connected to a server 100 via a communication network 1 such as the Internet.

Figure 2 is a block diagram showing an example of the configuration of an IoT device 50. The IoT device 50 includes a device main body 20 and a secure element 30. Most of the device main body 20 is composed of a single SoC (System on a Chip), and many or all of the functions required for the operation of the system (including, for example, a CPU 21, a network communication unit 23, a storage unit 24, etc.) are integrated and implemented on a single semiconductor chip. The application 22 is an application that runs on the CPU 21. Note that, for convenience, one application 22 is illustrated in Figure 2, but the number of applications 22 may be multiple. The application 22 can acquire data collected by the device 10 via the network communication unit 23. Note that a function equivalent to the device 10 can also be incorporated into the device main body 20.

The secure element 30 is a tamper-resistant security chip. The secure element 30 is physically connected to the device main body 20 via a communication path 25 such as I2C (Inter-Integrated Circuit) or SPI (Serial Peripheral Interface).

The secure element 30 includes an authentication unit 31, an encryption unit 32, a decryption unit 33, a communication unit 34, an update unit 35, a data preprocessing unit 36, an execution processing unit 37, a machine learning processing unit 38, and a non-volatile memory (NVM) 39. The NVM 39 has areas reserved for storing initial parameters 41, an algorithm (program), learned parameters 43, learning data 44, and evaluation data (also called test data or verification data) 45.

FIG. 3 is a block diagram showing an example of the configuration of the server 100. The server 100 includes a control unit 101 that controls the entire server 100, a communication unit 102, an authentication unit 103, an encryption/decryption unit 104, an evaluation unit 105, a determination unit 106, a learning processing unit 107, an execution processing unit 108, and a storage unit 109. The control unit 101 can be configured with a CPU (Central Processing Unit), a ROM (Read Only Memory), a RAM (Random Access Memory), and the like. The storage unit 109 is configured with a semiconductor memory or a hard disk, and has areas for storing initial parameters 111, learned parameters 112, an algorithm (program) 113, and evaluation data 114. The server 100 can access a database 110 in which learning data is stored, and read and write data. Details of the server 100 will be described later.

The machine learning system of this embodiment has the following three main aspects. That is, as a first aspect, (1) machine learning is performed in the secure element 30 and the learning result is provided to the server 100. As a second aspect, (2) data preprocessing is performed in the secure element 30 and summary data obtained as a result of the data preprocessing is provided to the server 100. As a third aspect, (3) machine learning learning results are obtained from the server 100 and inference (such as judgment processing and estimation processing) is performed in the secure element 30. Below, the first aspect will be described first, but first the secure element 30 will be described.

The secure element 30 can acquire data collected by the device 10 from the device main body 20 via the communication path 25. The secure element 30 stores the acquired data in the NVM 39 as learning data 44.

The authentication unit 31 performs device authentication. Device authentication is authentication when the secure element 30 acquires data from the device main body 20. In this specification, since the application 22 acquires data collected by the equipment 10, device authentication is authentication of the application. For example, an authentication method can be used in which an application certificate received from the application 22 is verified using an application verification key held by the secure element 30. If authentication is successful, the secure element 30 acquires data from the device main body 20, and if authentication is unsuccessful, the secure element 30 does not acquire data from the device main body 20. This makes it possible to prevent inappropriate data or data with fraudulent intent from being sent to the secure element 30 by a fraudulent application masquerading as the application 22.

The authentication unit 31 performs server authentication. Server authentication is performed when the secure element 30 exchanges data with the server 100. Details of server authentication will be described later.

The data preprocessing unit 36 has a function as a generating unit, and can generate summary data based on the data acquired from the device 10. The summary data is data obtained by performing data preprocessing on the data acquired from the device 10, and can be used in the learning stage of machine learning, the inference stage using a trained model, and the re-learning stage. The summary data can be generated, for example, by a process of removing unnecessary data from the acquired data, a process of thinning the acquired data, a process of converting the acquired data, a normalization process of the acquired data, a statistical process or vectorization process, a process of generating teacher labels, image processing, language processing, etc. Note that in the first aspect, the data preprocessing unit 36 is not essential.

The machine learning processing unit 38 performs machine learning using data (which may include summary data) acquired from the device 10. Machine learning is learning of a neural network, and may be supervised learning in which the neural network is optimized for a problem by inputting teacher data (correct answers and incorrect answers), or may be unsupervised learning or reinforcement learning. The learning method, for example, defines the structure of the neural network (e.g., input layer, output layer, intermediate layer), prepares an algorithm (problem optimization algorithm), sets initial parameters in the neural network, and provides learning data to the neural network, thereby repeatedly updating parameters (e.g., weights between neurons, biases to be given to neurons). This makes it possible to generate learned parameters as the learning result. Note that the learned parameters are not limited to the weights between neurons of the neural network and the biases to be given to neurons, and may include, for example, Q values and Q functions generated by reinforcement learning, and include parameters generated as the learning result of the machine learning process.

Figure 4 is a schematic diagram showing an example of machine learning of a neural network. In Figure 4, a vending machine that sells various types of beverages is taken as an example of the device 10. The secure element 30 acquires purchase time data, temperature data, sales data, etc. as data collected by the vending machine (learning data set). The purchase time data is time series data of the time when the beverage was purchased, the temperature data is temperature data at the time when the beverage was purchased, and the sales data is product data (product name, product code, etc.) of the purchased beverage. When the secure element 30 collects the amount of data required for machine learning, it provides the collected learning data set to the neural network to perform machine learning, and updates the parameters of the neural network (such as the weight of the neural network's connections and bias values) to generate learned parameters. The larger the scale of the neural network, the greater the number of learned parameters, but all the learned parameters of the neural network are collectively referred to as the learned parameter group W.

By incorporating the trained parameter set W into an inference algorithm (also called a program or algorithm), a trained model can be generated. A trained model is a program that can output an inference result when unknown input data is input. In the example of Figure 4, when temperature forecast data is input to the trained model as unknown data, the trained model can output sales forecast data for drinking water.

The encryption unit 32 encrypts the learned parameters generated by the machine learning processing unit 38. The encryption algorithm may be either an asymmetric key encryption (e.g., RSA) or a symmetric key encryption (shared key encryption) (e.g., AES: Advanced Encryption Standard), and any appropriate method may be used. The secure element 30 stores the encrypted learned parameters in the learned parameters 43 area of the NVM 39.

The communication unit 34 provides a communication function with the server 100 via the communication network 1. The secure element 30 can transmit encrypted learned parameters to the server 100 via the communication unit 34. Note that, if the device main body 20 has a communication function with the server 100, the secure element 30 may transmit encrypted learned parameters to the server 100 using the communication function.

The secure element 30 transmits the learned parameters, which are the results of machine learning, to the server 100, so that the amount of data communication can be reduced and communication costs can be reduced compared to when the data collected by the device 10 is transmitted directly to the server 100. In addition, the machine learning is performed within the secure element 30, and the learning results (learned parameters) are also stored within the secure element 30 and encrypted when transmitted to the server 100, so that confidentiality and safety during communication can be ensured, and the possibility of the learning results obtained by machine learning being leaked or illegally obtained can be reduced, and the learning results can be protected.

Furthermore, each process in the secure element 30 may be performed during an idle time when the IoT device 50 is not performing any particular process. This makes it possible to prevent the processes in the secure element 30 from affecting the processes in the IoT device 50.

The authentication unit 31 performs server authentication when transmitting the encrypted learned parameters to the server 100. If the authentication is successful (for example, if the server is a legitimate server), the secure element 30 transmits the encrypted learned parameters to the server 100. If the authentication is unsuccessful, the secure element 30 determines that the server is an unauthorized server and does not transmit the learned parameters. Since the server 100 is authenticated before transmitting the encrypted learned parameters, it is possible to prevent the learning results from being transmitted to an unauthorized server. Mutual authentication may be performed in which the secure element 30 authenticates the server and the server 100 authenticates the secure element 30.

The authentication method can be, for example, a method of verifying the server certificate received from the server 100 using a server verification key held by the secure element 30.

Furthermore, the following method can be used as an authentication method. In response to an authentication request to the server 100, the secure element 30 authenticates the server 100 by comparing the parameters transmitted by the server 100 with the predetermined parameters used for machine learning stored in the NVM 39. The predetermined parameters may be the initial values of the parameters (weights, biases) stored in the initial parameters 41 area, or the most recently learned parameters obtained by the most recently performed machine learning stored in the learned parameters 43 area. If the server 100 is a legitimate server, it holds the initial values of the parameters and the most recently learned parameters, and therefore can be used for authentication. Note that the predetermined parameters may be a portion of parameters extracted from all parameters (referred to as a parameter group) according to a certain rule, or may be a derived value derived from the parameter, such as a hash value of the parameter.

Next, we will explain the server 100 in the first embodiment.

The communication unit 102 provides a communication function with the secure element 30 via the communication network 1. The server 100 can receive encrypted learned parameters via the communication unit 102.

The authentication unit 103 authenticates the secure element 30. If the authentication is successful, the control unit 101 receives the encrypted learned parameters. If the authentication is not successful, the control unit 101 does not receive the encrypted learned parameters. The authentication method of the authentication unit 103 is the same as that of the authentication unit 31.

The encryption/decryption unit 104 decrypts the encrypted learned parameters received via the communication unit 102. The control unit 101 stores the decrypted learned parameters in the memory unit 109 as learned parameters 112.

The control unit 101 can generate a trained model based on the trained parameters 112 and the algorithm 113. The algorithm 113 can be an inference algorithm (program). The inference algorithm is a program that can output an inference result for unknown input data by applying the incorporated trained parameters 112. The trained model is an inference algorithm that incorporates the trained parameters 112.

The server 100 does not need to collect data for learning from the device 10, and can generate a trained model simply by receiving trained parameters from the secure element 30, thereby reducing communication costs. In addition, the trained parameters are received by the server 100 in an encrypted state, so the learning results obtained by machine learning can be protected.

The execution processing unit 108 uses the generated trained model to execute an inference algorithm including a judgment process, a prediction process, or an estimation process. Since the trained model generated differs depending on the type of device 10, the usage scenario of the trained model (the inference result of the inference algorithm) also differs.

Figure 5 is an explanatory diagram showing an example of a usage scenario of the trained model. Figure 4 also shows an example of a usage scenario in which the device 10 is a vending machine. Figure 5 explains cases in which the device 10 is, for example, various meters for electricity, water, gas, etc., production equipment (production machines, processing machines, painting machines, etc. at a manufacturing site), a camera in a store, and a wearable device. Note that the type of device 10 is not limited to the example in Figure 5, and can include devices in various fields such as the transportation field, construction/civil engineering field, manufacturing field, disaster prevention field, distribution field, transportation field, medical field, and health management field.

In the case of various meters such as electricity, water, and gas meters, the secure element 30 can acquire a learning dataset including meter time series data, meter location information, and the like. The learning dataset may be the measurement values of the various meters, or may be values captured by a camera that show the measurement values displayed by the various meters. The trained model can provide inference results such as demand forecasts for each region and supply optimization, for example.

In the case of production equipment, the secure element 30 can acquire a training data set including vibration data, acoustic data, equipment operation data (e.g., whether the equipment is normal or abnormal), etc. The training data set can be values detected by various sensors attached to the production equipment. The trained model can provide inference results such as an estimation of equipment deterioration.

In the case of an in-store camera, the secure element 30 can acquire a learning dataset that includes data on customers entering the store, data on the number of people waiting in front of the register, and so on. The learning dataset can be the result of applying preprocessing such as image recognition to image data obtained by the camera. The trained model can provide inference results such as predictions of crowded registers, for example.

In the case of a wearable device, the secure element 30 can acquire a learning data set including three-dimensional acceleration data, time data, location information, and the like. The wearable device can be worn, for example, on the wrist or waist of a subject such as an elderly person. The trained model can provide inference results such as prediction of behavioral patterns of elderly people and prediction of deterioration of their health condition.

Note that, since different types of devices 10 generate different trained models and have different usage scenarios, the server 100 may be distributed among multiple servers, with each distributed server using a different trained model.

When the evaluation data 114 is input to the generated trained model, the evaluation unit 105 evaluates the trained parameters included in the trained model according to the output results output by the trained model.

For example, if the accuracy rate of the output data output by the trained model when the evaluation data 114 is input to the trained model is equal to or higher than a predetermined threshold, the trained model is deemed to be optimized, and the trained parameters can be made usable. On the other hand, if the accuracy rate is less than a predetermined threshold, the trained model is deemed not yet optimized, and the trained parameters can be deemed to require updating. This makes it possible to select the trained parameters received from the secure element 30, and to determine whether the trained parameters need to be updated.

Consider a case where one or more devices 10 of the same type are connected to each of multiple IoT devices 50, and each secure element 30 of each IoT device 50 transmits learned parameters to the server 100. In this case, the server 100 receives each of the learned parameters (encrypted state) from each of the multiple secure elements 30, and the encryption/decryption unit 104 decrypts each of the received learned parameters. The evaluation unit 105 evaluates each of the learned parameters.

The determination unit 106 can determine the frequency of use of the learned parameters provided by each of the multiple secure elements 30 according to the evaluation result of the evaluation unit 105. For example, if the evaluation of any of the learned parameters can be used and there is a difference in the evaluation of each learned parameter (e.g., a difference in the accuracy rate), the frequency of use of the learned parameter provided by the secure element 30 that transmitted the learned parameter with a higher accuracy rate is increased. On the other hand, the frequency of use of the learned parameter provided by the secure element 30 that transmitted the learned parameter with a lower accuracy rate is decreased. The frequency of use may be determined by weighting according to the accuracy rate. This makes it possible to take into account the merits of the data collected by the multiple secure elements 30 (IoT devices 50) from the equipment 10.

The secure element 30 may have the following functions:

Each time a learned parameter is obtained by machine learning, the secure element 30 stores the encrypted learned parameter in the NVM 39. The secure element 30 can transmit the encrypted learned parameter read from the NVM 39 to the server 100 at a required timing. The required timing can be, for example, aligned with the timing of machine learning, and can be determined appropriately according to the usage environment and usage form in which the device 10 is used, and the attributes and type of data obtained from the device 10. The required timing can be once a day, once an hour, once a minute, or when the remaining storage capacity for the learned parameters 43 falls below a threshold. Since the learning result is stored in the NVM 39 in an encrypted state, unauthorized acquisition of the learning result can be prevented, thereby enhancing security.

When performing machine learning, the secure element 30 reads the encrypted learned parameters from the NVM 39, decrypts the read encrypted learned parameters in the decryption unit 33, and uses the decrypted learned parameters. When the secure element 30 ends machine learning, the encryption unit 32 encrypts the learned parameters obtained by machine learning. The update unit 35 can update the most recently encrypted learned parameters stored in the NVM 39 with the encrypted learned parameters. In this way, the learned parameters are decrypted only when they are used for machine learning and are encrypted when machine learning is not performed. Therefore, even if the learned parameters are illegally obtained, the encrypted learned parameters cannot be decrypted. This makes it possible to prevent the learned parameters from being misused by a third party.

When the secure element 30 inputs evaluation data 45 into a trained model including trained parameters obtained by machine learning, the secure element 30 may determine whether or not to encrypt and transmit the trained parameters to the server 100 depending on the output results output by the trained model.

Figure 6 is a schematic diagram showing an example of a method for determining whether a trained model can be transmitted. As shown in Figure 6, a trained parameter group generated as a result of machine learning using a training dataset D1 is designated as W1. The accuracy rate of the output of a trained model generated by applying the trained parameter group W1 to an inference algorithm is designated as 95%. If the determination threshold for whether transmission is possible is set to 90%, the trained parameter group W1 can be determined to be transmittable.

As a result of machine learning using the training dataset D2, the trained parameter set generated is designated as W2. If the accuracy rate of the output of the trained model generated by applying the trained parameter set W2 to the inference algorithm is 75%, then it can be determined that the trained parameter set W2 cannot be transmitted.

As a result of machine learning using the training dataset D3, the trained parameter group generated is designated as W3. If the accuracy rate of the output of the trained model generated by applying the trained parameter group W3 to the inference algorithm is 90%, then it can be determined that the trained parameter group W3 is suitable for transmission.

In this way, when the evaluation data 45 is input to the trained model, if the accuracy rate of the output data output by the trained model is equal to or greater than a predetermined threshold, it is determined that the trained parameters can optimize the neural network, and it is possible to determine that the trained parameters can be transmitted. Also, if the accuracy rate is less than the predetermined threshold, it is determined that the trained parameters cannot optimize the neural network, and it is possible to determine that the trained parameters cannot be transmitted. This allows the secure element 30 to select and transmit only trained parameters that can optimize the neural network, and the server 100 can prevent the transmission of unuseful trained parameters. Note that when the secure element 30 evaluates trained parameters, the evaluation unit 105 of the server 100 may not be essential.

Next, we will explain the second mode in which data preprocessing is performed in the secure element 30 and the summary data obtained as a result of the data preprocessing is provided to the server 100.

The function of the data preprocessing unit 36 is the same as that described in the first aspect, so the description will be omitted.

The encryption unit 32 can encrypt the summary data generated by the data preprocessing unit 36. The encryption algorithm can be either asymmetric key cryptography (e.g., RSA) or symmetric key cryptography (shared key cryptography) (e.g., AES: Advanced Encryption Standard), and any appropriate method can be used. The secure element 30 can store the encrypted summary data in the NVM 39.

The secure element 30 can transmit encrypted summary data to the server 100. When transmitting the summary data to the server 100, the authentication unit 31 can perform server authentication. In addition, mutual authentication may be performed by having the server 100 authenticate the secure element 30.

In the server 100, the encryption/decryption unit 104 decrypts the encrypted summary data. The learning processing unit 107 performs machine learning using the decrypted summary data as learning data, and can generate learned parameters.

As a result, the generation of summary data required at each stage, such as learning, inference, and re-learning, is performed within the secure element 30, and the summary data is encrypted when it is sent to the server 100, thereby reducing the possibility of important summary data being leaked or illegally obtained at each stage, such as learning, inference, and re-learning, and protecting the summary data.

Next, we will explain the third mode in which the machine learning learning results are obtained from the server 100 and inference (such as judgment processing and estimation processing) is performed by the secure element 30.

In the server 100, the learning processing unit 107 generates learned parameters 112 by machine learning using the learning data stored in the database 110. The learning data stored in the database 110 may be acquired from an IoT device other than the IoT device 50 shown in FIG. 1, or may be acquired from another device. The learning data stored in the database 110 can be collected at any time. The control unit 101 can generate a learned model based on the learned parameters 112 and the algorithm 113.

The server 100 can perform mutual authentication with the secure element 30. If the authentication is successful, the control unit 101 transmits the generated trained model or the generated trained parameters in an encrypted state to the secure element 30. If the secure element 30 holds an inference algorithm, the control unit 101 can transmit the trained parameters. If the secure element 30 does not hold an inference algorithm, the control unit 101 can transmit the trained model.

The secure element 30 authenticates the server 100, and if the authentication is successful, receives the encrypted trained parameters or the encrypted trained model from the server 100. If the authentication is not successful, the secure element 30 determines that the server 100 is an unauthorized server and does not receive the trained parameters or the trained model. Since the server is authenticated before receiving the encrypted trained parameters or the encrypted trained model, it is possible to prevent the reception of unauthorized trained parameters or trained models.

When the secure element 30 receives an encrypted trained model or encrypted trained parameters, it can perform MAC (Message Authentication Code) verification.

The MAC verification can be performed, for example, as follows. The authentication unit 103 uses a MAC key held by itself to calculate a MAC for the encrypted learned model or the encrypted learned parameters, and assigns the calculated MAC to the encrypted learned model or the encrypted learned parameters. For the MAC calculation, an existing MAC calculation algorithm (e.g., HMAC-SHA256, etc.) can be used for the data string of the encrypted learned model or the encrypted learned parameters. The secure element 30 uses a MAC verification key held by itself to verify the MAC assigned to the encrypted learned model or the encrypted learned parameters. Specifically, the MAC is derived by performing the same calculation as the MAC calculation performed by the server 100, and if it matches the MAC assigned to the encrypted learned model or the encrypted learned parameters, it can be determined that the MAC verification is successful. If the two do not match, the encrypted learned model or the encrypted learned parameters can be discarded as being invalid.

When the secure element 30 receives encrypted learned parameters, the update unit 35 can update the learned parameters 43 stored in the NVM 39 with the received learned parameters.

When the secure element 30 stores a trained model, it is possible to update the trained model by updating the trained parameters. The secure element 30 does not need to transmit data acquired from the device 10 to the server 100 and obtain the inference results executed by the server 100, and can execute the required inference (e.g., judgment processing, prediction processing, estimation processing, etc.) by the execution processing unit 37 in real time based on the data.

When the secure element 30 receives an encrypted trained model from the server 100, the decryption unit 33 decrypts the encrypted trained model, and the execution processing unit 37 can perform the required inference (e.g., judgment processing, prediction processing, estimation processing, etc.) using the decrypted trained model.

Even if the secure element 30 does not have a machine learning processing unit 38 and is unable to perform machine learning itself, it can obtain a trained model from the server 100. The secure element 30 can execute the required inference (e.g., judgment processing, prediction processing, estimation processing, etc.) in real time using the execution processing unit 37 based on the data obtained from the device 10.

The secure element 30 may have the following functions:

When the secure element 30 performs a required inference (e.g., a judgment process, a prediction process, an estimation process, etc.), the decryption unit 33 reads out and decrypts the encrypted trained model (algorithm 42 and trained parameters 43) stored in the NVM 39. The execution processing unit 37 inputs input data into the decrypted trained model and outputs the inference result. When the processing of the execution processing unit 37 is completed, the encryption unit 32 encrypts the trained model and stores it in the NVM 39. Note that if the trained model read out to the NVM 39 remains in the NVM 39, there is no need to write it again, so the trained model used for the inference may be erased after the processing of the execution processing unit 37 is completed.

The trained model is decrypted only when it is used for the required inference, and is encrypted when the required inference is not performed. Therefore, even if the trained model is illegally obtained, the encrypted trained model cannot be decrypted. This makes it possible to prevent the trained model from being misused by third parties.

Next, we will explain the operation of the machine learning system of this embodiment.

Figure 7 is a flowchart showing an example of the processing procedure in the first mode. The device main body 20 acquires data collected by the device 10 (S101). The secure element 30 performs device authentication (S301) and determines whether the authentication is successful (S302). If the authentication is successful (YES in S302), the secure element 30 acquires the data collected by the device 10 from the device main body 20 (S303).

The secure element 30 performs machine learning processing (S304) and determines whether learning is complete (S305). If learning is not complete (NO in S305), the secure element 30 continues processing from step S304 onwards. If learning is complete (YES in S305), the secure element 30 uses the evaluation data to evaluate the learned parameters generated as a result of the machine learning (S306).

The secure element 30 determines whether the accuracy rate of the output result output by the trained model when the evaluation data is used is equal to or greater than a threshold (S307), and if the accuracy rate is not equal to or greater than the threshold (NO in S307), discards the trained parameters (S308) and ends the process. If the accuracy rate is equal to or greater than the threshold (YES in S307), the secure element 30 encrypts the trained parameters and stores the encrypted trained parameters in the NVM 39 (S309).

The secure element 30 performs server authentication (S310). In this case, mutual authentication may be performed between the secure element 30 and the server 100. The secure element 30 determines whether the authentication is successful (S311).

If authentication is successful (YES in S311), the secure element 30 transmits the encrypted learned parameters to the server 100 (S312). If authentication is not successful (NO in S302, NO in S311), the secure element 30 ends the processing. The server 100 receives the learned parameters, decrypts the received learned parameters, stores them in the memory unit 109 (S501), and ends the processing.

Figure 8 is a flowchart showing an example of the processing procedure in the second mode. The device main body 20 acquires data collected by the device 10 (S111). The secure element 30 performs device authentication (S321) and determines whether the authentication is successful (S322). If the authentication is successful (YES in S322), the secure element 30 acquires the data collected by the device 10 from the device main body 20 (S323).

The secure element 30 generates summary data from the acquired data (S324), encrypts the generated summary data, and stores the encrypted summary data in the NVM 39 (S325). The secure element 30 performs server authentication (S326). Note that in this case, mutual authentication may be performed between the secure element 30 and the server 100. The secure element 30 determines whether the authentication is successful (S327).

If the authentication is successful (YES in S327), the secure element 30 transmits the encrypted summary data to the server 100 (S328). If the authentication is not successful (NO in S327), the secure element 30 ends the process.

The server 100 receives the summary data, decrypts the received summary data, and stores it in the storage unit 109 (S511). The server 100 performs machine learning processing using the summary data (S512), generates a trained model (S513), and ends the processing.

Figure 9 is a flowchart showing an example of the processing procedure in the third mode. The secure element 30 performs server authentication (S341). In this case, mutual authentication may be performed between the secure element 30 and the server 100. The secure element 30 determines whether the authentication is successful (S342), and ends the processing if the authentication is not successful (NO in S342).

If the authentication is successful (YES in S342), the secure element 30 receives the encrypted trained model from the server 100 (S343). Note that encrypted trained parameters may be received instead of the encrypted trained model. The secure element 30 performs MAC verification (S344) and determines whether the verification is successful (S345).

If the verification is unsuccessful (NO in S345), the secure element 30 discards the received trained model (S346) and ends the process. In this case, the server 100 may be notified that the verification was unsuccessful. If the verification is successful (YES in S345), the secure element 30 decrypts the trained model and stores it in NVM 39 (S347), and ends the process. Note that the trained model may also be stored in NVM 39 in an encrypted state.

Figure 10 is a flowchart showing an example of the procedure for the learning process in the secure element 30. The secure element 30 determines whether or not a learning data set has been acquired (S351), and if the learning data set has not been acquired (NO in S351), continues the process of step S351. If the learning data set has been acquired (YES in S351), the secure element 30 reads the encrypted most recent learning result (learned parameters, most recent accuracy rate corresponding to the learned parameters) from the NVM 39 and decrypts it (S352).

The secure element 30 performs machine learning processing (S353) and evaluates the learned parameters based on the output results output by the learned model when the evaluation data is used (S354). The secure element 30 determines whether the accuracy rate of the output results output by the learned model is equal to or higher than the most recent accuracy rate (S344), and if the accuracy rate is equal to or higher than the most recent accuracy rate (YES in S355), it encrypts the learned parameters generated in step S353, updates the most recent learned parameters (S356), and ends the process. If the accuracy rate is not equal to or higher than the most recent accuracy rate (NO in S355), the secure element 30 ends the process. In this case, the learned parameters generated in step S353 may be discarded.

Figure 11 is a flowchart showing an example of the procedure for inference processing in the secure element 30. The secure element 30 determines whether it is time to perform inference (judgment, estimation, etc.) (S361), and if it is not time to perform inference (NO in S361), it continues the processing of step S361. If it is time to perform inference (YES in S361), the secure element 30 reads the encrypted trained model from the NVM 39 and decrypts it (S362).

The secure element 30 acquires input data (S363), inputs the acquired input data into the trained model, and outputs an inference result (judgment result, estimation result, etc.) from the trained model (S364). The secure element 30 judges whether the inference process (judgment process, estimation process, etc.) has ended (S365), and if the inference process has not ended (NO in S365), it continues the process of step S363. If the inference process has ended (YES in S365), the secure element 30 encrypts the trained model and stores it in the NVM 39 (S366), and ends the process.

In this embodiment, the secure element 30 can be configured to be removable, like a UICC (Universal Integrated Circuit Card). Even if the secure element 30 is illegally obtained by a third party, the secure element 30 is tamper-resistant, so the possibility of the information in the secure element 30 being illegally obtained is extremely low.

In this embodiment, the secure element 30 has been described as an example of a secure component, but the secure component is not limited to the secure element 30. The secure component may be a trusted execution environment (also called a TEE) partitioned on a SoC (System on Chip) by using a technology called CPU virtualization support technology (for example, TrustZone (registered trademark)).

In this embodiment, the configuration includes one server 100, but the server 100 may be distributed across multiple servers. In this case, the configuration may include three servers corresponding to the first, second, and third aspects.

The secure component of this embodiment includes an acquisition unit that acquires data collected by a device, a first encryption unit that encrypts learned parameters obtained by machine learning using the data acquired by the acquisition unit, and a transmission unit that transmits the learned parameters encrypted by the first encryption unit to a first server.

The computer program of this embodiment causes a computer to execute a process of acquiring data collected by a device, encrypting learned parameters obtained by machine learning using the acquired data, and transmitting the encrypted learned parameters to a server.

In the machine learning method of this embodiment, the secure component acquires data collected by the device, encrypts the learned parameters obtained by machine learning using the acquired data, and transmits the encrypted learned parameters to the server.

A device that implements a secure component acquires data collected by the device from the equipment, and the secure component acquires data collected by the equipment via the device. The equipment is also called an edge device, and may be any device that can collect or generate data such as audio data, video data, or position, length, time, speed, acceleration, pressure, temperature, energy, or electrical quantity. For example, equipment includes various sensors, measuring instruments, cameras, automobile parts, vehicle detectors on roads, production equipment (industrial machinery), home appliances, POS terminals, smartphones, wearable devices, and other devices that can collect or generate data.

The secure component may be a secure element. The secure element is a tamper-resistant security chip that has an internal CPU, NVM (Non-volatile memory), and secure non-volatile memory. The secure component may also be a trusted execution environment (also called TEE) partitioned on a SoC (System on Chip) by using a technology called CPU virtualization support technology (e.g., TrustZone (registered trademark)).

The secure component encrypts the learned parameters obtained by machine learning using the acquired data. Machine learning is learning of a neural network, and may be supervised learning in which the neural network is optimized for a problem by inputting training data (correct and incorrect answers), or it may be unsupervised learning or reinforcement learning. The learning method, for example, defines the structure of the neural network (e.g., input layer, output layer, intermediate layer), prepares an algorithm (problem optimization algorithm), sets initial parameters for the neural network, and provides learning data to the neural network, thereby repeatedly updating the parameters (e.g., weights between neurons, biases provided to neurons). This generates the learned parameters.

The secure component transmits the encrypted learned parameters to the first server. Since the learned parameters, which are the learning results of machine learning in the secure component, are transmitted to the first server, the amount of data communication can be reduced compared to when data collected by the device is transmitted directly to the first server, and communication costs can be reduced. Furthermore, since machine learning is performed within the secure component and the learning results (learned parameters) are also stored within the secure component and are encrypted when transmitted to the first server, the possibility of the learning results obtained by machine learning being leaked or obtained illegally can be reduced, and the learning results can be protected.

The secure component of this embodiment includes a first authentication unit that authenticates the first server, and the transmission unit transmits the encrypted learned parameters to the first server if authentication is successful in the first authentication unit.

The secure component authenticates the first server, and if the authentication is successful (for example, if the first server is a legitimate server), it transmits the encrypted learned parameters to the first server. If the authentication is not successful, it determines that the first server is an unauthorized server and does not transmit the learned parameters. Since the server is authenticated before transmitting the encrypted learned parameters, it is possible to prevent the learning results from being transmitted to an unauthorized server.

The secure component of this embodiment includes a first storage unit that stores predetermined parameters used in the machine learning, and the first authentication unit authenticates the first server by comparing the parameters sent by the first server in response to an authentication request to the first server with the predetermined parameters stored in the first storage unit.

In response to an authentication request to the first server, the secure component authenticates the first server by comparing the parameters sent by the first server with the predetermined parameters used for machine learning stored in the first storage unit. The predetermined parameters may be the initial values of the neural network parameters (weights, biases), or the most recently learned parameters obtained by the most recently performed machine learning. If the first server is a legitimate server, it holds the initial values of the parameters and the most recently learned parameters, and can therefore be used for authentication. Note that the predetermined parameters may be a portion of parameters extracted from all parameters (referred to as a parameter group) according to a certain rule, or may be a derived value derived from the parameter, such as a hash value of the parameter.

The secure component of this embodiment includes a second storage unit that stores the learned parameters encrypted by the first encryption unit each time a learned parameter is obtained by the machine learning, and the transmission unit transmits the encrypted learned parameters read from the second storage unit to the first server at the required timing.

Each time a learned parameter is obtained by machine learning, the secure component stores the encrypted learned parameter in the second storage unit. The secure component transmits the encrypted learned parameter read from the second storage unit to the first server at a required timing. The required timing can be, for example, aligned with the timing of machine learning, and can be determined appropriately depending on the usage environment and usage form in which the device is used, and the attributes and type of data obtained from the device. The required timing can be once a day, once an hour, once a minute, or when the remaining storage capacity of the second storage unit falls below a threshold. Since the learning result is stored in an encrypted state, unauthorized acquisition of the learning result can be prevented, thereby enhancing security.

The secure component of this embodiment includes a first decryption unit that decrypts the encrypted learned parameters stored in the second storage unit, and when performing the machine learning, the learned parameters decrypted by the first decryption unit are used, and when the machine learning is terminated, the first encryption unit encrypts the learned parameters obtained by the machine learning, and further includes an update unit that updates the encrypted learned parameters stored in the second storage unit with the encrypted learned parameters.

When performing machine learning, the secure component reads the encrypted learned parameters from the second storage unit, decrypts the read encrypted learned parameters, and uses the decrypted learned parameters. When the secure component terminates machine learning, it encrypts the learned parameters obtained by machine learning and updates the encrypted learned parameters stored in the second storage unit with the encrypted learned parameters. Since the learned parameters are decrypted only when they are used for machine learning and are encrypted when machine learning is not being performed, even if the learned parameters are illegally obtained, the encrypted learned parameters cannot be decrypted. This makes it possible to prevent the learned parameters from being misused by a third party.

The secure component of this embodiment includes a third storage unit that stores evaluation data, and a determination unit that, when the evaluation data is input to a trained model including trained parameters obtained by the machine learning, determines whether or not to transmit the encrypted trained parameters to the first server depending on the output result output by the trained model.

The secure component stores evaluation data (also referred to as test data or validation data). When the secure component inputs the evaluation data to a trained model including trained parameters obtained by machine learning, the secure component determines whether to encrypt and transmit the trained parameters to the first server, depending on the output results output by the trained model.

For example, if the accuracy rate of the output data output by the trained model when the evaluation data is input to the trained model is equal to or higher than a predetermined threshold, it is determined that the neural network can be optimized using the trained parameters, and the trained parameters are encrypted and not transmitted to the first server. On the other hand, if the accuracy rate is less than the predetermined threshold, it is determined that the neural network cannot be optimized using the trained parameters, and the trained parameters are encrypted and not transmitted to the first server. This makes it possible to select and transmit only trained parameters that can optimize the neural network, and the first server can prevent the transmission of unuseful trained parameters.

The secure component of this embodiment includes a generation unit that generates summary data based on the data acquired by the acquisition unit, the first encryption unit encrypts the summary data generated by the generation unit, and the transmission unit transmits the encrypted summary data to the first server.

The secure component generates summary data based on the data acquired from the device. The summary data is obtained by performing data preprocessing on the data acquired from the device, and is used in the learning stage, re-learning stage, and inference stage using a trained model of machine learning. The summary data can be generated, for example, by a process of removing unnecessary data from the acquired data, a process of thinning the acquired data, a process of converting the acquired data, a normalization process of the acquired data, a statistical process, or a vectorization process.

The secure component encrypts the generated summary data and transmits the encrypted summary data to the first server. As a result, the generation of summary data required at each stage, such as learning, inference, and re-learning, is performed within the secure component, and the summary data is encrypted when transmitted to the first server. This reduces the possibility that important summary data will be leaked or illegally obtained at each stage, such as learning, inference, and re-learning, and enables the summary data to be protected.

The secure component of this embodiment includes a receiving unit that receives the encrypted learned parameters from the second server, and the update unit updates the encrypted learned parameters stored in the second storage unit with the encrypted learned parameters received by the receiving unit.

The secure component receives the encrypted learned parameters from the second server. The learned parameters can be the results of machine learning learning by the second server. The secure component updates the encrypted learned parameters stored in the second storage unit with the received encrypted learned parameters.

When the secure component stores a trained model, the trained model can be updated by updating the trained parameters. The secure component can perform required inferences (e.g., judgment processing, estimation processing, etc.) in real time based on data acquired from the device without transmitting the data to a server.

The secure component of this embodiment includes a receiving unit that receives the encrypted trained model from the second server, a second decryption unit that decrypts the encrypted trained model received by the receiving unit, and a processing unit that performs required processing using the trained model decrypted by the second decryption unit.

The secure component receives the encrypted trained model from the second server. The trained model may be a result of machine learning training by the second server. The secure component decrypts the encrypted trained model and performs required processing using the decrypted trained model. The required processing may be inference (e.g., a determination process, an estimation process, etc.).

Even if the secure component itself cannot perform machine learning, it can obtain a trained model from the second server. The secure component can perform required inferences (e.g., judgment processing, estimation processing, etc.) in real time based on data obtained from the device.

The secure component of this embodiment includes a third storage unit that stores the encrypted trained model received by the receiving unit, and the second decryption unit decrypts the encrypted trained model read from the third storage unit when the processing unit performs the required processing, and further includes a second encryption unit that encrypts the trained model when the processing unit has completed the required processing, and stores the trained model encrypted by the second encryption unit in the third storage unit.

The secure component stores the received encrypted trained model in the third storage unit. The secure component decrypts the encrypted trained model read from the third storage unit and performs the required processing. The required processing may be inference (e.g., a determination process, an estimation process, etc.). When the secure component finishes the required processing, it encrypts the trained model and stores the encrypted trained model in the third storage unit.

The trained model is decrypted only when it is used for the required inference, and is encrypted when the required inference is not performed. Therefore, even if the trained model is illegally obtained, the encrypted trained model cannot be decrypted. This makes it possible to prevent the trained model from being misused by third parties.

The secure component of this embodiment includes a second authentication unit that authenticates the second server, and the receiving unit receives the encrypted trained parameters or the encrypted trained model if authentication is successful in the second authentication unit.

The secure component authenticates the second server, and if the authentication is successful (for example, if the second server is a legitimate server), receives the encrypted trained parameters or the encrypted trained model from the second server. If the authentication is not successful, the secure component determines that the second server is an unauthorized server and does not receive the trained parameters or the trained model. Since the server is authenticated before receiving the encrypted trained parameters or the encrypted trained model, it is possible to prevent the reception of unauthorized trained parameters or trained models.

The device of this embodiment is equipped with the above-mentioned secure component.

It is possible to realize a device that can protect the learning results obtained through machine learning and reduce communication costs.

The server of this embodiment includes a receiving unit that receives encrypted trained parameters from the secure component, a decrypting unit that decrypts the encrypted trained parameters received by the receiving unit, and a generating unit that generates a trained model based on the trained parameters decrypted by the decrypting unit and a required algorithm.

The computer program of this embodiment causes a computer to execute a process of receiving encrypted trained parameters from a secure component, decrypting the received encrypted trained parameters, and generating a trained model based on the decrypted trained parameters and a required algorithm.

The server receives the encrypted trained parameters from the secure component and decrypts the received encrypted trained parameters. The server generates a trained model based on the decrypted trained parameters and a required algorithm. The required algorithm may be an inference algorithm (program). The inference algorithm is a program that can output an inference result for unknown input data by applying the built-in trained parameters. The trained model is an inference algorithm that incorporates the trained parameters.

The server does not need to collect data for learning from the device, and can generate a trained model simply by receiving the trained parameters from the secure component, thereby reducing communication costs. In addition, the trained parameters are received by the server in an encrypted state, so the learning results obtained by machine learning can be protected.

The server of this embodiment includes a storage unit that stores evaluation data, and an evaluation unit that evaluates the trained parameters included in the trained model according to the output result output by the trained model when the evaluation data is input to the trained model generated by the generation unit.

The server stores evaluation data (also called test data or validation data). When the server inputs the evaluation data into the generated trained model, it evaluates the trained parameters included in the trained model according to the output results output by the trained model.

For example, if the accuracy rate of the output data output by the trained model when evaluation data is input to the trained model is equal to or higher than a predetermined threshold, the trained model is deemed to be optimized, and the trained parameters can be deemed usable. On the other hand, if the accuracy rate is less than a predetermined threshold, the trained model is deemed not yet optimized, and the trained parameters can be deemed to require updating. This makes it possible to select trained parameters received from the secure component, and to determine whether or not the trained parameters need to be updated.

In the server of this embodiment, the evaluation unit includes a determination unit that evaluates each of the learned parameters obtained by the multiple secure components through machine learning, and determines the frequency of use of the learned parameters provided by each of the multiple secure components based on the evaluation results.

The server receives each of the learned parameters (encrypted state) obtained by the multiple secure components through machine learning, and decrypts and evaluates each of the received learned parameters. The server determines the frequency of use of the learned parameters provided by each of the multiple secure components according to the evaluation results. For example, if the evaluations of any of the learned parameters can be used and there is a difference in the evaluations of the respective learned parameters (e.g., a difference in the accuracy rate), the server increases the frequency of use of the learned parameters provided by the secure component that provided the learned parameters with a higher accuracy rate. On the other hand, the server decreases the frequency of use of the learned parameters provided by the secure component that provided the learned parameters with a lower accuracy rate. This makes it possible to stratify the data collected from equipment by multiple secure components (devices) from the perspective of machine learning.

Reference Signs List 1 Communication network 10 Equipment 20 Device body 21 CPU
22 Application 23 Network communication unit 24 Memory unit 25 Communication path 30 Secure element 31 Authentication unit 32 Encryption unit 33 Decryption unit 34 Communication unit 35 Update unit 36 Data preprocessing unit 37 Execution processing unit 38 Machine learning processing unit 39 NVM
41 Initial parameters 42 Algorithm 43 Learned parameters 44 Learning data 45 Evaluation data 50 IoT device 100 Server 101 Control unit 102 Communication unit 103 Authentication unit 104 Encryption/decryption unit 105 Evaluation unit 106 Determination unit 107 Learning processing unit 108 Execution processing unit 109 Storage unit 110 Database 111 Initial parameters 112 Learned parameters 113 Algorithm 114 Evaluation data

Claims (16)

an acquisition unit that acquires data collected by the device;
a first encryption unit that encrypts learned parameters obtained by machine learning using the data acquired by the acquisition unit;
a transmission unit that transmits the learned parameters encrypted by the first encryption unit to a first server ;
a third storage unit that stores evaluation data;
a determination unit that, when the evaluation data is input to a trained model including trained parameters obtained by the machine learning, determines whether or not to transmit the encrypted trained parameters to the first server, depending on an output result output by the trained model;
Equipped with
The determination unit is
When the accuracy rate of the output data output by the trained model is equal to or greater than a threshold, it is determined that the trained parameters are transmittable .
Secure components. a first authentication unit that authenticates the first server;
The transmission unit is
If authentication is successful in the first authentication unit, the encrypted learned parameters are transmitted to the first server.
The secure component of claim 1 . A first storage unit that stores a predetermined parameter used in the machine learning,
The first authentication unit
authenticating the first server by comparing a parameter transmitted by the first server in response to an authentication request to the first server with a predetermined parameter stored in the first storage unit;
The secure component of claim 2 . a second storage unit that stores the learned parameters encrypted by the first encryption unit each time a learned parameter is obtained by the machine learning;
The transmission unit is
Transmitting the encrypted learned parameters read from the second storage unit to the first server at a required timing.
A secure component according to any one of claims 1 to 3. A first decryption unit that decrypts the encrypted learned parameters stored in the second storage unit,
When performing the machine learning, the learned parameters decoded by the first decoding unit are used,
When the machine learning is completed, the first encryption unit encrypts the learned parameters obtained by the machine learning,
Further, an update unit is provided that updates the encrypted learned parameters stored in the second storage unit with the encrypted learned parameters.
A secure component as claimed in claim 4. a generation unit that generates summary data based on the data acquired by the acquisition unit;
The first encryption unit
encrypting the abstract data generated by the generation unit;
The transmission unit is
Sending the encrypted abstract to the first server;
A secure component according to any one of claims 1 to 5 . A receiving unit that receives the encrypted learned parameters from the second server,
The update unit is
updating the encrypted learned parameters stored in the second storage unit with the encrypted learned parameters received by the receiving unit;
A secure component as claimed in claim 5. A receiving unit that receives the encrypted trained model from the second server;
A second decryption unit that decrypts the encrypted trained model received by the receiving unit;
A processing unit that performs required processing using the trained model decoded by the second decoding unit.
A secure component according to any one of claims 1 to 6 . A third storage unit that stores the encrypted trained model received by the receiving unit,
The second decoding unit is
When performing required processing in the processing unit, the encrypted trained model read from the third storage unit is decrypted,
Further, a second encryption unit that encrypts the trained model when the processing unit has completed a required process,
The trained model encrypted by the second encryption unit is stored in the third storage unit.
A secure component as claimed in claim 8 . a second authentication unit that authenticates the second server;
The receiving unit is
If authentication is successful in the second authentication unit, the encrypted trained parameters or the encrypted trained model are received.
A secure component according to any one of claims 7 to 9 . A secure component according to any one of claims 1 to 10 ,
device. a receiving unit that receives encrypted learned parameters from the secure component;
a decryption unit that decrypts the encrypted learned parameters received by the receiving unit;
A generation unit that generates a trained model based on the trained parameters decoded by the decoding unit and a required algorithm ;
A storage unit that stores evaluation data;
an evaluation unit that evaluates a trained parameter included in the trained model according to an output result output by the trained model when the evaluation data is input to the trained model generated by the generation unit;
a determination unit that determines that the trained parameters are transmittable when a correct answer rate of output data output by the trained model is equal to or greater than a threshold;
Equipped with
server. The evaluation unit is
Evaluating each of the learned parameters obtained by machine learning by the multiple secure components;
a determination unit that determines a frequency of use of learned parameters provided by each of the plurality of secure components according to an evaluation result;
The server of claim 12 . On the computer,
Acquire the data collected by the device,
The learned parameters obtained through machine learning using the acquired data are encrypted,
The encrypted learned parameters are sent to the server.
Store evaluation data;
When the evaluation data is input to a trained model including trained parameters obtained by the machine learning, a determination is made as to whether or not the encrypted trained parameters can be transmitted to the server, depending on an output result output by the trained model;
When the accuracy rate of the output data output by the trained model is equal to or greater than a threshold, it is determined that the trained parameters are transmittable .
A computer program that executes a process. On the computer,
Receives encrypted learned parameters from the secure component,
Decrypting the received encrypted learned parameters;
generating a trained model based on the decoded trained parameters and a required algorithm;
Store evaluation data;
When the evaluation data is input to the generated trained model, trained parameters included in the trained model are evaluated according to an output result output by the trained model;
When the accuracy rate of the output data output by the trained model is equal to or greater than a threshold, it is determined that the trained parameters are transmittable .
A computer program that executes a process. The secure component
Acquire the data collected by the device,
The learned parameters obtained through machine learning using the acquired data are encrypted,
The encrypted learned parameters are sent to the server .
Store evaluation data;
When the evaluation data is input to a trained model including trained parameters obtained by the machine learning, a determination is made as to whether or not the encrypted trained parameters can be transmitted to the server, depending on an output result output by the trained model;
When the accuracy rate of the output data output by the trained model is equal to or greater than a threshold, it is determined that the trained parameters are transmittable .
Machine learning methods.

Images