当前位置：首页 > news >正文

尝试使用gocryptfs实现大模型加密部署

news 2025/8/5 13:14:17

契机

最近公司需要把大模型部署到三方公司服务器，当然不能让三方公司搞到模型的源文件。由于用transformers框架加载模型，输入参数直接就是模型的目录，所以传统的文件加密有点难搞，所以尝试使用gocryptfs目录加密，过程很曲折，结果也一般，此文不会作为最终的加密部署方案，仅仅记录下研究历程。

尝试gocryptfs


#**安装 Gocryptfs**
wget https://github.com/rfjakob/gocryptfs/releases/download/v2.4.0/gocryptfs_v2.4.0_linux-static_amd64.tar.gz
tar xf gocryptfs_v2.4.0_linux-static_amd64.tar.gz
sudo install -m 0755 ./gocryptfs /usr/local/bin
sudo apt install -y fuse#创建目录：cipher 存放加密数据，plain 是解密后的虚拟视图
mkdir -p ./mount/cipher ./mount/plain#创建密码
cd ./mount
echo "123456" > ./cachefs-password#初始化加密：用密码初始化加密文件系统（生成加密元数据）
cat ./cachefs-password | gocryptfs -init ./cipher#挂载文件系统：通过密码将加密存储挂载为明文视图
cat ./cachefs-password | gocryptfs ./cipher ./plain

此时目录文件如下

在这里插入图片描述


#往plain（明文目录）写入1.txt文件后，会同步到cipher（密文目录）
#直接修改 cipher 目录会导致数据损坏（必须通过明文目录挂载点操作）
echo "我是明文" > ./plain/1.txt#此时在df也可以看到
dh -h
Filesystem              Size  Used Avail Use% Mounted on
/xxxxxxxxxxxxxx/cipher  3.5T  2.8T  492G  86% /xxx/plain

在这里插入图片描述


# 停止访问明文，取消挂载
fusermount -u ./plain # 此时明文不可见
# dh -h也不可见
# 但是加密后的文件还存在于加密目录./cipher

在这里插入图片描述


#写入 plain 的文件会自动加密到 cipher
#读取 plain 的文件会自动解密自 cipher#**后续查看明文**
cat ./cachefs-password | gocryptfs ./mount/cipher ./mount/plain
cat ./plain/1.txt
fusermount -u ./plain #后续添加数据
cat ./cachefs-password | gocryptfs ./mount/cipher ./mount/plain
mv  xxxx ./mount/plain
fusermount -u ./plain #每次需要先挂载明文目录，然后查看或者修改明文目录
#cachefs-password或者master-key要妥善保存
#当然可以把数据先从自己的服务器加密好，然后把cipher加密目录压缩后转移到三方服务器，这里不展开

使用py读取加密

此时目录

在这里插入图片描述

测试代码

import re
from transformers import Qwen2_5_VLForConditionalGeneration, AutoProcessor
from qwen_vl_utils import process_vision_info
from datetime import datetime
import os
import torch
import os
import subprocess
from pathlib import Path
import ctypes
import numpy as np
import time
from multiprocessing import Process, Pipeclass RootResistantDecryptor:def __init__(self, cipher_path, psw, plain_path):self.cipher_path = Path(cipher_path).resolve()self.psw = pswself.mount_point = plain_pathself.proc = Noneself.parent_conn, self.child_conn = Pipe()def _mount_ns(self, mount_point, child_conn):os.setsid()try:# 使用 shell=True 和完整的 shell 命令字符串cmd = f"cat {self.psw} | gocryptfs {str(self.cipher_path)} {str(mount_point)}"subprocess.run(cmd, shell=True, check=True)print(f"Mounted {self.cipher_path} to {mount_point}")child_conn.send("mounted")while True:time.sleep(1)except Exception as e:print(f"Error occurred in child process: {e}")child_conn.send("failed")os._exit(1)def __enter__(self):self.proc = Process(target=self._mount_ns, args=(self.mount_point, self.child_conn))self.proc.start()result = self.parent_conn.recv()if result != "mounted":raise RuntimeError("Mount point is not valid.")return selfdef __exit__(self, *args):if self.proc:self.fusermount()self.proc.terminate()self.proc.join()self.mount_point.rmdir()key_array = np.frombuffer(self.psw.encode('utf-8'), dtype=np.uint8)ctypes.memset(key_array.ctypes.data, 0, key_array.nbytes)del self.pswdef fusermount(self, *args):try:subprocess.run(["fusermount", "-zu", str(self.mount_point)], check=True)print(f"Unmounted {self.mount_point}")except subprocess.CalledProcessError as e:print(f"Failed to unmount: {e}")if __name__ == "__main__":with RootResistantDecryptor("./mount/cipher", "./mount/cachefs-password", "./mount/plain") as mp:# 获取明文模型路径model_path = mp.mount_point+"/Qwen2.5-VL-7B-Instruct/"# 加载模型torch.manual_seed(42)model = Qwen2_5_VLForConditionalGeneration.from_pretrained(model_path, torch_dtype=torch.float16, device_map="auto", attn_implementation="flash_attention_2")processor = AutoProcessor.from_pretrained(model_path)# 卸载模型mp.fusermount()#todo 模型推理