Satellite-borne safe intelligent computing system

Abstract

A satellite-borne safety intelligent computing system is used for guaranteeing safety of a satellite edge computing system and comprises a host processor, an AI accelerator and a safety bus connected with the host processor and the accelerator. The satellite-borne safe intelligent computing system further comprises a bus stream encoding and decoding engine which is embedded in the interface controller of the data bus and used for encrypting and decrypting transmission data of the data bus. By encrypting the cache stream on the data bus, key data such as Bias bias cache and the like can be protected. In addition, an attacker can be prevented from stealing structural information of the neural network model through interrupt signals by interrupting obfuscated codes, dual protection of'signal + data 'is formed, and time sequence detection Trojan horse and side channel attacks can be effectively resisted.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of intelligent computing security on satellites, in particular, to a kind of intelligent computing security system on satellites. BACKGROUND

[0002] With the continuous development of artificial intelligence technology in edge computing scenarios, some AI models with new structures, more layers and higher accuracy are also being proposed. The proposal of these complex network models makes the demand for intelligent computing systems with higher performance urgent. However, intelligent computing systems have security problems, especially after Moore's law slows down, the progress of new architecture technology and the development of heterogeneous multi-core computing systems make the security problems of computing systems more complex. Attackers can use side-channel attacks to listen to interrupt signals to steal AI model structure information, and attackers can also trigger or assist Trojan horses by monitoring plaintext cache information during the computing process.

[0003] To defend against attacks on cache data, researchers have tried to build trusted execution environments to provide some secure isolation areas for plaintext computing. However, to complete high-precision reasoning and recognition tasks, neural network models often require more memory space to handle a large number of matrix calculations, and trusted execution environments based on physical memory isolation have limited memory space, which is usually difficult to meet the memory needs of real-time computing. For data confidentiality protection, encryption is still the current mature defense method. Traditional block encryption schemes represented by AES require more hardware resources, and have complex iteration processes such as ECB, CBC, and CTR, with large time delays, which are not friendly to neural network inference accelerators with high real-time requirements. Therefore, there is an urgent need for a lightweight cache encryption scheme and Trojan defense scheme. SUMMARY

[0004] In view of this, the present application provides a kind of intelligent computing security system on satellites, which realizes intelligent computing system timing detection Trojan attack defense through cache stream encryption and interrupt obfuscation coding.

[0005] The intelligent computing security system on satellites according to the embodiments of the present application is used for satellite edge computing, comprising: a host processor, an accelerator, and a secure bus connecting the host processor and the accelerator, The host processor is used to schedule the calculation of the neural network model in the satellite edge computing, map the accelerator to the IO device address space of the host processor through the secure bus, and make the neural network model layer multiplex the computing resource and cache structure resource of the accelerator by executing the neural network operator layer by layer, The security bus comprises a data bus and a signaling bus, and the satellite security intelligent computing system further comprises a bus stream codec engine for the data bus, which is embedded in an interface controller of the data bus and used for encryption and decryption operations on transmission data of the data bus.

[0006] Optionally, the data bus comprises a read address channel, a read data channel, a write address channel, a write data channel and a write response channel, The bus stream codec engine is composed of a first register of 93 bits, a second register of 84 bits and a third register of 111 bits in series, and the bus stream codec engine adopts a Trivium algorithm to perform encryption operation on data in the write data channel and decryption operation on data in the read data channel.

[0007] Optionally, the bus stream codec engine is used for: XOR operation is performed on data led out from a tap end of the first register, a tap end of the second register and a tap end of the third register to generate a key stream S; XOR operation is performed on the key stream S and first data m in the write data channel to obtain encrypted first data c; and XOR operation is performed on the key stream S and the encrypted first data c in the read data channel to obtain first data m.

[0008] Optionally, the first data m in the write data channel and the encrypted first data c in the read data channel are aligned by actual physical addresses of the first data sent in the write address channel and the read address channel when the first data is written and read.

[0009] Optionally, a physical address in the read address channel and the write address channel is subjected to modulo 8 operation, and only data corresponding to a physical address with a result of 0 in the modulo 8 operation is subjected to encryption and decryption operation.

[0010] Optionally, in an initialization phase of the bus stream codec engine, an initial key and an initialization vector of the bus stream codec engine are generated by a hardware random number generator of the satellite security intelligent computing system, and the first register, the second register and the third register are filled with the initial key and the initialization vector.

[0011] Optionally, the accelerator is used for sending an interrupt signal to the host processor through the signaling bus to instruct the host processor to interrupt current computation, The accelerator includes an encoder for encrypting the interrupt signal, and the host processor includes a decoder for decrypting the encrypted interrupt signal.

[0012] Optionally, encrypting the interrupt signal includes: obfuscating the interrupt signal, which is encoded as clock high and low levels, into a level period interval using a digital baseband encoding algorithm.

[0013] Optionally, the 1-bit binary interrupt signal can be encoded as a 4-bit binary signal.

[0014] Optionally, one of the sixteen pieces of information represented by a 4-bit binary signal can be mapped to one piece of information represented by a 1-bit binary signal.

[0015] According to the solution of this application embodiment, encryption of the cache stream on the data bus can protect critical data such as bias cache. In addition, interrupt obfuscation encoding can prevent attackers from stealing neural network model structure information through interrupt signals, forming a "signal + data" dual protection, which can effectively resist timing probe Trojans and side-channel attacks. Attached Figure Description

[0016] Figure 1 This is a partial architecture diagram of a spaceborne secure intelligent computing system according to an embodiment of the present invention; Figure 2 This is a schematic diagram illustrating the encryption and decryption of read and write data on the data bus by a bus stream encoding / decoding engine according to an embodiment of the present invention; Figure 3 This is a schematic diagram of interrupt signal encoding and decoding according to an embodiment of this application; Figure 4 This is a schematic diagram of a security module built on a spaceborne secure intelligent computing system according to one embodiment of this application; Figure 5 This is a comparison chart showing the results of Trojan defense against malware that does not use a bus stream encoding / decoding engine and interrupt signal encoding / decoding technology versus those that do. Detailed Implementation

[0017] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the spirit of the content disclosed in this application will be clearly explained below with reference to the accompanying drawings and detailed description. After understanding the embodiments of this application, any person skilled in the art can make changes and modifications based on the technology taught in this application without departing from the spirit and scope of this application.

[0018] The illustrative embodiments and descriptions provided in this application are for explaining the application, but are not intended to limit the application. Furthermore, elements / components using the same or similar reference numerals in the drawings and embodiments are used to represent the same or similar parts.

[0019] The terms “first,” “second,” etc., used in this document are not intended to specifically refer to order or sequence, nor are they used to limit this application; they are merely used to distinguish elements or operations described using the same technical terms.

[0020] The terms “include,” “including,” “have,” “contain,” etc., used in this article are all open-ended terms, meaning that they include but are not limited to.

[0021] The term "and / or" as used herein includes any or all of the things mentioned.

[0022] The term "multiple" in this article includes "two" and "more than two"; the term "multiple groups" in this article includes "two groups" and "more than two groups".

[0023] Certain terms used to describe this application will be discussed below or elsewhere in this specification to provide additional guidance to those skilled in the art in describing the application.

[0024] This application provides a spaceborne secure intelligent computing system that uses cache stream encryption and interrupt obfuscation coding to defend against timing detection Trojan attacks.

[0025] According to one embodiment of this application, a spaceborne secure intelligent computing system includes a host processor, an accelerator, and a secure bus connecting the host processor and the accelerator.

[0026] like Figure 1As shown, edge AI computing systems in inference scenarios typically consist of a host processor and an AI accelerator. The accelerator can be an NPU or a GPU. The host processor is responsible for scheduling the computation of the entire neural network model, handling bidirectional data transfer between main memory and the accelerator, and configuring the accelerator's control registers. First, the host processor maps the accelerator to its own I / O device address space via a secure bus (e.g., AXI bus, APB bus, or other on-chip high-speed bus). Then, the configurable function registers and data registers within the accelerator are mapped to the Linux user process virtual address space using the mmap() function. Finally, the host processor can also configure a DMA controller to enable direct transfer of large blocks of data between the accelerator and off-chip DRAM. The PE array within the accelerator is used for multiplication and addition operations of the feature map matrix and weight matrix. Ping-pong buffers can be used in some areas to alleviate the bottleneck between the fast computation speed of the PE array and the relatively low read / write speed of the cached data. The scheduler executes neural network operators layer by layer, allowing the neural network model to reuse the computational resources and cache structure resources within the accelerator in a hierarchical manner. The security bus can include a data bus and a signaling bus. The host processor communicates with the accelerator via the signaling bus and transmits data with the accelerator via the data bus.

[0027] However, attackers can trigger or assist Trojans in launching attacks by monitoring plaintext cached information via the data bus during the computation process.

[0028] Therefore, in this embodiment of the application, the onboard secure intelligent computing system also includes a bus stream encoding and decoding engine for the data bus, which is embedded in the interface controller of the data bus and is used to encrypt and decrypt the transmitted data of the data bus.

[0029] In one implementation, the data bus includes a read address channel, a read data channel, a write address channel, a write data channel, and a write response channel. The bus stream codec engine consists of a 93-bit first register, an 84-bit second register, and a 111-bit third register connected in series. The bus stream codec engine uses the Trivium algorithm to encrypt data in the write data channel and decrypt data in the read data channel.

[0030] Specifically, let's take the AXI bus as an example, where the data bus is an example. The AXI (Advanced eXtensible Interface) bus is a secure bus protocol within the AMBA (Advanced Microcontroller Bus Architecture) protocol proposed by ARM, designed for high-speed read / write, high bandwidth, and low latency. The AXI bus consists of five channels: read address, read data, write address, write data, and write response. Each channel communicates independently via a VALID / READY handshake mechanism, while the five channels cooperate to transmit data. When reading data, the AXI Master first sends address information to the Slave via the read address channel, informing the Slave which address to read data from. Then, the read data channel transmits data from the Slave to the Master in a specific mode. When writing data, the Master sends the address to the Slave via the write address channel, and then transmits the data to the Slave via the write data channel. The Slave transmits various status information to the Master via the write response channel, such as whether writing is possible or whether the write was successful.

[0031] The bus stream encoding / decoding engine consists of a cascaded array of three registers: a 93-bit register, an 84-bit register, and a 111-bit register. These registers are connected end-to-end and, after a series of non-linear logic operations, ultimately form a 288-bit non-linear feedback shift register. Each of the three registers has a tap; the data from these taps is XORed to generate the output keystream. During initialization, the bus stream encoding / decoding engine requires an 80-bit initial key K and an 80-bit initialization vector IV to fill the 288-bit register. The initial key and initialization vector are generated by the hardware random number generator of the onboard secure intelligent computing system, ensuring key randomness. Driven by a clock, the bus stream encoding / decoding engine performs multiple rounds of initialization shift operations, thoroughly scrambling and filling the register with the key K and initialization vector IV. During encryption and decryption, the output keystream is XORed with each bit of the plaintext data to obtain the ciphertext. For decryption, the ciphertext is XORed again with the same keystream to recover the plaintext.

[0032] like Figure 2As shown, the bus stream encoding / decoding engine is embedded in the interface controller of the AXI data bus responsible for reading and writing cached data. The bus stream encoding / decoding engine performs "encryption on write" and "decryption on read" operations on the write data channel and read data channel of the cached AXI bus, respectively. For encryption and decryption, in digital logic, a string of bit data can be XORed twice with any other string of bit data of the same width to recover the original bit string. This property can be used to encrypt and decrypt cached data. That is, the key stream is encrypted by performing a bitwise XOR operation with the plaintext data stream. When the generated ciphertext is XORed again with the aligned key stream, the corresponding plaintext can be recovered. The encryption and decryption process of the cached data plaintext is shown in formulas (1), (2), (3), and (4).

[0033] (1) (2) (3) (4) Since writing and reading the same cached data requires sending the actual physical address of the data first in the write address channel and the read address channel, the key streams used in the encryption and decryption processes can be aligned through this physical address to ensure the synchronous nature of the stream cipher.

[0034] Furthermore, in one embodiment, we propose a lightweight linear optimization of the encryption algorithm during deployment. Specifically, during encryption and decryption, the physical address in the AXI bus read / write address channel is first modulo-8. Only when the modulo-8 result is 0 is the cached data encrypted and decrypted in the data channel. This segmented encryption method can use randomization to ensure the overall confidentiality of the cached data, thus reducing the hardware and performance overhead of the accelerator.

[0035] As described above, the on-chip bus, after being encoded and decoded by the bus stream encoding and decoding engine, becomes a secure bus. The lightweight bus stream encoding and decoding engine scheme for the on-chip bus eliminates the need for complex iterative processes, consumes fewer hardware computing and storage resources, and is better suited to the limited hardware resources of spaceborne systems. Furthermore, the aforementioned bus stream encoding and decoding engine is embedded in the data bus interface controller, eliminating the need for large-scale modifications to the host processor + accelerator AI computing architecture, facilitating engineering deployment. It also allows for flexible customization and portability to different spaceborne secure intelligent computing systems.

[0036] In addition, Figure 1In the spaceborne secure intelligent computing system shown, the accelerator typically sends interrupt signals to the host processor via a signaling bus to instruct the host processor to interrupt the current computation. By recording and periodically analyzing the flooding of interrupt signals from the accelerator to the host processor, the number of layers and the types of internal layers in the neural network model can be inferred. This information can be used to capture specific neural network input models. Once a preset neural network model is captured, the malware's payload attacks the accelerator's on-chip bias cache, causing it to overflow. The overflowed bias cache hinders the activation of the ReLU activation function in the neural network, preventing the neural network from transmitting valid information and preventing the accelerator from performing normal inference and recognition. The malware hidden in the computing platform is only activated under special conditions, consumes relatively few computing and storage resources, is highly concealed, and is difficult to detect.

[0037] Therefore, in one embodiment of this application, to prevent the interception signal sent from the accelerator to the scheduling processor from being captured by Trojans or side-channel attacks, an encoder is set in the accelerator to encrypt the interrupt signal, and a decoder is set in the host processor to decrypt the encrypted interrupt signal. Specifically, obfuscation coding technology can be used for encoding and decoding. By adding an encoder and a decoder in the accelerator and the scheduling processor, the interrupt signal, which is traditionally encoded by clock high and low levels, is obfuscated into a time interval of a specific level pattern using a digital baseband encoding algorithm. This method can increase the information entropy in the accelerator system with minimal clock cycle overhead, making it impossible for attackers to capture the effective interrupt pattern.

[0038] Specifically, an encoder is installed at the interrupt signal output of the accelerator. A 1B / 4B digital baseband encoding / decoding algorithm is used to obfuscate the interrupt signal, which is encoded using clock high and low levels, into a level period interval with a specific pattern. Specifically, a 1-bit binary interrupt signal is encoded as a 4-bit binary signal. One of the sixteen pieces of information represented by a 4-bit binary signal can be mapped to one piece of information represented by a 1-bit binary signal. That is, a 1-bit binary "0" or "1" can be mapped to any one of the 4-bit binary signals "0001", "0010", "0011", "0100", "0101", "0110", "0111", "1000", "1001", "1010", "1011", "1100", "1101", and "1111". For example, "0" can be encoded as "0011" and "1" can be encoded as "1100".

[0039] Figure 3 A schematic diagram illustrating the encoding and decoding of an interrupt signal according to an embodiment of this application is shown. Figure 3As shown, the high and low levels of the interrupt signal changed after obfuscation encoding, and the monitor could not obtain information about the interrupt signal before encoding from the encoded interrupt signal.

[0040] As described above, using the aforementioned interrupt signal encoding and decoding scheme, the clock frequency for a 100MHz deep learning accelerator is on the order of 10⁸. The inference speed of a neural network model is on the order of 10¹ FPS. Even considering the cumulative effect of accelerator multiplexing due to the layering of the neural network model (on the order of 10¹), the impact of the obfuscation encoding and decoding module changing the interrupt signal from one cycle to four cycles on performance is only on the order of 1 / 10⁵ to 1 / 10⁶ (one in a hundred thousand to one in a million). For higher-frequency accelerators, this impact will be even lower, having almost no effect on the real-time performance of neural network inference. Furthermore, this interrupt encoding and decoding module is adaptable to various bus channels, requiring no large-scale modification of the host processor + accelerator AI computing architecture, making it easy to deploy in engineering. It also facilitates flexible customization and portability for different spaceborne secure intelligent computing systems.

[0041] This application also provides an example of the specific deployment of the aforementioned bus stream encoding / decoding engine and obfuscation encoding / decoding module. For example... Figure 4 As shown, a security module is built on the spaceborne secure intelligent computing system. The spaceborne intelligent system, consisting of a host processor and an accelerator, is as follows: 1. System Setup: The host processor CPU uses ARM Cortex-A9, the accelerator FPGA uses Xilinx Kintex-7, a YOLOv2 inference accelerator is built, and the security bus is AXI4.

[0042] 2. Module Deployment: The encoder is integrated on the accelerator FPGA and the decoder is integrated on the host processor CPU to complete the deployment of the interrupt obfuscation encoding scheme; the bus stream encoding and decoding engine is embedded in the FPGA's AXI4 bus controller and associated with the read data (RDATA) and write data (WDATA) channels to complete the deployment of the bus stream encryption and decryption module.

[0043] 3. Trojan Defense Test: An interrupt monitor is set up to record and periodically analyze the flooding of interrupt signals from the accelerator FPGA to the host CPU. When a preset neural network model is captured, the Trojan's payload attacks the on-chip bias cache of the accelerator FPGA. Without a defense scheme, the interrupt monitor can accurately identify the 24-layer network structure of YOLOv2. With the defense enabled, the interrupt signal pattern is completely random, making it impossible to infer the model's layer count. Furthermore, the bias cache data is encrypted, making it unbreakable even if stolen. The model inference accuracy remains above 98%, with an error of less than 2% compared to the undefended state. Figure 5The verification results are shown for both scenarios using and not using the scheme described in this application. Figure 5 As shown in the figure above, in the verification results without the proposed solution, the interrupt monitor accurately identified the 24-layer network structure of YOLOv2. However, in the verification results below with the proposed solution, the interrupt monitor could not infer the model structure.

[0044] The above description is a further detailed explanation of the present invention in conjunction with specific preferred embodiments. It should not be considered that the specific embodiments of the present invention are limited to this. For those skilled in the art, several simple deductions or substitutions can be made without departing from the concept of the present invention, and all such deductions or substitutions should be considered to fall within the scope of protection of the present invention as defined by the submitted claims.

Claims

1. A spaceborne secure intelligent computing system for satellite edge computing, characterized in that, The onboard secure intelligent computing system includes: a host processor, an accelerator, and a secure bus connecting the host processor and the accelerator. The host processor is used to schedule the computation of the neural network model in the satellite edge computing, map the accelerator to the I / O device address space of the host processor through the security bus, and enable the neural network model to reuse the computing resources and cache structure resources of the accelerator in a hierarchical manner by executing neural network operators layer by layer. The security bus includes a data bus and a signaling bus. The spaceborne security intelligent computing system also includes a bus stream encoding and decoding engine for the data bus, which is embedded in the interface controller of the data bus and is used to encrypt and decrypt the transmitted data of the data bus.

2. The spaceborne secure intelligent computing system according to claim 1, characterized in that, The data bus includes: a read address channel, a read data channel, a write address channel, a write data channel, and a write response channel. The bus stream encoding / decoding engine consists of a 93-bit first register, an 84-bit second register, and a 111-bit third register connected in series. The bus stream encoding / decoding engine uses the Trivium algorithm to encrypt the data in the write data channel and decrypt the data in the read data channel.

3. The spaceborne secure intelligent computing system according to claim 2, characterized in that, The bus stream encoding / decoding engine is used for: The data extracted from the taps of the first register, the second register, and the third register are XORed to generate the key stream S. The key stream S is XORed with the first data m in the write data channel to obtain the encrypted first data c. as well as The key stream S is XORed with the encrypted first data c in the read data channel to obtain the first data m.

4. The spaceborne secure intelligent computing system according to claim 3, characterized in that, The first data m in the write data channel and the encrypted first data c in the read data channel are aligned using the actual physical addresses of the first data sent in the write address channel and the read address channel when writing and reading the first data.

5. The spaceborne secure intelligent computing system according to claim 3, characterized in that, Perform a modulo-8 operation on the physical addresses in the read address channel and the write address channel, and only encrypt and decrypt the data corresponding to the physical addresses whose modulo-8 operation result is 0.

6. The spaceborne secure intelligent computing system according to claim 2, characterized in that, During the initialization phase of the bus stream codec engine, the initial key and initialization vector of the bus stream codec engine are generated by the hardware random number generator of the spaceborne secure intelligent computing system, and the first register, the second register and the third register are filled with the initial key and the initialization vector.

7. The spaceborne secure intelligent computing system according to claim 1, characterized in that, The accelerator is used to send an interrupt signal to the host processor via the signaling bus to instruct the host processor to interrupt the current calculation. The accelerator includes an encoder for encrypting the interrupt signal, and the host processor includes a decoder for decrypting the encrypted interrupt signal.

8. The spaceborne secure intelligent computing system according to claim 7, characterized in that, Encrypting the interrupt signal includes: The interrupt signal, which is encoded as clock high and low levels, is obfuscated and encoded into level period intervals using a digital baseband encoding algorithm.

9. The spaceborne secure intelligent computing system according to claim 8, characterized in that, Encode a 1-bit binary interrupt signal into a 4-bit binary signal.

10. The spaceborne secure intelligent computing system according to claim 9, characterized in that, One of the sixteen pieces of information represented by a 4-bit binary signal is mapped to one piece of information represented by a 1-bit binary signal.

Images