Method, system, device and medium for security management of large model based on core particle architecture

Abstract

The application provides a large model security management method, system, device and medium based on a core particle architecture, which can be applied to the technical field of semiconductor integrated circuits. The method comprises the following steps: setting a physically isolated special security core particle as a hardware trusted root in a heterogeneous integrated system, and connecting the special security core particle with at least one target core particle running a large model through a bus; deploying a lightweight security supervision model with a smaller parameter quantity than the large model in the special security core particle; collecting behavior characteristic data of the target core particle running the large model in real time; performing inference by using the lightweight security supervision model, calculating an abnormality metric between the current behavior of the target core particle and a preset normal behavior model; updating a dynamic trust state of the target core particle based on the abnormality metric; and performing a hardware-level security response operation by the special security core particle in response to the dynamic trust state reaching a predetermined threshold.

Description

Technical Field

[0001] This invention relates to the field of semiconductor integrated circuit technology, and more specifically to a large-scale model security management method, system, device, and medium based on chip architecture. Background Technology

[0002] As Moore's Law slows, advanced packaging and heterogeneous integration technologies, exemplified by chiplets, have become crucial for sustaining semiconductor performance growth. The rise of complex computational workloads, such as large language models, makes it difficult for a single chip to handle their enormous computing power and memory demands. Therefore, deploying large models on a system-on-a-chip (SoC) composed of multiple dedicated computing and memory chiplets has become a technological trend. By decomposing a large monolithic SoC into multiple functionally independent and flexibly assembled chiplets, chiplet architecture demonstrates significant advantages in terms of cost and yield.

[0003] However, this open and decoupled architecture also introduces new security challenges. First, the chip supply chain is becoming increasingly complex, and system integrators may need to integrate chips from different third parties. When these chips are integrated together with the chips carrying the large model on the same SoC, it may pose potential risks of unauthorized hardware-level modifications, information leaks, or physical interference. Second, chips communicate with each other via high-speed interconnects, and these interfaces themselves can become security entry points. For example, malicious chips may sniff data flowing through the bus, steal sensitive information or model weights processed by the large model; or inject specific traffic to cause service interruptions, making the large model chip group malfunction; or even attempt to escalate privileges and tamper with the inference behavior of the large model.

[0004] Existing security solutions primarily focus on monolithic SoC environments, making them difficult to directly apply to distributed chip architectures. For example, traditional Trusted Platform Modules (TPMs) or Trusted Execution Environments (TEEs) based on TrustZone typically assume a single root of trust and are tightly coupled to the main processor, failing to provide unified runtime oversight across physically isolated chips. Furthermore, security oversight of large models faces significant challenges: large models exhibit substantial black-box characteristics and massive parameter scale, making it difficult for them to possess effective introspection capabilities. This means large models often struggle to detect and correct their own logical errors, abnormal outputs, or implanted unauthorized access channels. Relying solely on the alignment mechanisms of large models (such as RLHF) not only consumes inference computing power but is also highly susceptible to failure when subjected to interference at the underlying hardware level.

[0005] Therefore, there is an urgent need to introduce an external regulatory entity with independent analytical capabilities. For the protection of critical assets such as large model chip groups on SoCs, a new security regulatory mechanism is required, which should possess the following characteristics: 1) a physically isolated root of trust; 2) an external design approach that introduces lightweight models to regulate large-scale models, utilizing low-overhead independent models to perform real-time monitoring of large model behavior; 3) the ability to quickly and effectively respond to and isolate detected anomalies; and 4) the ability to distinguish between occasional false alarms and persistent threats, possessing adaptive detection capabilities. Summary of the Invention

[0006] (a) Technical problems to be solved

[0007] To address the issues of ambiguous security trust boundaries and the difficulty for large models to self-check for security vulnerabilities in existing chip-based systems, this invention provides a method, system, device, and medium for large model security management based on chip-based architecture.

[0008] (II) Technical Solution

[0009] According to a first aspect of the present invention, a large-model security management method based on a core-particle architecture is provided, applied to a heterogeneous integrated system comprising multiple core particles. The method includes: setting a physically isolated dedicated security core particle in the system as a hardware root of trust; the dedicated security core particle being connected to at least one target core particle running a large model via a bus; deploying a lightweight security monitoring model in the dedicated security core particle, the lightweight security monitoring model having fewer parameters than the large model running on the target core particle; collecting behavioral feature data of the target core particle while running the large model in real time through the dedicated security core particle; using the lightweight security monitoring model to infer from the behavioral feature data and calculate an anomaly metric between the current behavior of the target core particle and a preset normal behavior model; updating the dynamic trust state of the target core particle based on the anomaly metric; and, in response to the dynamic trust state reaching a predetermined threshold, having the dedicated security core particle perform a hardware-level security response operation to isolate or block the abnormal target core particle.

[0010] In some exemplary embodiments, the behavioral feature data includes at least one of the following: bus transaction data, performance counter data, power state data, memory access patterns, input prompt word features, and model weight region access features.

[0011] In some exemplary embodiments, the lightweight security monitoring model is an offline-trained autoencoder, and the anomaly metric includes the reconstruction error of the behavioral feature data after reconstruction by the autoencoder.

[0012] In some exemplary embodiments, updating the dynamic trust status of the target core includes: reducing the trust value according to a preset penalty weight in response to an anomaly metric exceeding a preset anomaly threshold; gradually increasing the trust value according to a preset recovery weight in response to no anomaly being detected; and instantly reducing the trust value according to a preset violation weight in response to a policy violation event being detected.

[0013] In some exemplary embodiments, the dedicated security chip collects behavioral feature data by passively sniffing or actively arbitrating through a bus monitoring interface, and the dedicated security chip has a dedicated hardware-accelerated inference engine for performing inference of a lightweight security supervision model.

[0014] In some exemplary embodiments, hardware-level security response operations include at least one of the following: disconnecting the target chip from the system via a bus arbiter, placing the target chip in a reset state, and cutting off the power supply to the target chip.

[0015] In some exemplary embodiments, the method further includes: when the dynamic trust state reaches a suspicious threshold but does not reach an isolation threshold, the dedicated security chip initiates an active challenge to the target chip; the active challenge includes: the dedicated security chip sends a random number to the target chip, requesting the target chip to return a message authentication code calculated based on a preset key and the current internal state within a predetermined time window; if the response times out or the message authentication code verification fails, the dedicated security chip determines the target chip as compromised and performs a hardware-level security response operation.

[0016] According to a second aspect of the present invention, a large-model security management system based on a core-particle architecture is provided, comprising: multiple core particles, including at least one target core particle running a large model; and a physically isolated dedicated security core particle connected to the target core particle via a bus, the dedicated security core particle comprising: a data acquisition module for real-time acquisition of behavioral feature data of the target core particle while running the large model; a model deployment module for storing and executing a lightweight security monitoring model, wherein the number of parameters of the lightweight security monitoring model is less than the number of parameters of the large model; an anomaly detection module for inferring from the behavioral feature data using the lightweight security monitoring model and calculating anomaly metrics; a trust management module for updating the dynamic trust state of the target core particle based on the anomaly metrics; and a response execution module for executing hardware-level security response operations when the dynamic trust state reaches a predetermined threshold.

[0017] According to a third aspect of the present invention, an electronic device is provided, comprising: one or more processors; and a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the method described above.

[0018] In a fourth aspect, the present invention also provides a computer-readable storage medium having a computer program or instructions stored thereon, wherein the computer program or instructions, when executed by a processor, implement the steps of the above-described method.

[0019] (III) Beneficial Effects

[0020] As can be seen from the above technical solutions, the large-model security management method, system, device, and medium based on chip architecture provided by the embodiments of the present invention have at least the following beneficial effects:

[0021] (1) Physically isolated root of trust guarantee: By setting up a dedicated security core with physical isolation, a hardware root of trust independent of the target core is constructed, which is protected from the impact of software vulnerabilities or hardware attacks inside the target core, ensuring the secure storage of security policies, regulatory models and keys, and realizing unified runtime supervision of third-party cores.

[0022] (2) Efficient paradigm of lightweight model supervising large model: Innovatively construct an asymmetric supervision architecture of "lightweight model supervising large model", separate the supervision task from the large model, form a bypass supervision mechanism, avoid the computing power overhead caused by adding an alignment layer in the large model, and at the same time take advantage of the fast reasoning speed and strong interpretability of lightweight model to realize real-time accompanying monitoring.

[0023] (3) Real-time closed-loop response based on hardware acceleration: Through a dedicated hardware-accelerated inference engine, nanosecond or microsecond-level behavioral feature processing is achieved, forming a complete closed loop from feature acquisition, anomaly detection, trust update to hardware response, which can effectively block high-speed hardware attacks.

[0024] (4) Dynamic trust status and adaptive detection capability: A dynamic trust status update mechanism is introduced, and a graded response is carried out in combination with anomaly measurement and policy violation events. By setting suspicious thresholds and isolation thresholds, occasional false alarms, continuous low-intensity attacks and sudden high-intensity threats are effectively distinguished, balancing security and availability.

[0025] (5) Active questioning mechanism reduces the risk of misjudgment: In the suspicious state, key-based active questioning is introduced to make the final decision on the identity and behavior of the core particle. Hardware isolation is only performed when the questioning fails, which significantly reduces the business interruption caused by misjudgment.

[0026] (6) Good scalability and adaptability: The security strategy and regulatory model are configurable and updatable, and can flexibly adapt to new chips and evolving attack methods without redesigning the hardware. Attached Figure Description

[0027] The above-described features, other objects, and advantages of the present invention will become clearer from the following description of embodiments of the invention with reference to the accompanying drawings, in which:

[0028] Figure 1 A flowchart illustrating a large-model security management method based on a chip architecture according to an embodiment of the present invention is shown schematically.

[0029] Figure 2 The diagram illustrates the simulation and analysis results of low-frequency false alarms according to an embodiment of the present invention (the horizontal axis represents the time period, and the vertical axis represents the confidence value).

[0030] Figure 3 This diagram illustrates the simulation and analysis results of a sustained low-intensity attack according to an embodiment of the present invention (the horizontal axis represents the time period, and the vertical axis represents the trust value).

[0031] Figure 4 This diagram illustrates the simulation and analysis results of a sudden high-intensity attack according to an embodiment of the present invention (the horizontal axis represents the time period, and the vertical axis represents the trust value).

[0032] Figure 5 This schematically illustrates the architecture of a large-scale security management system based on a chip architecture according to an embodiment of the present invention; and

[0033] Figure 6 A block diagram of an electronic device according to an embodiment of the present invention, based on a chip architecture-based large-model security management method, is illustrated. Detailed Implementation

[0034] Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the invention. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of the invention for ease of explanation. However, it will be apparent that one or more embodiments may be practiced without these specific details. Furthermore, descriptions of well-known structures and techniques are omitted in the following description to avoid unnecessarily obscuring the concept of the invention.

[0035] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the invention. The terms “comprising,” “including,” etc., as used herein indicate the presence of features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0036] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0037] When using expressions such as "at least one of A, B and C", they should generally be interpreted in accordance with the meaning that is commonly understood by those skilled in the art (e.g., "a system having at least one of A, B and C" should include, but is not limited to, a system having A alone, a system having B alone, a system having C alone, a system having A and B, a system having A and C, a system having B and C, and / or a system having A, B and C, etc.).

[0038] Figure 1 A flowchart illustrating a large-model security management method based on a chip architecture according to an embodiment of the present invention is shown.

[0039] like Figure 1 As shown, the large-model security management method based on chip architecture according to an embodiment of the present invention can be applied to heterogeneous integrated systems including multiple chips. The method includes steps S110 to S160.

[0040] In step S110, a physically isolated dedicated security core is set in the system as a hardware root of trust. The dedicated security core is connected to at least one target core running the large model via a bus.

[0041] In embodiments of the present invention, a dedicated, physically isolated Secure Core (SCC) is designated as the system's hardware root of trust in a multi-core system. The SCC is independent of the Target Core (TC, i.e., the large model core group) responsible for complex business inference. Leveraging the inherent physical decoupling characteristics of the core architecture, the SCC is physically protected from software vulnerabilities or malicious tampering within the TC. Through bus connectivity, the SCC possesses the highest-level read and arbitration capabilities for other core data, thus providing a robust hardware foundation for upper-layer security oversight.

[0042] This control mechanism is implemented through a clear process: First, SCC collects behavioral data from each TC in real time during operation; second, SCC quickly analyzes this data to detect anomalies; finally, once a threat is confirmed, SCC will perform proactive warnings and suppression, thereby ensuring the safe and stable operation of critical applications such as large models.

[0043] In step S120, a lightweight security monitoring model is deployed in a dedicated security core, the number of parameters of which is smaller than the number of parameters of the large model running on the target core.

[0044] In embodiments of this invention, the lightweight security monitoring model is an offline-trained autoencoder, and the anomaly metric includes the reconstruction error of behavioral feature data after reconstruction by the autoencoder. This lightweight model, through distillation or special design, has a much smaller number of parameters than the large model on the target core, but possesses a high degree of abstraction and representation capability for the complex behavior of the large model. By deploying this small model on the SCC, the system forms a bypass monitoring mechanism: the large model on the business side is responsible for generating content, while the small model on the monitoring side is responsible for observing the microscopic physical characteristics of the content generated by the large model. This model is used to characterize features such as bus transactions, performance counters, or power states of the TC during normal operation. This monitoring method, with the intervention of an independent lightweight model, effectively compensates for the lack of self-monitoring by the large model.

[0045] In step S130, behavioral characteristic data of the target core during the running of the large model are collected in real time using a dedicated safety core.

[0046] In embodiments of the present invention, behavioral feature data includes at least one of the following: bus transaction data, performance counter data, power state data, memory access patterns, input prompt word features, and model weight region access features. The SCC passively sniffs or actively arbitrates all bus transactions flowing to or from the TC through its bus monitoring interface. At a specific point in time, the SCC extracts key features to form a feature vector. For large model particles, this feature vector may specifically include: the memory address of the model weight region, the transmission target of the activation value, the opcode of the I / O port, and the large model weight features, thereby completing the model integrity check. Simultaneously, input prompt word features are extracted to determine security.

[0047] In embodiments of the present invention, a dedicated security chip collects behavioral feature data through passive sniffing or active arbitration via a bus monitoring interface. The dedicated security chip contains a dedicated hardware-accelerated inference engine for executing inference of a lightweight security monitoring model. This hardware acceleration engine can achieve inference speeds in the nanosecond or microsecond range, far faster than the single-step generation speed of large models, thereby enabling accompanying monitoring.

[0048] In step S140, a lightweight safety monitoring model is used to infer the behavioral feature data and calculate the anomaly measure between the current behavior of the target core and the preset normal behavior model.

[0049] In embodiments of the present invention, the SCC uses a loaded lightweight security surveillance model to perform real-time inference on the collected feature vectors and calculates the reconstruction error as an anomaly score. This calculation is performed in dedicated hardware within the SCC to avoid performance bottlenecks. In this process, the lightweight security surveillance model essentially verifies in a high-dimensional feature space whether the current behavior of the large model deviates from the pre-trained benign manifold. Once the large model is implanted with unauthorized access channels or attacked, its micro-behavioral features will be keenly captured by the smaller model, resulting in a high reconstruction error.

[0050] In step S150, the dynamic trust state of the target core is updated based on the anomaly metric.

[0051] In embodiments of the present invention, a dynamic trust state is defined, with a value between 0 and a maximum value (e.g., 255). This state is updated based on anomaly scores and policy violations. Updating the dynamic trust state of the target core includes: reducing the trust value according to a preset penalty weight in response to anomaly metrics exceeding a preset anomaly threshold; gradually increasing the trust value according to a preset recovery weight in response to no anomalies being detected; and instantaneously reducing the trust value according to a preset violation weight in response to a detected policy violation event. This mechanism can effectively distinguish between occasional benign fluctuations, continuous low-intensity cumulative attacks, and sudden high-intensity threats.

[0052] In step S160, in response to the dynamic trust state reaching a predetermined threshold, a hardware-level security response operation is performed by a dedicated security chip to isolate or block the abnormal target chip.

[0053] In embodiments of the present invention, hardware-level security response operations include at least one of the following: disconnecting the target chip from the system via a bus arbiter, placing the target chip in a reset state, and cutting off the power supply to the target chip. When the trust value exceeds the suspicious threshold, SCC triggers further verification (such as active challenge); when the trust value reaches the isolation threshold, SCC immediately performs hardware isolation to ensure that malicious behavior is blocked in a timely manner.

[0054] exist Figure 1 Based on the method shown, the method according to embodiments of the present invention may further include: when the dynamic trust state reaches a suspicious threshold but does not reach an isolation threshold, the dedicated security chip initiates an active challenge to the target chip; the active challenge includes: the dedicated security chip sends a random number to the target chip, requesting the target chip to return a message authentication code calculated based on a preset key and the current internal state within a predetermined time window; if the response times out or the message authentication code verification fails, the dedicated security chip determines the target chip as compromised and performs a hardware-level security response operation.

[0055] For example, the core safety monitoring method proposed according to the present invention specifically includes the following steps:

[0056] System configuration and security monitoring model loading, defining the SCC and target chip TC sets in the system. This set can contain a group of LLM compute kernels, memory kernels, and other I / O kernels. During secure boot, SCC loads the kernels for each TC j from its internal secure storage. (where j is the index of the target core set $C_{TC}$, and TCj represents the j-th target core in the set) security policy and normal behavior model parameters . The normal operation logs of TC j can be analyzed via an autoencoder during the offline phase. The model is trained using, for example, the bus transaction logs generated during the processing of normal inference requests, for large model cores. The optimization objective is:

[0057]

[0058] in, It is an eigenvector. This is a refactoring function.

[0059] During runtime feature extraction, the SCC passively sniffs or actively arbitrates all bus transactions flowing to or from TC j through its bus monitoring interface. At time t, the SCC extracts key features to construct a feature vector. For large model cores, this feature vector can specifically include the memory address of the model weight region, the transmission target of activation values, and the opcode of the I / O port, as well as features including the large model weights, thereby completing the model integrity check. Simultaneously, input prompt word features are extracted to determine security.

[0060] SCC uses a loaded, safe small model for real-time anomaly detection. For the collected feature vectors Real-time inference is performed. Due to the lightweight design of the small model, its inference speed is much faster than the single-step generation speed of the large model, thus enabling adjoint supervision. SCC calculates the reconstruction error as an anomaly score. This calculation is performed in dedicated hardware within the SCC to avoid performance bottlenecks.

[0061]

[0062] In this process, the security small model essentially verifies in a high-dimensional feature space whether the current behavior of the large model deviates from the pre-trained benign manifold. Once the large model is infected with a Trojan or attacked, its micro-behavioral features will be keenly captured by the small model and generate high reconstruction errors.

[0063] Trust State Update and Decision: This invention defines a dynamic trust state. Its value is Within the specified range. This status is updated based on anomaly scores and policy violations:

[0064]

[0065] in Trust naturally restores its weight. and It refers to the penalty weight for abnormal and violation events. For indicator functions. When Exceeding a suspicious threshold At this time, SCC triggers the proactive challenge and mitigation steps. Reaching the isolation threshold Upon that, SCC immediately implemented isolation.

[0066] Active challenge and mitigation: When TC j is in a "suspicious" state, to prevent false positives, SCC can initiate a dynamic hardware authentication. SCC sends a random number to TC j. TC j must use its unique key, pre-configured by SCC. and its current internal state Calculate a Message Authentication Code (MAC):

[0067]

[0068] TC j must be within an extremely short time window Internal return SCC verifies the response:

[0069] If the response times out or Error, TC j was immediately identified as "damaged". Set as .

[0070] If the response is correct It can be partially reset, allowing TC j to continue running.

[0071] like achieve SCC performs mitigation actions The system can disconnect a target chip deemed malicious from the system bus, reset it, or cut off its power supply via a bus arbitrator.

[0072] Example 1: Robustness and Responsiveness Verification of Trust State Update Mechanism

[0073] This embodiment aims to verify, through simulation, the effectiveness, robustness, and response timeliness of the trust state update mechanism proposed in this invention under different attack scenarios, and to verify the mechanism's ability to distinguish threat levels and balance security and availability.

[0074] Specifically, this embodiment includes the following steps:

[0075] Step 1: Simulation Environment and Parameter Settings

[0076] Set trust status The maximum value is 255, and two levels of response thresholds are defined: a suspicious threshold. and isolation threshold Set trust update weights, including: trust natural decay weight. Abnormal event penalty weight and high-priority strategy violation penalty weights. .

[0077] Step 2: Simulation and Analysis of Low-Frequency False Alarms

[0078] Set up a simulated scenario to test the system's ability to handle occasional benign anomalies. In this scenario, the system is injected with a transient, low-intensity anomaly at times t=1000, 2000, 3000, and 4000, respectively. The simulation results are as follows: Figure 2 As shown, the trust state is maintained in 99.6% of the cycles. Keep it at 0 when an abnormal event occurs. A spike appears, but due to The weighting is reasonable, and the peak value is much lower than that. Threshold. Peak at The weights decay rapidly back to 0. Simulation results verify the robustness of this mechanism to minor, occasional disturbances, effectively preventing false alarms and avoiding unnecessary safety responses triggered by normal operational fluctuations.

[0079] Step 3: Simulation and Analysis of Continuous Low-Intensity Attacks

[0080] A simulated scenario is set up to test the system's cumulative response to a sustained low-intensity attack. In this scenario, low-intensity anomalous events are continuously injected starting from time t=0. The simulation results are as follows. Figure 3 As shown. Trust status. It grows rapidly and linearly with the accumulation of anomalies. At t At 120 cycles, Exceed This triggers a suspicious state; in t At 250 cycles, Exceed This triggers the isolation state. After reaching a maximum value of 255, it remains at a high level. Simulation results verify that this mechanism can effectively detect and respond to such "low and slow" attacks, that is, threats that are weak individually but have a cumulative effect, demonstrating the effectiveness of the mechanism in detection and escalation response.

[0081] Step 4: Simulation and Analysis of Sudden High-Intensity Attacks

[0082] Set up a simulated scenario to test the system's immediate response to sudden, critical threats. In this scenario, the system remains normal during time t < 2000; at time t=2000, a high-intensity policy violation event is injected. This was followed by a sustained low-intensity anomaly. Simulation results are as follows... Figure 4 As shown. Key observation points include: at t=2000, by Weight-driven, it instantly jumps from 0 to 100, immediately exceeding... The trust level continued to rise due to the accumulation of persistent anomalies. At t 2045 cycle, achieve It then enters an isolation state. Simulation results verify the mechanism's ability to rapidly detect and isolate critical threats, completing the closed loop from detection to response within a very short time window.

[0083] Figure 5 The diagram illustrates the architecture of a large-scale security management system based on a chip architecture according to an embodiment of the present invention.

[0084] like Figure 5 As shown, a large-model security management system based on a core-particle architecture according to an embodiment of the present invention includes: multiple core particles, including at least one target core particle running a large model; and a physically isolated dedicated security core particle connected to the target core particle via a bus. The dedicated security core particle includes: a data acquisition module for real-time acquisition of behavioral feature data of the target core particle while running the large model; a model deployment module for storing and executing a lightweight security monitoring model, wherein the number of parameters of the lightweight security monitoring model is smaller than that of the large model; an anomaly detection module for inferring from the behavioral feature data using the lightweight security monitoring model and calculating anomaly metrics; a trust management module for updating the dynamic trust state of the target core particle based on the anomaly metrics; and a response execution module for executing hardware-level security response operations when the dynamic trust state reaches a predetermined threshold.

[0085] According to embodiments of the present invention, any plurality of the above-described modules can be combined into one module, or any one of the modules can be split into multiple modules. Alternatively, at least a portion of the functionality of one or more of these modules can be combined with at least a portion of the functionality of other modules and implemented in one module. According to embodiments of the present invention, at least one of the above-described modules can be at least partially implemented as hardware circuitry, such as a Field Programmable Gate Array (FPGA), a Programmable Logic Array (PLA), a System-on-Chip, a System-on-Substrate, a System-on-Package, an Application-Specific Integrated Circuit (ASIC), or implemented in hardware or firmware by any other reasonable means of integrating or packaging circuitry, or implemented in software, hardware, or firmware, or in any suitable combination of any of these three implementation methods. Alternatively, at least one of the above-described modules can be at least partially implemented as a computer program module, which, when run, can perform corresponding functions.

[0086] Figure 6 A block diagram of an electronic device according to an embodiment of the present invention, based on a chip architecture-based large-model security management method, is illustrated.

[0087] like Figure 6 As shown, an electronic device 900 according to an embodiment of the present invention includes a processor 901, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 902 or a program loaded from a storage portion 908 into a random access memory (RAM) 903. The processor 901 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 901 may also include onboard memory for caching purposes. The processor 901 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present invention.

[0088] RAM 903 stores various programs and data required for the operation of electronic device 900. Processor 901, ROM 902, and RAM 903 are interconnected via bus 904. Processor 901 executes various operations of the method flow according to embodiments of the present invention by executing programs in ROM 902 and / or RAM 903. It should be noted that programs may also be stored in one or more memories other than ROM 902 and RAM 903. Processor 901 may also execute various operations of the method flow according to embodiments of the present invention by executing programs stored in one or more memories.

[0089] According to an embodiment of the present invention, the electronic device 900 may further include an input / output (I / O) interface 905, which is also connected to a bus 904. The electronic device 900 may also include one or more of the following components connected to the input / output (I / O) interface 905: an input section 906 including a keyboard, mouse, etc.; an output section 907 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 908 including a hard disk, etc.; and a communication section 909 including a network interface card such as a LAN card, modem, etc. The communication section 909 performs communication processing via a network such as the Internet. A drive 910 is also connected to the input / output (I / O) interface 905 as needed. A removable medium 911, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 910 as needed so that computer programs read from it can be installed into the storage section 908 as needed.

[0090] The present invention also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs, which, when executed, implement the method according to the embodiments of the present invention.

[0091] According to embodiments of the present invention, a computer-readable storage medium may be a non-volatile computer-readable storage medium, such as including, but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of the present invention, a computer-readable storage medium may include ROM 902 and / or RAM 903 and / or one or more memories other than ROM 902 and RAM 903 described above.

[0092] Those skilled in the art will understand that the features described in the various embodiments of the present invention can be combined and / or combined in various ways, even if such combinations or combinations are not explicitly described in the present invention. In particular, the features described in the various embodiments of the present invention can be combined and / or combined in various ways without departing from the spirit and teachings of the present invention. All such combinations and / or combinations fall within the scope of the present invention.

Claims

1. A large-model security management method based on a chip-particle architecture, characterized in that, Applied to a heterogeneous integrated system comprising multiple cores, the method includes: A physically isolated dedicated security core is set in the system as a hardware root of trust. The dedicated security core is connected to at least one target core running a large model via a bus. A lightweight security monitoring model is deployed in the dedicated security core, and the number of parameters of the lightweight security monitoring model is smaller than the number of parameters of the large model running on the target core. The dedicated safety core is used to collect real-time behavioral characteristic data of the target core when running the large model; The lightweight security monitoring model is used to infer the behavioral feature data and calculate the anomaly measure between the current behavior of the target core and the preset normal behavior model. Based on the anomaly measurement, update the dynamic trust state of the target core; and In response to the dynamic trust state reaching a predetermined threshold, the dedicated security chip performs a hardware-level security response operation to isolate or block the abnormal target chip.

2. The method according to claim 1, characterized in that, The behavioral feature data includes at least one of the following: bus transaction data, performance counter data, power status data, memory access patterns, input prompt word features, and model weight region access features.

3. The method according to claim 1, characterized in that, The lightweight security monitoring model is an autoencoder trained offline, and the anomaly metric includes the reconstruction error of the behavioral feature data after reconstruction by the autoencoder.

4. The method according to claim 1, characterized in that, Updating the dynamic trust state of the target core includes: In response to the anomaly metric exceeding a preset anomaly threshold, the trust value is reduced according to a preset penalty weight; In response to the absence of detected anomalies, the trust value is gradually increased according to the preset recovery weights; and In response to the detection of a policy violation, the trust value is instantly reduced according to the preset violation weight.

5. The method according to claim 1, characterized in that, The dedicated security chip collects the behavioral feature data through passive sniffing or active arbitration via a bus monitoring interface, and the dedicated security chip is equipped with a dedicated hardware-accelerated inference engine for executing the inference of the lightweight security monitoring model.

6. The method according to claim 1, characterized in that, The hardware-level security response operation includes at least one of the following: disconnecting the target chip from the system via a bus arbiter, placing the target chip in a reset state, and cutting off the power supply to the target chip.

7. The method according to claim 1, characterized in that, The method further includes: When the dynamic trust state reaches a suspicious threshold but does not reach the isolation threshold, the dedicated security chip initiates an active challenge to the target chip. The active challenge includes: the dedicated security chip sends a random number to the target chip, requesting the target chip to return a message authentication code calculated based on a preset key and the current internal state within a predetermined time window; If the response times out or the message authentication code fails to be verified, the dedicated security chip will determine that the target chip is damaged and execute the hardware-level security response operation.

8. A large-scale model security management system based on a core-particle architecture, characterized in that, include: Multiple cores, including at least one target core that runs a large model; as well as A physically isolated dedicated security chip is connected to the target chip via a bus. The dedicated security chip includes: The data acquisition module is used to collect behavioral feature data of the target core particle in real time when running the large model; A model deployment module is used to store and execute lightweight security monitoring models, wherein the number of parameters of the lightweight security monitoring models is smaller than the number of parameters of the large models; Anomaly detection module is used to infer the behavioral feature data using the lightweight security monitoring model and calculate anomaly measurement; The trust management module is used to update the dynamic trust status of the target core based on the anomaly metric; and The response execution module is used to perform hardware-level security response operations when the dynamic trust state reaches a predetermined threshold.

9. An electronic device, characterized in that, include: One or more processors; Memory, used to store one or more computer programs. The one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program or instructions stored thereon, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 7.

Images