Data processing system and method, and related device

Abstract

A data processing system and method, and a related device, relating to the technical field of artificial intelligence (AI). The data processing system comprises a general-purpose processor and an AI accelerator card. The general-purpose processor is used for sending an operation request comprising authorization authentication information and requesting to process an AI model deployed in the AI accelerator card. The AI accelerator card is constructed to be provided with a trusted execution environment (TEE), and the AI accelerator card is used for running a policy enforcement point (PEP) component deployed in the TEE, and is further used for receiving the operation request and determining whether the authorization authentication information in the operation request complies with a verification rule in the PEP component, and when the authorization authentication information complies with the verification rule, the first operation request is executed to execute a processing operation on the AI model. In this way, the PEP component is deployed in the TEE of the AI accelerator card, that is, the PEP is deployed in an execution environment closer to the AI model, so that the AI model can be effectively prevented from being illegitimately accessed by the general-purpose processor, thereby ensuring access safety of the AI model in the AI accelerator card.

Description

Data processing system, method and related device

[0001] The present application claims priority from the Chinese patent application No. 202410612652.4 filed on May 16, 2024, and entitled "Data processing system, method and related device", the content of which is incorporated herein by reference in its entirety. TECHNICAL FIELD

[0002] The present application relates to the field of artificial intelligence, and in particular, to a data processing system, method and related device. BACKGROUND

[0003] With the advent of the era of artificial intelligence (AI), AI model computing is increasingly concentrated in AI acceleration cards, such as deploying AI models in neural-network processing units (NPUs), etc. The NPU is a type of AI acceleration card. At the same time, the access security of AI models in AI acceleration cards has also become an important issue of increasing concern.

[0004] Currently, a trusted execution environment (TEE) is usually constructed in a general-purpose processor to construct a secure AI model computing environment for AI acceleration cards through a combination of software and hardware. In specific implementation, when an application in the general-purpose processor needs to access an AI model in the AI acceleration card, the application needs to complete access control verification based on a policy enforcement point (PEP) mechanism in the TEE in advance. And only when the application passes the access control verification, can the application successfully access the AI model in the AI acceleration card.

[0005] However, in actual application scenarios, when there is an illegal application (or an application with higher permissions) in the general-purpose processor, the application can bypass the PEP component in the general-purpose processor and directly access the AI model in the AI acceleration card, which makes the AI model in the AI acceleration card still subject to illegal access by the general-purpose processor, thereby affecting the security of the AI model in the AI acceleration card. SUMMARY

[0006] The present application provides a data processing system to improve the security of the general-purpose processor accessing the AI model in the AI acceleration card. In addition, the present application also provides a corresponding data processing method, an artificial intelligence acceleration card, a computer readable storage medium and a computer program product.

[0007] In a first aspect, the present application provides a data processing system, comprising a general processor and an artificial intelligence acceleration card (hereinafter referred to as AI acceleration card). Wherein the general processor, for example, can be a CPU, is used to send a first operation request, the first operation request is used to request processing of an AI model deployed in the AI acceleration card, such as reading, modifying or executing the AI model and the like, and the first operation request includes permission authentication information. The AI acceleration card not only deploys the AI model, but also constructs a TEE (trusted execution environment), wherein the AI model can be deployed in the TEE, or can be deployed in a REE (rich execution environment) constructed in the AI acceleration card. And the AI acceleration card is used to run the PEP (policy enforcement point) component deployed in the TEE, and is also used to receive the first operation request sent by the general processor, and determine whether the permission authentication information in the first operation request meets the verification rule in the PEP component, so as to execute the first operation request to perform processing operation on the AI model when the permission authentication information in the first operation request meets the verification rule.

[0008] Since the PEP component is deployed in the TEE of the AI acceleration card in the data processing system, that is, the PEP is deployed to an execution environment closer to the AI model, when the AI model in the AI acceleration card is requested to be accessed, the AI acceleration card can use the PEP component to perform permission authentication on the operation request, and only in the case of passing the permission authentication, the AI model in the AI acceleration card is allowed to be accessed by the general processor. At this time, even if there is an illegal application in the general processor, or the application in the general processor requests illegal access to the AI model by bypassing the authentication process in the TEE in the general processor, the AI acceleration card can use the PEP component to perform permission authentication on the operation request of illegal access, so as to effectively avoid illegal access of the AI model by the general processor, and realize the security of the AI model in the AI acceleration card.

[0009] And when the general processor deploys a plurality of applications, and the plurality of applications can all request to access the AI model, the applications of different owners in the general processor can be set different operation permissions for accessing the AI model, such as setting a higher permission for the application of owner 1, which can perform multiple operations such as reading, modifying and executing the AI model, and setting a lower permission for the application of owner 2, which can only perform execution operation (cannot read or modify the AI model). In this way, the access flexibility of different applications to the AI model in the AI acceleration card can be improved, and fine-grained security access control can be realized. Or, for operation requests sent by different users using the same application, different operation permissions for accessing the AI model can be set for different users, so as to improve the access flexibility of different users to the AI model in the AI acceleration card, and realize fine-grained security access control.

[0010] In a possible implementation, the permission authentication information in the first operation request includes an identity, a processing operation on the AI model, and a token. For example, the processing operation can be an operation of reading the AI model, an operation of modifying the AI model (such as modifying a parameter in the AI model), or an operation of performing inference on input data by using the AI model, and the like. At this time, the AU accelerator can determine that the permission authentication information meets the verification rule when the identity in the permission authentication information matches the identity in the verification rule, the processing operation in the permission authentication information matches the processing operation in the verification rule, and the token in the permission authentication information matches the token in the verification rule. In this way, the AI accelerator can perform security verification according to the identity, the processing operation, and the token, and different operation permissions for accessing the AI model can be set for different identities, thereby improving the flexibility of accessing the AI model.

[0011] In a possible implementation, the general-purpose processor is configured to run a TEE, and the general-purpose processor includes a PDP (policy decision point) component running in the TEE; and the general-purpose processor is further configured to, before sending the first operation request, add a token to a second operation request generated by the general-purpose processor by using the PDP component to obtain the first operation request, where the second operation request includes an identity and a processing operation. That is, the general-purpose processor can add a token participating in permission authentication to an operation request by using the PDP component running in the TEE. In this way, the AI accelerator can perform permission authentication on the identity, the processing operation, and the token in the first operation request by using the verification rule in the PEP component. In this way, by adding a token to an operation request by using the PDP component, the dimensions and quantities of data participating in permission authentication can be enriched, thereby further improving the security of accessing the AI model.

[0012] In a possible implementation, the AI accelerator includes an access controller; and the AI accelerator can perform permission authentication on the identity, the processing operation, and the token in the first operation request by using the verification rule in the access controller. The verification rule in the access controller is provided by the PEP component. In this way, by configuring the access controller in the AI accelerator, permission authentication on an operation request can be implemented. When the operation request is specifically used to request the AI model to perform inference, the access controller can first obtain the operation request and perform permission authentication on the operation request, and when the permission authentication fails, the data input to the AI model can not be obtained, thereby avoiding unnecessary data transmission and reducing resource consumption.

[0013] In a possible implementation, the access controller runs in the TEE in the AI acceleration card, and in this case, the access controller receives the first operation request based on a client application trusted application (CA-TA) communication interface, so as to ensure the security of data interaction between the REE environment and the TEE environment; or the access controller runs in the REE in the AI acceleration card.

[0014] In a possible implementation, the general processor can further perform encryption processing or obfuscation processing on a second operation request generated by the general processor by using the PDP component to obtain the first operation request before sending the first operation request, where the second operation request includes an identity and a processing operation for the AI model; and the AI acceleration card can specifically determine that the first operation request is successfully decrypted or de-obfuscated, and the permission authentication information meets the verification rule in the PEP component, when determining that the permission authentication information meets the verification rule. Correspondingly, when the first operation request fails to be decrypted (for example, decryption error) or de-obfuscated, it indicates that the general processor accesses the AI model illegally, and in this case, the AI acceleration card can refuse to respond to the first operation request. In this way, in the process of requesting the general processor to access the AI model in the AI acceleration card, the security of the general processor accessing the AI model can be improved by performing encryption (or obfuscation) and decryption (or de-obfuscation) processing on the operation request.

[0015] In a possible implementation, the PDP component runs in the TEE included in the AI acceleration card, that is, the PDP component is offloaded from the general processor to the AI acceleration card; and the AI acceleration card can further be configured to add a token to a second operation request generated by the general processor by using the PDP component to obtain the first operation request before the general processor sends the first operation request, where the second operation request includes an identity and a processing operation; and the AI acceleration card can specifically perform permission authentication on the identity, the processing operation and the token in the first operation request by using the verification rule in the PEP component, when determining whether the permission authentication information meets the verification rule in the PEP component. In this way, by adding the token to the operation request by using the PDP component, the dimensions and quantities of data participating in the permission authentication can be enriched, so as to further improve the security of accessing the AI model.

[0016] In a possible implementation, the first operation request is used to request the AI model to perform inference according to target data, the target data is input data of the AI model, the content risk control model is run in the TEE included by the artificial intelligence acceleration card, and the content risk control model is used to verify whether the target data meets an inference condition, such as verifying whether the content of the target data is legal content. When the target data meets the inference condition, the AI acceleration card can execute the first operation request. In this way, the AI acceleration card can perform double verification on the first operation request by using the PEP component and the content risk control model, which can not only effectively avoid illegal access of the AI model by the general processor, but also avoid inference of the AI model based on illegal content by the general processor, thereby further ensuring the security of access to the AI model in the AI acceleration card.

[0017] In a possible implementation, the AI acceleration card includes a DPU (deep learning processor), a DPU (data processor), an NPU (neural network processor), or a GPU (graphics processing unit).

[0018] In a second aspect, the present application provides a data processing method, which is applied to an artificial intelligence acceleration card, the artificial intelligence acceleration card is deployed with an AI (artificial intelligence) model, and is constructed with a TEE (trusted execution environment), and the artificial intelligence acceleration card runs a PEP (policy enforcement point) component deployed in the TEE. The method includes: the artificial intelligence acceleration card receives a first operation request, the first operation request is used to request processing of the AI model, and the first operation request includes permission authentication information; the artificial intelligence acceleration card determines whether the permission authentication information meets a verification rule in the PEP component; and when the permission authentication information meets the verification rule, the artificial intelligence acceleration card executes the first operation request to perform a processing operation on the AI model.

[0019] In a possible implementation, the permission authentication information includes an identity, a processing operation on the AI model, and a token. When the AI acceleration card determines that the permission authentication information meets the verification rule, the AI acceleration card can specifically determine that the identity matches the identity in the verification rule, the processing operation matches the processing operation in the verification rule, and the token matches the token in the verification rule.

[0020] In a possible implementation, the artificial intelligence acceleration card includes an access controller. The artificial intelligence acceleration card determines that the permission authentication information meets the verification rule in the PEP component, including: the artificial intelligence acceleration card performs permission authentication on the identity, the processing operation, and the token in the first operation request by using the verification rule in the access controller, and the verification rule is provided to the access controller by the PEP component.

[0021] In a possible implementation, the access controller runs in a TEE in the artificial intelligence acceleration card, and the access controller receives the first operation request based on a client application trusted application CA-TA communication interface; or the access controller runs in a REE in the artificial intelligence acceleration card.

[0022] In a possible implementation, the first operation request is subjected to encryption processing or obfuscation processing; and the permission authentication information meets the verification rule, including that the first operation request is successfully subjected to decryption processing or de-obfuscation processing, and the permission authentication information meets the verification rule in the PEP component.

[0023] In a possible implementation, the artificial intelligence acceleration card comprises a PDP component running in a TEE, and the method further comprises: before receiving the first operation request, the artificial intelligence acceleration card adds a token for a second operation request from a general processor by using the PDP component, to obtain the first operation request, the second operation request comprising an identity and a processing operation; and the artificial intelligence acceleration card determines whether the permission authentication information meets the verification rule in the PEP component, including that the artificial intelligence acceleration card performs permission authentication on the identity, the processing operation and the token in the first operation request by using the verification rule in the PEP component.

[0024] In a possible implementation, the first operation request is used to request the AI model to perform inference according to target data, the target data being input data of the AI model, the artificial intelligence acceleration card comprising a content risk control model running in a TEE, the content risk control model being used to verify whether the target data meets an inference condition; and the artificial intelligence acceleration card performs the first operation request, including: when the target data meets the inference condition, the artificial intelligence acceleration card performs the first operation request.

[0025] In a possible implementation, the AI acceleration card comprises a DPU (deep learning processor), a DPU (data processor), an NPU (neural network processor), or a GPU (graphics processing unit).

[0026] The data processing method provided in the second aspect corresponds to the data processing system provided in the first aspect, and therefore the technical effects of any implementation manner of the second aspect are the same as those of the corresponding implementation manner of the first aspect, which will not be described here.

[0027] In a third aspect, the present application provides an artificial intelligence acceleration card, comprising a processor and a memory. The processor and the memory are in communication with each other. The processor is configured to execute instructions stored in the memory, so that the artificial intelligence acceleration card performs the data processing method performed by the AI acceleration card in the second aspect or any implementation manner of the second aspect. It should be noted that the memory can be integrated into the processor or independent of the processor. The computing device can also include a bus. The processor connects the memory through the bus. The memory can include a readable memory and a random access memory.

[0028] In a fourth aspect, the present application provides a computer readable storage medium, which stores instructions, when executed on a computing device, causes the computing device to perform the operation steps of the data processing method in the second aspect or any implementation manner of the second aspect.

[0029] In a fifth aspect, the present application provides a computer program product comprising instructions, when executed on a computing device, causes the computing device to perform the operation steps of the data processing method in the second aspect or any implementation manner of the second aspect.

[0030] On the basis of the implementation manners of the above aspects, the present application can be further combined to provide more implementation manners. BRIEF DESCRIPTION OF DRAWINGS

[0031] FIG. 1 is a structural schematic diagram of an exemplary data processing system provided by the present application;

[0032] FIG. 2 is a structural schematic diagram of another exemplary data processing system provided by the present application;

[0033] FIG. 3 is a flow schematic diagram of a data processing method provided by the present application;

[0034] FIG. 4 is a schematic diagram of configuring an access controller 202 in the REE of the AI acceleration card 200 provided by the present application;

[0035] FIG. 5 is a schematic diagram of configuring an access controller 202 in the TEE of the AI acceleration card 200 provided by the present application;

[0036] FIG. 6 is a schematic diagram of configuring a forwarding module 203 in the REE of the AI acceleration card 200 provided by the present application;

[0037] FIG. 7 is a flow schematic diagram of another data processing method provided by the present application;

[0038] FIG. 8 is a schematic diagram of deploying a content risk control model in the AI acceleration card 200 provided by the present application;

[0039] FIG. 9 is a schematic diagram of a hardware structure of an AI acceleration card provided in the present application. DETAILED DESCRIPTION

[0040] The terms "first", "second", and the like in the description and claims of the present application and the above drawings are used to distinguish similar objects, and do not necessarily have to be used to describe a specific order or sequence. It should be understood that the terms used in this way can be interchanged, and this is merely a way of distinguishing the objects of the same attribute used in the description of the embodiments of the present application.

[0041] The technical solutions in the present application will be described below in conjunction with the accompanying drawings provided in the present application.

[0042] Referring to FIG. 1, it is a schematic diagram of the structure of an exemplary data processing system 10. As shown in FIG. 1, the data processing system 10 includes a general-purpose processor 100 and at least one AI acceleration card, and in FIG. 1, two AI acceleration cards are taken as an example for illustration, which are AI acceleration card 200 and AI acceleration card 300, and the general-purpose processor 100 and each AI acceleration card can communicate through a bus.

[0043] Exemplarily, the bus through which the general-purpose processor 100 and each AI acceleration card communicate, for example, can be a peripheral component interconnect express (PCIe) bus, a non-volatile memory express (NVMe) bus, a compute Express link (CXL) bus, a HCCS (Huawei Collective Communication Server) bus, a unified bus (UB or Ubus), or other types of buses, etc. And the general-purpose processor 100, for example, can be a central processing unit (CPU)

[0044] The AI acceleration card 200 (the AI acceleration card 300 is similar) can be, for example, a deep-learning processing unit (DPU), a data processing unit (DPU), a neural-network processing unit (NPU), or a graphics processing unit (GPU), and the like. In actual applications, the AI acceleration card 200 can also be other types of acceleration cards that can support the running of AI models, such as a tensor processing unit (TPU), a smart network card, and the like, and the like, and is not limited thereto.

[0045] The general processor 100 can be deployed with an application 101 and an application 102. For example, the application can be pre-deployed in the general processor 100 by an operation and maintenance personnel, or can be deployed in the general processor 100 by a user during use of the data processing system 10, and the like. In FIG. 1, the general processor 100 includes two applications as an example for illustration. In actual applications, the general processor 100 can deploy any number of applications. The application 101 can run in a rich execution environment (REE) in the general processor 100. Generally, the REE is an open execution environment and is vulnerable to attacks, such as attacks of sensitive resources being stolen, and the like. Therefore, the security of the application 101 performing operations in the REE is relatively low. The application running in the REE can also be referred to as a client application (CA).

[0046] In addition, the general processor 100 can be constructed with a TEE (trusted execution environment). The TEE is an independent execution environment running concurrently with the REE, and provides a secure execution environment for authorized trusted applications (TAs). Therefore, the operations performed in the TEE are generally trusted and secure.

[0047] As shown in FIG. 1, the TEE can be configured with a policy decision point (PDP) component 103. The PDP component 103 can generate an access control policy, which can be used to implement access control on the application 101 in the REE requesting to process the AI model in the AI acceleration card 200 or the AI acceleration card 300, so as to improve the security of the application 101 accessing the AI model, that is, to improve the security of the general processor 100 accessing the AI model.

[0048] The AI acceleration card 200 and the AI acceleration card 300 can jointly deploy an AI model, for example, different network layers in the AI model can be deployed in different AI acceleration cards. At this time, the AI model can be, for example, a large language model Meta AI (LLaMA) model, a bidirectional encoder representation from transformers (BERT) model, or a generative pre-trained transformer 3 (GPT-3) model, and the like, and can also be other types of models, such as a GPT-4 model, and the like, which are not limited. Alternatively, the AI acceleration card 200 and the AI acceleration card 300 can each deploy an AI model, different AI acceleration cards can deploy different AI models, different AI acceleration cards can deploy the same (large) model in a distributed manner, and the like. At this time, the AI model can be a neural network model with a relatively small number of model parameters. For ease of understanding, the following will be described by taking an example of the AI acceleration card 200 and the AI acceleration card 300 each being configured with an AI model.

[0049] As shown in FIG. 1, the AI model in the AI acceleration card 200 can run in the REE, and a TEE can be constructed in the AI acceleration card 200, and a policy enforcement point (PEP) component 201 can be configured in the TEE. FIG. 1 is described by taking an example of an application in the general-purpose processor 100 running in the REE, and in other embodiments, the application in the general-purpose processor 100 can also run in the TEE. The PEP component 201 can control the access of the application 101 (and other applications) in the general-purpose processor 100 to the AI model based on the access control policy generated by the PDP component 103. That is, when there is an application that illegally accesses the AI model (such as illegally updating the AI model or reading the parameters of the AI model, and the like), the PEP component 201 can refuse the application to access the AI model.

[0050] It can be understood that if the PEP component is deployed in the general-purpose processor 100, the application 101 accesses the AI model in the AI acceleration card 200 after being authenticated by the PEP component in the general-purpose processor 100 (or referred to as access control verification), which can improve the security of the AI model in the AI acceleration card 200 to a certain extent, but when there is an application with higher authority or an illegal application in the general-purpose processor 100, the application can directly bypass the PEP component in the general-purpose processor 100 and directly access the AI model in the AI acceleration card 200, thereby affecting the security of the AI model in the AI acceleration card 200.

[0051] Therefore, in the embodiment shown in FIG. 1, by constructing the TEE in the AI acceleration card 200 and configuring the PEP component 201 in the TEE, each application in the general-purpose processor 100 needs to obtain the authority authentication of the PEP component 201 when accessing the AI model in the AI acceleration card 200, thereby ensuring the security of the AI model being accessed.

[0052] In specific implementation, when the application 101 (or the application 102) sends an operation request to the AI acceleration card 200 to request processing of the AI model in the AI acceleration card 200 (such as reading, modifying, or executing the AI model, etc.), the AI acceleration card 200 can use the PEP component 201 in the TEE to determine whether the authority authentication information in the operation request conforms to the verification rule in the PEP component 201, and when the authority authentication information in the operation request conforms to the verification rule, it indicates that the operation request passes the authority authentication, and the AI acceleration card 200 executes the operation request to perform processing operation on the AI model, such as executing the corresponding inference process using the AI model, etc., and feeds back the obtained processing result (such as the inference result of the AI model) to the application 101.

[0053] In this way, in the data processing system 10, by deploying the PEP component 201 to the execution environment closer to the AI model, the AI acceleration card 200 can use the PEP component 201 to perform authority authentication on the operation request sent by the general-purpose processor 100 (specifically, the application 101 or the application 102 in the general-purpose processor 100), and only when the operation request passes the authority authentication, the application is allowed to access the AI model. At this time, even if there is an illegal application in the general-purpose processor 100, or the application in the general-purpose processor 100 bypasses the authentication process in the TEE in the general-purpose processor 100 to request illegal access to the AI model, the AI acceleration card 200 can use the PEP component 201 to perform authority authentication on the operation request of illegal access, thereby effectively avoiding the AI model being illegally accessed by the general-purpose processor 100, and realizing the security of the AI model in the AI acceleration card 200 being accessed.

[0054] Further, when multiple applications (e.g., the application 101 and the application 102) are deployed in the general processor 100, and the multiple applications belong to different users, the applications of different users can access the AI model in the AI acceleration card 200 based on different permissions. For example, the application 101 belonging to user 1 can have a higher permission to access the AI model, so that the application 101 can request to read, modify, and execute the AI model (e.g., the AI model can be deployed to the AI acceleration card 200 by user 1) when accessing the AI model. The application 102 belonging to user 2 has a lower permission to access the AI model (e.g., the application 102 can request to execute the AI model with the authorization of user 1), so that the application 102 of user 2 can only request to execute the AI model when accessing the AI model. When the application 102 of user 2 illegally requests to access the parameters in the AI model or illegally requests to modify the parameters of the AI model, the PEP component 201 can refuse the application 102 to access the AI model. In this way, the AI acceleration card 200 can implement fine-grained security access control, so as to improve the flexibility of different applications accessing the AI model in the AI acceleration card 200. Alternatively, for operation requests sent by different users based on the same application (e.g., different users send operation requests based on different accounts using the application 101), different users (specifically, different accounts of different users) can be set different operation permissions to access the AI model, so as to improve the access flexibility of different users to the AI model in the AI acceleration card, implement fine-grained security access control, and improve the flexibility of different users to access the AI model in the AI acceleration card 200 using the same application.

[0055] Exemplarily, the PEP component 201 can be implemented by software or hardware.

[0056] In a first example, when implemented by software, the PEP component 201 can be, for example, program code running in a TEE.

[0057] In a second example, when implemented by hardware, the PEP component 201 can be implemented by an application-specific integrated circuit (ASIC), a programmable logic device (PLD), a complex programmable logical device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), etc., and the present application does not limit this.

[0058] Similarly, for the AI model in the AI acceleration card 300, by constructing a TEE in the AI acceleration card 300 and deploying the PEP component in the TEE, the AI acceleration card 300 can avoid illegal access of the AI model in the AI acceleration card 300 by the application through the PEP component, so as to improve the security of the AI model in the AI acceleration card 300.

[0059] It is worth noting that the data processing system 10 shown in FIG. 1 is only an exemplary illustration and is not intended to be limiting.

[0060] For example, in actual application scenarios, the data processing system 10 can include more number or more types of AI acceleration cards, or can include only one AI acceleration card, etc.

[0061] For another example, in other possible data processing systems, in addition to limiting illegal access of the AI model by the application in the general-purpose processor 100, the PEP component 201 can also limit illegal access of the AI model by other subjects other than the general-purpose processor 100.

[0062] For another example, in other possible data processing systems, the PDP component can also be deployed in the AI acceleration card. Specifically, in the data processing system 20 shown in FIG. 2, the general-purpose processor 100, the AI acceleration card 200, the AI acceleration card 300, and the AI acceleration card 400 can be included, and the general-purpose processor 100 and the other AI acceleration cards can communicate through a bus. The AI acceleration card 200 and the AI acceleration card 300 include REEs in which an AI model is running, and the REEs of the AI acceleration card 200 and the AI acceleration card 300 are configured with a PEP component, as shown in FIG. 2. The AI acceleration card 400 can be constructed with a TEE, and the TEE can be configured with a PDP component 401, which can generate an access control policy and configure the access control of the PEP components in the other AI acceleration cards according to the access control policy. Thus, the PEP components in the AI acceleration cards can improve the security of the AI model included in each of them under the configuration of the PDP component 401. Or, the PDP component 401 in FIG. 2 can also be deployed in the TEE in the AI acceleration card 200 or in the TEE in the AI acceleration card 300, which is not limited.

[0063] In actual application scenarios, the data processing system 10 (and the data processing system 20) can be deployed on a single computing device, for example, the data processing system 10 can be deployed in a server to ensure the security of AI assets in the AI acceleration card. Alternatively, the data processing system 10 (and the data processing system 20) can be deployed on a cluster of multiple computing devices, so that the general-purpose processor 100 can access AI models and other resources in the AI acceleration card on the multiple computing devices.

[0064] For ease of understanding, the embodiments of the data processing method provided in the present application are described below with reference to the accompanying drawings.

[0065] Referring to FIG. 3, FIG. 3 is a flowchart of a data processing method provided in an embodiment of the present application. The method can be applied to the data processing system shown in FIG. 1 or FIG. 2, or can be applied to other applicable data processing systems. For ease of illustration, the present embodiment is exemplarily described by taking the application to the data processing system 10 shown in FIG. 1 and the request of the general-purpose processor 100 to access the AI model in the AI acceleration card 200 as an example.

[0066] Specifically, the data processing method shown in FIG. 3 can include the following steps.

[0067] S301: The general-purpose processor 100 sends an operation request 1 to the AI acceleration card 200. The operation request 1 is used to request processing of the AI model in the AI acceleration card 200, and the operation request 1 includes permission authentication information.

[0068] In the present embodiment, the AI model can be deployed in the AI acceleration card 200. The AI model can be, for example, a high-value business model, or a model with high security requirements, such as a model for attack detection, a model for content risk control, a model for licence control, a model for audit traceability, etc. When the AI model is used for attack detection, the AI model can identify whether an attack is suffered according to the data input to the model. When the AI model is used for content risk control, the AI model can identify the existence of risky content data and prohibit further operations on the data, such as prohibiting inference on sensitive data according to the sensitive data after the sensitive data is identified. When the AI model is used for licence control, the AI model can identify that the model granted with the use licence is not bound with the correct hardware, such as the AI model authorized to use is backed up and then run on multiple illegal hardware. When the AI model is used for audit traceability, the AI model can identify the processing operation on the use log of the AI model and prohibit the deletion, modification, etc. of the log of the AI model (allowing the log to be queried and copied).

[0069] Further, the general processor 100 can request to access the AI model. For example, the application 101 or the application 102 in the general processor 100 can request to read parameters in the AI model, or request to update the AI model (i.e., update parameters in the AI model), or request to execute the AI model (i.e., use the AI model to infer according to model input data), and the like during running of the application 101 or the application 102, or can perform other types of processing operations on the AI model, and the like.

[0070] In actual application, the application 101 and the AI model can belong to the same subject (hereinafter referred to as the owner), such as the same user. The owner can pre-load the AI model into the AI acceleration card 200, and deploy the application 101 in the general processor 100, so as to meet the business requirements by accessing the AI model during running of the application 101. Alternatively, the application 101 and the AI model can belong to different users. In this case, the user 101 can have the permission to access the AI model with the authorization of the owner of the AI model.

[0071] During running of the general processor 100, if the AI model in the AI acceleration card 200 needs to be accessed, a corresponding operation request can be generated to request to process the AI model by using the operation request.

[0072] In a possible implementation, the application 101 (or other applications such as the application 102) running in the general processor 100 can first generate an operation request 2, which can include a processing operation on the AI model and an identity. For example, the processing operation can be an operation of reading the AI model, an operation of modifying the AI model, or an operation of executing the AI model, and the like. The identity can be an identity of the application, or an identity of the owner of the application (such as a user identity), or other information used to identify the identity of the subject requesting to access the AI model. Then, the general processor 100 can call an application programming interface (API) provided by the TEE to send the operation request 2 to the TEE, specifically to the PDP component 103 in the TEE. The PDP component 103 can add verification information for the operation request 2 to participate in subsequent verification of the verification information for permission authentication, to obtain an operation request 1, and return the operation request 1 to the application 101. Thus, the application 101 can send the operation request 1 carrying the verification information, the identity, and the processing operation to the AI acceleration card 200.

[0073] In this embodiment, the following implementation examples are provided for the implementation of the PDP component 103 adding the verification information to the operation request 2.

[0074] As a first implementation example, the PDP component 103 adds verification information to the operation request 2, which can be a token and the like. At this time, the operation request 1 can carry data a, and the PDP component 103 can encrypt the data a by using a pre-configured key, generate a corresponding token, and replace the data a in the operation request 2 with the token, so as to generate the operation request 1. The key can be pre-configured in the PDP component 103 by a technician or a user. Thus, after the application 101 sends the operation request 1 to the AI acceleration card 200, the AI acceleration card 200 can determine whether the access of the application 101 to the AI model is legal according to the token in the operation request 1. At this time, the token, the identity, and the processing operation in the operation request 1 can be used as the permission authentication information for subsequent permission authentication of the AI acceleration card to the access of the general processor 100 to the AI model.

[0075] As a second implementation example, when the PDP component 103 adds verification information to the operation request 2, the PDP component 103 can specifically encrypt the operation request 2 to obtain the operation request 1 (i.e., the encrypted operation request 2). For example, the PDP component 103 can use a symmetric encryption algorithm or an asymmetric encryption algorithm to encrypt the operation request 2. Alternatively, when the PDP component 103 adds verification information to the operation request 2, the PDP component 103 can specifically obfuscate the operation request 2 to obtain the operation request 1 (i.e., the obfuscated operation request 2). For example, the PDP component 103 can use a data conversion obfuscation technique to obfuscate the operation request 2. Thus, after the application 101 sends the operation request 1 to the AI acceleration card 200, the AI acceleration card 200 can decrypt or de-obfuscate the operation request 1, and determine whether the access of the application 101 to the AI model is legal by judging whether the operation request obtained by decryption or de-obfuscation is correct. For example, when the format of the operation request obtained by decryption or de-obfuscation is incorrect, it can be determined that the access is not legal. Therefore, the PDP component 103 encrypts or obfuscates the operation request, so that the operation request carries verification information that can be used for subsequent permission authentication. Meanwhile, the identity and the processing operation in the operation request 1 can also be used as the permission authentication information for subsequent permission authentication of the AI acceleration card to the access of the general processor 100 to the AI model.

[0076] In actual application, after receiving the operation request 2, the PDP component 103 can determine whether the application (such as the application 101 or the application 102) sending the operation request 2 is a legal application, for example, whether the application and the processing operation in the operation request 2 match the application and the processing operation recorded in the table (which records the application and the at least one processing operation allowed to be executed) configured by the user in priority. If the match is correct, the PDP component 103 can determine that the application sending the operation request 2 is a legal application, and encrypt or obfuscate the operation request 2 provided by the application. If the match is incorrect, the PDP component 103 can determine that the application is an illegal application, and the PDP component 103 can not encrypt or obfuscate the operation request 2.

[0077] It can be understood that the above-mentioned manner of adding verification information to the operation request 2 is only as some exemplary description, and in actual application, the PDP component 103 can also add verification information to the operation request 2 in other manners, for example, the added verification information can also be other types of information in addition to the token, and the like, which are not limited.

[0078] S302: The AI acceleration card 200 determines whether the permission authentication information in the operation request 1 meets the verification rule in the PEP component 201 in the TEE.

[0079] Exemplarily, the AI acceleration card 200 can use multiple verification manners to verify whether the operation request 1 is legal.

[0080] In a first possible implementation manner, the permission authentication information in the operation request 1 includes the identity, the processing operation and the token. Then, the AI acceleration card 200 verifies whether the identity, the processing operation and the token in the operation request 1 are legal.

[0081] As a first implementation example, as shown in FIG. 4, the REE of the AI acceleration card 200 can be configured with an access controller 202, and the access controller 202 can receive the operation request 1 sent by the general-purpose processor 100. Thus, the access controller 202 can use the verification rule to verify whether the identity, the processing operation and the token carried by the operation request 1 are correct. If correct, the access controller 202 can determine that the operation request 1 passes the permission authentication, so that the AI acceleration card 200 can execute the corresponding operation on the AI model based on the processing operation carried in the operation request 1, such as reading the parameters in the AI model, updating the parameters in the AI model, or using the AI model to infer according to the model input data. If incorrect, the AI acceleration card 200 rejects to execute the operation request 1. In this way, the access controller 202 in the REE can directly execute the operation request 1, so as to guarantee that the processing efficiency of the operation request 1 reaches a high level.

[0082] The verification rule in the access controller 202 can be pre-configured in the access controller 202 by the PEP component 201 in the TEE. In a specific implementation, taking the operation request 1 generated by the application 101 in the general processor 100 as an example, the owner of the application 101 can pre-configure the identity of the application 101 that requests to access the AI model (which can be a user identifier or an application identifier, etc.), the key used to generate the token when requesting to access the AI model, and the processing operation that can be performed by each application on the AI model in the process of accessing the AI model, etc. in the PDP component 103 in the general processor 100 based on the CA-TA (client application-trusted application) communication interface. Then, the PDP component 103 can generate an access control policy using the policy engine 1031 in the PDP component 103 according to the configuration operation of the owner, and provide the access control policy to the policy administrator 1032, which can convert the access control policy into a verification rule recognizable by the PEP component 201, and transmit the verification rule to the PEP component 201 through the secure channel between the TEE in the general processor 100 and the TEE in the AI acceleration card 200. The secure channel between different TEEs can be constructed by corresponding encryption algorithms and security protocols, for example, to ensure the security of data transmission between different TEEs; and the data to be transmitted can also be encrypted by using stream cipher (encryption bit by bit) and other methods to meet the requirement of high security performance. In actual application scenarios, the communication data volume between the PDP component 103 and the PEP component 201 is small, which makes the communication speed of the secure channel not need to reach the line speed, thereby reducing the communication overhead. In this way, the PEP component 201 can configure the verification rule in the access controller 202 through the CA-TA communication interface in the AI acceleration card 200, so that the access controller 202 performs permission authentication on each operation request received according to the verification rule.

[0083] For example, when the access controller 202 performs permission authentication on the operation request 1 according to the verification rule, specifically, the access controller 202 can check whether the token in the operation request 1 matches the token in the verification rule (for example, check whether the two tokens are the same, etc.), check whether the identity in the operation request 1 matches the identity in the verification rule (for example, check whether the two identities are the same, etc.), and check whether the processing operation in the verification rule matches the processing operation in the operation request 1 (for example, check whether the processing operation in the verification rule includes the processing operation in the operation request 1, etc.). When the token, the identity, and the processing operation in the operation request 1 all have matching information in the verification rule, the access controller 202 determines that the operation request 1 passes the permission authentication. Otherwise, the access controller 202 determines that the operation request 1 fails the permission authentication, that is, the permission authentication fails.

[0084] It is worth noting that in the present implementation example, the verification rule in the access controller 202 can be configured by the PEP component 201 in advance before the AI acceleration card 200 receives the operation request 1. In other possible implementation manners, the access controller 202 can not store the verification rule, and then the access controller 202 can request the PEP component 201 for the verification rule for the operation request 1 through the CA-TA communication interface after receiving the operation request 1, specifically, the access controller 202 can request the PEP component 201 for the verification rule including the identity in the operation request 1. The verification rule can be pre-stored in the PEP component 201, or requested by the PEP component 201 from the PDP component 103 through a secure channel. Then, the access controller 202 can receive the verification rule fed back by the PEP component 201 through the CA-TA communication interface, and check the operation request 1 according to the received verification rule. In this way, the verification rule can be prevented from being leaked in the REE, thereby ensuring the security and reliability of the permission authentication of the access controller 202 on the operation request 1. At the same time, for a new application (or a new user) that obtains the owner authorization, the verification rule corresponding to the new application can be requested from the PDP component 103 to ensure that the new application can successfully access the AI model, and to prevent the verification rule in the access controller 202 from not being updated in time, thereby causing the new application to fail to access the AI model.

[0085] As a second implementation example, as shown in FIG. 5, an access controller 202 can be configured in the TEE of the AI acceleration card 200. At this time, the application 101 can send an operation request 1 to the AI acceleration card 200 through the CA-TA communication interface. Correspondingly, the access controller 202 receives the operation request 1 based on the CA-TA communication interface, and verifies the token, identity carried by the operation request 1 and whether the processing operation is correct according to the pre-configured verification rule. If correct, the access controller 202 can determine that the operation request 1 passes the permission authentication, so that the AI acceleration card 200 can execute the corresponding operation on the AI model based on the processing operation carried in the operation request 1. If not correct, the AI acceleration card 200 rejects to execute the operation request 1. Wherein, for the specific implementation manner of configuring the verification rule for the access controller 202, please refer to the description of the related part of the foregoing implementation example, which will not be repeated here. In this way, the access controller 202 executes the operation request 1 in the TEE, so as to ensure that the security of executing the operation request 1 is at a higher level, thereby helping to improve the security of the general processor 100 accessing the AI model.

[0086] In a second possible implementation, the AI acceleration card 200 verifies whether the access of the application 101 to the AI model is legal by decrypting or de-obfuscating the operation request 1.

[0087] In a specific implementation, the operation request 1 received by the AI acceleration card 200 is obtained by performing encryption processing on the PDP component 103 in the general processor 100. As shown in FIG. 6, the REE of the AI acceleration card 200 can be configured with a forwarding module 203. The forwarding module 203 can be a functional module implemented by software or a functional module implemented by hardware. After receiving the operation request 1, the forwarding module 203 can forward the operation request 1 to the TEE through the CA-TA communication interface. At this time, the PEP component 201 in the TEE can perform decryption processing on the operation request 1 received through the CA-TA communication interface to obtain a decrypted operation request, and send the decrypted operation request (plaintext) to the forwarding module 203 through the CA-TA communication interface. In this way, the forwarding module 203 can verify whether the decrypted operation request is correct request type data. If not, the forwarding module 203 can determine that the operation request 1 fails the permission authentication. For example, the operation request generated by the application 101 does not complete the corresponding encryption processing in the TEE in the general processor 100 (for example, the application 101 requests to access the AI model under illegal conditions); accordingly, the decrypted operation request is usually random code data. At the same time, the PEP component 201 also authenticates the permission authentication information in the operation request 1 by using the verification information. At this time, the permission authentication information in the operation request 1 can specifically include an identity and a processing operation. Moreover, when the PEP component 201 determines that the permission authentication information in the operation request 1 does not match the verification rule, the PEP component 201 can determine that the operation request 1 fails the permission authentication. When the PEP component 201 determines that the permission authentication information in the operation request 1 matches the verification rule, and the decrypted operation request is correct request type data, the forwarding module 203 can determine that the operation request 1 passes the permission authentication.

[0088] Similarly, when the operation request 1 received by the AI acceleration card 200 is obtained by performing obfuscation processing on the PDP component 103, the PEP component 201 can perform de-obfuscation processing on the operation request 1 sent by the forwarding module 203 through the CA-TA communication interface to obtain a de-obfuscated operation request, and feed back the de-obfuscated operation request to the forwarding module 203 through the CA-TA communication interface. In this way, the forwarding module 203 can verify whether the de-obfuscated operation request is correct request type data. If yes, the forwarding module 203 can determine that the operation request 1 passes the permission authentication. If not, the forwarding module 203 can determine that the operation request 1 fails the permission authentication.

[0089] S303: When the permission authentication information in the operation request 1 matches the verification rule, the AI acceleration card 200 executes the operation request 1 to perform the processing operation on the AI model.

[0090] S304: The AI acceleration card 200 feeds back the processing result obtained by executing the operation request 1 to the general-purpose processor 100.

[0091] In this embodiment, assuming that the operation request 1 sent by the general-purpose processor 100 passes the permission authentication, the AI acceleration card 200 can execute the corresponding operation on the AI model according to the processing operation carried in the operation request 1.

[0092] When the processing operation carried in the operation request 1 is specifically the operation of reading the model parameters, the model structure or the model file, the AI acceleration card 200 can copy the parameters, the structure or the model file of the AI model in the memory, and feed back the copied parameters, the structure or the model file of the AI model as the processing result obtained by executing the operation request 1 to the application 101.

[0093] When the processing operation carried in the operation request 1 is specifically the operation of updating the model parameters, the operation request 1 can also carry the training samples, then the AI acceleration card 200 can perform one or more rounds of training on the AI model by using the training samples, so as to update the values of the parameters in the AI model, thereby the AI acceleration card 200 can return the processing result for indicating the completion of the model parameter update to the general-purpose processor 100. Alternatively, the operation request 1 can also directly carry the values of the parameters in the AI model, thereby the AI acceleration card 200 can directly replace the values of the parameters in the AI model by using the values of the parameters carried in the operation request 1, and can return the processing result for indicating the completion of the model parameter update to the general-purpose processor 100.

[0094] When the processing operation carried in the operation request 1 is specifically the operation of updating the execution of the AI model, the operation request 1 can also carry the data as the input of the AI model, thereby the AI acceleration card 200 can perform inference according to the model input data by using the AI model, obtain the corresponding inference result, and feed back the inference result as the processing result obtained by executing the operation request 1 to the general-purpose processor 100.

[0095] Or, when the processing operation carried in the operation request 1 is specifically an operation of updating / executing an AI model, the operation request 1 can not carry training sample / model input data. In the AI acceleration card 200 shown in FIG. 4 or FIG. 5, the access controller 202, in a case where the operation request 1 passes the permission authentication, accesses the training sample / model input data (which can be saved in the memory in the AI acceleration card 200) from the general processor 100 based on a memory mapped input / output (MMIO) or a direct memory access (DMA) technology, and trains the AI model according to the obtained training sample to update the parameter values in the AI model, or performs inference on the AI model according to the obtained model input data to obtain a corresponding inference result. In this way, the AI acceleration card 200 obtains the training sample / model input data from the general processor 100 only in a case where the operation request passes the permission authentication, which makes it possible for the training sample or the model input data not to be transmitted to the AI acceleration card 200 for an operation request that does not pass the verification, so that resource consumption caused by data transmission between the general processor 100 and the AI acceleration card 200 in a scenario of an illegal request can be avoided.

[0096] It can be understood that the implementation manner of the AI acceleration card 200 for executing the operation request 1 by using the AI model is only some example implementation manners, and in actual application, the AI acceleration card 200 can also execute the operation request 1 in other manners.

[0097] When the application 101 requests to access the AI model in the AI acceleration card 300, the AI acceleration card 300 can also refer to the above manner, use the PEP component in the TEE to perform permission authentication on the operation request received by the AI acceleration card 300, and in a case where the operation request passes the permission authentication, perform the operation request to realize access of the general processor 100 to the AI model.

[0098] In this embodiment, it is taken that the AI acceleration card 200 determines that the operation request 1 sent by the general processor 100 passes the permission authentication based on the PEP component 201 as an example. When the general processor 100 illegally accesses the AI model in the AI acceleration card 200, the AI acceleration card 200 can identify the operation request that does not pass the permission authentication based on the PEP component 201 and refuse to execute the operation request, so as to avoid the AI model in the AI acceleration card 200 being illegally accessed by the general processor 100, specifically, avoid the AI model being illegally accessed by the application in the general processor 100. Hereinafter, it is taken that the general processor 100 illegally accesses the AI model as an example.

[0099] In a specific implementation, the general processor 100 can generate an operation request 3 and send the operation request 3 to the AI acceleration card 200. In the AI acceleration card 200 shown in FIG. 4 or FIG. 5, the access controller 202 can determine that the operation request 3 fails the permission authentication when it is determined that the operation request 3 does not carry an identity or the carried identity does not match the identity in the verification rule. Alternatively, the access controller 202 can determine that the operation request 3 fails the permission authentication when it is determined that the operation request 3 does not carry a token. Alternatively, the access controller 202 can determine that the operation request 3 fails the permission authentication when it is determined that the token carried in the operation request 3 is incorrect according to the verification rule configured by the PEP component 201. Alternatively, the access controller 202 can determine that the operation request 3 fails the permission authentication when it is determined that the token carried in the operation request 3 is correct but the processing operation requested to be performed does not match the processing operation in the verification rule (exceeds the access permission) according to the verification rule configured by the PEP component 201. In the AI acceleration card 200 shown in FIG. 6, after the forwarding module 203 forwards the operation request 3 to the PEP component 201 in the TEE, the PEP component 201 can perform decryption processing or de-obfuscation processing on the operation request 3 and feed back the data obtained after the decryption or de-obfuscation processing to the forwarding module 203. Thus, the forwarding module 203 can further determine that the operation request 3 fails the permission authentication when it is determined that the data obtained after the decryption or de-obfuscation processing is incorrect. At this time, the AI acceleration card 200 can refuse to perform the operation request 3 to refuse the general processor 100 to access the AI model in the AI acceleration card 200. In this way, the AI acceleration card 200 can identify the operation request of illegally accessing the AI model by using the PEP component 201 to protect the security of the AI model being accessed.

[0100] In the embodiment shown in FIG. 3, the AI acceleration card 200 uses a layer of verification mechanism to perform permission authentication on the operation request. In other embodiments, the AI acceleration card 200 can also perform multi-authentication on the operation request to further improve the security of the AI model being accessed. This will be described in detail below in conjunction with FIG. 7.

[0101] Referring to FIG. 7, a flowchart of another data processing method is shown, which is applied to the data processing system 10 shown in FIG. 1. As shown in FIG. 7, the method can specifically include:

[0102] S701: The general processor 100 sends an operation request 1 to the AI acceleration card 200, the operation request 1 being used to request the AI model in the AI acceleration card 200 to perform inference on target data, the target data being input data of the AI model, and the operation request 1 including permission authentication information.

[0103] Exemplarily, the target data can be carried in the operation request 1. For example, when the AI acceleration card 200 receives the operation request 1 sent by the general processor 100 through the forwarding module 203 shown in FIG. 6, the target data can be carried in the operation request 1.

[0104] Alternatively, the target data is not carried in the operation request 1. For example, when the AI acceleration card 200 receives the operation request 1 sent by the general processor 100 through the access controller 202 shown in FIG. 4 or FIG. 5, the access controller 202 can continue to obtain the target data from the general processor 100 and the like in the case that the operation request 1 passes the permission authentication.

[0105] S702: The AI acceleration card 200 determines whether the permission authentication information in the operation request 1 meets the verification rule in the PEP component 201. When the permission authentication information meets the verification rule, the step S703 is executed; when the permission authentication information does not meet the verification rule, the step S706 is executed.

[0106] In this embodiment, the specific implementation of the steps S701 to S702 can refer to the description of the related part of the steps S301 to S302 in the above-described embodiment shown in FIG. 3, which will not be repeated here.

[0107] S703: In the case that the permission authentication information meets the verification rule, the AI acceleration card 200 verifies whether the target data meets the inference condition by using the content control model running in the TEE. When the target data meets the inference condition, the step S704 is executed; when the target data does not meet the inference condition, the step S706 is executed.

[0108] Exemplarily, as shown in FIG. 8, the content control model can run in the TEE in the AI acceleration card 200, and the content control model can run through part of the hardware resources in the AI acceleration card 200, which can include, for example, the memory resource, the AI CPU and the AI core shown in FIG. 8 and the like in the AI acceleration card 200. Accordingly, another part of the hardware resources in the AI acceleration card 200 can run the AI model in the REE. In the AI acceleration card 200 shown in FIG. 8, the hardware resources for implementing the REE and the hardware resources for implementing the TEE can be isolated from each other to ensure the security of the operation performed in the TEE.

[0109] In a case where the PEP component 201 determines that the operation request 1 passes the permission authentication according to the verification rule, the AI acceleration card 200 can further utilize the content risk control model in the TEE to verify whether the target data as the input of the AI model satisfies the inference condition. For example, the AI acceleration card 200 can input the target data into the content risk control model to obtain an inference result output by the content risk control model, and the inference result indicates whether the target data has content risk. For example, when the semantics indicated by the target data is semantics related to illegal crimes, the inference result can indicate that the target data has content risk; or when the semantics indicated by the target data is in line with laws and regulations or specific regulations, the inference result can only indicate that the target data does not have content risk. In this way, when the AI acceleration card 200 determines that the target data has content risk according to the inference result, it can be determined that the target data does not satisfy the inference condition, and at this time, the AI acceleration card 200 can reject to execute the operation request 1. When the AI acceleration card 200 determines that the target data does not have content risk according to the inference result, it can be determined that the target data satisfies the inference condition, and at this time, the AI acceleration card 200 can continue to execute the subsequent steps to execute the operation request 1.

[0110] S704: The AI acceleration card 200 executes the operation request 1 to obtain a processing result, and the processing result includes an inference result generated by utilizing the AI model to infer the target data.

[0111] S705: The AI acceleration card 200 feeds back the processing result to the general processor 100.

[0112] In this embodiment, the specific implementation manners of steps S704 to S705 can be referred to the descriptions of the related parts of steps S303 to S304 in the above-described embodiment shown in FIG. 3, which will not be described herein.

[0113] S706: The AI acceleration card 200 rejects to execute the operation request 1.

[0114] In this way, the AI acceleration card 200 can utilize the PEP component 201 and the content risk control model to double-check the operation request 1, which not only can effectively avoid that the AI model is accessed illegally, but also can avoid that the general processor 100 (the application 101 or the application 102) utilizes the AI model to infer based on illegal content, thereby further ensuring the security of the AI model in the AI acceleration card 200.

[0115] It should be noted that, in the embodiments shown in FIG. 3 and FIG. 7, the PDP component 103 is deployed in the TEE in the general processor 100. In the data processing system 20 shown in FIG. 2, the PDP component 401 is deployed in the TEE in the AI acceleration card 400. At this time, the implementation process of the general processor 100 requesting to access the AI model in the AI acceleration card 200 can be described with reference to the related parts in the embodiments shown in FIG. 3 or FIG. 7, which will not be described here. Among them, the general processor 100 and the PDP component 401 can communicate through the CA-TA communication interface. For example, the PDP component 401 can add verification information to the operation request 2 generated by the general processor 100 through the CA-TA communication interface, and feed back the newly generated operation request 1 to the general processor 100 through the CA-TA communication interface. The PDP component 401 and the PEP component 201 can communicate through a secure channel, etc. For example, the verification rule can be transmitted through the secure channel.

[0116] It should be noted that, according to the above description, other reasonable combinations of steps that can be thought of by those skilled in the art also belong to the protection scope of the present application. Secondly, those skilled in the art should be familiar with the fact that the embodiments described in the specification are preferred embodiments, and the actions involved are not necessarily required by the present application.

[0117] The data processing system and the data processing method provided by the embodiments of the present application are introduced above in combination with FIG. 1 to FIG. 8. Next, the structure of the AI acceleration card provided by the embodiments of the present application will be introduced in combination with the drawings.

[0118] Referring to FIG. 9, a hardware structure schematic diagram of an AI acceleration card 900 is shown, which can implement the AI acceleration card 200 and the like mentioned in the above embodiments.

[0119] As shown in FIG. 9, the AI acceleration card 900 includes a processor 901, a memory unit 902, and a communication interface 903. Among them, the processor 901, the memory unit 902, and the communication interface 903 communicate through a bus 904, and can also communicate through wireless transmission and other means. Further, the computing device 900 can also include a storage 905, which can be connected to the processor 901, the memory unit 902, and the communication interface 903 through the bus 904. The storage 902 can be used to store instructions, and the processor 901 can execute the instructions stored in the storage 902. Among them, the processor 901 can perform the following operations:

[0120] receiving a first operation request, the first operation request being used to request processing of an AI model, the first operation request including permission authentication information;

[0121] determine whether the permission authentication information meets the verification rule in the PEP component;

[0122] when the permission authentication information meets the verification rule, execute the first operation request to perform a processing operation on the AI model.

[0123] It should be understood that in the present embodiment, the processor 901 can be a CPU, and the processor 901 can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic device, a discrete gate or transistor logic device, a discrete device component, or the like, or can be other conventional processors or the like.

[0124] When the AI acceleration card 900 includes a memory 905, the memory 905 can include read-only memory and random access memory, and provide instructions and data to the processor 905. The memory 905 can also include non-volatile random access memory.

[0125] The memory 905 can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memories. Among them, the non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically EPROM (EEPROM) or flash memory. The volatile memory can be random access memory (RAM) used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM) and direct memory bus random access memory (DRAM) (DRAM).

[0126] The communication interface 903 is configured to communicate with other devices connected with the AI acceleration card 900. The bus 904 can include a data bus, a power bus, a control bus, a status signal bus, etc. However, for the purpose of clarity, all the buses are marked as the bus 904 in the figure.

[0127] It should be understood that the AI acceleration card 900 according to the embodiments of the present application can correspond to the AI acceleration card 200 in the embodiments of the present application, and can correspond to performing the method performed by the AI acceleration card 200 in each of the above embodiments. The above and other operations and / or functions implemented by the AI acceleration card 900 are respectively for implementing the flow of the corresponding method of the AI acceleration card 200 in each of the above embodiments, and for the sake of brevity, will not be repeated here.

[0128] The embodiments of the present application also provide a computer readable storage medium. The computer readable storage medium can be any available medium or data storage device including one or more available media that a computing device can store. The available medium can be a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, a DVD), or a semiconductor medium (for example, a solid state disk), etc. The computer readable storage medium includes instructions indicating the computing device to execute the above data processing method.

[0129] The embodiments of the present application also provide a computer program product. The computer program product includes one or more computer instructions. When the computer instructions are loaded and executed on a computing device, the flow or function according to the embodiments of the present application is generated in whole or in part.

[0130] The computer instructions can be stored in a computer readable storage medium or transmitted from one computer readable storage medium to another computer readable storage medium, for example, the computer instructions can be transmitted from one website, computer or data center to another website, computer or data center through wired (for example, coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (for example, infrared, wireless, microwave, etc.) mode.

[0131] The computer program product can be a software installation package, which can be downloaded and executed on a computing device in any case where the above data processing method is needed.

[0132] The above embodiments can be implemented, in whole or in part, by software, hardware, firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded or executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more sets of available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium. A semiconductor medium can be a solid-state drive.

[0133] The terminology used in the above embodiments is for the purpose of describing specific embodiments only and is not intended to be limiting of this application. As used in the specification and appended claims of this application, the singular expressions “a,” “an,” “the,” “the,” “the,” and “this” are intended to also include expressions such as “one or more,” unless the context clearly indicates otherwise. It should also be understood that in the embodiments of this application, “one or more” refers to one, two, or more; the character “ / ” generally indicates that the preceding and following objects are in an “or” relationship. In the embodiments of this application, “simultaneously” means within the same time period, including situations where they are at the same moment.

[0134] References to "one embodiment" or "some embodiments" as described in this specification mean that one or more embodiments of this application include a specific feature, structure, or characteristic described in connection with that embodiment. Therefore, the phrases "in one embodiment," "in some embodiments," "in other embodiments," "in still other embodiments," etc., appearing in different parts of this specification do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically emphasized. The terms "comprising," "including," "having," and variations thereof mean "including but not limited to," unless otherwise specifically emphasized.

[0135] The above merely provides the specific implementation of the present application, but the protection scope of the present application is not limited to this. Any person skilled in the art can easily think of various equivalent modifications or replacements within the technical range disclosed by the present application, and these modifications or replacements should be covered in the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A data processing system, characterized by The data processing system comprises: a general processor configured to send a first operation request, the first operation request being used to request processing of an artificial intelligence (AI) model, the first operation request comprising permission authentication information; an AI acceleration card on which the AI model is deployed and in which a trusted execution environment (TEE) is constructed, configured to run a policy enforcement point (PEP) component deployed in the TEE, receive the first operation request, determine whether the permission authentication information meets a verification rule in the PEP component, and when the permission authentication information meets the verification rule, execute the first operation request to perform a processing operation on the AI model.

2. The system of claim 1, wherein, The permission authentication information comprises an identity, a processing operation on the AI model, and a token. The permission authentication information meets the verification rule, which comprises that the identity matches an identity in the verification rule, the processing operation matches a processing operation in the verification rule, and the token matches a token in the verification rule.

3. The system of claim 2, wherein, The general processor comprises a TEE in which a policy decision point (PDP) component is run; The general processor is further configured to, before sending the first operation request, add the token to a second operation request generated by the general processor by using the PDP component, to obtain the first operation request, the second operation request comprising the identity and the processing operation; When determining whether the permission authentication information meets the verification rule in the PEP component, the AI acceleration card is specifically configured to: The AI acceleration card performs permission authentication on the identity, the processing operation, and the token in the first operation request by using the verification rule in the PEP component.

4. The system of claim 3, wherein, The AI acceleration card comprises an access controller. When performing permission authentication on the identity, the processing operation, and the token in the first operation request by using the verification rule in the PEP component, the AI acceleration card is specifically configured to: The AI acceleration card performs permission authentication on the identity, the processing operation, and the token in the first operation request by using the verification rule in the access controller, the verification rule being provided to the access controller by the PEP component.

5. The system of claim 3 or 4, wherein, The access controller runs in a TEE in the AI acceleration card, and the access controller receives the first operation request based on a client application trusted application (CA-TA) communication interface. Alternatively, the access controller runs in a runtime environment (REE) in the AI acceleration card.

6. The system of claim 1, wherein, Before sending the first operation request, the general processor is further configured to perform encryption processing or obfuscation processing on a second operation request generated by the general processor by using the PDP component, to obtain the first operation request, the second operation request comprising the identity and a processing operation on the AI model. The permission authentication information conforms to the verification rule, including that the first operation request succeeds in decryption processing or de-obfuscation processing, and the permission authentication information conforms to the verification rule in the PEP component.

7. The system of claim 2, wherein, The artificial intelligence acceleration card comprises a PDP component running in a TEE. The artificial intelligence acceleration card is further configured to add the token to a second operation request generated by the general-purpose processor by using the PDP component to obtain the first operation request before the general-purpose processor sends the first operation request, and the second operation request comprises the identity and the processing operation. The artificial intelligence acceleration card is configured to: The artificial intelligence acceleration card is configured to perform permission authentication on the identity, the processing operation, and the token in the first operation request by using the verification rule in the PEP component.

8. The system of any one of claims 1 to 7, wherein, The first operation request is used to request the AI model to perform inference according to target data, the target data is input data of the AI model, and the artificial intelligence acceleration card comprises a content risk control model running in a TEE. The artificial intelligence acceleration card is configured to: When the target data meets the inference condition, the artificial intelligence acceleration card executes the first operation request.

9. The system according to any one of claims 1 to 8, characterized in that, The artificial intelligence acceleration card comprises a deep learning processor (DPU), a data processor (DPU), a neural network processor (NPU), or a graphics processing unit (GPU).

10. A data processing method, characterized by, The method is applied to an artificial intelligence acceleration card, the artificial intelligence acceleration card deploys an artificial intelligence (AI) model and constructs a trusted execution environment (TEE), and the artificial intelligence acceleration card runs a policy enforcement point (PEP) component deployed in the TEE. The method comprises: The artificial intelligence acceleration card receives a first operation request, and the first operation request is used to request processing of the AI model, and the first operation request comprises permission authentication information. The artificial intelligence acceleration card determines whether the permission authentication information conforms to a verification rule in the PEP component. When the permission authentication information conforms to the verification rule, the artificial intelligence acceleration card executes the first operation request to perform a processing operation on the AI model.

11. The method of claim 10, wherein, The permission authentication information comprises an identity, a processing operation for the AI model, and a token. The permission authentication information conforms to the verification rule, including that the identity matches the identity in the verification rule, the processing operation matches the processing operation in the verification rule, and the token matches the token in the verification rule.

12. The method of claim 11, wherein, The artificial intelligence acceleration card comprises an access controller. The artificial intelligence acceleration card determines whether the permission authentication information conforms to the verification rule in the PEP component, comprising: The artificial intelligence acceleration card utilizes a verification rule in the access controller to perform permission authentication on the identity, the processing operation, and the token in the first operation request, the verification rule being provided to the access controller by the PEP component.

13. The method according to claim 11 or 12, characterized in that, The access controller runs in a TEE in the artificial intelligence acceleration card, and the access controller receives the first operation request based on a client application trusted application (CA-TA) communication interface. Alternatively, the access controller runs in a REE in the artificial intelligence acceleration card.

14. The method of claim 10, wherein, The first operation request is subjected to encryption processing or obfuscation processing. The permission authentication information complies with the verification rule, including that the first operation request is successfully subjected to decryption processing or de-obfuscation processing, and the permission authentication information complies with the verification rule in the PEP component.

15. The method of claim 11, wherein, The artificial intelligence acceleration card comprises a PDP component running in a TEE, and the method further comprises: Before receiving the first operation request, the artificial intelligence acceleration card adds the token to a second operation request from a general-purpose processor by using the PDP component, to obtain the first operation request, the second operation request comprising the identity and the processing operation. The artificial intelligence acceleration card determines whether the permission authentication information complies with the verification rule in the PEP component, comprising: The artificial intelligence acceleration card utilizes a verification rule in the PEP component to perform permission authentication on the identity, the processing operation, and the token in the first operation request.

16. The method according to any one of claims 10 to 15, characterized in that, The first operation request is used to request the AI model to perform inference according to target data, the target data being input data of the AI model, and the artificial intelligence acceleration card comprises a content risk control model running in a TEE, the content risk control model being used to verify whether the target data meets an inference condition. The artificial intelligence acceleration card executes the first operation request, comprising: When the target data meets the inference condition, the artificial intelligence acceleration card executes the first operation request.

17. The method according to any one of claims 10 to 16, characterized in that, The artificial intelligence acceleration card comprises a deep learning processor (DPU), a data processor (DPU), a neural network processor (NPU), or a graphics processing unit (GPU).

18. An artificial intelligence accelerator card, comprising: comprise a processor and a memory; The artificial intelligence acceleration card is used to execute instructions stored in the memory, so that the artificial intelligence acceleration card performs the steps of the method according to any one of claims 10 to 17.

19. A computer-readable storage medium, characterized in that, comprise instructions that, when executed on a computing device, cause the computing device to perform the steps of the method according to any one of claims 10 to 17.

20. A computer program product comprising instructions, characterized in that, when executed on at least one computing device, cause the at least one computing device to perform the method according to any one of claims 10 to 17.

Images