Method and system for encrypting data using commands

Abstract

In an embodiment, a computer-implemented method of a DP accelerator performing an encryption or decryption operation includes receiving a command and input data by the DP accelerator to be encrypted or decrypted by the DP accelerator. The command is one of the following commands: encrypt input data or decrypt input data. The method also includes encrypting or decrypting the input data by the DP accelerator according to the command; and providing the encrypted or decrypted input data to the host device. The host device and the DP accelerator may exchange one or more keys, and the key may be used to establish a secure link between the host device and the DP accelerator and / or for encryption or decryption. The one or more keys may be based on a root key or a key pair of the DP accelerator and may be stored in a secure memory of a security unit of the DP accelerator.

Description

Technical Field

[0001] Embodiments of the present disclosure generally relate to artificial intelligence model training and inference. More specifically, embodiments of the present disclosure relate to artificial intelligence model training and inference performed by data processing accelerators and associated security. Background Art

[0002] Because artificial intelligence (AI) technology has been deployed in various fields such as image classification or autonomous driving, AI models (also called "machine learning models") have recently become widely used. Similar to an executable image or binary image of a software application, an AI model can perform inference based on a set of attributes to classify features when trained. Therefore, the AI ​​model can be "portable" and can be used without authorization. Currently, there is a lack of effective digital rights protection for AI models. In addition, using processing tasks of AI models that are delegated to secondary processing systems such as data processing (DP) accelerators or remote systems, there is a lack of evidence that the results produced by the DP accelerator system are protected by a "trust root" system. Summary of the invention

[0003] According to one aspect of the present application, a computer-implemented method of a data processing accelerator is disclosed, which may include: receiving, by the data processing accelerator, a command and input data from a host device, the command requesting the data processing accelerator to encrypt or decrypt the input data; encrypting or decrypting the input data by the data processing accelerator according to the command; and transmitting the encrypted or decrypted input data to the host device.

[0004] According to another aspect of the present application, a data processing accelerator is disclosed, which may include: an interface for receiving commands and input data from a host device, wherein the command requests the data processing accelerator to encrypt or decrypt the input data; and a security unit for encrypting or decrypting the input data according to the command, and transmitting the encrypted or decrypted input data to the host device.

[0005] According to another aspect of the present application, a non-transitory machine-readable medium having instructions stored therein is disclosed, wherein the instructions, when executed by a processor, cause the processor to perform operations of a data processing accelerator. The operations include: receiving a command and input data from a host device by the data processing accelerator, wherein the command requests the data processing accelerator to encrypt or decrypt the input data; encrypting or decrypting the input data by the data processing accelerator according to the command; and sending the encrypted or decrypted input data to the host device.

[0006] According to another aspect of the present application, a host device is disclosed, which may include: a processor; and a memory connected to the processor to store instructions, the instructions causing the processor to perform operations of the host device when executed by the processor, the operations causing a data processing accelerator to perform encryption or decryption operations. The operations may include: transmitting a command and input data to the data processing accelerator device to encrypt or decrypt the input data using one of one or more specified keys; and receiving the encrypted or decrypted input data from the data processing accelerator, wherein the data processing accelerator is configured to encrypt or decrypt the input data in response to the command. BRIEF DESCRIPTION OF THE DRAWINGS

[0007] Embodiments of the present disclosure are illustrated by way of example and not limitation in the figures of the accompanying drawings in which like references indicate similar elements.

[0008] Figure 1 is a block diagram illustrating a secure processing system according to one embodiment.

[0009] Figure 2A and Figure 2B is a block diagram illustrating a secure computing environment between one or more hosts and one or more data processing accelerators according to one embodiment.

[0010] Figure 3A and Figure 3B is a block diagram illustrating a method of ensuring that a data processing (DP) accelerator signs a watermark of an artificial intelligence (AI) model according to an embodiment.

[0011] Figure 4A and Figure 4B is a block diagram illustrating a method of securely encrypting or decrypting data using a DP accelerator having a cryptographic module according to an embodiment.

[0012] Figure 5A and Figure 5B is a block diagram illustrating a method of securely encrypting or decrypting data using a host-provided kernel and a DP accelerator according to an embodiment.

[0013] Fig. 6A and Figure 6B is a block diagram illustrating a method for securely digitally signing an AI watermark using implicit data according to an embodiment.

[0014] Figure 7 is a block diagram illustrating a method of securely digitally signing output using a host-provided kernel according to an embodiment.

[0015] Figure 8is a block diagram illustrating a method for securely digitally signing a watermark of an AI model using watermark-enabled and signature-enabled kernels provided by a host and an AI accelerator according to an embodiment.

[0016] Fig. 9 is a block diagram illustrating an exemplary computing system for implementing the functionality disclosed herein. DETAILED DESCRIPTION

[0017] Various embodiments and aspects of the present disclosure will be described with reference to the details discussed below, and the accompanying drawings will illustrate various embodiments. The following description and the accompanying drawings are illustrative of the present disclosure and should not be construed as limiting the present disclosure. Many specific details are described to provide a comprehensive understanding of various embodiments of the present disclosure. However, in some cases, well-known or conventional details are not described to provide a concise discussion of embodiments of the present disclosure.

[0018] References in this specification to "one embodiment" or "an embodiment" mean that a particular feature, structure, or characteristic described in conjunction with the embodiment can be included in at least one embodiment of the present disclosure. The appearances of the phrase "in one embodiment" in various places in this specification are not necessarily all referring to the same embodiment.

[0019] The following embodiments relate to using a data processing (DP) accelerator to increase the processing throughput of certain types of operations that can be offloaded (or delegated) from a host device to the DP accelerator. The DP accelerator may be a general purpose processing unit (GPU), an artificial intelligence (AI) accelerator, a math coprocessor, a digital signal processor (DSP), or other type of processor. The DP accelerator may be a proprietary design, such as AI accelerator or another GPU, etc. Although the embodiments are shown and described with respect to a host device securely coupled to one or more DP accelerators, the concepts described herein may be more generally implemented as a distributed processing system.

[0020] The host device and the DP accelerator may be interconnected via a high-speed bus, such as a peripheral component interconnect express (PCIe) or other high-speed bus. The host device and the DP accelerator may exchange keys and initiate a secure channel via the PCIe bus prior to performing operations of various aspects of the present invention described below. Some operations include the DP accelerator using an artificial intelligence (AI) model to perform inferences using data provided by the host device. Before the AI ​​model inferences are trusted by the host device, the host device may cause the DP accelerator to perform one or more validation tests, as described below, including determining a watermark of the AI ​​model. In some embodiments and operations, the DP accelerator is unaware that the host device is testing the validity of the results generated by the DP accelerator.

[0021] A watermark for an AI model is an identifier or indicator, or a combination thereof, embedded within an AI model or in the output of an AI model that identifies or indicates the source / maker of the AI ​​model. In some embodiments, a watermark may be a subset of coefficients or parameters, such as weights within an AI model, that when extracted from the AI ​​model include a watermark. Some purposes of watermarks include: identifying an AI model by its watermark; storing information such as digital rights within an AI model without affecting inferences generated by the model, and associating inferences generated by an AI model with the AI ​​model that generated the inferences using the watermark as an identifier. A watermark should not be easily discoverable outside of a secure computing environment.

[0022] In an embodiment, the host device may send input to the DP accelerator, and when the DP accelerator executes the AI ​​model using the input, the DP accelerator extracts the watermark from the AI ​​model. The host device may verify the watermark before using the DP accelerator and / or the AI ​​model for trusted operations. A watermark-enabled AI model is an AI model that is capable of extracting its own watermark in response to specified input data.

[0023] In some embodiments, the host device may transmit a kernel to the DP processing device for use in performing one or more operations. In this context, a kernel is a small piece of code provided to the DP accelerator for execution by the DP accelerator to perform the intended function of the kernel. In embodiments, the kernel is provided to the DP accelerator by the host device as part of a trust proof operation performed by the DP accelerator to be verified by the host device. In some embodiments, the DP accelerator is unaware of the purpose of the kernel it executes on behalf of the host device.

[0024] In some embodiments, the kernel may be a "watermark-enabled kernel". A watermark-enabled kernel is a kernel that, when executed, is capable of extracting watermarks from an artificial intelligence (AI) model. AI watermarks are associated with a particular AI model and can be embedded or "implanted" within the AI ​​model using several different methods. The watermark may be implanted into one or more weight variables of one or more nodes of the AI ​​model. In embodiments, the watermark is stored in one or more bias variables of one or more nodes of the AI ​​model, or by creating one or more additional nodes of the AI ​​model during training to store the watermark.

[0025] In some implementations, the kernel may be an "inherited watermark kernel". An inherited watermark kernel is a kernel that is able to inherit a watermark from a data object (e.g., an existing AI model or other data object). The kernel may then implant the inherited watermark into another AI model or inferences generated by an AI model.

[0026] In some embodiments, the kernel may be a "signing kernel" that may digitally sign any input it receives. The signing kernel may generate a hash or digest of the input data to be signed, and may embed the hash or digest into the input to be signed before signing the input. The hash or digest may be any hash algorithm, such as SHA-1, SHA-2, or SHA-3, among others. The input data with the hash or digest may be encrypted (signed) using a private key of a data processing (DP) accelerator, a symmetric key shared with a host device, or a key received from a host device.

[0027] In some embodiments, a watermark-enabled AI model is an AI model with a watermark embedded within the AI ​​model. In some embodiments, the host device may provide a watermark-enabled kernel to the DP accelerator so that the DP accelerator may, for example, use the AI ​​model to perform inferences, and then use the watermark-enabled kernel to extract the watermark from the AI ​​model, embed the watermark into the inference, and digitally sign the inference. Such embodiments allow the host device to verify that the DP accelerator is indeed using the correct AI model to perform inferences, indicating that the inferences may be trusted.

[0028] With respect to any of the following aspects, in one embodiment, a watermark may be embedded in one or more nodes of one or more layers of an artificial intelligence (AI) model. For example, a watermark may be embedded in one or more weight variables or bias variables. Alternatively, one or more nodes (e.g., pseudo nodes that are not used or unlikely to be used by the artificial intelligence model) may be created to implant or store watermarks. The host processor may be a central processing unit (CPU), and the DP accelerator may be a general processing unit (GPU) connected to the CPU via a bus or interconnect. The DP accelerator may be implemented in the form of an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) device, or other form of integrated circuit (IC). Alternatively, the host processor may be part of a main data processing system, and the DP accelerator may be one of many distributed systems (e.g., a cloud computing system such as software as a service or SaaS system, or a platform as a service or PaaS system) as an auxiliary system to which the main system can remotely offload its data processing tasks over a network. The link between the host processor and the DP accelerator may be a peripheral component interconnect express (PCIe) link or a network connection such as an Ethernet connection.

[0029] In a first aspect, a computer-implemented method of a data processing (DP) accelerator for obtaining a watermark of a watermark-enabled artificial intelligence (AI) model includes: receiving, by the DP accelerator, data input to the DP accelerator that causes the watermark-enabled AI model to extract a watermark from the watermark-enabled AI model; providing the watermark of the watermark-enabled AI model to a host device. The DP accelerator may receive the model from the host device. The DP accelerator may also receive a command to digitally sign the watermark, and invoke a security unit of the DP accelerator to digitally sign the watermark.

[0030] In a second aspect, a computer-implemented method of a DP accelerator performing an encryption or decryption operation includes receiving, by the DP accelerator, a command and input data for encryption or decryption of the DP accelerator. The command is one of the following commands: encrypt input data or decrypt input data. The method also includes encrypting or decrypting the input data according to the command by the DP accelerator; and providing the encrypted or decrypted input data to a host device. The host device and the DP accelerator may exchange one or more keys, and such keys may be used to establish a secure link between the host device and the DP accelerator and / or for encryption or decryption. The one or more keys may be based on a root key or a key pair of the DP accelerator and may be stored in a secure memory of a security unit of the DP accelerator.

[0031] In a third aspect, a computer-implemented method for encrypting or decrypting input data by a data processing (DP) accelerator may include receiving a command, input data, and a kernel from a host device. The kernel may be an encryption kernel or a decryption kernel, and the DP accelerator does not need to know which kernel it has received. The DP accelerator runs the received kernel. In response to the DP accelerator receiving the command, if the received kernel is an encryption kernel, the DP accelerator uses the kernel to perform encryption of the input data, otherwise it uses the kernel to decrypt the input data. The encrypted or decrypted input data is then provided to the host device. The host device and the DP accelerator may exchange one or more keys, and such keys may be used to establish a secure link between the host device and the DP accelerator and / or for encryption or decryption. The one or more keys may be based on a root key or a key pair of the DP accelerator and may be stored in a secure memory of a security unit of the DP accelerator.

[0032] In a fourth aspect, a computer-implemented method of a data processing (DP) accelerator for obtaining a watermark of an artificial intelligence (AI) model includes: receiving an AI model to be executed on a DP accelerator from a host device; and receiving input data triggering an output of the AI ​​model on the DP accelerator. The DP accelerator calculates the AI ​​model output in response to the received input and provides the output to the host device. The output may be a watermark extracted from the AI ​​model. The DP accelerator may call a security unit of the DP accelerator to digitally sign the output. In an embodiment, the security unit digitally signs the output from the AI ​​model using a key retrieved from a key stored in a secure memory on the security unit or a key derived from a key in a secure memory on the security unit.

[0033] In a fifth aspect, a computer-implemented method for digitally signing an input through a data processing (DP) accelerator operation and embedding the digitally signed input into an output includes receiving a signature kernel of an input specified to the signature kernel from a host device, and executing the signature kernel to: extract a watermark from the input and obtain a hash of the watermark; generate an output from the input; and embed the hash into the output. The DP accelerator provides an output to the host device. In an embodiment, the input includes an artificial intelligence (AI) model executed by the DP accelerator. The DP accelerator receives a second input from the host device to generate an inferred output from the AI ​​model. The digital signature watermark of the AI ​​model is embedded in the inferred output and provided to the host device.

[0034] In a sixth aspect, a computer-implemented method of a data processing (DP) accelerator for providing a watermark of an artificial intelligence (AI) model to a host device includes: receiving, by the DP accelerator, the AI ​​model from the host device, and receiving a watermark-enabled kernel to the DP accelerator. The DP accelerator also receives first input data from the host device to the DP accelerator, and when the first input data is used as an input to the watermark-enabled kernel, the DP accelerator generates a watermark of the AI ​​model. The watermark is provided to the host device. In an embodiment, the method further includes receiving a signature kernel from the host device and calling the signature kernel to digitally sign the watermark. In an embodiment, the method alternatively includes calling a digital signature routine in a security unit of the DP accelerator to digitally sign the watermark.

[0035] Any of the above functions may be programmed as executable instructions onto one or more non-transitory computer-readable media. When the executable instructions are executed by a processing system having at least one hardware processor, the processing system causes the function to be implemented. Any of the above functions may be implemented by a processing system having at least one hardware processor, the hardware processor being coupled to a memory programmed with executable instructions, the executable instructions causing the processing system to implement the function when executed.

[0036] Figure 1 is a block diagram illustrating an example of a system configuration for securing communications between a host 104 and data processing (DP) accelerators 105-107 according to some embodiments. Figure 1 , the system configuration 100 includes, but is not limited to, one or more client devices 101-102 communicatively coupled to a DP server 104 (e.g., a host) via a network 103. The client devices 101-102 may be any type of client device, such as a personal computer (e.g., a desktop computer, a laptop computer, and a tablet computer), a "thin" client, a personal digital assistant (PDA), a web-enabled device, a smart watch, or a mobile phone (e.g., a smartphone), etc. Alternatively, the client devices 101-102 may be other servers. The network 103 may be any type of network, such as a wired or wireless local area network (LAN), a wide area network (WAN) such as the Internet, or a combination thereof.

[0037] The server (e.g., host) 104 can be any type of server or server cluster, such as a web or cloud server, an application server, a backend server, or a combination thereof. The server 104 also includes an interface (not shown) to allow clients such as client devices 101-102 to access resources or services provided by the server 104 (such as resources and services provided by the DP accelerator via the server 104). For example, the server 104 can be a cloud server or a server in a data center that provides various cloud services to clients, such as cloud storage, cloud computing services, artificial intelligence training services, data mining services, etc. The server 104 can be configured as part of a software as a service (SaaS) or platform as a service (PaaS) system on a cloud, which can be a private cloud, a public cloud, or a hybrid cloud. The interface can include a web interface, an application programming interface (API), and / or a command line interface (CLI).

[0038] For example, the client, in this example, the user application of the client device 101 (e.g., a web browser, application) can send or transmit instructions for execution (e.g., AI training, reasoning instructions, etc.) to the server 104 via the network 103 via an interface, and the server 104 receives the instruction. In response to the instruction, the server 104 communicates with the DP accelerators 105-107 to implement the execution of the instruction. In some embodiments, the instruction is a machine learning type instruction, where the DP accelerator as a dedicated machine or processor can execute the instruction many times faster than the server 104. Therefore, the server 104 can control / manage the execution jobs of one or more DP accelerators in a distributed manner. The server 104 then returns the execution results to the client devices 101-102. The DP accelerator or AI accelerator may include one or more dedicated processors, such as those available from Baidu Inc. (Baidu, Inc. ) An artificial intelligence (AI) chipset, or alternatively, the DP accelerator may be an AI chipset from another AI chipset provider.

[0039] According to one embodiment, each of the applications accessing any of the DP accelerators 105-107 hosted by the data processing server 104 (also referred to as the host) can verify that the application is provided by a trusted source or vendor. Each application can be launched and executed within a trusted execution environment (TEE) that is specifically configured and executed by the central processing unit (CPU) of the host 104. When the application is configured to access any of the DP accelerators 105-107, an obfuscated connection can be established between the host 104 and the corresponding one of the DP accelerators 105-107, thereby protecting the data exchanged between the host 104 and the DP accelerator 105-107 from malware / intrusion attacks.

[0040] Figure 2A 2 is a block diagram illustrating an example of a multi-layered protection solution for obfuscated communications between a host system 104 and data processing (DP) accelerators 105-107 according to some embodiments. In one embodiment, the system 200 provides a protection solution for obfuscated communications between a host system 104 and a DP accelerator 105-107 with or without hardware modifications to the DP accelerator. Figure 2A , the host machine or server 104 can be described as a system with one or more layers to be protected from intrusion, such as user applications 205, runtime libraries 206, drivers 209, operating system 211, and hardware 213 (e.g., security module (Trusted Platform Module (TPM)) / central processing unit (CPU)). Memory security application 207 can run in sandboxed memory. Under the application 205 and runtime library 206, one or more drivers 209 can be installed to interface to hardware 213 and / or DP accelerators 105-107.

[0041] The hardware 213 may include one or more processors 201 and a storage device 204. The storage device 204 may include one or more artificial intelligence (AI) models 202 and one or more kernels 203. The kernel 203 may include a signature kernel, a watermark-enabled kernel, an encryption and / or decryption kernel, etc. The signature kernel may digitally sign any input according to the programming of the kernel when executed. The watermark-enabled kernel may extract a watermark from a data object (e.g., an AI model or other data object). The watermark-enabled kernel may also implant a watermark into an AI model, an inference output, or other data object. A watermark kernel (e.g., a watermark-inherited kernel) may inherit a watermark from another data object and implant the watermark into a different object, such as an inference output or an AI model. As used in this application, a watermark is an identifier associated with an AI model or an inference generated by an AI model, and may be implanted into an AI model or an inference generated by an AI model. For example, a watermark may be implanted into one or more weight variables or bias variables. Alternatively, one or more nodes (e.g., pseudo nodes that are not used or are unlikely to be used by an artificial intelligence model) may be created to implant or store a watermark.

[0042] The host machine 104 is typically a CPU system that can control and manage the execution of jobs on the host machine 104 and / or the DP accelerators 105-107. In order to protect / mask the communication channel 215 between the DP accelerators 105-107 and the host machine 104, different components may be required to protect different layers in the host system that are susceptible to data intrusion or attack. For example, a trusted execution environment (TEE) can protect the user application 205 layer and the runtime library 206 layer from data intrusion.

[0043] According to some embodiments, system 200 includes host system 104 and DP accelerators 105-107. DP accelerators may include AI chipset or another AI chipset, such as a graphics processing unit (GPU) that can perform artificial intelligence (AI) intensive computing tasks. In one embodiment, the host system 104 includes hardware having one or more CPUs 213, and the CPU 213 is equipped with a security module (e.g., a trusted platform module (TPM)) within the host machine 104. TPM is a dedicated chip on an endpoint device that stores encryption keys (e.g., RSA encryption keys) dedicated to hardware authentication for the host system. Each TPM chip can contain one or more RSA key pairs (e.g., public and private key pairs), called endorsement keys (endorsement keys, EK) or endorsement credentials (endorsement credentials, EC), i.e., root keys. The key pair is kept inside the TPM chip and cannot be accessed by software. Then, before executing the key parts of the firmware and software, the key parts of the firmware and software can be hashed by EK or EC to protect the system from unauthorized firmware and software modifications. Therefore, the TPM chip on the host machine can be used as a trust root for secure boot.

[0044] The TPM chip also protects the driver 209 and the operating system (OS) 211 in the working kernel space to communicate with the DP accelerator 105-107. Herein, the driver 209 is provided by the DP accelerator vendor and can be used as a driver for the user application to control the communication channel 215 between the host and the DP accelerator. Because the TPM chip and the secure boot processor protect the OS 211 and the driver 209 in their kernel space, the TPM also effectively protects the driver 209 and the OS 211.

[0045] Since the communication channel 215 for the DP accelerators 105-107 can be exclusively occupied by the OS 211 and the driver 209, the communication channel 215 can be protected by a TPM chip. In one embodiment, the communication channel 215 includes a peripheral component interconnect or a peripheral component interconnect express (PCIE) channel. In one embodiment, the communication channel 215 is an obfuscated communication channel.

[0046] The host machine 104 may include a trusted execution environment (TEE) 210 that is enforced by a TPM / CPU 213 to ensure security. A TEE is a secure environment. A TEE can ensure that the code and data loaded into the TEE are protected in terms of confidentiality and integrity. Examples of a TEE may be Software Guard Extensions (SGX) or Secure Encrypted Virtualization (SEV). SGX and / or SEV may include a set of central processing unit (CPU) instruction codes that allow user-level code to allocate a dedicated area of ​​the CPU's memory that is protected from processes running at a higher privilege level. In the present application, TEE210 can protect user applications 205 and runtime libraries 206, where user applications 205 and runtime libraries 206 can be provided by end users and DP accelerator vendors, respectively. In the present application, runtime library 206 can convert application programming interface (API) calls into commands for execution, configuration and / or control of the DP accelerator. In one embodiment, runtime library 206 provides a predetermined set of (e.g., predefined) kernels executed by user applications. In an embodiment, the kernel can be stored in storage device 204 as kernel 203.

[0047] The host machine 104 may include a memory-safe application 207 implemented in a memory-safe language such as Rust and GoLang. Versions (such as MesaLock ) can further protect the system 200 from data confidentiality and integrity attacks. However, the operating system can be any distributed, OS or OS.

[0048] The host machine 104 may be configured as follows: The distributed installation is performed on a system equipped with a TPM secure boot. The installation can be performed offline during the manufacturing or preparation phase. The installation can also ensure that the user space applications of the host system are programmed using a memory-safe programming language. Ensuring that other applications running on the host system 104 are memory-safe applications can further mitigate potential confidentiality and integrity attacks on the host system 104.

[0049] After installation, the system can then be started through a TPM-based secure boot. TPM secure boot ensures that only signed / certified operating systems and accelerator drivers are started in the kernel space that provides accelerator services. In one embodiment, the operating 211 system can be loaded through a hypervisor (not shown). A hypervisor or virtual machine manager is computer software, firmware, or hardware that creates and runs virtual machines. Kernel space is a declarative area or range in which a kernel (i.e., a predetermined set of (e.g., predefined) functions for execution) is identified to provide functions and services to user applications. In the event that the integrity of the system is compromised, TPM secure boot may not be initiated, but instead the system is shut down.

[0050] After the secure boot, the runtime library 206 runs and creates the TEE 210, which places the runtime library 206 in the trusted memory space associated with the CPU 213. Next, the user application 205 is started in the TEE 210. In one embodiment, the user application 205 and the runtime library 206 are statically linked and started together. In another embodiment, the runtime library 206 is first started in the TEE 210, and then the user application 205 is dynamically loaded into the TEE 210. In another embodiment, the user application 205 is first started in the TEE 210, and then the runtime library 206 is dynamically loaded in the TEE 210. Statically linked libraries are libraries that are linked to the application at compile time. Dynamic loading can be performed by a dynamic linker. The dynamic linker loads and links shared libraries so that the user application runs in the runtime library. Here, the user application 205 and the runtime library 206 in the TEE 210 are visible to each other at runtime, for example, all processing data are visible to each other. However, external access to the TEE is denied.

[0051] In one embodiment, the user application 205 can only call the kernel from the kernel set predetermined by the runtime library 206. In another embodiment, the user application 205 and the runtime library 206 are reinforced with a side-channel-free algorithm to defend against side-channel attacks, such as cache-based side-channel attacks. A side-channel attack is any attack based on information obtained from the implementation of a computer system, rather than weaknesses in the implemented algorithm itself (e.g., cryptanalysis and software defects). Examples of side-channel attacks include cache attacks, which are attacks based on the ability of an attacker to monitor the cache of a shared physical system in a virtualized environment or a cloud environment. Reinforcement can include masking of caches, outputs generated by the algorithm and placed on the cache. Next, when the user application completes execution, the user application terminates its execution and exits from the TEE.

[0052] In one embodiment, the TEE 210 and / or the memory security application 207 are not required, for example, the user application 205 and / or the runtime library 206 are hosted in the operating system environment of the host 104.

[0053] In one embodiment, the kernel set includes a fuzzy kernel algorithm. In one embodiment, the fuzzy kernel algorithm can be a symmetric or asymmetric algorithm. A symmetric fuzzy algorithm can use the same algorithm to blur and deblur data communications. An asymmetric fuzzy algorithm requires a pair of algorithms, where the first of the pair is used for blurring and the second of the pair is used for deblurring, or vice versa. In another embodiment, the asymmetric fuzzy algorithm includes a single fuzzy algorithm for blurring a data set, but is not intended to deblur the data set, e.g., there is no corresponding deblurring algorithm.

[0054] Obfuscation refers to obscuring the intended meaning of a communication by making the communication message difficult to understand, usually using confusing and ambiguous language. Obfuscated data is more difficult and complicated to reverse engineer. Obfuscation algorithms can be applied to obfuscate (encrypt / decrypt) data communications before transmitting the data, thereby reducing the chance of eavesdropping. In one embodiment, the obfuscation algorithm may also include an encryption scheme to further encrypt the obfuscated data for an additional layer of protection. Unlike encryption, which is computationally intensive, obfuscation algorithms can simplify computations.

[0055] Some obfuscation techniques may include, but are not limited to, letter obfuscation, name obfuscation, data obfuscation, control flow obfuscation, etc. Letter obfuscation is the process of replacing one or more letters in the data with specific replacement letters, thereby making the data meaningless. Examples of letter obfuscation include letter rotation functions, where each letter is shifted or rotated a predetermined number of positions along the alphabet. Another example is reordering or shuffling letters based on a specific pattern. Name obfuscation is the process of replacing a specific target string with a meaningless string. Control flow obfuscation can use additive code to change the order of control flow in a program with additive code (insert zombie code, insert uncontrolled jumps, insert alternative structures) to hide the true control flow of the algorithm / AI model.

[0056] In summary, system 200 provides multiple layers of protection for DP accelerators (for data transmission including machine learning models, training data, and inference outputs) to avoid loss of data confidentiality and integrity. System 200 may include a TPM-based secure boot protection layer, a TEE protection layer, and a kernel verification / validation layer. In addition, system 200 may provide a memory-safe user space by ensuring that other applications on the host machine are implemented in a memory-safe programming language, which may further eliminate attacks by eliminating potential memory corruption / vulnerabilities. In addition, system 200 may include applications that use side-channel-free algorithms to defend against side-channel attacks (e.g., cache-based side-channel attacks).

[0057] The runtime library 206 may provide a fuzzy kernel algorithm to fuzzify data communications between the host 104 and the DP accelerators 105-107. In one embodiment, the fuzzification may be paired with a cryptographic scheme. In another embodiment, the fuzzification is a separate protection scheme and cryptographic-based hardware becomes unnecessary for the DP accelerator.

[0058] Figure 2B is a block diagram illustrating an example of a host channel manager (HCM) 259 communicatively coupled to one or more accelerator channel managers (ACMs) 270 that interface with DP accelerators 105-107 according to some embodiments. Figure 2BIn one embodiment, the HCM 259 includes an authentication module 251, a termination module 252, a key manager 253, a key storage 254, and a cryptographic engine 255. The authentication module 251 can authenticate a user application running on the host server 104 to allow access to or use of resources of the DP accelerator 105.

[0059] The termination module 252 may terminate the connection (e.g., terminate the channel associated with the connection). The key manager 253 may manage (e.g., create or destroy) asymmetric key pairs or symmetric keys to encrypt / decrypt one or more data packets for different secure data exchange channels. Figure 2A A user application 205 (part of) can correspond to or be mapped to different secure data exchange channels in a one-to-many relationship, and each data exchange channel can correspond to a DP accelerator 105. Each application can utilize multiple session keys, where each session key is used for a secure channel corresponding to a DP accelerator (e.g., accelerators 105..107). The key storage 254 can store encrypted asymmetric key pairs or symmetric keys. The cryptographic engine 255 can encrypt or decrypt data packets for data exchanged over any secure channel. It should be noted that some of these modules can be integrated into fewer modules.

[0060] In one embodiment, the DP accelerator 105 includes an ACM 270 and a security unit (SU) 275. The security unit 275 may include a key manager 271, a key storage 272, a true random number generator 273, and a cryptographic engine 274. The key manager 271 may manage (e.g., generate, securely maintain, and / or destroy) asymmetric key pairs or symmetric keys. The key storage 272 may store cryptographic asymmetric key pairs or symmetric keys in a secure memory within the security unit 275. The true random number generator 273 may generate seeds for key generation and use by the cryptographic engine 274. The cryptographic engine 274 may encrypt or decrypt key information or data packets for data exchange. In some embodiments, the ACM 270 and the SU 275 are integrated modules.

[0061] The DP accelerator 105 may also include a memory / storage 280 that may store an artificial intelligence model 277, a watermark kernel 278 (including a genetic watermark kernel, a watermark enablement kernel, a watermark signature kernel, etc.), an encryption and decryption kernel 281, and data 279. The HCM 259 may communicate with the ACM 270 via the communication channel 215.

[0062] In one embodiment, the DP accelerator 105 also includes an AI unit, which may include an AI training unit and an AI inference unit. The AI ​​training and inference units may be integrated into a single unit. The AI ​​training module is configured to train an AI model using a training data set. The AI ​​model and training data to be trained may be received from the host system 104 via the communication link 215. The AI ​​model inference unit may be configured to execute a trained artificial intelligence model on a set of input data (e.g., a set of input features) to infer and classify the input data. For example, an image may be input into the artificial intelligence model to classify whether the image contains a person, a landscape, etc. The trained artificial intelligence model and input data may also be received from the host system 104 via the communication link 215 via the interface 140.

[0063] In one embodiment, the watermark unit 276 may include a watermark generator and a watermark recorder (also referred to as a "watermark implanter"). The watermark unit 276 may include a watermark kernel executor or kernel processor (not shown) to execute the kernel. In an embodiment, the kernel may be received from the host 104, or retrieved from a permanent or non-permanent memory, and executed in a memory (not shown) of the DP accelerator 105. The watermark generator is configured to generate a watermark using a predetermined watermark algorithm. Alternatively, the watermark generator may inherit a watermark from an existing watermark, or extract a watermark from another data structure or data object, such as an artificial intelligence model or a set of input data received from the host system 104. The watermark implanter is configured to burn or implant a watermark into a data structure such as an artificial intelligence model or output data generated by the artificial intelligence model. The artificial intelligence model or output data in which the watermark is implanted may be returned from the DP accelerator 105 to the host system 104 via the communication link 215. It should be noted that the DP accelerators 105 - 107 have the same or similar structures or components, and the description regarding the DP accelerator will apply to all DP accelerators throughout the present application.

[0064] Figure 3A and 3B is a block diagram illustrating a method 300 for signing a watermark of an artificial intelligence (AI) model using a query according to an embodiment. The purpose of the method 300 is to provide a general watermark signing method to prove that the AI ​​model is indeed used by the DP accelerator 105. In preparation for the method 300, the host device 104 and the DP accelerator 105 may exchange one or more specified keys and establish a secure communication link 215. The one or more exchanged keys may also be used to digitally sign a watermark extracted from the AI ​​model. In an embodiment, the communication between the host device 104 and the DP accelerator 105 uses encryption and decryption to maintain secure communication over the communication link 215. Embodiments of the method 300 may use a method such as The DP accelerator 105 is an AI accelerator or other data processing (DP) accelerator or an accelerator such as a graphics processing unit (GPU).

[0065] Reference now Figure 3A , a method 300 for generating an effective watermark from an AI model is described according to one embodiment. In operation 305, an application on the host device 104 sends a watermark-enabled AI model to the DP accelerator 105. In operation 350, the DP accelerator 105 receives the watermark-enabled AI model and loads the watermark-enabled AI model for execution.

[0066] In operation 310, an application on the host device 104 sends input data, which may be in the form of a query, to the DP accelerator 105. In operation 355, the DP accelerator receives the input data from the host device 104, and in operation 360, the DP accelerator runs an AI model using the input data to extract a watermark from the watermark-enabled AI model.

[0067] In operation 325, the host device 104 may retrieve the watermark from the DP accelerator 105, which has been made available to the host device 104 in operation 375. Before making further calls to the DP accelerator 105 to perform operations according to method 300, the host device 104 may optionally verify the received watermark. In operation 325, the host device 104 may perform one or more verification operations on the watermark to ensure that the watermark extracted from the watermark-enabled AI model is valid. The host device 104 may compare the watermark obtained from the DP accelerator 105 with a pre-existing watermark to determine whether the watermark received from the DP accelerator 105 is valid.

[0068] Alternatively, in an embodiment, the host device 104 may verify the watermark by running the watermark-enabled AI model with the input data to obtain the watermark and comparing the obtained watermark with the watermark received from the DP accelerator 105. If the two watermarks match, the DP accelerator 105 generates the watermark using the watermark-enabled AI model, and the watermark is determined to be valid. If the watermark is valid, the application on the host device 104 may make one or more additional calls to the DP accelerator 105 using the watermark-enabled AI model to perform one or more inferences using the watermark-enabled AI model. In operation 330, the host 104 may make one or more calls to the DP accelerator to perform the operations of method 300.

[0069] Reference now Figure 3B , Figure 3B A method 300 of extracting and digitally signing a watermark from an artificial intelligence (AI) model is described.

[0070] In operation 305, the application on the host device 104 sends the watermark-enabled AI model to the DP accelerator 105. In operation 350, the DP accelerator 105 receives the watermark-enabled AI model and loads the watermark-enabled AI model for execution.

[0071] In operation 310, the host device 104 sends input data, which may be in the form of a query, to the DP accelerator 105. In operation 355, the DP accelerator receives the input data from the host device 104, and in operation 360, the DP accelerator runs the watermark-enabled AI model using the input data to extract a watermark of the watermark-enabled AI model.

[0072] In operation 370, the DP accelerator 105 invokes the security unit 275 to digitally sign the watermark. In an embodiment, the watermark may be digitally signed with a private key or a symmetric key of the DP accelerator. As described above, the private key or the symmetric key of the DP accelerator may be one of the one or more keys exchanged with the host device 104 and the DP accelerator 105. In an embodiment, digitally signing the watermark by the security unit 275 of the DP accelerator 105 includes calculating a hash or digest of the watermark, and causing the hash or digest to include the digitally signed watermark.

[0073] In operation 325, the host device 104 may retrieve the digitally signed watermark from the DP accelerator 105, which the host device 104 has made available to the host device 104 in operation 375. The host device 104 may optionally verify the received watermark before making further calls to the DP accelerator 105 to perform operations according to method 300. The host device 104 may perform one or more verification operations on the digitally signed watermark. The host device 104 may compare the watermark obtained from the DP accelerator 105 with a pre-existing watermark to determine whether the watermark received from the DP accelerator 105 is valid.

[0074] Alternatively, in an embodiment, the host 104 may decrypt the digital signature on the watermark using a public key or a symmetric key of the DP accelerator 105. After decrypting the digital signature, the host device 104 may verify the unsigned watermark by running the watermark-enabled AI model with the input data to extract the watermark and comparing the extracted watermark with the watermark received from the DP accelerator 105. If the two watermarks match, the DP accelerator 105 generates the watermark using the watermark-enabled AI model and determines that the digital signature is valid. In operation 330, the application on the host device 104 may make one or more additional calls to the DP accelerator 105 that utilizes the watermark-enabled AI model.

[0075] Figure 4A and 4B4 is a block diagram illustrating a method 400 for securely encrypting or decrypting data using a data processing (DP) accelerator according to some embodiments. In preparation for the method 400, the host device 104 and the DP accelerator 105 may exchange one or more designated keys and establish a secure communication channel 215 for communication. According to embodiments of the method 400, an accelerator (e.g., An artificial intelligence (AI) accelerator or other AI accelerator) or a graphics processing unit (GPU) is used as the DP accelerator 105.

[0076] Reference now Figure 4A In operations 405 and 450, the host device 104 and the DP accelerator 105 may exchange one or more designated keys. The designated keys may include one or more symmetric keys and / or one or more asymmetric key pairs. Symmetric keys may be used for a secure communication session between the host device 104 and the DP accelerator 105 via the communication channel 215. Asymmetric keys may be used for encrypting and decrypting data and digital signatures. In an embodiment, sharing the designated keys includes the host device 104 and the DP accelerator 105 sharing a public key of the host device 104, and the DP accelerator 105 and the host device 104 sharing a public key of the DP accelerator.

[0077] In operation 410, the application on the host device 104 sends commands and data to the DP accelerator 105 to encrypt or decrypt using one of the specified keys. In operation 455, the DP accelerator 105 receives the commands (encrypted or decrypted) and data to be encrypted or decrypted by the DP accelerator 105 using the specified key.

[0078] In operation 475, the cryptographic engine 274 of the DP accelerator security unit 275 encrypts or decrypts data received from the host device 104 according to a command received from the host device 104. The DP accelerator 105 makes the encrypted or decrypted data available to the host device 104. In operation 420, the host device 104 may retrieve the encrypted or decrypted data from the DP accelerator 105.

[0079] In operation 425, the application on the host device 104 may optionally verify the received encrypted or decrypted data. If the command is "encrypt", the host device 104 may use the public key of the DP accelerator 105 to decrypt the received encrypted data. The host device may then compare the decrypted data with the plaintext input data sent to the DP accelerator for encryption. If the comparison is a match, the encryption operation is verified. If the command is "decrypt", the host device 104 may compare the plaintext of the encrypted data of the input data sent to the DP accelerator 105 with the decrypted data received from the DP accelerator.

[0080] Alternatively, in an embodiment, host device 104 may decrypt plaintext data that host device 104 previously sent to DP accelerator 105 for decryption. Host device 104 may compare the result of the plaintext input of the encrypted data sent to the DP accelerator, or the result of the host decrypting the encrypted data, with the decrypted data returned to host device 104 by DP accelerator 105. If the comparison is a match, the decryption operation is verified.

[0081] In operation 430, host device 104 may request one or more additional encryption or decryption operations from DP accelerator 150. In an embodiment, if the encryption or decryption operation is not verified, host device 104 may choose not to make additional encryption or decryption calls to DP accelerator 105. Method 400 ends.

[0082] Reference now Figure 4B In operation 410 , the application on the host device 104 sends a command and data to the DP accelerator 105 to encrypt the data. In operation 455 , the DP accelerator 105 receives the encrypted command and data to be encrypted by the DP accelerator 105 .

[0083] In operation 465, the DP accelerator 105 generates a new symmetric key or asymmetric key pair using the security unit 275. The DP accelerator 105 transmits the key (eg, the public key of the newly generated asymmetric key pair) to the host device 104. In operation 415, the host device 104 receives the key from the DP accelerator 105.

[0084] In operation 475, the cryptographic engine 274 of the DP accelerator security unit 275 encrypts the data received from the host device 104 according to the command received from the host device 104. The DP accelerator 105 may encrypt the data using, for example, the private key of the asymmetric key pair generated in operation 465 above. The DP accelerator 105 makes the encrypted data available to the host device 104. In operation 420, the host device 104 may retrieve the encrypted data from the DP accelerator 105.

[0085] In operation 425, the application on the host device 104 may optionally verify the received encrypted data. The host device 104 may decrypt the received encrypted data using the public key of the DP accelerator 105. The host device 104 may then compare the decrypted data with the plaintext input data sent to the DP accelerator for encryption. If the comparison is a match, the encryption operation is verified.

[0086] In operation 430, the host device 104 may request one or more cryptographic operations from the DP accelerator 105. In an embodiment, if the cryptographic operations are not verified, the host device 104 may choose not to make additional cryptographic calls to the DP accelerator 105. The method 400 ends.

[0087] Figure 5A and 5B 1 is a block diagram illustrating a method 500 for encrypting or decrypting data using an encryption kernel or a decryption kernel provided by a host and a DP accelerator 105 according to an embodiment. The DP accelerator may be Artificial intelligence (AI) processors, graphics processing units (GPUs), multi-core processors, DSP processors or other DP accelerators.

[0088] Reference now Figure 5A In operations 505 and 550, the host device 104 and the DP accelerator 105 may exchange one or more designated keys. The designated keys may include one or more symmetric keys and / or one or more asymmetric keys. The symmetric keys may be used for a communication session between the host device 104 and the DP accelerator 105 on the communication channel 215. The asymmetric keys may be used to encrypt and decrypt data and digital signatures. In an embodiment, sharing the designated keys includes the host device 104 and the DP accelerator 105 sharing a public key of the host device 104, and the DP accelerator 105 sharing a public key of the DP accelerator with the host device 104.

[0089] In operation 512, the application on the host device 104 may transmit an encryption kernel or a decryption kernel, a command to execute the kernel, and input data to be encrypted or decrypted to the DP accelerator. In operation 557, the DP accelerator 105 receives the encryption kernel or the decryption kernel, the input data, and a command to execute the kernel using the input data from the host device 104.

[0090] In operation 565, the DP accelerator 105 runs the received kernel in response to the command and uses the command to encrypt or decrypt (depending on which kernel the DP accelerator 105 receives) the input data using the specified key.

[0091] In operation 570, the DP accelerator 105 may provide the host device 104 with the result output of running the encryption kernel or the decryption kernel using the command and the input data. In operation 522, the host device 104 may retrieve the result data from the DP accelerator 105, and optionally, verify the retrieved result data. If the kernel transmitted to the DP accelerator is an encryption kernel, the host device 104 may decrypt the result data received from the DP accelerator 105 using a specified key or a key corresponding to a specified key in a key pair. The host device 104 may compare the decrypted result data with the plaintext of the input data sent to the DP accelerator 105 for encryption.

[0092] If the decrypted result data received from the DP accelerator matches the plaintext input data transmitted by the host device 104 to the DP accelerator 105 in operation 512, the encryption operation of the DP accelerator is valid. If the kernel received by the DP accelerator is a decryption kernel, the host device 104 may decrypt the input data transmitted by the host device 104 to the DP accelerator 150 in operation 512. The host device 104 may compare the decrypted input data with the result data received from the DP accelerator 105. If the result data received from the DP accelerator 105 matches the input data decrypted by the host device 104, the decryption operation is valid.

[0093] In operation 530, the host device 104 may make one or more additional calls for encryption / decryption operations using the encryption or decryption kernel on the DP accelerator 105. In an embodiment, if the encryption or decryption operation is not verified, the host 104 may choose not to make future calls to the DP accelerator 105 for encryption or decryption operations using method 500.

[0094] Reference now Figure 5B In operation 507, the application on the host device 104 transmits input data to be encrypted or decrypted to the DP accelerator 105. In operation 551, the DP accelerator 105 receives the input data from the host device 104. In operation 510, the application on the host device 104 may transmit an encryption kernel or a decryption kernel, a command to execute the kernel, and a key to be used by the DP accelerator 105 for encryption or decryption to the DP accelerator 105. In operation 555, the DP accelerator 105 receives the encryption kernel or the decryption kernel, the command to execute the kernel, and the key to encrypt or decrypt the input data from the host device 104.

[0095] In operation 565, the DP accelerator 105 runs the received encryption kernel or decryption kernel in response to the command, and uses the command to encrypt or decrypt input data using the key received from the host 104 (depending on the kernel received by the DP accelerator 105).

[0096] In operation 570, the DP accelerator 105 may provide the host device 104 with the result output of running the encryption kernel or the decryption kernel using the command, the received key, and the input data. In operation 522, the host device 104 may retrieve the result data from the DP accelerator 105, and optionally, verify the retrieved result data. If the kernel transmitted to the DP accelerator 105 is an encryption kernel, the host device 104 may decrypt the result data received from the DP accelerator 105 using a key corresponding to the key transmitted to the DP accelerator in operation 510 described above.

[0097] In an embodiment, the key used by the host device 104 to decrypt the result data received from the DP accelerator 105 is a private key corresponding to the public key transmitted to the DP accelerator 105. The host device 104 may compare the decrypted result data with the plaintext input data sent to the DP accelerator 105 for encryption. If the decrypted result data received from the DP accelerator matches the plaintext input data transmitted to the DP accelerator 105 by the host device 104 in operation 512, the encryption operation of the DP accelerator is valid.

[0098] If the kernel received by the DP accelerator is a decrypted kernel, the host device 104 may decrypt the input data that the host device 104 transmits to the DP processor 150 in operation 512. The host device 104 may compare the decrypted input data with the result data received from the DP accelerator 105. If the result data received from the DP accelerator 105 matches the input data decrypted by the host device 104, the decryption operation is valid.

[0099] In operation 530, the host device 104 may call the DP accelerator 105 to perform one or more additional encryption / decryption operations using the encryption kernel or decryption kernel on the DP accelerator 105. In an embodiment, if the encryption or decryption operation is not verified, the host 104 may choose not to use the method 500 to make future calls to the DP accelerator 105 for encryption or decryption operations.

[0100] Fig. 6A and 6B is a block diagram illustrating a method 600 for signing an AI watermark using implicit data according to an embodiment. Fig. 6A In operation 605, an application on the host device 104 may transmit an artificial intelligence (AI) model to the DP accelerator 105. In operation 650, the DP accelerator may receive the AI ​​model from the host device 104.

[0101] In operation 610, an application on the host device 104 may transmit an input to the DP accelerator, the input being used to trigger an output from the AI ​​model. In operation 655, the DP accelerator 105 may receive input data from the host device 104. In operation 660, the DP accelerator 105 may run the AI ​​model using the received input data to generate output data. The output data may be a watermark of the AI ​​model.

[0102] In operation 680, the DP accelerator may make the output data available for retrieval by the host device 104. In operation 620, the host device 104 may retrieve and optionally verify the output of the DP accelerator running the AI ​​model with the input data. To verify the output data, the host device 104 may run the AI ​​model with the input data to obtain a watermark from the AI ​​model, or otherwise obtain a watermark from a pre-existing source, and compare the obtained AI model watermark with the output data received from the DP accelerator 105. If the obtained watermark matches the output data received from the DP accelerator 105, then the watermark operation of the DP accelerator is valid.

[0103] In operation 625, the host device 104 may use the AI ​​model to request additional data processing operations from the DP accelerator 105. In an embodiment, if the watermark is not verified, the host 104 may choose not to make future calls to the DP accelerator 105 using the method 600.

[0104] Reference now Figure 6B In operation 605 , the application on the host device 104 may transmit the AI ​​model to the DP accelerator 105 . In operation 650 , the DP accelerator may receive the AI ​​model from the host device 104 .

[0105] In operation 610 , an application on the host device 104 may transmit input to the DP accelerator, which is used to trigger output from the AI ​​model. In operation 655 , the DP accelerator 105 may receive input data from the host device 104 .

[0106] In operation 660, the DP accelerator 105 may run the AI ​​model using the received input data to generate output data. The output data may be a watermark of the AI ​​model.

[0107] In operation 675, the DP accelerator may call the security unit 275 of the DP accelerator 105 to digitally sign the output data (watermark). In an embodiment, digitally signing the watermark may include generating a hash or digest of the watermark, including the hash or digest in the packet with the watermark, and encrypting the packet with the private key of the DP accelerator.

[0108] In operation 680, the DP accelerator may make the digitally signed output data available to the host device 104 for retrieval. In operation 620, the host device 104 may retrieve and optionally verify the output of the DP accelerator running the AI ​​model with the input data, or otherwise obtain the watermark from a pre-existing source. To verify the received digitally signed output data, the host device may decrypt the received output using the public key of the DP accelerator 105 and extract the watermark and the hash or digest of the watermark. The host device 104 may compare the extracted watermark with the watermark obtained by the host device running the AI ​​model with the input data. If they match, the host device 104 may also calculate the hash or digest of the watermark and compare the calculated hash or digest with the extracted hash or digest. If the hash / digest matches, the DP accelerator 105 successfully extracted the watermark from the AI ​​model using the input data and digitally signed the watermark.

[0109] In operation 625, the host device 104 may use the AI ​​model to request additional data processing operations from the DP accelerator 105. In an embodiment, if the watermark is not verified, the host 104 may choose not to make future calls to the DP accelerator 105 using the method 600.

[0110] Figure 7 is a block diagram illustrating a method 700 for signing an output using a host-provided signature kernel according to an embodiment. In preparation for the method 700, the host device 104 and the DP accelerator 105 may exchange one or more specified keys and establish a secure communication channel 215. Embodiments of the method 700 may use a signature kernel such as An AI accelerator or another AI accelerator or an accelerator such as a GPU is used as the DP accelerator 105 .

[0111] In operation 705, the application on the host device 104 may send a signed kernel to the DP accelerator 105 via the communication channel 215. In operation 750, the DP accelerator 105 may receive the signed kernel from the host device 150. The signed kernel specifies the input data to be accessed. The input data may be an AI model with a watermark. The signed kernel may generate output data using the input.

[0112] In operation 755, the DP accelerator runs a kernel to extract a watermark from input data. The input data can be a watermark-enabled AI model or data representing a watermark of an AI model. The signature kernel can access specified input data from several different sources. The source of the specified input data can be specified within the signature kernel, in a separate transmission from the host device 104 to the DP accelerator 105, or can be specified by reference (e.g., a pointer), or by reference to a register within the DP accelerator, such as "extract watermark from the input data or data object specified in DP accelerator register AX". The signature kernel can generate a hash or digest of the watermark using any known hashing or digesting technique.

[0113] In operation 756, the kernel generates an output using the input data obtained as described above. In operation 757, the signature kernel may embed a hash or digest into the output data generated by the signature kernel. In operation 758, the kernel may digitally sign the output data. The signature may be generated using a key previously exchanged between the host device 104 and the DP accelerator 105 or a private key of the DP accelerator 105.

[0114] In operation 760, the DP accelerator 105 may notify the host device 104 that the digitally signed output data is ready to be retrieved by the host device 104. In operation 710, the host device 104 may retrieve the output data from the DP accelerator 105.

[0115] In operation 715, the host device 104 may optionally verify the output data retrieved from the DP accelerator 105. In an embodiment, verifying the output may include an application on the host device 104 performing operations 755 to 757, then decrypting the digital signature of the digitally signed output received from the DP accelerator, or otherwise obtaining the specified output from a pre-existing source, and comparing the result to the unsigned (after decrypting the signature) result generated by the DP accelerator. If the two match, the DP accelerator 105 signature has been verified. In operation 720, the host 104 may make one or more additional calls to the DP accelerator and signature kernel to perform additional operations. In an embodiment, if the signed output is not verified, the host 104 may choose not to make additional calls to the DP accelerator 105 using method 700.

[0116] Figure 8800 is a block diagram illustrating a method 800 for digitally signing a watermark of an AI model by a DP accelerator using a watermarking kernel and a signature kernel provided by a host device 104 according to an embodiment. In an embodiment, the watermarking kernel and the signature kernel may be integrated into a single kernel. The method 800 provides a general AI watermark signing method to prove that an AI model with a watermark is used by the DP accelerator 105. In preparation for the method 800, the host device 104 and the DP accelerator 105 may exchange one or more specified keys, and establish a communication channel 215 between the host device 104 and the DP accelerator 105. In an embodiment, the DP accelerator 105 may be a host device such as a DP accelerator 105. An AI accelerator or other AI accelerator or an accelerator such as a graphics processing unit (GPU).

[0117] In operation 805, the application on the host device 104 sends the watermark-enabled AI model to the DP accelerator 105 through the communication channel 215. In operation 850, the DP accelerator 105 receives the watermark-enabled AI model from the host device 104. In operation 810, the application on the host device 104 sends the watermark-enabled kernel and the signature kernel to the DP accelerator 105 through the communication channel 215. In operation 855, the DP accelerator 105 receives the watermark-enabled kernel and the signature kernel from the host device 104. In an embodiment, the watermark-enabled kernel and the signature kernel may be a single kernel combining the functionality of each kernel.

[0118] In operation 815, the application on the host device 104 transmits input data to the DP accelerator 105 through the communication channel 215. When the input data is used as input to the watermark-enabled kernel, the input data triggers the watermark-enabled kernel to output a watermark of the watermark-enabled AI model. In operation 860, the DP accelerator 105 receives the input data from the host device 104.

[0119] In operation 865, the DP accelerator runs a watermark-enabled kernel using the received input data as input to extract a watermark from the watermark-enabled AI model received from the host device 104. In operation 870, in an embodiment, the watermark-enabled kernel may optionally call a signature kernel to digitally sign the watermark. In an embodiment, the digital signature includes a hash or digest of the watermark. In an embodiment, digitally signing the watermark includes a hash or digest of the watermark and encrypting the watermark and the hash / digest using a private key of the DP accelerator 105.

[0120] In operation 875, DP accelerator 105 notifies host device 104 that the watermark (optionally digitally signed) is available for retrieval by host device 104. In operation 820, the application on host device 104 retrieves the (optionally digitally signed) watermark of the AI ​​model from DP accelerator 105.

[0121] In operation 825, the host device 104 optionally verifies the (e.g., optionally digitally signed) watermark. If the watermark was digitally signed by the signature kernel in operation 870, the host device may decrypt the digital signature using the public key of the DP accelerator 105. A hash or digest of the watermark may be unpacked from the decrypted output data. The host device 104 may run a watermark-enabled kernel to obtain a watermark from a watermark-enabled AI model, or otherwise obtain a watermark from a pre-existing source, and the host device 104 may calculate a digest or hash of the watermark. If the watermark and hash calculated or obtained by the host match the watermark and hash calculated by the DP accelerator, the DP accelerator, the watermark-enabled kernel, and the signature kernel output are verified.

[0122] In operation 830, host device 104 may invoke DP accelerator 105 to perform one or more such operations using the signature kernel and the watermark-enabled kernel. In an embodiment, if the watermark and digital signature generated by the DP accelerator are not verified, host device 104 may choose not to invoke DP accelerator 105 for further operations using the watermark-enabled kernel and / or the signature kernel.

[0123] Fig. 9 1 is a block diagram illustrating an example of a data processing system 1500 that can be used with one embodiment of the present disclosure. For example, system 1500 can represent any of the above-described data processing systems that perform any of the above-described processes or methods, such as described above for DP accelerator 105, for example, establishing secure communications between host device 104 and data processing (DP) accelerator 105; running a code kernel of an artificial intelligence (AI) model received from host device 104 by DP accelerator; executing an application on host device 104; executing APIs and drivers on host device 104; running encryption / decryption logic, seed generators, encryption / decryption key generators, etc. System 1500 can include many different components. These components can be implemented as integrated circuits (ICs), portions of integrated circuits, discrete electronic devices, or other modules suitable for circuit boards (such as, motherboards or plug-in cards of computer systems) or as components otherwise incorporated into the chassis of a computer system.

[0124] It should also be noted that system 1500 is intended to illustrate a high-level view of many components of a computer system. However, it should be understood that additional components may be provided in some embodiments, and in addition, different arrangements of the components shown may be provided in other embodiments. System 1500 may represent a desktop computer, a laptop computer, a tablet computer, a server, a mobile phone, a media player, a personal digital assistant (PDA), a smart watch, a personal communicator, a gaming device, a network router or hub, a wireless access point (AP) or a repeater, a set-top box, or a combination thereof. In addition, although only a single machine or system is shown, the term "machine" or "system" should also be understood to include any set of machines or systems that individually or collectively execute one (or more) instruction sets to execute any one or more methods discussed herein.

[0125] In one embodiment, system 1500 includes a processor 1501, a memory 1503, and devices 1505 to 1508 connected by a bus or interconnect 1510. Processor 1501 may represent a single processor or multiple processors including a single processor core or multiple processor cores. Processor 1501 may represent one or more general-purpose processors, such as a microprocessor, a central processing unit (CPU), etc. More specifically, processor 1501 may be a complex instruction set computing (CISC) microprocessor, a reduced instruction set computing (RISC) microprocessor, a very long instruction word (VLIW) microprocessor, or a processor that implements other instruction sets, or a processor that implements a combination of instruction sets. Processor 1501 may also be one or more special-purpose processors, such as, AI processor, GPU, ASIC, cellular or baseband processor, FPGA, DSP, network processor, graphics processor, communications processor, encryption processor, coprocessor, embedded processor, or any other type of logic capable of processing instructions.

[0126] Processor 1501 (which may be a low-power multi-core processor socket, such as an ultra-low voltage processor) may serve as a main processing unit and central hub for communicating with various components of the system. Such a processor may be implemented as a system on a chip (SoC). Processor 1501 is configured to execute instructions for performing the operations and steps discussed herein. System 1500 may also include a graphics interface that communicates with an optional graphics subsystem 1504, which may include a display controller, a graphics processor, and / or a display device.

[0127] The processor 1501 may communicate with the memory 1503, which in one embodiment may be implemented via a plurality of memory devices to provide a certain amount of system storage. The memory 1503 may include one or more volatile storage (or memory) devices, such as random access memory (RAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), static RAM (SRAM), or other types of storage devices. The memory 1503 may store information including sequences of instructions to be executed by the processor 1501 or any other device. For example, executable code and / or data of various operating systems, device drivers, firmware (e.g., input-output basic system or BIOS), and / or applications may be loaded into the memory 1503 and executed by the processor 1501. The operating system may be any type of operating system, such as the Robot Operating System (ROS), a Company Operating system from Apple From Company LINUX, UNIX, or other real-time or embedded operating systems.

[0128] System 1500 may also include IO devices, such as devices 1505 to 1508, including a network interface device 1505, an optional input device 1506, and other optional IO devices 1507. The network interface device 1505 may include a wireless transceiver and / or a network interface card (NIC). The wireless transceiver may be a WiFi transceiver, an infrared transceiver, a Bluetooth transceiver, a WiMax transceiver, a wireless cellular phone transceiver, a satellite transceiver (e.g., a global positioning system (GPS) transceiver) or other radio frequency (RF) transceivers or combinations thereof. The NIC may be an Ethernet card.

[0129] Input device 1506 may include a mouse, a touchpad, a touch-sensitive screen (which may be integrated with display device 1504), a pointer device (such as a stylus), and / or a keyboard (e.g., a physical keyboard or a virtual keyboard displayed as part of a touch-sensitive screen). For example, input device 1506 may include a touch screen controller coupled to a touch screen. The touch screen and touch screen controller may, for example, use any of a variety of touch-sensitive technologies (including, but not limited to, capacitive, resistive, infrared, and surface acoustic wave technologies), as well as other proximity sensor arrays or other elements for determining one or more points of contact with the touch screen to detect contact and movement or discontinuity thereof.

[0130] IO devices 1507 may include audio devices. The audio devices may include speakers and / or microphones to facilitate voice-enabled functions such as voice recognition, voice replication, digital recording, and / or telephone functions. Other IO devices 1507 may also include universal serial bus (USB) ports, parallel ports, serial ports, printers, network interfaces, bus bridges (e.g., PCI-PCI bridges), sensors (e.g., such as accelerometer motion sensors, gyroscopes, magnetometers, light sensors, compasses, proximity sensors, etc.), or combinations thereof. Device 1507 may also include an imaging processing subsystem (e.g., a camera), which may include an optical sensor such as a charge coupled device (CCD) or a complementary metal oxide semiconductor (CMOS) optical sensor for facilitating camera functions (e.g., recording photos and video clips). Certain sensors may be coupled to interconnect 1510 via a sensor hub (not shown), while other devices such as a keyboard or thermal sensor may be controlled by an embedded controller (not shown) according to the specific configuration or design of system 1500.

[0131] In order to provide permanent storage of information such as data, applications, one or more operating systems, etc., a mass storage device (not shown) may also be connected to the processor 1501. In various embodiments, in order to achieve a thinner and lighter system design and improve system responsiveness, such a mass storage device may be implemented via a solid-state device (SSD). However, in other embodiments, the mass storage device may be implemented primarily using a hard disk drive (HDD), wherein a smaller amount of SSD storage devices act as SSD caches to achieve non-volatile storage of context states and other such information during power-off events, thereby enabling fast power-on when system activities are restarted. In addition, a flash memory device may be connected to the processor 1501, for example, via a serial peripheral interface (SPI). Such a flash memory device may provide non-volatile storage of system software, including the BIOS and other firmware of the system.

[0132] The storage device 1508 may include a computer-accessible storage medium 1509 (also referred to as a machine-readable storage medium or a computer-readable medium) on which is stored one or more instruction sets or software (e.g., modules, units, and / or logic 1528) embodying any one or more of the methods or functions described herein. The processing module / unit / logic 1528 may represent any of the above components, such as the user application 205, the runtime library 206, the driver 209 of the host device 104, the true random number generator 273, the key manager 272, the watermark unit 276, and the cryptographic engine 274 on the DP accelerator 105. The processing module / unit / logic 1528 may also reside completely or at least partially in the memory 1503 and / or in the processor 1501 during its execution by the data processing system 1500, the memory 1503, and the processor 1501, which also constitute the machine-accessible storage medium. The processing module / unit / logic 1528 may also transmit or receive over a network via the network interface device 1505 .

[0133] Computer-readable storage medium 1509 may also be used to permanently store some of the software functions described above. Although computer-readable storage medium 1509 is shown as a single medium in an exemplary embodiment, the term "computer-readable storage medium" should be considered to include a single medium or multiple media (e.g., a centralized or distributed database and / or associated caches and servers) storing the one or more instruction sets. The term "computer-readable storage medium" should also be considered to include any medium capable of storing or encoding an instruction set that is used to be executed by a machine and causes the machine to perform any one or more methods of the present disclosure. Therefore, the term "computer-readable storage medium" should be considered to include, but is not limited to, solid-state memory and optical and magnetic media, or any other non-temporary machine-readable medium.

[0134] The processing modules / units / logic 1528, components, and other features described herein may be implemented as discrete hardware components or integrated into the functionality of hardware components (such as ASICS, FPGAs, DSPs, or similar devices). In addition, the processing modules / units / logic 1528 may be implemented as firmware or functional circuits within a hardware device. In addition, the processing modules / units / logic 1528 may be implemented in any combination of hardware devices and software components.

[0135] It should be noted that although system 1500 is shown as having various components of a data processing system, it is not intended to represent any particular architecture or manner of interconnecting the components; as such details are not germane to the embodiments of the present disclosure. It should also be appreciated that network computers, handheld computers, mobile phones, servers, and / or other data processing systems having fewer or possibly more components may also be used with embodiments of the present disclosure.

[0136] Some portions of the foregoing detailed description have been presented in terms of algorithms and symbolic representations of operations on data bits within a computer memory. These algorithmic descriptions and representations are the means used by those skilled in the data processing arts to most effectively convey the substance of their work to others skilled in the art. An algorithm is generally considered herein to be a self-consistent sequence of operations leading to a desired result. These operations are those requiring physical manipulation of physical quantities.

[0137] It should be borne in mind, however, that all of these and similar terms are intended to be associated with the appropriate physical quantities and are merely convenient labels applied to these quantities. Unless otherwise expressly indicated in the above discussion, it should be understood that throughout the specification, discussions utilizing terms such as those set forth in the appended claims refer to the actions and processes of a computer system or similar electronic computing device that manipulates data represented as physical (electronic) quantities within the computer system's registers and memories and transforms the data into other data similarly represented as physical quantities within the computer system's memories or registers or other such information storage, transmission, or display devices.

[0138] Embodiments of the present disclosure also relate to devices for performing the operations herein. Such a computer program is stored in a non-transitory computer-readable medium. A machine-readable medium includes any mechanism for storing information in a form readable by a machine (e.g., a computer). For example, a machine-readable (e.g., computer-readable) medium includes a machine (e.g., computer) readable storage medium (e.g., a read-only memory ("ROM"), a random access memory ("RAM"), a magnetic disk storage medium, an optical storage medium, a flash memory device).

[0139] The processes or methods depicted in the foregoing figures may be performed by processing logic including hardware (e.g., circuits, dedicated logic, etc.), software (e.g., embodied on a non-transitory computer-readable medium), or a combination of both. Although the processes or methods are described above in terms of some sequential operations, it should be understood that some of the operations may be performed in a different order. In addition, some operations may be performed in parallel rather than sequentially.

[0140] The embodiments of the present disclosure are not described with reference to any particular programming language. It will be appreciated that a variety of programming languages ​​may be used to implement the teachings of the embodiments of the present disclosure as described herein.

[0141] In the above description, embodiments of the present invention have been described with reference to specific exemplary embodiments of the present disclosure. It will be apparent that various modifications may be made to the present disclosure without departing from the broader spirit and scope of the present invention as set forth in the appended claims. Therefore, the present description and the accompanying drawings should be understood in an illustrative sense rather than a restrictive sense.

Claims

1. A computer-implemented method for a data processing accelerator, the method comprising: receiving, by the data processing accelerator, a command, input data, and a kernel from a host device, the command requesting the data processing accelerator to encrypt the input data or decrypt the input data, the kernel being a code provided to the data processing accelerator to execute the intended function of the kernel by the data processing accelerator; Encrypting or decrypting the input data according to the command by the data processing accelerator; as well as transmitting the encrypted or decrypted input data to the host device; Wherein, the kernel includes a watermark-enabling kernel for extracting a watermark from an AI model; The method further comprises: The data processing accelerator receives an AI model and first input data from the host device, and when the first input data is used as an input to the watermark-enabled kernel, the data processing accelerator generates a watermark extracted from the AI ​​model and provides the watermark to the host device.

2. The method of claim 1 further includes exchanging one or more designated keys between the host device and the data processing accelerator before the input data is encrypted or decrypted by the data processing accelerator, wherein the encryption or decryption operation is performed using one of the one or more designated keys.

3. The method of claim 2, wherein: At least one of the one or more designated keys is used to establish a secure communication link between the host device and the data processing accelerator.

4. The method of claim 1, wherein: When the command is to encrypt the input data, the method further includes: generating one or more keys by the data processing accelerator; encrypting the input data using one of the one or more keys; and At least one of the one or more keys is sent to the host device.

5. The method of claim 4, wherein: The key used to encrypt the input data is a symmetric key, and wherein the symmetric key is transmitted to the host device.

6. The method of claim 1, wherein: A key used to encrypt or decrypt the input data is retrieved from or based on a key stored in a secure memory of the data processing accelerator.

7. A data processing accelerator, comprising: an interface to receive commands, input data, and kernels from a host device, the commands requesting the data processing accelerator to encrypt the input data or decrypt the input data, the kernels being codes provided to the data processing accelerator to execute the intended functions of the kernels by the data processing accelerator; Safety unit, encrypting or decrypting the input data according to the command, and transmitting the encrypted or decrypted input data to the host device; The kernel includes a watermark-enabled kernel for extracting a watermark from an AI model; the data processing accelerator receives the AI ​​model and first input data from the host device, and when the first input data is used as input to the watermark-enabled kernel, the data processing accelerator generates a watermark extracted from the AI ​​model and provides the watermark to the host device.

8. The data processing accelerator of claim 7, further comprising a channel manager for exchanging one or more designated keys between the host device and the data processing accelerator before the input data is encrypted or decrypted by the data processing accelerator, wherein: The encryption or decryption operation is performed using a specified key of the one or more specified keys.

9. The data processing accelerator according to claim 8, wherein: At least one of the one or more designated keys is used to establish a secure communication link between the host device and the data processing accelerator.

10. The data processing accelerator according to claim 7, wherein: When the command is to encrypt the input data, the data processing accelerator further includes a key manager to generate one or more keys, wherein one of the one or more keys is used to encrypt the input data, and at least one of the one or more keys is transmitted to the host device.

11. The data processing accelerator according to claim 10, wherein: The key used to encrypt the input data is a symmetric key, and wherein the symmetric key is transmitted to the host device.

12. The data processing accelerator according to claim 7, wherein: A key used to encrypt or decrypt the input data is retrieved from, or based on, a key stored in a secure memory of the data processing accelerator.

13. A non-transitory machine-readable medium having stored therein instructions that, when executed by a processor, cause the processor to perform operations of a data processing accelerator, the operations comprising: receiving, by the data processing accelerator, a command, input data, and a kernel from a host device, the command requesting the data processing accelerator to encrypt the input data or decrypt the input data, the kernel being a code provided to the data processing accelerator to execute the intended function of the kernel by the data processing accelerator; Encrypting or decrypting the input data according to the command by the data processing accelerator; as well as sending the encrypted or decrypted input data to the host device; The kernel includes a watermark-enabled kernel for extracting a watermark from an AI model; the data processing accelerator receives the AI ​​model and first input data from the host device, and when the first input data is used as input to the watermark-enabled kernel, the data processing accelerator generates a watermark extracted from the AI ​​model and provides the watermark to the host device.

14. The machine-readable medium of claim 13, wherein: The operations also include exchanging, by the host device and the data processing accelerator, one or more designated keys before encrypting or decrypting the input data by the data processing accelerator, wherein the encryption or decryption operation is performed using one of the one or more designated keys.

15. The machine-readable medium of claim 14, wherein: At least one of the one or more designated keys is used to establish a secure communication link between the host device and the data processing accelerator.

16. The machine-readable medium of claim 13, wherein: When the command is to encrypt the input data, the operation further includes: generating one or more keys by the data processing accelerator; encrypting the input data using one of the one or more keys; and At least one of the one or more keys is sent to the host device.

17. A host device, comprising: processor; as well as a memory coupled to the processor to store instructions that, when executed by the processor, cause the processor to perform operations of a host device, the operations causing a data processing accelerator to perform encryption or decryption operations, the operations comprising: transmitting commands, input data, and a kernel to the data processing accelerator to encrypt or decrypt the input data using one of one or more specified keys, the kernel being code provided to the data processing accelerator to perform the intended function of the kernel by the data processing accelerator; and receiving encrypted or decrypted input data from the data processing accelerator, wherein the data processing accelerator is configured to encrypt or decrypt the input data in response to the command; The kernel includes a watermark-enabled kernel for extracting a watermark from an AI model; transmitting the AI ​​model and first input data to the data processing accelerator, wherein when the first input data is used as input to the watermark-enabled kernel, the data processing accelerator generates a watermark extracted from the AI ​​model and provides the watermark to the host device.

18. The host device of claim 17, wherein: The operations further include receiving a decryption key from the data processing accelerator in response to the command to encrypt the input data.

19. The host device of claim 17, wherein the operations further comprise exchanging one or more keys with the data processing accelerator.

20. The host device of claim 19, wherein the operations further comprise establishing a secure link between the host device and the data processing accelerator using one or more of the specified keys.

Images