A Method for Constructing a Data-Parallel Trusted Distributed Neural Network Accelerator Architecture

Abstract

A method for constructing a data-parallel trusted distributed neural network accelerator architecture, the accelerator architecture, the accelerator, and the server includes the following steps: a host node construction step for remote authentication, control, and data distribution of multiple neural network accelerator nodes; a dynamic random access memory construction step; and a construction of the multiple neural network accelerator nodes, further including: a control processor construction step; a computing unit construction step; and a memory controller construction step for providing trusted data protection, which further includes: constructing a global version number structure of a distributed large model on-chip; and encrypting, decrypting, generating, and verifying data using a method that does not use data addresses; wherein the encryption, decryption, integrity protection generation, and integrity protection verification are communicated at the tensor granularity of the neural network layers.

Description

Technical Field

[0001] This invention relates to the field of computer science and technology, and in particular to the field of artificial intelligence neural network accelerators. Background Technology

[0002] As technological expansion slows, computing systems are increasingly relying on hardware accelerators to improve performance and energy efficiency. For example, modern machine learning (ML) models, such as deep neural networks (DNNs), are typically quite computationally intensive and are increasingly running on hardware accelerators. Similarly, hardware accelerators are widely used for other computationally intensive workloads such as video decoding, signal processing, cryptographic operations, and genome assembly.

[0003] Meanwhile, as training data increases, the size of neural network models also grows. A single accelerator can no longer support the training and inference of large models, leading to the widespread adoption of distributed training models based on multiple machines and GPUs. Specifically, current parallel strategies include pipelined parallelism, data parallelism, and tensor parallelism. Pipeline parallelism divides the model into multiple parts sequentially, with each accelerator storing only a portion of the model's weight parameters and performing the corresponding calculations, thus distributing storage and computational pressure. Data parallelism partitions the data, with each accelerator retaining the complete model but only the training or inference data; after completing the current round, multi-GPU model aggregation and distribution are performed. Tensor parallelism distributes large tensors in the computation process across multiple accelerators, reducing storage pressure on the accelerators; for example, multi-head self-attention layers are partitioned head-by-head, or the weights of fully connected layers are partitioned by row or column.

[0004] In many applications, hardware accelerators may handle private or sensitive data, requiring robust security measures. For example, ML algorithms typically need to collect, store, and process large amounts of personal and potentially private data from users to train models. Furthermore, due to their high computational demands, training and inference are often performed on remote servers rather than on client devices such as smartphones, meaning that private data and ML models could be exposed if the server is compromised or subjected to malicious attacks.

[0005] One approach to providing strong confidentiality and integrity guarantees in untrusted environments is to create a hardware-protected Trusted Execution Environment (TEE). Encryption protection of off-chip memory is a fundamental technique for implementing a hardware-protected TEE. In traditional secure processor designs, off-chip memory protection is a major source of performance overhead. For general-purpose processors, memory protection schemes need to be able to handle any sequence of memory accesses to arbitrary memory locations and typically protect memory accesses at the cache block granularity. In secure processors, a counter-based encryption mode is used to hide decryption latency, where the counter value is typically a combination of a memory address and a version number (VN). The version number is stored in memory and incremented each time an encrypted block is written. To protect the integrity of off-chip memory, a Message Authentication Code (MAC) needs to be appended to each cache block in memory. Furthermore, since the VN cannot be entirely stored on-chip and must be stored in external storage, its integrity also needs to be protected. To this end, traditional schemes construct a Merkle Tree structure, reducing the integrity guarantees of all VNs to the root node. By placing the root node on the chip and reconstructing the tree upon access, comparing it with the root node stored on the chip, if they are the same, the VN is considered to have been tampered with, and its integrity is guaranteed. Figure 2 As shown in the left figure, AES encryption takes plaintext U, physical address PA, version number VN and key Kenc as input, generates ciphertext V, and uses a hash function to generate MAC.

[0006] Version number (VN) and MAC (Macro-Version) incur significant performance and storage overhead. To address this issue, recent work MGX (Near-Zero Overhead Memory Protection for Data-Intensive Accelerators) leverages the fixed data flow characteristics of neural networks. By utilizing scheduling information from the compilation phase and the on-chip state during accelerator execution, the version number (VN) can be directly inferred, eliminating the need for off-chip storage of VN. This also eliminates the overhead of tree construction and access, significantly reducing overall overhead. Figure 2 As shown in the right figure. However, the secure memory problem of distributed multi-accelerators remains unresolved. Constructing a portable Merkle Tree (MMT) structure can eliminate the overhead of software re-encryption and decryption across multiple machines. However, its encryption granularity is still 64 bytes per memory row, resulting in excessive storage overhead.

[0007] By analyzing the two methods above, we found that neither of these solutions can be directly applied in distributed scenarios for large-scale model inference. Firstly, the data flow of neural networks under large models is no longer completely static. Due to memory limitations, tensors in data parallelism are divided into blocks and distributed across multiple accelerators, and then recombined via communication when needed. This dynamic change cannot be met by MGX's completely static design. Secondly, the MAC of the MMT method itself also consumes significant storage overhead, which will lead to additional machine requirements in storage-constrained large-scale model training scenarios. It is estimated that 10% storage overhead may result in 10-20% additional machines, which will bring huge costs due to the high cost of accelerators such as GPUs. Simultaneously, the MMT method relies on addresses for encryption and decryption, which will require the TEE layer to re-encrypt and decrypt the ciphertext after communication. Summary of the Invention

[0008] To address the aforementioned problems, this invention discloses a method for constructing a data-parallel trusted distributed neural network accelerator architecture, comprising the following steps:

[0009] The steps for building host nodes are used for remote authentication, control, and data distribution to multiple neural network accelerator nodes;

[0010] Steps for constructing dynamic random access memory;

[0011] The step of constructing the plurality of neural network accelerator nodes further includes:

[0012] Steps for building a control processor;

[0013] Steps for constructing a computing unit;

[0014] The steps involved in building a memory controller to provide trusted data protection include:

[0015] Build a global version number structure for a distributed large model on-chip;

[0016] Encryption, decryption, integrity protection generation, and integrity protection verification of data without using data addresses;

[0017] The encryption, decryption, integrity protection generation, and integrity protection verification are communicated at the tensor level of the neural network layer.

[0018] In one embodiment of the method described above, the step of remotely authenticating multiple neural network accelerator nodes further includes:

[0019] Step S11: The host node requests remote authentication from the neural network accelerator node and establishes a trusted communication channel;

[0020] Step S12: The neural network accelerator node generates a report based on the on-chip root of trust and sends it to the host node;

[0021] Step S13: The host node verifies the credibility of the report based on the information provided by the manufacturer;

[0022] Step S14: The host node assigns a global accelerator number and application key to the neural network accelerator node to complete remote authentication.

[0023] In one embodiment of the method described above, providing trusted data protection includes trusted data protection within neural network accelerator nodes and between neural network accelerator nodes.

[0024] In one embodiment of the method of the present invention, the step of constructing a global version number structure of a distributed large model on-chip includes:

[0025] Construct the on-chip root state structure;

[0026] Set the global version number structure in the on-chip root state, including:

[0027] The tensor dictionary within a node further includes:

[0028] First tensor version number;

[0029] Floor number;

[0030] The array of maximum version numbers for other nodes further includes:

[0031] First node number;

[0032] Maximum version number;

[0033] The inter-node tensor dictionary further includes:

[0034] Tensor address;

[0035] Second tensor version number;

[0036] Second node number.

[0037] In one embodiment of the method described above, the first tensor version number and the second tensor version number are globally increasing and non-repeating within their respective corresponding neural network accelerator nodes.

[0038] In one embodiment of the method described above, the steps of encrypting, decrypting, generating integrity protection, and verifying integrity protection of data without using address methods are performed using a global version number.

[0039] In one embodiment of the method described above, the steps of encrypting, decrypting, generating integrity protection, and verifying integrity protection using a global version number further include:

[0040] Step S61: Construct an encryption / decryption engine to ensure encryption, decryption, integrity protection generation, and integrity protection verification during data transmission, including:

[0041] Step S62: Construct the encryption / decryption module;

[0042] Step S63: Construct the hash module;

[0043] Step S64: Build a communication verification engine to ensure trusted transmission between neural network accelerator nodes.

[0044] In one embodiment of the method described above, the encryption and decryption using the global version number are performed using a block encryption method, including the AES-CTR method.

[0045] In one embodiment of the method described above, the step of encrypting using a global version number further includes:

[0046] Step S811: Combine the first data, the second data, and the third data to obtain the data block identifier;

[0047] Step S812: The encryption / decryption module encrypts the data block identifier to obtain ciphertext;

[0048] Step S813: Perform an XOR operation on the ciphertext and plaintext to obtain the ciphertext data.

[0049] In one embodiment of the method described above, the step of decryption via a global version number further includes:

[0050] Step S821: Combine the first data, the second data, and the third data to obtain the data block identifier;

[0051] Step S822: The encryption / decryption module encrypts the data block identifier to obtain ciphertext;

[0052] Step S823: Perform an XOR operation on the ciphertext data and the data block identifier to obtain the plaintext.

[0053] In one embodiment of the method described above, the step of encrypting and decrypting within the neural network accelerator node further includes:

[0054] The first data is the current node number;

[0055] The second data is the version number of the first tensor;

[0056] The third data is the block number.

[0057] In one embodiment of the method described above, the step of encrypting and decrypting between neural network accelerator nodes further includes:

[0058] The first data is the second node number;

[0059] The second data is the version number of the second tensor;

[0060] The third data is the block number.

[0061] In one embodiment of the method described above, the step of generating integrity protection data using a global version number further includes:

[0062] Step S831: Hash the ciphertext of each data block using the hash module;

[0063] Step S832: Perform an XOR operation between the hash result and the corresponding ciphertext to obtain the message verification code for each data block;

[0064] Step S833: XOR the message verification code of each data block to obtain the message verification code of the tensor, and store it in dynamic random access memory.

[0065] In one embodiment of the method described above, the step of performing integrity protection verification using a global version number further includes:

[0066] Step S841: Calculate the message verification code for each data block based on the ciphertext of the data blocks obtained in the decryption step;

[0067] Step S842: XOR the message verification code of each data block to obtain the message verification code of the tensor;

[0068] Step S843: Compare the message verification code of the tensor with the message verification code of the tensor in dynamic random access memory;

[0069] Step S844: The comparison results are consistent and pass the integrity protection verification.

[0070] In one embodiment of the method described above, the step of ensuring reliable transmission between neural network accelerator nodes further includes:

[0071] Step S641: Trusted on-chip transmission between neural network accelerator nodes;

[0072] Step S642: Off-chip trusted transfer between neural network accelerator nodes;

[0073] Step S643: Perform anti-replay attack verification;

[0074] Step S644: Set tensor data permissions during transmission.

[0075] In one embodiment of the method described above, the step of reliable on-chip transmission between neural network accelerator nodes further includes:

[0076] Step S6411: Establish a trusted channel between the source node and the destination node for data transmission;

[0077] Step S6412: The data to be transmitted is encrypted and protected with the aforementioned integrity protection, and then transmitted via the trusted channel.

[0078] In one embodiment of the method described above, the step of off-chip trusted transmission between neural network accelerator nodes further includes:

[0079] Step S6421: Establish a direct transmission channel between the source node and the destination node for data transmission;

[0080] Step S6422: Generate the integrity protection for the data to be transmitted, and transmit the data on the direct transmission channel.

[0081] In one embodiment of the method described above, the step of verifying against replay attacks further includes:

[0082] Step S6431: The communication verification engine obtains the second node number and the second tensor version number through the trusted channel;

[0083] Step S6432: Obtain the maximum tensor version number by indexing the array of maximum version numbers of other nodes based on the second node number;

[0084] Step S6433: The verification that the second tensor version number is greater than the maximum tensor version number is successful.

[0085] In one embodiment of the method described above, the step of setting tensor data permissions during transmission further includes:

[0086] Step S6441: Set three data transfer permissions: read-only, read-write, and invalid;

[0087] Step S6442: When the neural network accelerator node is computing, the tensor data is in a read / write state;

[0088] Step S6443: The tensors on the target neural network accelerator nodes are in an invalid state during transmission;

[0089] Step S6444: After the transmission is complete, the tensor of the target neural network accelerator node is converted to a read-only state.

[0090] In one embodiment of the method described above, the step of communicating at the tensor level of the neural network layer further includes:

[0091] Step S91: Tensor readout step within a neural network accelerator node;

[0092] Step S92: Tensor writing step within a neural network accelerator node;

[0093] Step S93: Tensor transfer steps between neural network accelerator nodes;

[0094] Step S94: Tensor reading steps between neural network accelerator nodes.

[0095] In one embodiment of the method described above, the step of tensor reading within the neural network accelerator node further includes:

[0096] Step S911: The memory controller indexes the first tensor version number based on the layer number obtained from the instruction sent by the control processor and sends it to the encryption / decryption engine;

[0097] Step S912: Read the ciphertext and the ciphertext message verification code from the dynamic random access memory according to the first tensor version number;

[0098] Step S913: The encryption / decryption module performs decryption to obtain plaintext and sends it to the computing unit;

[0099] Step S914: The hash module performs integrity protection verification.

[0100] In one embodiment of the method described above, the step of writing tensors within the neural network accelerator node further includes:

[0101] Step S921: Update the version number of the first tensor and store it in the tensor dictionary within the node;

[0102] Step S922: Perform encryption operation based on the updated first tensor version number and the encryption / decryption module;

[0103] Step S923: Write the ciphertext to dynamic random access memory;

[0104] Step S924: The hash module generates integrity protection.

[0105] In one embodiment of the method described above, the step of tensor transfer between neural network accelerator nodes further includes:

[0106] Step S931: Transmit the second node number and the second tensor version number through on-chip trusted transmission between nodes of the neural network accelerator;

[0107] Step S932: Perform anti-replay attack verification;

[0108] Step S933: Store the version number of the second tensor into the inter-node tensor dictionary;

[0109] Step S934: Use the tensor data obtained through the second tensor version number and the message verification code of the tensor data for off-chip trusted transmission between the nodes of the neural network accelerator.

[0110] In one embodiment of the method described above, the tensor reading step between neural network accelerator nodes further includes:

[0111] Step S941: The encryption / decryption engine obtains the second tensor version number from the inter-node tensor dictionary;

[0112] Step S942: Read the ciphertext and the ciphertext message verification code from the dynamic random access memory according to the second tensor version number;

[0113] Step S943: The encryption / decryption module performs decryption to obtain plaintext and sends it to the computing unit;

[0114] Step S944: The hash module performs integrity protection verification.

[0115] This invention also discloses a data-parallel trusted distributed neural network accelerator architecture for implementing any of the above, comprising:

[0116] The host node is used for remote authentication, control, and data distribution to multiple neural network accelerator nodes.

[0117] Dynamic random access memory;

[0118] Multiple neural network accelerator nodes, further including:

[0119] Control processor;

[0120] Computational unit;

[0121] The memory controller, used to provide trusted data protection, includes:

[0122] Global version number structure building module: Used to build a global version number structure for distributed large models on-chip;

[0123] Encryption / decryption engine: used to encrypt, decrypt, generate, and verify data without using addresses; the encryption, decryption, integrity protection generation, and integrity protection verification are communicated at the tensor level of the neural network layer.

[0124] The present invention also discloses a data-parallel trusted distributed neural network accelerator, which is built using the above-described architecture.

[0125] The present invention also discloses a server, including a processor, a memory, and an input / output interface, wherein the processor, memory, and input / output interface are connected via a system bus, and the aforementioned neural network accelerator is also included.

[0126] The present invention also discloses a storage medium for storing a computer control program, the computer control program being used to execute the steps of any of the above methods.

[0127] By employing the above method, a global version number structure for a distributed large model is constructed on-chip, solving the problem of distributed version number allocation for large models that MGX cannot satisfy. Using the on-chip version number allocation strategy designed in this invention for data-parallel large model training can reduce the memory access overhead of version numbers. Since the version number is generated on-chip, it does not need to rely on a Merkle Tree to ensure integrity; therefore, the Merkle Tree does not need to be constructed or accessed.

[0128] Furthermore, data transmission is performed at the granularity of neural network layer tensors, increasing the granularity of encryption and MAC generation. Using tensors (KB or even MB in size) as the granularity reduces the proportion of auxiliary data and lowers storage overhead compared to MMT, which uses memory rows (64B) as the granularity.

[0129] Encryption and MAC generation utilize a global version number, discarding the address, thus avoiding the problem of re-encryption and decryption at the TEE layer after communication transmission. Attached Figure Description

[0130] Figure 1 This is a schematic diagram illustrating the steps of a method for constructing a data-parallel trusted distributed neural network accelerator architecture according to an embodiment of the present invention.

[0131] Figure 2 This is a schematic diagram illustrating a method for encrypting and protecting the integrity of data in a neural network accelerator in the prior art.

[0132] Figure 3a This diagram illustrates data aggregation across multiple nodes during training based on data parallelism in existing technologies.

[0133] Figure 3b This diagram illustrates data distribution across multiple nodes during training based on data parallelism in existing technologies.

[0134] Figure 4 This is a block diagram of a data-parallel trusted distributed neural network accelerator architecture according to an embodiment of the present invention.

[0135] Figure 5 This is a flowchart illustrating the steps of remotely authenticating multiple neural network accelerator nodes in one embodiment of the present invention.

[0136] Figure 6 This is a schematic diagram of the global version number structure for constructing a distributed large model in one embodiment of the present invention.

[0137] Figure 7 This is a flowchart illustrating the construction process of the internal module of the memory controller in a neural network accelerator node according to an embodiment of the present invention.

[0138] Figure 8 This is a flowchart of the steps for encryption using a global version number in one embodiment of the present invention.

[0139] Figure 9 This is a flowchart of the steps for decryption using a global version number in one embodiment of the present invention.

[0140] Figure 10 This is a flowchart of the steps for generating integrity protection using a global version number in one embodiment of the present invention.

[0141] Figure 11 This is a flowchart of the steps for integrity protection verification using a global version number in one embodiment of the present invention.

[0142] Figure 12 This is a flowchart illustrating the steps for ensuring reliable transmission between nodes of a neural network accelerator in one embodiment of the present invention.

[0143] Figure 13 This is a flowchart of the steps for on-chip trusted transmission between nodes of a neural network accelerator in one embodiment of the present invention.

[0144] Figure 14 This is a flowchart of the steps for off-chip trusted transmission between nodes of a neural network accelerator in one embodiment of the present invention.

[0145] Figure 15 This is a flowchart of the steps for verifying the protection against replay attacks in one embodiment of the present invention.

[0146] Figure 16 This is a flowchart illustrating the steps for setting tensor data permissions during transmission in one embodiment of the present invention.

[0147] Figure 17 This is a flowchart of the steps for communication at the tensor level of a neural network layer in one embodiment of the present invention.

[0148] Figure 18 This is a flowchart of the tensor reading step within a neural network accelerator node in one embodiment of the present invention.

[0149] Figure 19 This is a flowchart of the tensor writing steps within a neural network accelerator node in one embodiment of the present invention.

[0150] Figure 20This is a flowchart of the tensor transfer steps between nodes of a neural network accelerator in one embodiment of the present invention.

[0151] Figure 21 This is a flowchart of the tensor reading steps between neural network accelerator nodes in one embodiment of the present invention.

[0152] Figure 22 This is a schematic diagram illustrating the update of tensor version numbers during data aggregation between nodes of a neural network accelerator in one embodiment of the present invention.

[0153] Figure 23 This is a block diagram of a data-parallel trusted distributed neural network accelerator according to an embodiment of the present invention.

[0154] Figure 24 This is a block diagram of a server using a data-parallel trusted distributed neural network accelerator in one embodiment of the present invention.

[0155] In the attached figures, the following labels are used:

[0156] 1: Host Node

[0157] 2: Neural Network Accelerator Nodes

[0158] 3: Control processor

[0159] 4: Calculation Unit

[0160] 5: Memory controller

[0161] 51: Global Version Number Structure Building Module

[0162] 52: Encryption / decryption engine

[0163] 53: Communication Verification Engine

[0164] 521: Encryption / Decryption Module

[0165] 522: Hash Module

[0166] 523: Global Version Number Structure

[0167] 5231: Tensor Dictionary within a Node

[0168] 5232: Array of maximum version numbers for other nodes

[0169] 5233: Inter-node tensor dictionary

[0170] 6: Dynamic Random Access Memory

[0171] 10: An architecture for a data-parallel trusted distributed neural network accelerator

[0172] 100: A Data-Parallel Trusted Distributed Neural Network Accelerator

[0173] 200: Server

[0174] 2001: Processor

[0175] 2002: Memory

[0176] 2003: Input / Output Interface

[0177] 2004: System Bus Detailed Implementation

[0178] To make the objectives, technical solutions, and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that references to "an embodiment," "embodiment," "example embodiment," etc., in the specification refer to the described embodiment including specific features, structures, or characteristics, but not necessarily including these specific features, structures, or characteristics. Furthermore, such expressions do not refer to the same embodiment. Moreover, when describing specific features, structures, or characteristics in conjunction with embodiments, whether or not explicitly described, it is indicated that incorporating such features, structures, or characteristics into other embodiments is within the knowledge scope of those skilled in the art.

[0179] The specification and subsequent claims use certain terms to refer to specific modules, components, or parts. Those skilled in the art will understand that users or manufacturers may use different names or terms to refer to the same module, component, or part. This specification and subsequent claims do not distinguish modules, components, or parts by differences in name, but rather by differences in function. The terms "comprising" and "including" used throughout the specification and subsequent claims are open-ended and should be interpreted as "including but not limited to." Furthermore, the term "connection" here includes any direct and indirect electrical connection means. Indirect electrical connection means include connections via other means.

[0180] Furthermore, in the following description and claims, numerous terms will be referenced, which should be defined as having the following meanings. The singular forms “a” and “the” include plural referents, unless the context clearly specifies otherwise. “Optional” or “optionally” indicates that an event or situation subsequently described may or may not occur, and the description includes both the scenario where the event occurs and the scenario where the event does not occur.

[0181] Please refer to Figure 3a and Figure 3b , Figure 3a This aims to aggregate data across multiple nodes in existing data-parallel training techniques. Figure 3bThis diagram illustrates data distribution across multiple nodes during training based on data parallelism in existing technologies.

[0182] First, let's take data-parallel training as an example to introduce the background of distributed training for large models. Data-parallel training is represented by PyTorch's Distributed Data Parallel (DDP), which completes training on a portion of the data on each accelerator. At the end of each round, DDP performs gradient aggregation through communication, a process that generates a large amount of inter-node communication. Each of the three nodes contains three parts of the model, a, b, and c. The goal of gradient aggregation is to obtain the sum of a, b, and c across the three nodes (the top left diagram shows the initial state, and the bottom right diagram shows the target state). This involves two steps: aggregation and distribution. In the aggregation phase, nodes form a circular connection, passing their partial gradients to the next node to complete the aggregation. After two iterations, each node completes the aggregation of its partial gradients, that is... Figure 3a The rightmost diagram shows the state of the distribution phase. Also utilizing a circular connection, each node passes its aggregated gradients to other nodes, ensuring that all nodes possess all the aggregated gradients. Figure 3b As shown in the rightmost image.

[0183] To ensure the confidentiality, integrity, and freshness of data during training, a trusted execution environment is required. In distributed training, this involves two levels of protection: protection within each node and protection of communication between nodes.

[0184] Please refer to Figure 1 and Figure 4 , Figure 1 This is a schematic diagram illustrating the steps of a method for constructing a data-parallel trusted distributed neural network accelerator architecture according to an embodiment of the present invention. Figure 4 This is a block diagram of a data-parallel trusted distributed neural network accelerator architecture according to an embodiment of the present invention.

[0185] This invention discloses a method for constructing a data-parallel trusted distributed neural network accelerator architecture, comprising the following steps:

[0186] The first step is to build a host node, which is used for remote authentication, control, and data distribution to multiple neural network accelerator nodes 2.

[0187] Six steps to build dynamic random access memory;

[0188] The step of constructing the multiple neural network accelerator nodes 2 further includes:

[0189] Building a control processor involves three steps;

[0190] The four steps to construct a computing unit;

[0191] The five steps to building a memory controller to provide trusted data protection include:

[0192] The global version number structure 523 is used to build a distributed large model on the chip;

[0193] Encryption, decryption, integrity protection generation, and integrity protection verification of data without using data addresses;

[0194] The encryption, decryption, integrity protection generation, and integrity protection verification are communicated at the tensor level of the neural network layer.

[0195] Because the encryption and integrity protection process does not require the involvement of addresses, there is no need to re-encrypt and decrypt when the data is transmitted to other neural network accelerator nodes 2 due to address changes.

[0196] Furthermore, the data-parallel trusted distributed neural network accelerator architecture disclosed in this invention can be used for data-parallel, pipeline parallel, and tensor parallel training, and is not limited thereto.

[0197] Please refer to Figure 5 , Figure 5 This is a flowchart illustrating the steps of remotely authenticating multiple neural network accelerator nodes in one embodiment of the present invention.

[0198] In one embodiment of the method described above, the step of remotely authenticating multiple neural network accelerator nodes 2 further includes:

[0199] Step S11: Host node 1 requests remote authentication from the neural network accelerator node 2 and establishes a trusted communication channel;

[0200] Step S12: Neural network accelerator node 2 generates a report based on the on-chip root of trust and sends it to host node 1;

[0201] Step S13: Host node 1 verifies the credibility of the report based on the information provided by the manufacturer;

[0202] Step S14: Host node 1 assigns a global accelerator number and application key to neural network accelerator node 2 to complete remote authentication.

[0203] In the case of distributed neural network accelerators, it is necessary to ensure the trustworthiness of the remote accelerator hardware, which requires the aforementioned remote authentication process. The accelerator number is used to ensure the correctness of the data source for communication between nodes; the application key is used for tensor encryption of all nodes to avoid the overhead of re-encryption and decryption during data transmission.

[0204] Please refer to Figure 6 , Figure 6 This is a schematic diagram of the global version number structure for constructing a distributed large model in one embodiment of the present invention.

[0205] In one embodiment of the method described above, providing trusted data protection includes trusted data protection within neural network accelerator nodes and between neural network accelerator nodes.

[0206] In one embodiment of the method of the present invention, the step of constructing the global version number structure 523 of the distributed large model on-chip includes:

[0207] Construct the on-chip root state structure;

[0208] Set the global version number structure 523 in the on-chip root state, including:

[0209] The tensor dictionary 5231 within the node further includes:

[0210] First tensor version number;

[0211] Floor number;

[0212] The maximum version number array for other nodes is 5232, which further includes:

[0213] First node number;

[0214] Maximum version number;

[0215] The inter-node tensor dictionary 5233 further includes:

[0216] Tensor address;

[0217] Second tensor version number;

[0218] Second node number.

[0219] In one embodiment of the method described above, the first tensor version number and the second tensor version number are globally increasing and non-repeating within their respective corresponding neural network accelerator nodes.

[0220] Specifically, the first and second tensor version numbers each include three dictionaries, recording the version numbers of the features, weights, and gradients for each layer of the model. For example, the tensor version number in the intra-node tensor dictionary 5231 contains the following three version numbers: feature version number: {layer number: tensor version number}; weight version number: {layer number: tensor version number}; gradient version number: {layer number: tensor version number}. The on-chip storage and access behavior of the feature version number, weight version number, and gradient version number is consistent, and the term "tensor version number" will be used consistently here and in the following text.

[0221] Furthermore, although the first and second tensor version numbers are globally increasing and non-repeating within their respective neural network accelerator nodes, they can be repeated when passed between nodes. In this case, by combining them with the second node number, the tensor version numbers between different nodes can be distinguished, thus avoiding confusion.

[0222] Please refer to Figure 7 , Figure 7 This is a flowchart illustrating the construction process of the internal module of the memory controller in a neural network accelerator node according to an embodiment of the present invention.

[0223] In one embodiment of the method described above, the steps of encrypting, decrypting, generating integrity protection, and verifying integrity protection of data without using address methods are performed using a global version number.

[0224] In one embodiment of the method described above, the steps of encrypting, decrypting, generating integrity protection, and verifying integrity protection using a global version number further include:

[0225] Step S61: Construct encryption / decryption engine 52 to ensure encryption, decryption, integrity protection generation, and integrity protection verification during data transmission, including:

[0226] Step S62: Construct encryption / decryption module 521;

[0227] Step S63: Construct hash module 522;

[0228] Step S64: Construct a communication verification engine 53 to ensure trusted transmission between neural network accelerator nodes.

[0229] Please refer to Figure 8 , Figure 8 This is a flowchart of the steps for encryption using a global version number in one embodiment of the present invention.

[0230] In one embodiment of the method described above, the encryption and decryption using the global version number are performed using a block encryption method, including the AES-CTR method.

[0231] In one embodiment of the method described above, the step of encrypting using a global version number further includes:

[0232] Step S811: Combine the first data, the second data, and the third data to obtain the data block identifier;

[0233] Step S812: The encryption / decryption module 521 encrypts the data block identifier to obtain ciphertext;

[0234] Step S813: Perform an XOR operation on the ciphertext and plaintext to obtain the ciphertext data.

[0235] Please refer to Figure 9 , Figure 9 This is a flowchart of the steps for decryption using a global version number in one embodiment of the present invention.

[0236] In one embodiment of the method described above, the step of decryption via a global version number further includes:

[0237] Step S821: Combine the first data, the second data, and the third data to obtain the data block identifier;

[0238] Step S822: The encryption / decryption module 521 encrypts the data block identifier to obtain ciphertext;

[0239] Step S823: Perform an XOR operation on the ciphertext data and the data block identifier to obtain the plaintext.

[0240] In one embodiment of the method described above, the step of encrypting and decrypting within the neural network accelerator node further includes:

[0241] The first data is the current node number;

[0242] The second data is the version number of the first tensor;

[0243] The third data is the block number.

[0244] In one embodiment of the method described above, the step of encrypting and decrypting between neural network accelerator nodes further includes:

[0245] The first data is the second node number;

[0246] The second data is the version number of the second tensor;

[0247] The third data is the block number.

[0248] Please refer to Figure 10 , Figure 10 This is a flowchart of the steps for generating integrity protection using a global version number in one embodiment of the present invention.

[0249] In one embodiment of the method described above, the step of generating integrity protection data using a global version number further includes:

[0250] Step S831: Hash the ciphertext of each data block using the hash module 522;

[0251] Step S832: Perform an XOR operation between the hash result and the corresponding ciphertext to obtain the message verification code for each data block;

[0252] Step S833: XOR the message verification code of each data block to obtain the message verification code of the tensor, and store it in the dynamic random access memory 6.

[0253] Please refer to Figure 11 , Figure 11 This is a flowchart of the steps for integrity protection verification using a global version number in one embodiment of the present invention.

[0254] In one embodiment of the method described above, the step of performing integrity protection verification using a global version number further includes:

[0255] Step S841: Calculate the message verification code for each data block based on the ciphertext of the data blocks obtained in the decryption step;

[0256] Step S842: XOR the message verification code of each data block to obtain the message verification code of the tensor;

[0257] Step S843: Compare the message verification code of the tensor with the message verification code of the tensor in the dynamic random access memory 6;

[0258] Step S844: The comparison results are consistent and pass the integrity protection verification.

[0259] The encryption, decryption, integrity protection generation, and integrity protection verification processes described above are all performed on a tensor basis, while encryption and decryption provide a certain degree of random access guarantee. AES-CTR encryption and decryption are used to ensure security while providing parallelism. Specifically, 128-bit AES is used to divide the tensor into 128-bit data blocks, each assigned a sequence number. Nodes are numbered Node. idThe tensor version number TensorVN and block number Block_num are input into the encryption / decryption module 521. The resulting ciphertext is XORed with the plaintext data block to obtain the ciphertext data, as shown in formula (1), where Cipher_i and Plain_i are both 128 bits, referring to the ciphertext and plaintext of the i-th data block, respectively. Based on the property of XOR, decryption also follows the same operation process. Since the AES-CTR method is used, there is no dependency between data blocks for encryption and decryption, so the random access requirement of 128-bit data blocks can be met. The MAC is generated based on the Carter-Wegman MAC algorithm. The ciphertext of each data block is hashed, which is actually a polynomial multiplication of the key2 and the ciphertext. The result is XORed with the encryption result of the data block identifier triple by the encryption / decryption module 521. Finally, the MACs of different data blocks are XORed together to obtain the MAC at the tensor granularity. When writing back the tensor, the MAC and tensor combination is stored back in the dynamic random access memory (DRAM). When reading the tensor, the MAC_i of each data block is calculated while reading and decrypting, and finally the tensor MAC is regenerated and compared with the tensor MAC in DRAM. If they match, the integrity is protected; otherwise, the data is considered to have been tampered with.

[0260]

[0261]

[0262] Please refer to Figure 12 , Figure 12 This is a flowchart illustrating the steps for ensuring reliable transmission between nodes of a neural network accelerator in one embodiment of the present invention.

[0263] In one embodiment of the method described above, the step of ensuring reliable transmission between neural network accelerator nodes further includes:

[0264] Step S641: Trusted on-chip transmission between neural network accelerator nodes;

[0265] Step S642: Off-chip trusted transfer between neural network accelerator nodes;

[0266] Step S643: Perform anti-replay attack verification;

[0267] Step S644: Set tensor data permissions during transmission.

[0268] Please refer to Figure 13 , Figure 13 This is a flowchart of the steps for on-chip trusted transmission between nodes of a neural network accelerator in one embodiment of the present invention.

[0269] In one embodiment of the method described above, the step of reliable on-chip transmission between neural network accelerator nodes further includes:

[0270] Step S6411: Establish a trusted channel between the source node and the destination node for data transmission;

[0271] Step S6412: The data to be transmitted is encrypted and protected with the aforementioned integrity protection, and then transmitted via the trusted channel.

[0272] Please refer to Figure 14 , Figure 14 This is a flowchart of the steps for off-chip trusted transmission between nodes of a neural network accelerator in one embodiment of the present invention.

[0273] In one embodiment of the method described above, the step of off-chip trusted transmission between neural network accelerator nodes further includes:

[0274] Step S6421: Establish a direct transmission channel between the source node and the destination node for data transmission;

[0275] Step S6422: Generate the integrity protection for the data to be transmitted, and transmit the data on the direct transmission channel.

[0276] Please refer to Figure 15 , Figure 15 This is a flowchart of the steps for verifying the protection against replay attacks in one embodiment of the present invention.

[0277] In one embodiment of the method described above, the step of verifying against replay attacks further includes:

[0278] Step S6431: The communication verification engine 53 obtains the second node number and the second tensor version number through the trusted channel;

[0279] Step S6432: Obtain the maximum tensor version number by indexing the array of maximum version numbers of other nodes 5232 based on the second node number index;

[0280] Step S6433: The verification that the second tensor version number is greater than the maximum tensor version number is successful.

[0281] Please refer to Figure 16 , Figure 16 This is a flowchart illustrating the steps for setting tensor data permissions during transmission in one embodiment of the present invention.

[0282] In one embodiment of the method described above, the step of setting tensor data permissions during transmission further includes:

[0283] Step S6441: Set three data transfer permissions: read-only, read-write, and invalid;

[0284] Step S6442: During computation, the tensor data of neural network accelerator node 2 is in a read / write state;

[0285] Step S6443: During the transmission process, the tensor on node 2 of the target neural network accelerator is in an invalid state;

[0286] Step S6444: After the transmission is complete, the tensor of node 2 of the target neural network accelerator is converted to a read-only state.

[0287] Please refer to Figure 17 , Figure 17 This is a flowchart of the steps for communication at the tensor level of a neural network layer in one embodiment of the present invention.

[0288] In one embodiment of the method described above, the step of communicating at the tensor level of the neural network layer further includes:

[0289] Step S91: Tensor readout step within a neural network accelerator node;

[0290] Step S92: Tensor writing step within a neural network accelerator node;

[0291] Step S93: Tensor transfer steps between neural network accelerator nodes;

[0292] Step S94: Tensor reading steps between neural network accelerator nodes.

[0293] Please refer to Figure 18 , Figure 18 This is a flowchart of the tensor reading step within a neural network accelerator node in one embodiment of the present invention.

[0294] In one embodiment of the method described above, the step of tensor reading within the neural network accelerator node further includes:

[0295] Step S911: The memory controller 5 obtains the layer number from the instruction sent by the control processor 3, indexes the version number of the first tensor, and sends it to the encryption / decryption engine 52;

[0296] Step S912: Read the ciphertext and the ciphertext message verification code from the dynamic random access memory 6 according to the first tensor version number;

[0297] Step S913: The encryption / decryption module 521 performs decryption to obtain plaintext and sends it to the computing unit 4;

[0298] Step S914: Hash module 522 performs integrity protection verification.

[0299] Please refer to Figure 19 , Figure 19This is a flowchart of the tensor writing steps within a neural network accelerator node in one embodiment of the present invention.

[0300] In one embodiment of the method described above, the step of writing tensors within the neural network accelerator node further includes:

[0301] Step S921: Update the version number of the first tensor and store it in the tensor dictionary 5231 within the node;

[0302] Step S922: Perform encryption operation based on the updated first tensor version number and encryption / decryption module 521;

[0303] Step S923: Write the ciphertext into dynamic random access memory 6;

[0304] Step S924: Hash module 522 generates integrity protection.

[0305] Please refer to Figure 20 , Figure 20 This is a flowchart of the tensor transfer steps between nodes of a neural network accelerator in one embodiment of the present invention.

[0306] In one embodiment of the method described above, the step of tensor transfer between neural network accelerator nodes further includes:

[0307] Step S931: Transmit the second node number and the second tensor version number through on-chip trusted transmission between nodes of the neural network accelerator;

[0308] Step S932: Perform anti-replay attack verification;

[0309] Step S933: Store the version number of the second tensor into the inter-node tensor dictionary 5233;

[0310] Step S934: Use the tensor ciphertext obtained through the second tensor version number and the message verification code of the tensor ciphertext for off-chip trusted transmission between the nodes of the neural network accelerator.

[0311] Please refer to Figure 21 , Figure 21 This is a flowchart of the tensor reading steps between neural network accelerator nodes in one embodiment of the present invention.

[0312] In one embodiment of the method described above, the tensor reading step between neural network accelerator nodes further includes:

[0313] Step S941: The encryption / decryption engine 52 obtains the second tensor version number from the inter-node tensor dictionary 5233;

[0314] Step S942: Read the ciphertext and the ciphertext message verification code from dynamic random access memory 6 according to the second tensor version number;

[0315] Step S943: The encryption / decryption module 521 performs decryption to obtain plaintext and sends it to the computing unit 4;

[0316] Step S944: Hash module 522 performs integrity protection verification.

[0317] On-chip trusted data transmission in the inter-node neural network accelerator involves tensor version numbers and node numbers, while off-chip data transmission involves ciphertext tensors and their message verification codes. On-chip trusted data is fundamental to data security and relies on a software trusted channel during transmission. First, a trusted channel is established between the source and destination nodes, for example, by generating the same key using protocols like Diffie-Hellman. Then, the trusted channel is used to encrypt and generate a MAC, ensuring the trusted transmission of on-chip data. Off-chip data is transmitted simultaneously with on-chip data transmission. It's important to note that the off-chip data is already encrypted, and the MAC does not need to be confidential; therefore, it does not require transmission through a trusted channel, thus avoiding the overhead of software re-encryption and decryption.

[0318] Please refer to Figure 22 , Figure 22 This is a schematic diagram illustrating the update of tensor version numbers during data aggregation between nodes of a neural network accelerator in one embodiment of the present invention.

[0319] Figure 22 This diagram illustrates the version number updates within nodes during the aggregation process and the maximum version number of tensors received from other nodes stored on-chip. The diagram uses three nodes as an example for illustration, but this invention is not limited to this. Each node Nx contains three tensors ax, bx, and cx, which are aggregated through communication. The parentheses below each tensor indicate its version number within that node. For generalization, the third tensor in node N2 is decremented instead of incrementing in the order ax, bx, cx. The "maximum version number of other nodes" for the current node is displayed below each node.

[0320] Please refer to Figure 4 , Figure 4 This is a block diagram of a data-parallel trusted distributed neural network accelerator architecture according to an embodiment of the present invention.

[0321] The present invention also discloses a data-parallel trusted distributed neural network accelerator architecture 10, a method for implementing any of the above, comprising:

[0322] Host node 1 is used for remote authentication, control, and data distribution to multiple neural network accelerator nodes 2;

[0323] Dynamic random access memory (DRAM) 6;

[0324] Multiple neural network accelerator nodes 2, further including:

[0325] Control processor 3;

[0326] Calculation Unit 4;

[0327] Memory controller 5, used to provide trusted data protection, includes:

[0328] Global version number structure building module 51: global version number structure 523 used to build distributed large models on-chip;

[0329] Encryption / decryption engine 52: used to encrypt, decrypt, generate, and verify data without using addresses; the encryption, decryption, integrity protection generation, and integrity protection verification are communicated at the tensor level of the neural network layer.

[0330] Please refer to Figure 23 , Figure 23 This is a block diagram of a data-parallel trusted distributed neural network accelerator according to an embodiment of the present invention.

[0331] The present invention also discloses a data-parallel trusted distributed neural network accelerator 100, which is built using the above-described architecture.

[0332] Please refer to Figure 24 , Figure 24 This is a block diagram of a server using a data-parallel trusted distributed neural network accelerator in one embodiment of the present invention.

[0333] The present invention also discloses a server 200, including a processor 2001, a memory 2002, and an input / output interface 2003, wherein the processor 2001, the memory 2002, and the input / output interface 2003 are connected through a system bus 2004, and also includes the aforementioned neural network accelerator.

[0334] The processor 2001 described above can be a CPU (Central Processing Unit), a general-purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It can implement or execute the various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. The processor 2001 can also be a combination that implements computational functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc.

[0335] The present invention also discloses a storage medium for storing a computer control program, the computer control program being used to execute the steps of any of the above methods.

[0336] The computer program that can be executed by the processor 2001 may be placed in random access memory (RAM), memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, register, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0337] In summary, the present invention may have many other embodiments. Without departing from the spirit and essence of the present invention, those skilled in the art can devise various corresponding changes and modifications based on the present invention, but these corresponding changes and modifications should all fall within the protection scope of the patent application of the present invention.

Claims

1. A method for constructing a data-parallel trusted distributed neural network accelerator architecture, characterized in that, The method comprises the following steps: a host node step for remotely authenticating, controlling and distributing data to a plurality of neural network accelerator nodes; a dynamic random access memory step; the plurality of neural network accelerator nodes step further comprises: a control processor step; a computing unit step; a memory controller step for providing data trust protection, which further comprises: constructing a global version number structure of a distributed large model on-chip; encrypting, decrypting, integrity protection generation and integrity protection verification of data without using data addresses; the encryption, decryption, integrity protection generation and integrity protection verification are performed in tensor granularity of a neural network layer.

2. The method of claim 1, wherein, The step of remotely authenticating the plurality of neural network accelerator nodes further comprises: Step S11: The host node requests remote authentication from the neural network accelerator node and establishes a trusted communication channel; Step S12: The neural network accelerator node generates a report according to the on-chip root of trust and sends it to the host node; Step S13: The host node verifies the authenticity of the report according to the manufacturer's information; Step S14: The host node assigns a global accelerator number and an application key to the neural network accelerator node, completing the remote authentication.

3. The method of claim 2, wherein, The step of providing data trust protection includes data trust protection within and between neural network accelerator nodes.

4. The method of claim 1 or 3, wherein, The step of constructing a global version number structure of a distributed large model on-chip comprises: constructing an on-chip root state structure; setting up a global version number structure in the on-chip root state, including: an intra-node tensor dictionary, further comprising: a first tensor version number; a layer number; an array of maximum version numbers of other nodes, further comprising: a first node number; a maximum version number; an inter-node tensor dictionary, further comprising: a tensor address; a second tensor version number; a second node number.

5. The method of claim 4, wherein, The first tensor version number and the second tensor version number are globally incremental and non-repetitive in the respective neural network accelerator nodes.

6. The method of claim 4, wherein, The step of encrypting, decrypting, integrity protection generation and integrity protection verification of data without using addresses is performed through the global version number.

7. The method of claim 6, wherein, The step of encrypting, decrypting, integrity protection generation and integrity protection verification through the global version number further comprises: Step S61: Constructing an encryption and decryption engine to ensure encryption, decryption, integrity protection generation and integrity protection verification during data transmission, including: Step S62: Constructing an encryption and decryption module; Step S63: Constructing a hash module; Step S64: Constructing a communication verification engine to ensure trusted transmission between neural network accelerator nodes.

8. The method of claim 7, wherein, The encryption and decryption through the global version number is performed by a block encryption method, including: AES-CTR method.

9. The method of claim 8, wherein, The step of encrypting through the global version number further comprises: Step S811: Combining the node number, tensor version number and block sequence number to obtain a data block identifier; Step S812: The encryption and decryption module encrypts the data block identifier to obtain ciphertext; Step S813: XOR operation is performed on the ciphertext and plaintext to obtain ciphertext data.

10. The method of claim 9, wherein, The step of decrypting by the global version number further comprises: Step S821: combining the node number, the tensor version number, and the block sequence number to obtain a data block identifier; Step S822: encrypting the data block identifier by the encryption and decryption module to obtain ciphertext; Step S823: performing an exclusive OR operation on the ciphertext data and the data block identifier to obtain plaintext.

11. The method of claim 10, wherein, The step of encrypting and decrypting within the neural network accelerator node further comprises: The node number is a first node number; The tensor version number is a first tensor version number.

12. The method of claim 10, wherein, The step of encrypting and decrypting between the neural network accelerator nodes further comprises: The node number is a second node number; The tensor version number is a second tensor version number.

13. The method of claim 7, wherein, The step of integrity protection generation by the global version number further comprises: Step S831: performing a hash operation on the ciphertext of each data block by the hash module; Step S832: performing an exclusive OR operation on the hash result and the corresponding ciphertext to obtain a message authentication code of each data block; Step S833: performing an exclusive OR operation on the message authentication codes of each data block to obtain a message authentication code of the tensor and storing the message authentication code in the dynamic random access memory.

14. The method of claim 13, wherein, The step of integrity protection verification by the global version number further comprises: Step S841: calculating the message authentication code of each data block according to the data block ciphertext obtained in the decryption step; Step S842: performing an exclusive OR operation on the message authentication codes of each data block to obtain a message authentication code of the tensor; Step S843: comparing the message authentication code of the tensor with the message authentication code of the tensor in the dynamic random access memory; Step S844: passing the integrity protection verification if the comparison result is consistent.

15. The method of claim 7, wherein, The step of ensuring trusted transmission between the neural network accelerator nodes further comprises: Step S641: on-chip trusted transmission between the neural network accelerator nodes; Step S642: off-chip trusted transmission between the neural network accelerator nodes; Step S643: performing anti-replay attack verification; Step S644: setting the tensor data authority in the transmission process.

16. The method of claim 15, wherein, The step of on-chip trusted transmission between the neural network accelerator nodes further comprises: Step S6411: establishing a trusted channel between the source node and the target node for data transmission; Step S6412: performing the encryption and the integrity protection generation on the data to be transmitted and performing data transmission on the trusted channel.

17. The method of claim 15, wherein, The step of off-chip trusted transmission between the neural network accelerator nodes further comprises: Step S6421: establishing a direct transmission channel between the source node and the target node for data transmission; Step S6422: performing the integrity protection generation on the data to be transmitted and performing data transmission on the direct transmission channel.

18. The method of claim 16, wherein, The step of anti-replay attack verification further comprises: Step S6431: the communication verification engine obtains the second node number and the second tensor version number through the trusted channel; Step S6432: indexing the maximum tensor version number from the maximum version number array of the other nodes according to the second node number to obtain the maximum tensor version number; Step S6433: verifying that the second tensor version number is greater than the maximum tensor version number.

19. The method of claim 15, wherein, The step of setting the tensor data permission in the transmission process further includes: Step S6441: setting three transmission data permissions of read-only, read-write and invalid; Step S6442: the tensor data is in read-write state when the neural network accelerator node is calculating; Step S6443: the tensor on the target neural network accelerator node is in invalid state during the transmission process; Step S6444: the tensor on the target neural network accelerator node is converted to read-only state after the transmission is completed.

20. The method of claim 19, wherein, The step of communicating in the granularity of the tensor of the neural network layer further includes: Step S91: a tensor reading step in the neural network accelerator node; Step S92: a tensor writing step in the neural network accelerator node; Step S93: a tensor transmission step between the neural network accelerator nodes; Step S94: a tensor reading step between the neural network accelerator nodes.

21. The method of claim 20, wherein, The tensor reading step in the neural network accelerator node further includes: Step S911: the memory controller indexes the first tensor version number according to the layer number obtained from the control processor sending instruction and sends it to the encryption and decryption engine; Step S912: the ciphertext and the message authentication code of the ciphertext are read from the dynamic random access memory according to the first tensor version number; Step S913: the encryption and decryption module performs decryption to obtain the plaintext and sends it to the computing unit; Step S914: the hash module performs integrity protection verification.

22. The method of claim 20, wherein, The tensor writing step in the neural network accelerator node further includes: Step S921: updating the first tensor version number and storing it into the node tensor dictionary; Step S922: performing encryption operation according to the updated first tensor version number and the encryption and decryption module; Step S923: writing the ciphertext into the dynamic random access memory; Step S924: the hash module generates integrity protection.

23. The method of claim 20, wherein, The tensor transmission step between the neural network accelerator nodes further includes: Step S931: transmitting the second node number and the second tensor version number through the on-chip trusted transmission between the neural network accelerator nodes; Step S932: performing anti-replay attack verification; Step S933: storing the second tensor version number into the inter-node tensor dictionary; Step S934: performing the off-chip trusted transmission of the tensor data obtained through the second tensor version number and the message authentication code of the tensor data.

24. The method of claim 20, wherein, The tensor reading step between the neural network accelerator nodes further includes: Step S941: the encryption and decryption engine obtains the second tensor version number from the inter-node tensor dictionary; Step S942: reading the ciphertext and the message authentication code of the ciphertext from the dynamic random access memory according to the second tensor version number; Step S943: the encryption and decryption module performs decryption to obtain the plaintext and sends it to the computing unit; Step S944: the hash module performs integrity protection verification.

25. A data and parallelism based trusted distributed neural network accelerator system for implementing the method of any one of claims 1 to 24, characterized in that, It includes: A host node for remotely authenticating, controlling and data distributing a plurality of neural network accelerator nodes; A dynamic random access memory; A plurality of neural network accelerator nodes, further including: A control processor; A computing unit; A memory controller for providing data trusted protection, which further includes: A global version number structure building module for building a global version number structure on-chip for distributed large models; An encryption and decryption engine for encryption, decryption, integrity protection generation and integrity protection verification of data without using addresses; the encryption, decryption, integrity protection generation and integrity protection verification are communicated in tensor granularity of a neural network layer.

26. A data and parallelism based trusted distributed neural network accelerator, comprising: is built using a system as claimed in claim 25.

27. A server comprising a processor, a memory, an input output interface, the processor, the memory, the input output interface are connected through a system bus, characterized in that Also included is a neural network accelerator as claimed in claim 26.

28. A storage medium for storing a computer control program, characterized by The computer control program is for performing the steps of the method as claimed in any one of claims 1 to 24.

Images