Method, system, computing device, medium and program product for transmitting data

Abstract

The present invention relates to a method, system, computing device, medium and program product for transmitting data. The method comprises: obtaining interactive data between a host and a device, wherein the host and the device are configured with one or more physically isolated hardware access paths, wherein the interactive data comprises business data and other data; providing the business data in the interactive data to a cryptographic engine; and encrypting and / or decrypting the business data via the cryptographic engine, wherein the cryptographic engine is inlined on the hardware access path. The present invention can effectively avoid leakage of sensitive data.

Description

Technical Field

[0001] Embodiments of the present invention generally relate to the field of artificial intelligence, and more specifically, to a method, system, computing device, computer-readable storage medium, and computer program product for transmitting data. Background Art

[0002] In the artificial intelligence computing environment, data interaction is relatively frequent. For example, a considerable amount of data needs to be transmitted between the host and the device (for example, GPU). The data transmitted from the host to the GPU via PCIe may include: Direct Memory Access (DMA) data, command packets, page tables, kernel functions, etc. In the traditional method of transmitting data between the host and the device, the data is usually transmitted without encryption, and the data is stored without protection, which can easily lead to the leakage of sensitive data.

[0003] In summary, the traditional method for transmitting data has the disadvantage that it is easy to cause leakage of sensitive data. Summary of the invention

[0004] The present invention provides a method, system, computing device, computer-readable storage medium and computer program product for transmitting data, which can effectively avoid leakage of sensitive data.

[0005] According to a first aspect of the present invention, a method for transmitting data is provided. The method comprises: obtaining interactive data between a host and a device, the host and the device being configured with one or more physically isolated hardware access paths, the interactive data comprising business data and other data; providing business data in the interactive data to a cryptographic engine; and encrypting and / or decrypting the business data via the cryptographic engine, the cryptographic engine being inlined on the hardware access path.

[0006] In some embodiments, the cryptographic engine is configured to be inline between a device portal on a device side and a high-speed bus, and the cryptographic engine is configured to be enabled or disabled based on a confidential computing mode flag.

[0007] In some embodiments, the interaction data is direct memory access data, and the other data includes: at least one of command packets, kernel functions, and page tables. The method also includes: providing other data in the interaction data to an open buffer area in high-bandwidth memory associated with a hardware access path via a device portal; and storing the business data encrypted and / or decrypted via a cryptographic engine to an encrypted memory area in high-bandwidth memory associated with a hardware access path.

[0008] In some embodiments, providing the business data in the interaction data to the cryptographic engine includes: providing the business data from the device to the host to the cryptographic engine via a security detection module of the device portal, and the cryptographic engine is configured to be inline between the device portal and the high-speed bus.

[0009] In some embodiments, the method for transmitting data also includes: on the host side, via the kernel mode driver, calling an encryption algorithm to encrypt business data in the interaction data to be transmitted to the device side, so as to provide the encrypted business data to an encryption buffer; providing other data in the interaction data to be transmitted to the device side to the host shared memory via the kernel mode driver; and providing the encrypted business data and other unencrypted data to the device portal via PCIe.

[0010] In some embodiments, encrypting and / or decrypting the business data via the cryptographic engine includes: checking the encryption computing mode, the data type of the interaction data, and the hardware access path identifier via the security detection module of the device portal; in response to the security detection module determining that the encryption computing mode has been started and the data type indicates business data, providing the business data to the cryptographic engine so that the cryptographic engine decrypts the business data; based on the hardware access path identifier, providing the decrypted business data to an encrypted memory area in the high-bandwidth memory corresponding to the hardware access path identifier; and in response to the security detection module determining that the data type indicates other data, based on the hardware access path identifier, providing the other data to an open buffer area in the high-bandwidth memory corresponding to the hardware access path identifier.

[0011] In some embodiments, the method for transmitting data also includes: dividing the high-bandwidth memory on the device side into multiple memory areas for mapping multiple hardware access paths that are respectively isolated from the hardware, the multiple hardware access paths including at least one confidential hardware access path; and configuring the memory area corresponding to the confidential hardware access path as an open buffer area and an encrypted memory area, the open buffer area is used to store other data associated with the confidential hardware access path, and the encrypted memory area is used to store business data associated with the confidential hardware access path.

[0012] In some embodiments, the method for transmitting data also includes: encrypting, via a cryptographic engine, direct memory access data from a device portal to be transmitted to a host side so as to obtain encrypted direct memory access data; providing the encrypted direct memory access data to a designated buffer of the host via PCIe; and notifying an encryption virtual machine of the host that the encrypted direct memory access data is ready.

[0013] According to the second aspect of the present invention, a system is also provided. The system includes: a host, configured to transmit interactive data with a device via PCIe; a device, the device at least including: a device portal, which obtains interactive data transmitted between the host and the device, the host and the device are configured with one or more physically isolated hardware access paths, the interactive data includes business data and other data; and a cryptographic engine, configured to encrypt and / or decrypt the business data, the cryptographic engine being inlined on the hardware access path.

[0014] According to a third aspect of the present invention, a computing device is also provided. The computing device comprises: at least one processor; and a memory connected to the at least one processor in communication; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can perform the method of the first aspect of the present invention.

[0015] According to a fourth aspect of the present invention, a computer-readable storage medium is further provided, wherein a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a machine, the method of the first aspect of the present invention is executed.

[0016] According to a fifth aspect of the present invention, there is also provided a computer program product, comprising a computer program, wherein when the computer program is executed by a machine, the method of the first aspect of the present invention is performed.

[0017] It should be understood that the present invention can not only encrypt and / or decrypt the interactive business data between the host and the GPU, thereby effectively avoiding the leakage of sensitive data, but also does not bring about the performance consumption cost caused by performing too many encryption and decryption operations on all interactive data.

[0018] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The above and other features, advantages and aspects of the embodiments of the present invention will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. In the accompanying drawings, the same or similar reference numerals represent the same or similar elements.

[0020] Figure 1 The figure schematically shows a schematic diagram of a computing device implementing a method for transmitting data according to an embodiment of the present invention.

[0021] Figure 2 A flow chart of a method for transmitting data according to an embodiment of the present invention is shown.

[0022] Figure 3 A schematic diagram of a system for transmitting data according to some embodiments of the present invention is shown.

[0023] Figure 4 A flow chart of a method for providing business data and other data to a device side according to an embodiment of the present invention is shown.

[0024] Figure 5 A schematic diagram of a device portal and a cryptographic engine according to an embodiment of the present invention is shown.

[0025] Figure 6 A flowchart of a method for encrypting and / or decrypting business data via a cryptographic engine according to an embodiment of the present invention is shown.

[0026] Figure 7 A schematic diagram of a GPU physical address space according to an embodiment of the present invention is shown.

[0027] Figure 8 A flow chart of a method for transmitting data from a device side to a host side according to an embodiment of the present invention is shown.

[0028] In the various drawings, the same or corresponding reference numerals represent the same or corresponding parts. DETAILED DESCRIPTION

[0029] The preferred embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although the preferred embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided to make the present invention more thorough and complete, and to fully convey the scope of the present invention to those skilled in the art.

[0030] As used herein, the term "including" and its variations mean open inclusion, i.e., "including but not limited to". Unless otherwise stated, the term "or" means "and / or". The term "based on" means "based at least in part on". The terms "an example embodiment" and "an embodiment" mean "at least one example embodiment". The term "another embodiment" means "at least one additional embodiment". The terms "first", "second", etc. may refer to different or the same objects.

[0031] As described above, the traditional method for transmitting data has the disadvantage that it easily leads to the leakage of sensitive data.

[0032] In order to at least partially solve one or more of the above problems and other potential problems, an exemplary embodiment of the present invention proposes a method for transmitting data. In this method, the business data in the acquired interactive data between the host and the device is provided to a cryptographic engine (which is inlined on the hardware access path between the host and the device); and the business data is encrypted and / or decrypted via the cryptographic engine; the present invention can not only encrypt and / or decrypt the interactive business data between the host and the GPU, thereby effectively avoiding the leakage of sensitive data, but also does not bring about the performance consumption cost caused by performing too many encryption and decryption operations on all interactive data.

[0033] Figure 1 A schematic diagram of a computing device 100 for implementing a method for transmitting data according to an embodiment of the present invention is schematically shown. Figure 1 As shown, the computing device 100 may have one or more processing units, including special processing units such as a graphics processing unit (GPU), a field programmable gate array (FPGA), an application-specific integrated circuit (ASIC), or a general-purpose graphics processing unit (GPGPU), and a general-purpose processing unit such as a CPU. In some embodiments, the computing device 100 is also configured with at least: an interactive data acquisition module 102, a business data providing module 104, and a business data encryption and / or decryption module 106. In some embodiments, the interactive data acquisition module 102, the business data providing module 104, and the business data encryption and / or decryption module 106 are, for example, program modules running on the computing device 100.

[0034] The interactive data acquisition module 102 is used to acquire interactive data between a host and a device, wherein the host and the device are configured with one or more physically isolated hardware access paths, and the interactive data includes business data and other data.

[0035] As for the business data providing module 104, it is used to provide the business data in the interactive data to the cryptographic engine.

[0036] The business data encryption and / or decryption module 106 is used to encrypt and / or decrypt the business data via a cryptographic engine, and the cryptographic engine is inline on the hardware access path.

[0037] The following will be combined Figure 2 and Figure 3 A method 200 for transmitting data according to an embodiment of the present invention is described. Figure 2 A flow chart of a method 200 for transmitting data according to an embodiment of the present invention is shown. Figure 3 FIG. 2 is a schematic diagram of a system 300 for transmitting data according to some embodiments of the present invention. It should be understood that the method 200 may be used, for example, in Figure 1 The method 200 is executed at the described computing device 100. The method 200 may also include additional actions not shown and / or may omit the actions shown, and the scope of the present invention is not limited in this respect.

[0038] exist Figure 3 In the embodiment, the system 300 includes a host (e.g., a CPU), a device (e.g., a GPU), and a peripheral component interconnect express (PCIe). The host and the device are configured with one or more physically isolated hardware access paths. The schematic diagram on the left side of the PCIe 310 indicates the host side, for example, and the schematic diagram on the right side of the PCIe 310 indicates the device side, for example. The host is configured to transmit interactive data with the device via PCIe; the device includes at least: a device portal 360 (e.g., a GPU portal) and a cryptographic engine 370. The device portal 360 is configured to obtain interactive data (the interactive data includes business data and other data) transmitted between the host (e.g., a CPU) and the device (e.g., a GPU). The cryptographic engine 370 is configured to encrypt and / or decrypt the business data, and the cryptographic engine 370 is inlined on the hardware access path (e.g., the cryptographic engine 370 is inlined between the device portal 360 and the high-speed bus 390). In some embodiments, the host (e.g., CPU) side is configured with an encrypted virtual machine 330 (e.g., CVM) and a CPU memory 340, and the encrypted virtual machine 330 further includes a kernel mode driver 332. In some embodiments, the host further includes an operating system / hypervisor 320. The CPU memory 340 includes a CPU encrypted memory 342 and a CPU shared memory 344. The device further includes a PCIe physical function (PF), i.e., a PCIe PF, e.g., Figure 3 Indicated by the mark 350.

[0039] At step 202, the computing device 100 obtains interaction data between a host and a device, where the host and the device are configured with one or more physically isolated hardware access paths, and the interaction data includes business data and other data.

[0040] For example, the device portal 360 (eg, GPU portal) on the GPU side obtains the interaction data between the CPU and the GPU (eg, interaction data from the CPU to the GPU, or interaction data from the GPU to the CPU) transmitted via the PCIe 310. The interaction data includes business data and other data.

[0041] Regarding business data, it is, for example, data related to direct memory access (DMA). In some embodiments, the business data is, for example, encrypted via the CPU side. For example, the CPU driver (e.g., Figure 3 The kernel mode driver indicated by the mark 332) calls the corresponding cryptographic engine to encrypt the business data and then put it into the corresponding encryption buffer (for example, Figure 3 The encrypted bounce buffer 346 shown in FIG. 1 ). The encrypted business data in the encryption buffer is provided to the device portal 360 via, for example, PCIe 310, as shown in FIG. Figure 3 The first half of the dashed line 376 indicates the data transmission path.

[0042] Regarding other data, for example, management data and / or interactive data. In some embodiments, the other data, for example, includes at least: command packets, kernel functions, and page tables. In some embodiments, the other data, for example, is unencrypted.

[0043] Regarding one or more physically isolated hardware access paths configured by the host and the device, for example, they are configured on hardware-based GPU virtualization. In some embodiments, a hardware-isolated GPU instance is configured on the device (e.g., GPU) side to form an independent hardware access path with at least one of the multiple virtual machines configured on the host (CPU) side, so as to be used to build a trusted execution environment supporting confidential computing. The hardware access path is, for example, formed by at least one GPU instance among the multiple GPU instances and a corresponding virtual machine among the multiple virtual machines configured on the CPU side. Specifically, regarding the method of forming an independent hardware access path, it includes, for example: the computing device 100 forms a hardware access path based on each GPU instance among the multiple GPU instances and a corresponding virtual machine among the multiple virtual machines configured on the CPU side, thereby forming multiple hardware access paths; or based on one GPU instance among the multiple GPU instances, through multiplexing, multiple hardware access paths are formed with multiple corresponding virtual machines among the multiple virtual machines.

[0044] At step 204, the computing device 100 provides the business data in the interaction data to the cryptographic engine.

[0045] Regarding the cryptographic engine 370, it is inlined in the hardware access path. The cryptographic engine 370 is connected to the device portal 360 and is configured with an encryption and / or decryption algorithm, such as Figure 3 The AES-GCM encryption algorithm shown. In some embodiments, the cryptographic engine is configured to be inline between the device portal on the device side and the high-speed bus 390, and the cryptographic engine 370 is configured to be enabled or disabled based on the confidential computing mode flag.

[0046] For example, the device portal 360 provides the business data in the acquired interaction data to the cryptographic engine 370 .

[0047] At step 206, the computing device 100 encrypts and / or decrypts the business data via a cryptographic engine, and the cryptographic engine is inlined on the hardware access path. It should be understood that by encrypting and / or decrypting the business data instead of all interactive data, the security of the business data can be guaranteed without incurring performance consumption costs caused by excessive encryption and decryption calculations.

[0048] For example, the cryptographic engine 370 utilizes the configured symmetric encryption module to encrypt and / or decrypt business data.

[0049] In some embodiments, method 200 also includes: providing other data in the interaction data to an open buffer area in high-bandwidth memory associated with a hardware access path via a device portal; and storing the business data encrypted and / or decrypted via a cryptographic engine to an encrypted memory area in high-bandwidth memory associated with a hardware access path.

[0050] like Figure 3 As shown, a high bandwidth memory (HBM), that is, HBM 380, is configured with multiple memory areas associated with a hardware access path (or referred to as "VF"), and the multiple memory areas associated with the VF include, for example: an open buffer area for the VF (e.g., VF0 open buffer area 382), an encrypted memory area for the VF (e.g., VF0 encrypted memory area 384), and a general device memory area for the VF (e.g., VF1 memory area 386). Figure 3 As shown, a portion of the multiple memory areas associated with the first hardware access path (VF0) is configured as an open buffer area associated with VF0, and another portion is configured as an encrypted memory area associated with VF0.

[0051] For example, Figure 3As shown, the computing device 100 stores the business data decrypted by the AES-GCM encryption module in the cryptographic engine 370 to the VF0 encrypted memory area 384 in the HBM 380, for example, the storage path indicated by the mark 372; and stores other data in the interaction data to the VF0 open buffer area 382 in the HBM 380, for example, the path indicated by the second half of the dotted line 374.

[0052] In the above scheme, the business data in the acquired interactive data between the host and the device is provided to a cryptographic engine (which is inlined in the hardware access path between the host and the device); and the business data is encrypted and / or decrypted via the cryptographic engine; the present invention can not only encrypt and / or decrypt the interactive business data between the host and the GPU, thereby effectively avoiding the leakage of sensitive data, but also does not bring about the performance consumption cost caused by too many encryption and decryption operations on all interactive data.

[0053] The following will be combined Figure 3 and Figure 4 A method 400 for providing business data and other data to a device side according to an embodiment of the present invention is described. Figure 4 FIG. 4 is a flowchart of a method 400 for providing service data and other data to a device according to an embodiment of the present invention. It should be understood that the method 400 may be implemented in Figure 1 The method 400 is executed at the described computing device 100. The method 400 may also include additional actions not shown and / or may omit the actions shown, and the scope of the present invention is not limited in this respect.

[0054] At step 402, the computing device 100, on the host side, via the kernel mode driver, calls an encryption algorithm to encrypt the service data in the interactive data to be transmitted to the device side, so as to provide the encrypted service data to the encryption buffer. Figure 3 Indicated by the dashed line 377.

[0055] Regarding the kernel mode driver 332, it is, for example, a driver running in the operating system kernel space, which can directly access the operating system kernel and perform low-level operations and control on system resources, including device management, memory management, process management, etc. In some embodiments, the kernel mode driver 332 matches hardware resources based on whether the data to be interacted involves direct memory access (DMA) data.

[0056] For example, the kernel mode driver 332 provides the service data to the encryption bounce buffer 346 after encryption. Regarding the encryption bounce buffer, it is, for example, a section of memory managed by the CPU for storing encrypted data. In some embodiments, the encryption bounce buffer can be continuous with the shared memory, depending on the CPU memory management.

[0057] At step 404, the computing device 100 provides other data in the interactive data to be transmitted to the device side to the host shared memory via the kernel mode driver. Figure 3 Indicated by the dashed line 375.

[0058] For example, the kernel mode driver 332 provides command packets, kernel functions, page tables and other data directly to the CPU shared memory 344, such as Figure 3 Indicated by the dashed line 375.

[0059] At step 406, the computing device 100 provides the encrypted business data and other unencrypted data to the device portal via PCIe.

[0060] For example, the encrypted business data at the encryption bounce buffer 346 and the unencrypted other data at the host shared memory 344 are provided to the device portal 360 on the GPU side via the PCIe 310, as shown in FIG. Figure 3 The paths are indicated by the first half of dashed lines 374 and 376 .

[0061] By adopting the above means, the host side can realize encrypted storage and transmission of business data.

[0062] Figure 5 A schematic diagram of a device portal 360 and a cryptographic engine 370 according to an embodiment of the present invention is shown.

[0063] like Figure 5 As shown, the device portal 360 is configured with, for example: a virtualization wrap module, an address translation module, a security detection module 362, and an AXI-Bridge interface.

[0064] Regarding the security detection module 362, it is used to detect the corresponding interaction data. In some embodiments, the security detection module is also configured to provide the interaction data to the cryptographic engine 370 if it is determined that the interaction data is business data (for example, DMA data); and if the interaction data is other data, it is not provided to the cryptographic engine 370.

[0065] Regarding the address conversion module, it is used to implement address conversion on the CPU and GPU sides, such as address conversion for the system memory address space, PCIe address space, high-speed bus address, low-speed bus address, or HBM physical address on the CPU side.

[0066] Regarding the AXI bridge interface, it is used for high-bandwidth access to the AXI memory mapping space from the host. The present invention can map one or more PCIe BARs of a physical function (or "PF") or a virtual function to the AXI bridge interface.

[0067] like Figure 5 As shown, the cryptographic engine 370 is configured to be inline between the device portal 360 and the high-speed bus 390. It should be understood that by inlining the cryptographic engine 370 between the device portal and the high-speed bus, a high-throughput encryption / decryption function can be provided for DMA data, avoiding the throughput limitation of encrypted DMA data transmission caused by using a conventional symmetric key engine (SKE). In some embodiments, the cryptographic engine 370 is configured with, for example: an input control module module, an output control module, an AES-CTR encryption module, a GSM hash encryption module. A cryptographic index and context memory, and a hash index and context memory.

[0068] Regarding the input control module and the output control module, they are mainly used to manage and convert according to the bit width, address logic, bus protocol, etc. of the input or output data.

[0069] Regarding the AES (Advanced Encryption Standard)-CTR (Counter Mode) encryption module, it is, for example, a symmetric encryption module, which, for example but not limited to, performs parallel encryption processing based on the AES-CTR encryption algorithm.

[0070] Regarding the GSM hash encryption module, it is an asymmetric encryption module. Generally speaking, the present invention performs symmetric encryption and decryption on the transmitted business data, and performs asymmetric encryption and decryption on the authentication data.

[0071] The following will be combined Figure 5 and Figure 6 A method 600 for encrypting and / or decrypting business data via a cryptographic engine according to an embodiment of the present invention is described. Figure 6 FIG. 6 is a flowchart of a method 600 for encrypting and / or decrypting business data via a cryptographic engine according to an embodiment of the present invention. It should be understood that the method 600 may be implemented, for example, in Figure 1 The method 600 is executed at the described computing device 100. The method 600 may also include additional actions not shown and / or may omit the actions shown, and the scope of the present invention is not limited in this respect.

[0072] At step 602, the computing device 100 checks the encryption computing mode, the data type of the interactive data, and the hardware access path identification via the security detection module of the device portal.

[0073] Regarding the encryption computing mode identifier, it is used to enable or disable the encryption and / or decryption function of the cryptographic engine for business data. In some embodiments, the encryption computing mode identifier is, for example, cc_flag. For example, cc_flag == ENABLED, which indicates, for example, that the encryption computing mode is turned on, that is, the encryption and / or decryption function of the cryptographic engine for business data is enabled. If the encryption computing mode identifier indicates, for example, that the encryption computing mode is turned off, the encryption and / or decryption function of the cryptographic engine for business data is disabled. In some embodiments, the encryption computing mode identifier is associated with a hardware access path.

[0074] In some embodiments, when the computing device 100 transmits interactive data, it passes a security flag indicating a "non-secure state" (eg, AxPROT[1] = non-secure) to the GPU portal.

[0075] At step 604, if the security detection module determines that the encryption calculation mode has been started and the data type indicates business data, the business data is provided to the cryptographic engine so that the cryptographic engine decrypts the business data.

[0076] If the security detection module of the device portal determines that the encryption computing mode for the confidential hardware access path (CVF) is turned on, then for the transmission of business data (DMA data) from the host to the device, the device portal provides the business data to the inline cryptographic engine for decryption.

[0077] At step 606, the computing device 100 provides the decrypted business data to an encrypted memory area in the high bandwidth memory corresponding to the hardware access path identifier based on the hardware access path identifier.

[0078] For example, if the hardware access path identifier indicates the first hardware access path VF0, the business data is decrypted via the symmetric encryption module (e.g., AES-CTR encryption module) of the cryptographic engine. After the decryption process, the device portal sets the security identifier AxPROT[1] to "secure state", for example, AwPROT[1] = secure, and provides the decrypted business data to the target address of the VF0 encrypted memory area 384 for storage. The VF0 encrypted memory area 384 is configured to be readable and writable by the corresponding encrypted virtual machine of the first hardware access path VF0.

[0079] At step 608 , if the security detection module determines that the data type indicates other data, based on the hardware access path identifier, the other data is provided to an open buffer area in the high bandwidth memory corresponding to the hardware access path identifier.

[0080] For example, if the device portal determines that the data type indicates other data rather than business data, and the hardware access path identifier indicates the first hardware access path VF0, the other data is directly processed or provided to the VF0 open buffer area 382 for storage. The VF0 open buffer area 382 is configured to be readable by the corresponding encrypted virtual machine of the first hardware access path VF0.

[0081] The following will be combined Figure 7 The configuration of the GPU physical address space according to an embodiment of the present invention is described. Figure 7 A schematic diagram of a GPU physical address space 700 according to an embodiment of the present invention is shown.

[0082] from Figure 7 As shown, regarding the GPU physical address space, it is, for example, a high bandwidth memory (HBM) address space. The high bandwidth memory on the device side is configured to divide into multiple memory areas for mapping to multiple hardware access paths isolated from the hardware, respectively, and the multiple hardware access paths include at least one confidential hardware access path; and the memory area corresponding to the confidential hardware access path is configured as an open buffer area and an encrypted memory area, the open buffer area is used to store other data associated with the confidential hardware access path, and the encrypted memory area is used to store business data associated with the confidential hardware access path.

[0083] For example, the GPU is configured with four GPU instances that are physically isolated from each other, and four hardware access paths that are isolated from each other are formed based on the four GPU instances that are physically isolated from each other and the corresponding virtual machines on the CPU side. That is, the first hardware access path (VF0), the second hardware access path (VF1), the third hardware access path (VF2), and the fourth hardware access path (VF3). Correspondingly, the GPU physical address space is configured with the VF0 device memory area, the VF1 device memory area, the VF2 device memory area, and the VF3 device memory area corresponding to the four hardware access paths. If any user's hardware access path (for example, the first hardware access path (VF0)) is configured as a confidential hardware access path, the cryptographic engine inlined in the confidential hardware access path (for example, the first hardware access path (VF0)) is, for example, started. The device memory area corresponding to the confidential hardware access path is, for example, configured as an open buffer area and an encrypted memory area, the open buffer area is used to store other data associated with the confidential hardware access path, and the encrypted memory is used to store business data associated with the confidential hardware access path. For example, the VF0 device memory area 388 includes a VF0 encrypted memory area 384 and a VF0 open buffer area 382 .

[0084] Regarding the open buffer area, it is configured to exchange unencrypted data (e.g., other data) with a host (e.g., CPU) or other clients in a confidential computing mode. For the data stored in the open buffer area, the corresponding hardware access path (VF) can read the data, but cannot write the data.

[0085] Regarding the encrypted memory area, the writing or reading of all business data of the corresponding hardware access path needs to be performed in the corresponding encrypted memory area. In some embodiments, the security bit of the address in the page table can be used to check the security access of the memory, depending on whether the memory address is within the given security area. For example, the first hardware access path VF0 constructed by the encrypted virtual machine (e.g., CVM) on the host side and the first GPU instance on the GPU side is an encrypted hardware access path for confidential computing. For example, the confidential virtual machine (CVM) in the host is responsible for encrypting the business data (e.g., DMA data) to be transmitted to the GPU, and then transmitting it to the device portal via PCIe. The device portal provides the business data to the cryptographic engine for decryption. Then, the decrypted business data is processed, and the decrypted or processed business data is stored in the encrypted memory area (e.g., VF0 encrypted memory area 384).

[0086] The following will be combined Figure 7 and Figure 8 A method 800 for transmitting data from a device side to a host side according to an embodiment of the present invention is described. Figure 8FIG. 8 is a flowchart of a method 800 for transmitting data from a device side to a host side according to an embodiment of the present invention. It should be understood that the method 800 may be implemented, for example, in Figure 1 The method 800 is executed at the described computing device 100. The method 800 may also include additional actions not shown and / or may omit the actions shown, and the scope of the present invention is not limited in this respect.

[0087] At step 802, the computing device 100 encrypts the direct memory access data from the device portal to be transmitted to the host side via the cryptographic engine to obtain encrypted direct memory access data.

[0088] Regarding the DMA data, it is, for example but not limited to, a calculation result of business data.

[0089] For example, the GPU portal provides DMA data to be transferred from the GPU to the CPU to the cryptographic engine, and the cryptographic engine encrypts the DMA data.

[0090] At step 804, the computing device 100 provides the encrypted direct memory access data to a designated buffer of the host via PCIe.

[0091] At step 806, the computing device 100 notifies the host's encrypted virtual machine that the encrypted direct memory access data is ready.

[0092] By adopting the above-mentioned means, the present invention can effectively avoid leakage of sensitive data in data transmitted from the device side to the host side.

[0093] The various processes and processing described above, such as methods 200, 400, 600, and 800, may be performed at a computing device. The computing device, for example, includes: at least one processor (at least one graphics processor and at least one central processing unit); and a memory connected to the at least one processor in communication; wherein the memory stores instructions that can be executed by at least one processor, and the instructions are executed by at least one processor. In some embodiments, methods 200, 400, 600, and 800 may be implemented as a computer software program or program product, which is tangibly contained in a machine-readable medium. In some embodiments, part or all of the computer program may be loaded and / or installed on a computing device via a read-only memory (ROM) and / or a communication unit. When the computer program is loaded into a random access memory (RAM) and executed by a GPU and a CPU, one or more actions of methods 200, 400, 600, and 800 described above may be performed.

[0094] The present invention may be a method, an apparatus, a system and / or a computer program product. The computer program product may include a computer-readable storage medium having computer-readable program instructions for executing various aspects of the present invention. The computer-readable storage medium may be a tangible device that can hold and store instructions used by an instruction execution device. The computer-readable storage medium may be, for example, but not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination thereof.

[0095] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to various computing / processing devices, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. Various aspects of the present invention are described herein with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each box of the flowchart and / or block diagram, and the combination of boxes in the flowchart and / or block diagram, can be implemented by computer-readable program instructions.

[0096] These computer-readable program instructions can be provided to a central processing unit of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine, so that when these instructions are executed by the central processing unit of the computer or other programmable data processing device, a device that implements the functions / actions specified in one or more boxes in the flowchart and / or block diagram is generated. These computer-readable program instructions can also be stored in a computer-readable storage medium, and these instructions cause the computer, programmable data processing device, and / or other equipment to work in a specific manner, so that the computer-readable medium storing the instructions includes a manufactured product, which includes instructions for implementing various aspects of the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0097] The flow chart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to multiple embodiments of the present invention. In this regard, each square box in the flow chart or block diagram can represent a part of a module, program segment or instruction, and a part of a module, program segment or instruction includes one or more executable instructions for realizing the logical function of the specification. In some alternative implementations, the function marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two continuous square boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the function involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be realized by a special hardware-based system that performs the function or action of the specification, or can be realized by a combination of special hardware and computer instructions.

[0098] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this application can be executed in parallel, sequentially or in different orders, as long as the expected results of the technical solution disclosed in this application can be achieved, and this document is not limited here.

[0099] The above specific implementations do not constitute a limitation on the protection scope of the present application. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions may be made according to design requirements and other factors.

Claims

1. A method for transmitting data, characterized in that: The method comprises: Acquire interaction data between a host and a device, wherein the host and the device are configured with one or more physically isolated hardware access paths, and the interaction data includes business data and other data; Providing the business data in the interactive data to the cryptographic engine; Encrypting and / or decrypting the service data via a cryptographic engine, wherein the cryptographic engine is inlined on a hardware access path; Dividing the high-bandwidth memory on the device side into a plurality of memory regions for mapping to a plurality of hardware access paths isolated from the hardware, respectively, the plurality of hardware access paths including at least one confidential hardware access path; and Among them, encrypting and / or decrypting the business data via the cryptographic engine includes: checking the encryption calculation mode, the data type of the interactive data, and the hardware access path identifier via the security detection module of the device portal; in response to the security detection module determining that the encryption calculation mode has been started and the data type indicates business data, providing the business data to the cryptographic engine so that the cryptographic engine decrypts the business data.

2. The method according to claim 1, characterized in that: The cryptographic engine is configured to be inline between a device portal on a device side and a high-speed bus, and the cryptographic engine is configured to be enabled or disabled based on a confidential computing mode flag.

3. The method according to claim 1, characterized in that The interactive data is direct memory access data, the other data includes: at least one of a command packet, a kernel function, and a page table, and the method further includes: Providing, via the device portal, other of the interaction data to an open buffer area in the high bandwidth memory associated with the hardware access path; and The business data encrypted and / or decrypted via the cryptographic engine is stored in an encrypted memory area associated with a hardware access path in the high bandwidth memory.

4. The method according to claim 1, characterized in that Providing the business data in the interactive data to the cryptographic engine includes: The business data from the device to the host is provided to the cryptographic engine via the security detection module of the device portal, and the cryptographic engine is configured to be inline between the device portal and the high-speed bus.

5. The method according to claim 1, characterized in that Also includes: On the host side, via the kernel mode driver, an encryption algorithm is called to encrypt the service data in the interactive data to be transmitted to the device side, so as to provide the encrypted service data to the encryption buffer; Providing other data in the interaction data to be transmitted to the device side to the host shared memory via the kernel mode driver; as well as Encrypted business data and unencrypted other data are provided to the device portal via PCIe.

6. The method according to claim 1, characterized in that Encrypting and / or decrypting the business data via the cryptographic engine further includes: Based on the hardware access path identifier, providing the decrypted service data to an encrypted memory area in the high bandwidth memory corresponding to the hardware access path identifier; and In response to the security detection module determining that the data type indicates other data, based on the hardware access path identifier, the other data is provided to an open buffer area in the high bandwidth memory corresponding to the hardware access path identifier.

7. The method according to claim 1, characterized in that Also includes: The memory area corresponding to the confidential hardware access path is configured as an open buffer area and an encrypted memory area, wherein the open buffer area is used to store other data associated with the confidential hardware access path, and the encrypted memory area is used to store business data associated with the confidential hardware access path.

8. The method according to claim 1, characterized in that Also includes: Encrypting, via a cryptographic engine, direct memory access data from a device portal to be transmitted to a host side, so as to obtain encrypted direct memory access data; Providing the encrypted direct memory access data to a designated buffer of the host via PCIe; as well as Notify the host's encrypted virtual machine that encrypted direct memory access data is ready.

9. A system, characterized in that: include: A host, configured to transmit interactive data with the device via PCIe; The device comprises at least: A device portal, which obtains interactive data transmitted between a host and a device, wherein the host and the device are configured with one or more physically isolated hardware access paths, and the interactive data includes business data and other data; and A cryptographic engine is configured to encrypt and / or decrypt the business data, the cryptographic engine is inlined on the hardware access path, wherein the encryption and / or decryption of the business data includes: checking the encryption calculation mode, the data type of the interaction data, and the hardware access path identifier via a security detection module of the device portal; in response to the security detection module determining that the encryption calculation mode has been started and the data type indicates business data, providing the business data to the cryptographic engine so that the cryptographic engine decrypts the business data; The high bandwidth memory is configured to divide a plurality of memory areas for mapping to a plurality of hardware access paths isolated from the hardware, respectively, wherein the plurality of hardware access paths include at least one confidential hardware access path.

10. A computing device, characterized in that: include: at least one processor; as well as a memory communicatively coupled to the at least one processor; in The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a machine, the method according to any one of claims 1 to 8 is performed.

12. A computer program product, characterized in that The invention comprises a computer program, which, when executed by a machine, performs the method according to any one of claims 1 to 8.

Images