Security isolation system and device based on neural network processor NPU

Abstract

The invention provides a security isolation system and device based on a neural network processor (NPU), which are characterized in that an NPU memory access controller is integrated in the NPU, the NPU memory access controller integrates a check register and a translation register in an NPU core, and memory permission check and memory address translation are put in front of a direct memory access (DMA) engine; performing static division and isolation on the NPU SRAM, and performing dynamic division and isolation based on ID; through an access control mechanism and in combination with off-line routing integrity check, the access control mechanism generates an identity label for an NoC data packet on an NPU sending core, and the identity label is transmitted in an NoC network along with the data packet; the NPU and the CPU interact through the memory mapping I / O interface and a preset instruction. According to the security isolation mechanism provided by the invention, on the premise of ensuring the isolation, the performance overhead during operation can be minimized, and a higher resource utilization rate can be realized.

Description

Technical Field

[0001] The present invention relates to the technical field of neural network processors, and in particular to a security isolation system and device based on a neural network processor NPU. Background Art

[0002] Trusted Execution Environment (TEE) is a hot topic in modern hardware-assisted security architecture. Currently, different instruction set architectures (ISA) have their own TEE architecture designs, including: Intel's SGX and TDX, AMD's SEV, ARM's TrustZone and CCA, and RISC-V's Penglai and Keystone. TEE provides a trusted execution environment with hardware isolation mechanism protection for running security tasks and processing confidential data, while attackers outside the TEE cannot steal confidential data and tamper with the execution flow of secure applications.

[0003] In addition, with the development of AI applications such as large language models (LLM), autonomous driving, and image recognition, there is a growing trend to offload machine learning tasks to custom accelerators such as neural processing units (NPUs). To accelerate AI applications, NPUs utilize specialized hardware structures such as matrix computing units (MCUs), registers, and networks on chip (NoCs). Due to the high demand for AI applications on mobile devices, current mobile phone chips also integrate NPU cores within system-on-chip (SoCs) to improve energy efficiency and performance.

[0004] However, integrating the NPU into the SoC introduces new attack surfaces that need to be considered in the TEE system. These attack surfaces can be summarized into three aspects:

[0005] 1. Use NPU to attack CPU resources: The NPU in mobile devices usually has access to CPU memory and can access sensitive data, such as personal facial features, personal health data, etc. If the NPU is compromised, malicious NPU tasks can steal confidential data stored on the CPU.

[0006] 2. NPU internal attack: Modern NPUs support concurrent execution of multiple tasks. However, this concurrent execution brings the risk of stealing confidential models or data by exploiting NPU internal resources (such as registers and NoC). At the same time, a vulnerability LeftoverLocals was recently disclosed that exploits the internal structure of the NPU to steal the data of the model running on it. This vulnerability exploits the local storage (registers) of the accelerator to extract confidential information from the model being processed. LeftoverLocals has been confirmed to affect Apple, AMD, and Qualcomm platforms, indicating that various hardware implementations are generally at risk.

[0007] 3. Using CPU to attack NPU: CPU-side tasks can exploit vulnerabilities in NPU instructions or drivers to attack NPU-side tasks. In order to solve these security issues, a complete TEE design combining CPU and NPU becomes crucial.

[0008] Some early works proposed coarse-grained and static TEE designs for CPU-NPU systems. One approach is to temporarily designate the entire NPU as a secure device and migrate the entire NPU driver to the TEE. However, this solution leads to severe idleness of NPU resources and a large TCB due to the complexity of the software stack. Other NPU TEEs such as GuardNN, TNPU, etc. focus on memory encryption and integrity protection. These approaches mainly consider physical attacks on DRAM (e.g., freezing memory), but lack protection for the internal structure of the NPU because the data inside the NPU is still calculated in plaintext. In addition, TEE systems on other accelerators (such as GPUs) mainly focus on protecting the security of the GPU's global memory, CPU-GPU connection, etc. However, it is not sufficient to directly apply these from the GPU TEE mechanism to the integrated NPU. First, the isolation mechanisms such as IOMMU adopted in the GPU TEE are not efficient for the integrated NPU because the NPU requires a larger memory bandwidth. Second, the NPU has specialized hardware structures such as scratchpads and networks on chips (NoCs), which bring new attack surfaces.

[0009] Definitions of Abbreviations and Key Terms:

[0010] NPU: Neural Network Processor, neural network processor;

[0011] SoC: System On Chip, system on chip;

[0012] DMA: Direct Memory Access, direct memory access;

[0013] SRAM: Static Random Access Memory, static random access memory;

[0014] NoC: Network-on-Chip, network on chip;

[0015] HBM: High-bandwidth-Memory, high-speed bandwidth memory;

[0016] MCU: Matrix computing unit, matrix computing unit;

[0017] ML: Machine Learning, artificial intelligence;

[0018] TEE: Trusted Execution Environment, Trusted Execution Environment;

[0019] Scratchpad: scratchpad. Summary of the invention

[0020] In view of the defects in the prior art, the purpose of the present invention is to provide a security isolation system and device based on a neural network processor NPU.

[0021] The safety isolation system based on the neural network processor NPU provided by the present invention includes:

[0022] Security isolation module of the neural network accelerator NPU: The NPU memory access controller is integrated inside the NPU. The NPU memory access controller integrates the check register and translation register inside the NPU core, and places the memory permission check and memory address translation before the direct memory access DMA engine.

[0023] NPU SRAM isolation module: static partition isolation of NPU SRAM, as well as dynamic partition isolation based on ID;

[0024] NPU NoC interconnection isolation module: Through the gate control mechanism and combined with offline routing integrity check, the gate control mechanism generates an identity for the NoC data packet on the NPU sending core, and the identity is transmitted with the data packet in the NoC network;

[0025] NPU security software stack module: The NPU interacts with the CPU through memory-mapped I / O interfaces and preset instructions. In a trusted environment, only the secure CPU is allowed to interact with the secure NPU. The NPU security context is set only by the secure CPU, which uses preset security instructions to directly configure and control the security status and access rights of the NPU. The NPU monitor is used to perform security checks, manage NPU resources, and serve as a bridge between the secure CPU and the secure NPU.

[0026] Preferably, the NPU memory access controller adopts a coarse-grained memory permission check and a fine-grained memory address translation mechanism;

[0027] For memory permission checking, a check register is used to record the access rights of continuous memory areas, including the starting address, size, and read, write, and execute permissions;

[0028] For memory address translation, translation registers are used to map specific regions from virtual addresses to corresponding physical addresses.

[0029] Preferably, the static random access memory SRAM is divided into a secure SRAM and a non-secure SRAM of fixed size; the non-secure NPU core only accesses the non-secure SRAM and the non-secure system memory; the secure NPU core accesses the secure SRAM and the system memory;

[0030] Add ID status for NPU core and registers, with secure status value as 1 and non-secure status value as 0; setting the ID status of NPU core is only done through secure instructions.

[0031] Preferably, for accessing entries in the SRAM, access rules are defined:

[0032] For exclusive SRAM entries: the NPU core is prohibited from reading SRAM entries with different ID states, the NPU core is allowed to force write data into the SRAM entries, and the ID state of the SRAM is automatically updated to the ID state of the NPU core;

[0033] For shared registers: the non-secure NPU core is prohibited from accessing secure SRAM entries; the secure NPU core will force the ID state of the accessed register to be set to secure.

[0034] Preferably, when the receiving core of the NPU receives a NoC data packet, the access control system on the receiving core will authenticate the NoC request based on its identity; the ID status of the NPU core serves as a valid identity identifier in the access control mechanism; if the receiving core is a non-secure NPU core, the authentication process fails and this NoC request will be rejected; otherwise, a secure NPU core will accept this request and receive subsequent data packets.

[0035] Preferably, routing integrity checks are added on multiple NPU cores to ensure that the actual NoC routing is consistent with the user-defined computational graph; the integrity of the artificial intelligence application code is verified, the hash value of the running code is calculated and compared with the expected hash value set by the user. If they are consistent, the application is allowed to execute; if not, the application execution is rejected.

[0036] Preferably, the NPU monitor includes: a context setter, a trusted distributor, a code verifier and a secure loader;

[0037] The context setter is responsible for setting the security context of the NPU, including configuring the ID state of the NPU, checking the security tasks, and translating the register values; the NPU context determines the hardware resources accessible to the NPU;

[0038] The trusted allocator is responsible for allocating secure memory in the secure memory pool for storing input / output data and model weights of the security tasks; it is also responsible for allocating secure SRAM to ensure that there is no overlap between the SRAMs used by different security tasks;

[0039] The code verifier first loads the code and sensitive model of the security task into the security task queue, and then calculates and verifies whether the hash value of the task code is equal to the hash value expected by the user;

[0040] The security loader first ensures the routing integrity of the security task. The security loader verifies whether the topology of the NPU core matches the NoC network topology expected by the user. If they are consistent, subsequent operations are performed; if they are inconsistent, the security task is refused to be executed. After verifying the routing integrity, the security loader uploads the machine learning task to the corresponding NPU core.

[0041] Preferably, the NPU monitor further comprises two auxiliary components: a springboard and a secure task queue, wherein the springboard serves as a medium for transmitting data between the non-secure NPU driver and the NPU monitor, and the secure task queue stores secure NPU tasks for scheduling.

[0042] Preferably, during machine startup, the secure CPU verifies a minimal firmware loader code, then the firmware loader verifies the secure firmware code, the secure firmware further loads and verifies the software in the secure world, and finally loads the software running in the non-secure world, keeping the root of trust of the entire secure boot chain in the chip.

[0043] The safety isolation device based on the neural network processor NPU provided by the present invention is equipped with the safety isolation system based on the neural network processor NPU.

[0044] Compared with the prior art, the present invention has the following beneficial effects:

[0045] (1) The present invention proposes lightweight memory access control and address translation, which efficiently checks the external memory access behavior of the NPU and limits the ability of the NPU to access external storage resources without affecting the bandwidth of the DMA.

[0046] (2) The present invention isolates the hardware resources inside the NPU (e.g., Scratchpad / SRAM, NoC network DENG1), ensuring that the NPU resources used by tasks on different NPUs are isolated from each other, while ensuring the integrity of the routing graph when calculating on multiple NPU cores;

[0047] (3) The present invention reduces the size of the trusted base of the NPU software stack and reduces the amount of trusted software code by two orders of magnitude by splitting security-sensitive code (e.g., NPU context setup, secure NPU memory allocator, etc.). BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Other features, objects and advantages of the present invention will become more apparent from the detailed description of non-limiting embodiments made with reference to the following drawings:

[0049] Figure 1 This is a schematic diagram of the NPU memory access isolation and translation mechanism;

[0050] Figure 2a and Figure 2b Schematic diagram of NPU SRAM static partitioning and ID-based dynamic partitioning;

[0051] Figure 3 Schematic diagram of the execution flow of tampering NPU tasks using NoC interconnection;

[0052] Figure 4 Schematic diagram of the peephole check mechanism for NPU NoC interconnection;

[0053] Figure 5 Design a schematic diagram for a trusted execution environment that includes CPU, NPU, and memory;

[0054] Figure 6 Schematic diagram of the NPU security software stack split. DETAILED DESCRIPTION

[0055] The present invention is described in detail below in conjunction with specific embodiments. The following embodiments will help those skilled in the art to further understand the present invention, but are not intended to limit the present invention in any form. It should be noted that, for those of ordinary skill in the art, several changes and improvements can also be made without departing from the concept of the present invention. These all belong to the protection scope of the present invention.

[0056] Example

[0057] The present invention provides a safety isolation system based on a neural network processor NPU, comprising:

[0058] Secure Isolation Design for Neural Network Accelerator (NPU)

[0059] (I) NPU external memory access isolation mechanism

[0060] NPU memory access control and translation mechanism: Figure 1 The design of the NPU memory access control and translation mechanism is presented, which is a lightweight memory access controller that utilizes the NPU-specific memory access pattern. Compared with MMU or IOMMU, it has two main advantages: (1) it is lightweight and does not require checking overhead; (2) it can be integrated into the NPU.

[0061] 1. Lightweight memory access control and translation design:

[0062] First, in order to eliminate the runtime overhead of traditional paging-based memory access control, the NPU memory controller adopts coarse-grained memory checking and fine-grained address translation mechanisms.

[0063] a) In terms of memory permission checking, it uses a check register to record the access rights of continuous memory areas (starting address, size, read / write / executable permissions), because sensitive data in mobile operating systems are usually stored in pre-allocated secure memory areas (e.g., TrustZone secure memory areas).

[0064] b) In terms of memory address translation, the NPU memory controller provides fine-grained translation registers at the block level (e.g., input blocks and output blocks). Each translation register maps a specific area from a virtual address to a corresponding physical address. Unlike the check registers mentioned above (the check registers are configured at system startup and are not modified at runtime), the translation registers may need to be updated during NPU calculations. For example, if different kernels in an NPU task use non-contiguous physical memory, the virtual address and physical address in the translation register need to be updated when the kernel is loaded.

[0065] 2. Lightweight memory access control and translation design:

[0066] The NPU memory controller integrates the check and translation registers inside the NPU core, and places the memory access check and translation before the DMA engine. Compared with other device memory access translation modules such as IOMMU, the integrated design of the NPU memory controller reduces the complexity of the SoC. It can adapt to different scenarios on mobile, desktop and server (without considering the location of the NPU in the SoC).

[0067] In addition, since the memory check and translation of the NPU memory controller is performed at the DMA instruction level rather than at the memory packet level, and the IOMMU is placed after the DMA engine and receives fixed-size memory packet requests (64B in size), for example, a DMA request for a large memory will be divided into multiple fixed-size memory packet requests, so the NPU memory controller can save additional energy compared to the IOMMU (reducing the number of checks from N to 1, where N is proportional to the memory size of the DMA request).

[0068] (II) NPU SRAM isolation mechanism

[0069] 1. Static partition isolation of NPU SRAM:

[0070] Static partitioning of NPU SRAM is a simple hardware isolation mechanism, such as Figure 2aAs shown. Exclusive and shared SRAM can be divided into secure SRAM and non-secure SRAM, and the size of secure and non-secure SRAM is fixed. The non-secure NPU core can only access the non-secure SRAM and non-secure system memory; the secure NPU core can access the secure SRAM and system memory. Static resource partitioning has been used in the trusted execution environment (TEE) of CPU and GPU, such as ARM TrustZone, NVIDIAMIG, etc. However, this mechanism is plagued by fragmentation problems, making it difficult to adjust the isolation boundaries at runtime. In addition, due to low resource utilization, partitioning will also introduce considerable overhead in actual NPU tasks. Therefore, another dynamic NPU SRAM isolation mechanism will be proposed

[0071] 2. Dynamic partitioning and isolation of NPU SRAM based on ID

[0072] In the NPU isolator, an ID-based isolation mechanism specifically for the scratchpad is proposed, such as Figure 2b As shown. Taking advantage of the lack of address association between NPU SRAM and HBM, data can be stored in any SRAM entry, rather than in a certain cache group like Cache. Therefore, NPU SRAM can adopt a finer-grained and more dynamic isolation mechanism than cache and memory. Therefore, a dynamic partitioning isolation mechanism based on ID is designed. The specific mechanism is as follows:

[0073] a) Add ID status for the NPU core and registers, with the secure status value being 1 and the non-secure status value being 0. Setting the ID status of the NPU core can only be done through secure instructions.

[0074] b) For access to entries in SRAM, two access rules are defined:

[0075] 1. For exclusive SRAM entries (exclusive scratchpad): the NPU core is prohibited from reading SRAM entries with different ID states, but the NPU core is allowed to force write data to the SRAM entries and automatically update the SRAM ID state to the NPU core ID state.

[0076] 2. For shared scratchpad: the non-secure NPU core is prohibited from accessing (both reading and writing) secure SRAM entries; conversely, the secure NPU core will force the ID state of the accessed scratchpad to be set to secure.

[0077] 3. Use dedicated security instructions to reset the SRAM state from secure to non-secure. By enforcing these rules, fine-grained and dynamic isolation of each SRAM entry can be achieved, and the allocation policy is decoupled from its security check. This allows the NPU driver to reuse any allocation policy to achieve better SRAM utilization. In addition, since each SRAM entry has a large payload (e.g., ≥128B), the resource overhead of a single-bit ID state is very slight (<1%).

[0078] (III) NPU NoC interconnection isolation mechanism

[0079] 1. An attack method based on NPU NoC

[0080] Lack of NoC isolation and integrity protection: In addition to the SRAM and memory access control of the NPU, the NPU isolator also ensures the isolation and integrity of the NoC network. The NPU is able to run different layers of the model on different NPU cores and transmit intermediate results directly through the NoC network of Katayama, thereby accelerating machine learning tasks and greatly reducing the overhead of storing and reloading data from memory. However, the use of NoC networks will introduce a new attack surface: destroying the routing integrity of artificial intelligence applications. Figure 3 As shown in the figure, the routing integrity protection for NPU tasks is different from the code integrity protection in the trusted execution environment (TEE) on the CPU. For example, if the NPU scheduler is attacked, it may schedule malicious tasks to the wrong NPU core. For example, an attacker can modify the routing map to direct confidential intermediate results sent on the secure NPU core to the NPU core hijacked by the attacker; or send malicious NoC packets to the victim NPU core. By tampering with the routing integrity of the NoC network, the attacker can manipulate the entire machine learning task data flow.

[0081] 2. Protection mechanism for NPU NoC interconnection

[0082] NPU NoC Isolation Mechanism: To defend against attacks on the NoC network, a lightweight NoC authentication mechanism called “gateway” is introduced in the NPU NoC, combined with offline routing integrity checks, such as Figure 4As shown, the access control mechanism generates an identity for the NoC data packet (Header flit) on the NPU sending core, and the identity is transmitted with the data packet in the NoC network. When the receiving core of the NPU receives this NoC data packet, the access control system on the receiving core will authenticate this NoC request based on its identity. The ID state of the NPU core (secure and non-secure) can be used as a valid identity in the access control mechanism. For example, a data packet originating from a secure NPU core contains a security bit as its identity. If the receiving core is a non-secure NPU core, the authentication process will fail and this NoC request will be rejected. Otherwise, a secure NPU core will accept this request and receive subsequent data packets (Body flits).

[0083] NPU NoC Route Integrity: Although the gate mechanism provides isolation for the NoC network, in order to ensure complete NoC protection, the integrity of the routing / computation graph of the AI ​​tasks running on multiple NPU cores also needs to be considered. Therefore, in addition to verifying the integrity of the AI ​​application code (calculating the hash value of the running code and comparing it with the expected hash value set by the user), it is also necessary to increase the verification of routing integrity (routing integrity check ensures that the actual NoC route is consistent with the user-defined computational graph). For example, a secure AI application requires the use of four secure NPU cores with a topology of 2×2, but a malicious NPU driver may allocate an NPU core with a topology of 1×4 to the task, which will cause the task to interact with two non-secure NPU cores during execution. Therefore, before loading the AI ​​application to the NPU core, it is necessary to verify whether the actual allocation of the NPU core matches the expected NoC topology configuration defined by the user.

[0084] (IV) NPU security software stack design

[0085] 1. NPU and CPU security interaction mechanism

[0086] Figure 5The entire TEE system is shown, including the CPU, NPU, and memory. There are usually two common methods for interaction between the NPU and the CPU: the memory-mapped I / O (MMIO) interface and specific instructions (for example, matrix expansion or RoCC accelerator instructions). In order to establish a complete trusted environment, the interaction between the CPU and the NPU is restricted, and only the secure CPU is allowed to interact with the secure NPU. Specifically, the NPU security context (for example, ID status and check registers) can only be set by the secure CPU using specialized security instructions. In this setting, the secure CPU directly configures and controls the security state and access rights of the NPU by using specialized security instructions. These instructions ensure that only verified and authorized security code can modify the security configuration of the NPU, thereby preventing malware from tampering with or accessing sensitive data.

[0087] 2. NPU software stack split

[0088] NPU includes a huge software stack, such as artificial intelligence frameworks (such as TensorFlow, PyTorch), compilers (such as TVM, CANN), and NPU drivers, and the amount of code above will exceed 1 million lines. Incorporating the entire software stack into the Trusted Computing Base (TCB) may introduce potential vulnerabilities and security risks (for example: CVE-2021-1940, CVE-2021-1968, CVE-2021-1969). To mitigate these risks, only a lightweight NPU monitor is placed in the secure world. The monitor is responsible for performing security checks, managing NPU resources, etc., and serves as a bridge between the secure CPU and the secure NPU. This design effectively reduces the size and attack surface of the trusted base (TCB), and keeps the amount of trusted NPU software code within 10,000 lines.

[0089] 3. NPU security monitor design

[0090] The NPU Monitor plays a key role in ensuring the confidentiality and integrity of multiple secure machine learning tasks. Figure 6 As shown in Figure 1, it includes several modules: context setter, trusted allocator, code verifier, and secure loader. It is worth noting that the NPU monitor is only applicable to secure machine learning tasks. For non-secure tasks, no software checks are implemented, and only hardware mechanisms are relied upon to ensure isolation between secure and non-secure tasks.

[0091] a) The context setter is responsible for setting the security context of the NPU, which includes the NPU ID status, security task check and translation registers. The NPU context determines the hardware resources that the NPU can access, such as system memory and SRAM.

[0092] b) The Trusted Allocator is responsible for allocating secure memory in the secure memory pool to store input / output data and model weights of security tasks. At the same time, the Trusted Allocator is also responsible for allocating secure SRAM, which ensures that there is no overlap between the SRAMs used by different security tasks.

[0093] c) The code verifier first loads the code and sensitive model of the security task into the security task queue. Then, it calculates and verifies whether the hash value of the task code is equal to the hash value expected by the user.

[0094] d) The Secure Loader first ensures the routing integrity of the security task. Unlike the traditional CPU-side trusted execution environment, machine learning tasks may use multiple NPU cores connected to the NoC network. The Secure Loader verifies whether the topology of the NPU core matches the NoC network topology expected by the user. After verifying the routing integrity, the Secure Loader uploads the machine learning task to the corresponding NPU core.

[0095] In addition to the above modules, the NPU monitor also includes two auxiliary components: trampoline and secure queue. The trampoline serves as a medium for transmitting data between the non-secure NPU driver and the NPU monitor, while the secure queue stores secure NPU tasks for scheduling.

[0096] 4. NPU security software stack loading and secure boot process

[0097] The secure boot process of the secure NPU is similar to previous work (TrustZone Secure Boot, AndroidSecure Boot, Windows TXT). During machine startup, the secure CPU verifies a minimal firmware loader code (Bootrom loader), and then the firmware loader verifies the secure firmware code. The secure firmware further loads and verifies software in the secure world, such as TEEOS and the NPU monitor mentioned above in this patent. Finally, the software running in the non-secure world (including the Linux kernel, NPU driver, and artificial intelligence framework, etc.) is loaded. The root of trust for the entire secure boot chain remains in the chip.

[0098] Those skilled in the art know that, in addition to implementing the system, device and its various modules provided by the present invention in a purely computer-readable program code, it is entirely possible to implement the same program in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers and embedded microcontrollers by logically programming the method steps. Therefore, the system, device and its various modules provided by the present invention can be considered as a hardware component, and the modules included therein for implementing various programs can also be considered as structures within the hardware component; the modules for implementing various functions can also be considered as both software programs for implementing the method and structures within the hardware component.

[0099] The above describes the specific embodiments of the present invention. It should be understood that the present invention is not limited to the above specific embodiments, and those skilled in the art can make various changes or modifications within the scope of the claims, which does not affect the essence of the present invention. In the absence of conflict, the embodiments of the present application and the features in the embodiments can be combined with each other arbitrarily.

Claims

1. A safety isolation system based on a neural network processor NPU, characterized in that: include: Security isolation module of the neural network accelerator NPU: The NPU memory access controller is integrated inside the NPU. The NPU memory access controller integrates the check register and translation register inside the NPU core, and places the memory permission check and memory address translation before the direct memory access DMA engine. NPU SRAM isolation module: static partition isolation of NPU SRAM, as well as dynamic partition isolation based on ID; NPU NoC interconnection isolation module: Through the gate control mechanism and combined with offline routing integrity check, the gate control mechanism generates an identity for the NoC data packet on the NPU sending core, and the identity is transmitted with the data packet in the NoC network; NPU security software stack module: NPU interacts with CPU through memory-mapped I / O interface and preset instructions; In a trusted environment, only the secure CPU is allowed to interact with the secure NPU; The NPU security context is only set by the secure CPU, which uses preset security instructions to directly configure and control the security state and access rights of the NPU, and uses the NPU monitor to perform security checks, manage NPU resources, and act as a bridge between the secure CPU and the secure NPU.

2. The safety isolation system based on the neural network processor NPU according to claim 1 is characterized in that: The NPU memory access controller adopts a coarse-grained memory permission check and a fine-grained memory address translation mechanism; For memory permission checking, a check register is used to record the access rights of continuous memory areas, including the starting address, size, and read, write, and execute permissions; For memory address translation, translation registers are used to map specific regions from virtual addresses to corresponding physical addresses.

3. The safety isolation system based on the neural network processor NPU according to claim 1 is characterized in that: The static random access memory SRAM is divided into a secure SRAM and a non-secure SRAM of fixed size; the non-secure NPU core only accesses the non-secure SRAM and the non-secure system memory; the secure NPU core accesses the secure SRAM and the system memory; Add ID status for NPU core and registers, with secure status value as 1 and non-secure status value as 0; setting the ID status of NPU core is only done through secure instructions.

4. The safety isolation system based on the neural network processor NPU according to claim 1 is characterized in that: For access to entries in SRAM, define access rules: For exclusive SRAM entries: the NPU core is prohibited from reading SRAM entries with different ID states, the NPU core is allowed to force write data into the SRAM entries, and the ID state of the SRAM is automatically updated to the ID state of the NPU core; For shared registers: prohibit non-secure NPU cores from accessing secure SRAM entries; The secure NPU core will force the ID state of the accessed register to be secure.

5. The safety isolation system based on the neural network processor NPU according to claim 1 is characterized in that: When the receiving core of the NPU receives the NoC data packet, the access control system on the receiving core will authenticate the NoC request based on its identity; the ID state of the NPU core serves as a valid identity in the access control mechanism; If the receiving core is a non-secure NPU core, the authentication process fails and the NoC request will be rejected; Otherwise, a secure NPU core will accept the request and receive subsequent data packets.

6. The safety isolation system based on the neural network processor NPU according to claim 1 is characterized in that: On multiple NPU cores, routing integrity checks are added to ensure that the actual NoC routing is consistent with the user-defined computational graph; the integrity of the AI ​​application code is verified, the hash value of the running code is calculated and compared with the expected hash value set by the user. If they are consistent, the application execution is allowed; if not, the application execution is rejected.

7. The safety isolation system based on the neural network processor NPU according to claim 1 is characterized in that: The NPU monitor includes: a context setter, a trusted distributor, a code verifier and a secure loader; The context setter is responsible for setting the security context of the NPU, including configuring the ID state of the NPU, checking the security tasks, and translating the register values; the NPU context determines the hardware resources accessible to the NPU; The trusted allocator is responsible for allocating secure memory in the secure memory pool for storing input / output data and model weights of the security tasks; it is also responsible for allocating secure SRAM to ensure that there is no overlap between the SRAMs used by different security tasks; The code verifier first loads the code and sensitive model of the security task into the security task queue, and then calculates and verifies whether the hash value of the task code is equal to the hash value expected by the user; The security loader first ensures the routing integrity of the security task. The security loader verifies whether the topology of the NPU core matches the NoC network topology expected by the user. If they are consistent, subsequent operations are performed; if they are inconsistent, the security task is refused to be executed. After verifying the routing integrity, the security loader uploads the machine learning task to the corresponding NPU core.

8. The safety isolation system based on the neural network processor NPU according to claim 7 is characterized in that: The NPU monitor also includes two auxiliary components: a springboard and a secure task queue. The springboard serves as a medium for transmitting data between the non-secure NPU driver and the NPU monitor, and the secure task queue stores secure NPU tasks for scheduling.

9. The safety isolation system based on the neural network processor NPU according to claim 1 is characterized in that: During machine boot, the secure CPU verifies a minimal firmware loader code, which then verifies the secure firmware code. The secure firmware further loads and verifies the software in the secure world, and finally loads the software running in the non-secure world, keeping the root of trust for the entire secure boot chain in the chip.

10. A safety isolation device based on a neural network processor NPU, characterized in that: It is equipped with a safety isolation system based on a neural network processor NPU as described in any one of claims 1 to 9.

Images