Safe calling method, device and equipment for GPGPU (General Purpose Graphics Processing Unit) and medium

Abstract

The invention discloses a safe calling method and device of a GPGPU, equipment and a medium, relates to the technical field of graphic processing, is applied to a safe control module in the GPGPU, and comprises the steps that a ciphertext instruction and request data sent by a target host after a GPGPU access request sent by a remote user node is analyzed are acquired; decrypting the ciphertext instruction by using a target decryption algorithm corresponding to the remote user node to obtain a plaintext instruction, and verifying the legality of the GPGPU access request; if the plaintext instruction and the request data are legal, sending the plaintext instruction and the request data to a scheduler through a bus, so that the scheduler calls a target calculation unit determined from the GPGPU based on a preset scheduling algorithm to process the plaintext instruction and the request data; and encrypting the processing result by using a target encryption algorithm corresponding to the remote user node, and sending a ciphertext result to the target host, so that the target host sends the ciphertext result to the remote user node. And the safety protection efficiency is improved.

Description

Technical Field

[0001] The present invention relates to the field of graphics processing technology, and in particular to a GPGPU secure calling method, device, equipment and medium. Background Art

[0002] GPGPU (General-purpose computing on graphics processing units) is a powerful computing tool. Unlike GPU, GPGPU has a higher degree of parallelism in its computing core and is better at computing some non-graphics-related programs and repetitive tasks with massive amounts of data, such as large-scale data encryption, decryption, data computing, and AI computing acceleration.

[0003] With the rapid advancement of current technology, the application demand for GPGPU has increased significantly. Currently, the application mode of multiple clients sharing GPGPU is usually supported. This design supports several users to remotely call a heterogeneous GPGPU to perform calculations in the form of a network, which can reduce the number of GPGPU applications and maximize the efficiency of GPGPU applications without affecting the computing requirements, thereby improving economic efficiency. However, under this design, remote users access the Host through the network and call heterogeneous GPGPU, but security challenges such as cache side channel attacks, memory vulnerability attacks, and misaccess of heterogeneous units caused by remote access through the network are difficult to avoid.

[0004] At present, software security protection methods are usually adopted, that is, by installing software security drivers on the Host to avoid illegal access to heterogeneous GPGPUs. However, the software security protection verification solution based on the CPU (Central Processing Unit) is inefficient and has long delays. The complicated security authentication process will directly affect the feedback efficiency of GPGPU calculations, and this solution will increase the task load of the Host CPU, thereby affecting the execution of other important processes. In addition, the existing hardware solution cannot achieve physical isolation between the hardware security control module and the GPGPU computing unit, which is bound to cause a waste of logical resources in the GPGPU computing unit. It may also affect the accuracy of GPGPU's recognition of illegal access due to problems such as metastable data transmission, seriously affecting the user experience.

[0005] In summary, how to improve the security protection efficiency of GPGPU access is a problem that needs to be solved. Summary of the invention

[0006] In view of this, the purpose of the present invention is to provide a GPGPU security calling method, device, equipment and medium, which can improve the security protection efficiency of GPGPU access. The specific scheme is as follows:

[0007] In a first aspect, the present application discloses a GPGPU security calling method, which is applied to a security control module in a GPGPU. The method comprises:

[0008] Obtaining the ciphertext instruction and request data carried in the GPGPU access request sent by the target host after parsing the GPGPU access request sent by the remote user node;

[0009] Decrypting the ciphertext instruction using a target decryption algorithm corresponding to the remote user node to obtain a plaintext instruction, and verifying the legitimacy of the GPGPU access request based on the plaintext instruction;

[0010] If the GPGPU access request is a legitimate request, the plaintext instruction and the request data are sent to a preset scheduler through a bus, so that the preset scheduler calls a target computing unit determined from the GPGPU based on a preset scheduling algorithm to process the plaintext instruction and the request data and obtain a processing result;

[0011] Obtain the processing result sent by the target computing unit through the bus, and encrypt the processing result using the target encryption algorithm corresponding to the remote user node to obtain a ciphertext result, and then send the ciphertext result to the target host, so that the target host sends the ciphertext result to the remote user node.

[0012] Optionally, decrypting the ciphertext instruction by using a target decryption algorithm corresponding to the remote user node to obtain a plaintext instruction includes:

[0013] Authentication is performed on the target host. If the authentication is successful, the ciphertext to be decrypted, the instruction identification number and the IP information of the remote user node are extracted from the ciphertext instruction, and the ciphertext to be decrypted and the instruction identification number are associated with each other and sent to a locally preset decryption state machine;

[0014] Determine a corresponding target decryption algorithm based on the IP information, and associate the target decryption algorithm with the instruction identification number and send it to the decryption state machine;

[0015] Determining the instruction encryption format by the decryption state machine using the access request category and the calculation type obtained from the preset instruction comparison table based on the instruction identification number;

[0016] In the decryption state machine, based on the instruction identification number, the target decryption algorithm and the instruction encryption format are used to decrypt the ciphertext to be decrypted in the ciphertext instruction to obtain a plaintext instruction.

[0017] Optionally, the preset instruction comparison table stores pre-set legal instruction parameters;

[0018] Accordingly, the verifying the legitimacy of the GPGPU access request based on the plaintext instruction includes:

[0019] Determining whether the instruction parameters of the plain text instruction are consistent with the legal instruction parameters stored in the preset instruction comparison table;

[0020] If they are consistent, the GPGPU access request is determined to be a legal request, otherwise it is an illegal request.

[0021] Optionally, if the GPGPU access request is a legitimate request, the method further includes:

[0022] Based on the instruction identification number, splicing the corresponding plaintext instruction and the request data according to a first preset format to obtain first spliced ​​data;

[0023] Accordingly, the preset scheduler calls the target computing unit determined from the GPGPU based on the preset scheduling algorithm to process the plaintext instruction and the request data, including:

[0024] The preset scheduler calls a target computing unit determined from the GPGPU based on a preset scheduling algorithm to process the first spliced ​​data.

[0025] Optionally, encrypting the processing result by using a target encryption algorithm corresponding to the remote user node to obtain a ciphertext result includes:

[0026] Determine the unit identification number of the target computing unit, and obtain the encryption operation code and encryption algorithm data corresponding to the IP information of the remote user node from the computing unit identification list corresponding to the unit identification number;

[0027] The encryption algorithm data and the unit identification number are associated with each other and sent to a locally preset encryption state machine, and a target encryption algorithm corresponding to the encryption operation code is obtained from a preset kernel;

[0028] The target encryption algorithm is associated with the unit identification number and then sent to the encryption state machine, so that in the encryption state machine, based on the unit identification number, the processing result is encrypted using the target encryption algorithm and the encryption algorithm data to obtain a ciphertext result.

[0029] Optionally, after encrypting the processing result by using a target encryption algorithm corresponding to the remote user node to obtain a ciphertext result, the method further includes:

[0030] Based on the unit identification number, the ciphertext result and the processing result are spliced ​​in a second preset format to obtain second spliced ​​data;

[0031] Correspondingly, the step of sending the ciphertext result to the target host so that the target host sends the ciphertext result to the remote user node includes:

[0032] The second spliced ​​data is sent to the target host, so that the target host sends the second spliced ​​data to the remote user node.

[0033] Optionally, after verifying the legitimacy of the GPGPU access request based on the plaintext instruction, the method further includes:

[0034] If the GPGPU access request is an illegal request, the GPGPU access request is discarded to prohibit the step of calling a target computing unit determined from the GPGPU based on a preset scheduling algorithm to process the plaintext instruction and the request data.

[0035] In a second aspect, the present application discloses a GPGPU security calling device, which is applied to a security control module in a GPGPU, and the device includes:

[0036] An information acquisition module, used for acquiring the ciphertext instruction and request data carried in the GPGPU access request sent by the target host after parsing the GPGPU access request sent by the remote user node;

[0037] A decryption verification module, configured to decrypt the ciphertext instruction using a target decryption algorithm corresponding to the remote user node to obtain a plaintext instruction, and verify the legitimacy of the GPGPU access request based on the plaintext instruction;

[0038] a computing module, configured to send the plaintext instruction and the request data to a preset scheduler through a bus if the GPGPU access request is a legitimate request, so that the preset scheduler calls a target computing unit determined from the GPGPU based on a preset scheduling algorithm to process the plaintext instruction and the request data and obtain a processing result;

[0039] An encryption module is used to obtain the processing result sent by the target computing unit through the bus, and encrypt the processing result using a target encryption algorithm corresponding to the remote user node to obtain a ciphertext result, and then send the ciphertext result to the target host, so that the target host sends the ciphertext result to the remote user node.

[0040] In a third aspect, the present application discloses an electronic device, comprising:

[0041] Memory, used to store computer programs;

[0042] The processor is used to execute the computer program to implement the steps of the aforementioned GPGPU security calling method disclosed above.

[0043] In a fourth aspect, the present application discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, the steps of the aforementioned disclosed GPGPU secure calling method are implemented.

[0044] It can be seen that the security control module in the GPGPU obtains the ciphertext instruction and request data carried in the GPGPU access request sent by the target host after parsing the GPGPU access request sent by the remote user node; uses the target decryption algorithm corresponding to the remote user node to decrypt the ciphertext instruction to obtain a plaintext instruction, and verifies the legitimacy of the GPGPU access request based on the plaintext instruction; if the GPGPU access request is a legitimate request, sends the plaintext instruction and the request data to the preset scheduler through the bus, so that the preset scheduler calls the target computing unit determined from the GPGPU based on the preset scheduling algorithm to process the plaintext instruction and the request data, and obtains the processing result; obtains the processing result sent by the target computing unit through the bus, encrypts the processing result using the target encryption algorithm corresponding to the remote user node to obtain a ciphertext result, and then sends the ciphertext result to the target host, so that the target host sends the ciphertext result to the remote user node.

[0045] Beneficial effects: After receiving the GPGPU access request sent by the remote user node, the target host in the present application first needs to parse the GPGPU access request to convert it into a relevant machine code stream recognizable by the GPGPU, so as to send the ciphertext instructions and request data carried in the GPGPU access request to the security control module in the GPGPU. The security control module first needs to use the target decryption algorithm corresponding to the remote user node to decrypt the ciphertext instruction to obtain the plaintext instruction, so as to verify the legitimacy of the GPGPU access request based on the plaintext instruction. That is, the security control module in the present application is equipped with a variety of decryption algorithms, and different users have their own independent decryption protection methods, that is, the security control module can configure different decryption algorithms for users according to the information of legitimate users, and has high flexibility. Further, if it is determined that the current access is legitimate, the plaintext instruction and request data are sent to the preset scheduler through the bus, so that the preset scheduler calls the target computing unit determined from the GPGPU based on the preset scheduling algorithm to process the plaintext instruction and request data, and obtain the processing result. That is, the communication between the security control module and the preset scheduler is realized through the bus to achieve physical isolation between the two, and different processes do not interfere with each other. In addition, the security control module and the computing unit also communicate through the bus, so the security control module obtains the processing results sent by the target computing unit through the bus. Similarly, the security control module can also configure different encryption algorithms for users based on the information of legitimate users, that is, the processing results are encrypted using the target encryption algorithm corresponding to the remote user node to obtain the ciphertext result, and then the ciphertext result is sent to the host, so that the target host can then send the ciphertext result to the remote user node. In this way, the above scheme can improve the security protection efficiency of GPGPU access, realize the physical isolation between the security control module and the computing unit and scheduler, and help users better realize the unified scheduling control of GPGPU and significantly improve system performance. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0047] Figure 1 A system architecture diagram applicable to a GPGPU security call disclosed in this application;

[0048] Figure 2 A detailed architecture diagram of a GPGPU disclosed in this application;

[0049] Figure 3A flowchart of a GPGPU security calling method disclosed in this application;

[0050] Figure 4 A schematic diagram of an input instruction decryption architecture disclosed in the present application;

[0051] Figure 5 A decryption flow chart of a ciphertext instruction disclosed in this application;

[0052] Figure 6 A schematic diagram of a processing result output encryption architecture disclosed in this application;

[0053] Figure 7 An encrypted flow chart of a processing result disclosed in this application;

[0054] Figure 8 A schematic diagram of the structure of a GPGPU security calling device disclosed in this application;

[0055] Fig. 9 This is a structural diagram of an electronic device disclosed in this application. DETAILED DESCRIPTION

[0056] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0057] Remote users access the Host through the network and call heterogeneous GPGPU, but it is difficult to avoid security challenges such as cache side channel attacks, memory vulnerability attacks, and misaccess to heterogeneous units caused by remote access through the network. At present, software security protection methods are usually adopted, that is, to avoid illegal access to heterogeneous GPGPU by installing software security drivers on the Host. However, the CPU-based software security protection verification scheme is inefficient and has a long delay. The complicated security authentication process will directly affect the feedback efficiency of GPGPU calculations, and this scheme will increase the task load of the Host CPU, thereby affecting the execution of other important processes. In addition, the existing hardware solution cannot achieve physical isolation between the hardware security control module and the GPGPU computing unit, which is bound to cause a waste of logical resources of the GPGPU computing unit. It may also affect the accuracy of GPGPU's recognition of illegal access due to problems such as metastable data transmission, seriously affecting the user experience.

[0058] To this end, the embodiments of the present application disclose a GPGPU secure calling method, apparatus, device and medium, which can improve the security protection efficiency of GPGPU access.

[0059] The system architecture used in the GPGPU security call solution of this application can be found in Figure 1 As shown in , it mainly includes remote users, hosts and GPGPUs, where multiple remote user nodes are independently connected to the host through the network, and heterogeneous GPGPUs communicate and exchange information with the host through the PCIe (Peripheral Component Interconnect Express, a high-speed serial computer expansion bus standard) interface in the form of DMA (Direct Memory Access). Among them, user nodes refer to user terminals, which can be smart devices such as mobile phones and computers.

[0060] In addition, GPGPU is mainly composed of a security control module, a computing scheduling module (with a preset scheduler), several computing units, on-chip cache, etc. After the host receives the GPGPU access request from the remote user node, it sends the encrypted computing instructions and related data to the GPGPU through the PCIe interface. After the GPGPU completes the security verification of the current GPGPU access request, it schedules the computing task to the target computing unit. After the target computing unit completes the processing, the security control module encrypts the processing result, and then feeds the processing result back to the requesting user node through the PCIe interface through the host.

[0061] Furthermore, Figure 2 The detailed architecture of GPGPU is demonstrated, including the interrupt control module, configuration module, calculation scheduling module, DMA data transceiver module, security control module, GPGPU calculation module and corresponding data storage module as well as the AXI (Advanced eXtensible Interface, a high-performance, high-bandwidth on-chip bus) bus connecting each module.

[0062] The top layer of the interrupt control module is PIC (Programmable Interrupt Controller), which has TMR (Timer Module) timer module, MTHD (Multiple Thread Hardware Dispatch) interrupt processing mode configuration module, CTXSW (Context Switch) process / thread switching module, etc., responsible for processing interrupt processing requests from the host;

[0063] The configuration module arranges the CFG BUS (Configuration Bus) configuration bus module, which is responsible for completing the host's configuration of relevant parameters involved in the security control module, kernel scheduling module, GPGPU computing module, etc.

[0064] The computing scheduling module arranges the thread bundle / thread scheduling function core and the necessary Icache (Instruction Cache) and Dcache (Data Cache), and is responsible for allocating computing tasks that have passed security verification to the corresponding computing units of the GPGPU computing module;

[0065] The DMA data transceiver module deploys a DMA data transceiver engine, which is responsible for data exchange between GPGPU and host memory, and real-time sending and receiving of computing tasks and processing results;

[0066] The security control module is mainly composed of two parts: the input instruction decryption architecture and the processing result output encryption architecture. The module deploys relevant symmetric or asymmetric encryption algorithms such as SHA (Secure Hash Algorithm), AES (Advanced Encryption Standard, a symmetric encryption algorithm), RSA (Rivest-Shamir-Adleman, an asymmetric encryption algorithm), ECC (Elliptic Curve Cryptography) and corresponding decryption algorithms. After receiving the GPGPU access request, the GPGPU needs to perform security checks on the relevant requests first to ensure that the current request is a legal access. Only after passing the security check of the security control module can the request be sent to the computing scheduling module;

[0067] The GPGPU computing module deploys all GPGPU computing units and is responsible for executing all computing tasks sent by user nodes;

[0068] The data storage module includes instruction TCM (Tightly-Coupled Memory) storage and data TCM storage, which are responsible for storing relevant instruction data and computing demand data, and completing data exchange with the host through the AXI bus;

[0069] The above modules are connected through the AXI control bus and the AXI data bus. The AXI bus transmits the instructions and related data required for each module to work. All functional modules are uniformly controlled and deployed by GPGPU.

[0070] See also Figure 3 As shown, the embodiment of the present application discloses a GPGPU security calling method, which is applied to a security control module in a GPGPU. The method includes:

[0071] Step S11: Obtain the ciphertext instruction and request data carried in the GPGPU access request sent by the target host after parsing the GPGPU access request sent by the remote user node.

[0072] In this embodiment, the remote user node will send a GPGPU access request to the target host via a wired / wireless network. After receiving the GPGPU access request, the target host first needs to parse the GPGPU access request to convert it into a related machine code stream that can be recognized by GPGPU, so as to send the ciphertext instructions and request data carried in the GPGPU access request to the security control module in the GPGPU in the form of DMA through the PCIe interface.

[0073] Step S12: decrypting the ciphertext instruction using a target decryption algorithm corresponding to the remote user node to obtain a plaintext instruction, and verifying the legitimacy of the GPGPU access request based on the plaintext instruction.

[0074] In this embodiment, the security control module needs to use the target decryption algorithm corresponding to the remote user node to decrypt the ciphertext instructions to obtain plaintext instructions, so as to verify the legitimacy of the GPGPU access request based on the plaintext instructions, such as whether the decrypted data conforms to the predefined data format, and whether the user identity information carried in the instruction belongs to the pre-stored legitimate user identity information.

[0075] That is, the security control module in this application pre-stores multiple encryption and decryption algorithms, such as SHA, AES, RSA, ECC, etc., and different users have their own independent decryption protection methods, that is, the security control module can configure different decryption algorithms for users according to the information of legitimate users, which is highly flexible.

[0076] It should be noted that the security control module is provided with an input instruction decryption architecture for decrypting ciphertext instructions to obtain plaintext instructions and verifying the legitimacy of GPGPU access requests. Figure 4 As shown. Figure 4 It can be seen that the input instruction decryption architecture includes management information configuration module, instruction queue module, instruction ciphertext decomposition module, user IP decomposition module, algorithm decryption FSM state machine, decryption algorithm information selection module, request side instruction comparison table, MUX data merging module, instruction decryption result cache module, and instruction parameter cache module.

[0077] Among them, the management information configuration module is responsible for completing the necessary parameter settings and initialization configurations for other modules, and configuring the preset information of the management terminal; the instruction queue module is responsible for verifying the legitimacy of the host administrator's identity, and caches the user's relevant instructions in the order of input, and issues them in sequence; the instruction ciphertext decomposition module is used to decompose the ciphertext to be decrypted required for the instruction to execute the decryption algorithm; the user IP decomposition module is responsible for decomposing the IP information of the remote user node in the instruction information; the instruction parameter cache module is responsible for caching the relevant request data in the instruction according to the instruction identification number represented by the instruction PC (Program Counter) as a mark; the decryption algorithm information selection module pre-stores a variety of decryption algorithms corresponding to the IP information of legitimate users, such as symmetric decryption algorithms AES, SHA, and asymmetric decryption algorithm RSA. This module determines the decryption algorithm category corresponding to the current GPGPU access request user IP, and selects the relevant decryption parameters involved in the corresponding decryption algorithm from the module kernel; the algorithm decryption FSM (Finite State The finite state machine (FSM) is responsible for decrypting the input instructions in sequence and then judging the legitimacy of the current request. The request side instruction comparison table stores information such as the instruction access request category and calculation type corresponding to different instruction PCs. The MUX (Multiplexer) data merging module merges and splices the decrypted related GPGPU access request instructions and the instruction calculation related request data in the instruction parameter cache based on the instruction PC and in the format preset by the user. The instruction decryption result cache module is responsible for caching the related instruction decryption results and the related data required for instruction execution.

[0078] Therefore, if Figure 5 As shown, in some specific embodiments, the step of decrypting the ciphertext instruction using the target decryption algorithm corresponding to the remote user node to obtain the plaintext instruction may include:

[0079] Step S121: Authenticate the target host. If the identity authentication is successful, extract the ciphertext to be decrypted, the instruction identification number and the IP information of the remote user node from the ciphertext instruction, and establish an association between the ciphertext to be decrypted and the instruction identification number and send them to a locally preset decryption state machine.

[0080] In this embodiment, the security control module first needs to authenticate the target host, specifically, it can verify the identity of the current administrator of the host. For example, when receiving an instruction from the host, it will extract the administrator identity information contained in the instruction and compare it with the pre-stored information. If the two are consistent, it is determined that the administrator identity authentication has passed.

[0081] If the identity authentication is passed, the relevant instructions are cached in the order of instruction input, and the instructions and related data are sent to the instruction ciphertext decomposition module, user IP decomposition module, and instruction parameter cache module in sequence. Among them, the instruction ciphertext decomposition module decomposes the ciphertext to be decrypted and the instruction identification number required for algorithm decryption from the ciphertext instruction, and sends the ciphertext to be decrypted to the local algorithm decryption FSM state machine with the instruction identification number as a tag; the user IP decomposition module is responsible for decomposing the IP information of the remote user node in the instruction information, and sending the decomposed user IP information to the decryption algorithm information selection module. The decryption algorithm information selection module pre-stores a variety of decryption algorithms corresponding to the legitimate user IP, such as symmetric decryption algorithms AES and SHA, asymmetric decryption algorithm RSA, etc.

[0082] Step S122: Determine a corresponding target decryption algorithm based on the IP information, and associate the target decryption algorithm with the instruction identification number and send the result to the decryption state machine.

[0083] In this embodiment, the decryption algorithm information selection module selects the corresponding target decryption algorithm and the relevant decryption parameters involved in the algorithm from the module kernel according to the decryption algorithm category corresponding to the user IP information of the current GPGPU access request, and sends it to the algorithm decryption FSM state machine with the instruction identification number as a mark.

[0084] Step S123: The decryption state machine determines the instruction encryption format using the access request category and calculation type obtained from the preset instruction comparison table based on the instruction identification number.

[0085] In this embodiment, the decryption state machine obtains the corresponding access request category and calculation type from the preset instruction comparison table (i.e., the request side instruction comparison table) based on the instruction identification number to determine the instruction encryption format inside the instruction. It should be pointed out that the access request category here refers to the calculation category that requires the participation of the model or the conventional data processing category, etc., and the calculation type refers to the specific calculation method under the corresponding category, such as sorting, filtering, etc.

[0086] Step S124: In the decryption state machine, based on the instruction identification number, the ciphertext to be decrypted in the ciphertext instruction is decrypted using the target decryption algorithm and the instruction encryption format to obtain a plaintext instruction.

[0087] In this embodiment, the decryption state machine decrypts the ciphertext to be decrypted in the ciphertext instruction according to the instruction encryption format, the target decryption algorithm and related parameters, thereby obtaining the plaintext instruction.

[0088] Furthermore, the preset instruction comparison table may also store pre-set legal instruction parameters; accordingly, the verification of the legality of the GPGPU access request based on the plaintext instruction includes: determining whether the instruction parameters of the plaintext instruction are consistent with the legal instruction parameters stored in the preset instruction comparison table; if they are consistent, the GPGPU access request is determined to be a legal request, otherwise it is an illegal request. That is, the decrypted instruction can also be compared with the legal instruction parameters stored in the request side instruction comparison table, and it can be determined whether the information of the two is consistent. If they are consistent, the GPGPU access request is determined to be a legal request, otherwise it is an illegal request. In addition, it is also possible to check whether the access request category and calculation type of the instruction are consistent with the information recorded in the comparison table. If the instruction claims to perform a matrix multiplication operation, but the corresponding instruction PC in the comparison table is marked as a data read operation, then the request is illegal.

[0089] In addition, the legitimacy of GPGPU access requests can also be verified by timestamps. For example, in some systems with high security requirements, instructions will carry timestamp information. The state machine needs to check whether the timestamp is within a reasonable range to prevent replay attacks. If the timestamp shows that the instruction was sent a long time ago, or the difference with the current system time is too large, then the request may have been intercepted and resent by an attacker and should be judged as an illegal request.

[0090] Step S13: If the GPGPU access request is a legitimate request, the plaintext instruction and the request data are sent to the preset scheduler through the bus, so that the preset scheduler calls the target computing unit determined from the GPGPU based on the preset scheduling algorithm to process the plaintext instruction and the request data and obtain the processing result.

[0091] In this embodiment, if it is determined that the current access is legal, the plaintext instructions and request data are sent to the preset scheduler in the calculation scheduling module through the bus, so that the preset scheduler determines the target computing unit based on the preset scheduling algorithm, and sends the plaintext instructions and request data to the target computing unit to perform the calculation operation and obtain the processing result. That is, the security control module and the preset scheduler communicate through the bus to achieve physical isolation between the two, and different processes do not interfere with each other. In addition, the security control module and the computing unit also communicate through the bus, with high transmission efficiency and good stability.

[0092] In addition, it can also be pointed out that the above-mentioned preset scheduling algorithm can specifically adopt a first-come, first-served algorithm, a shortest job first algorithm, and a scheduling algorithm based on load balancing, etc. Among them, the first-come, first-served algorithm refers to the allocation of computing units for processing in the order of task arrival, and the first-arrived tasks are executed first, and the subsequent tasks are not processed until they are completed. The shortest job first algorithm means that the scheduler selects the task with the shortest estimated execution time and assigns it to the computing unit for processing first. The scheduling algorithm based on load balancing needs to monitor the load of each computing unit in real time, so as to allocate new tasks to the computing unit with the lightest load, so as to achieve load balancing between each computing unit.

[0093] Furthermore, if the GPGPU access request is a legitimate request, it also includes: based on the instruction identification number, the corresponding plaintext instruction and the request data are spliced ​​in a first preset format to obtain first spliced ​​data; accordingly, the preset scheduler calls the target computing unit determined from the GPGPU based on the preset scheduling algorithm to process the plaintext instruction and the request data, including: the preset scheduler calls the target computing unit determined from the GPGPU based on the preset scheduling algorithm to process the first spliced ​​data.

[0094] That is, if the current GPGPU access request is legal, the algorithm decryption FSM state machine sends the decrypted plaintext instruction to the MUX module, and the MUX uses the instruction PC as the reference for the plaintext instruction and the related request data of the instruction parameter cache, and merges and splices the data according to the user's first preset format, and then sends the obtained first spliced ​​data to the instruction decryption result cache module, and the instruction decryption result cache module then outputs the instruction decryption results in sequence to send to the calculation scheduling module, so that the preset scheduler calls the corresponding computing units to complete the calculation task. Here, by splicing the instruction and request data with the instruction identification number, the corresponding relationship between the instruction and the parameter can be ensured to be accurate, and the consistency and accuracy in the data transmission can be guaranteed. In addition, it can be transmitted as a whole during the data transmission process, reducing the additional overhead caused by multiple transmissions and improving the data transmission efficiency.

[0095] In addition, after verifying the legitimacy of the GPGPU access request based on the plaintext instruction, it also includes: if the GPGPU access request is an illegal request, the GPGPU access request is discarded to prohibit the execution of the step of calling the target computing unit determined from the GPGPU based on the preset scheduling algorithm to process the plaintext instruction and the request data. That is, if the current GPGPU access request is an illegal request, the GPGPU access request is directly discarded without further calculation, that is, the step of calling the target computing unit determined from the GPGPU based on the preset scheduling algorithm to process the instruction and the request data is prohibited.

[0096] Step S14: Obtain the processing result sent by the target computing unit through the bus, and encrypt the processing result using the target encryption algorithm corresponding to the remote user node to obtain a ciphertext result, and then send the ciphertext result to the target host, so that the target host sends the ciphertext result to the remote user node.

[0097] In this embodiment, the security control module obtains the processing result sent by the target computing unit through the bus. Similarly, the security control module can also configure different encryption algorithms for users based on the information of legitimate users, that is, the processing result is encrypted using the target encryption algorithm corresponding to the remote user node to obtain the ciphertext result, and then the ciphertext result is sent to the host through the PCIe interface in the form of DMA, so that the target host can then send the ciphertext result to the remote user node. In this way, the above scheme can improve the security protection efficiency of GPGPU access, realize the physical isolation between the security control module and the computing unit and scheduler, and help users better realize the unified scheduling control of GPGPU and significantly improve system performance.

[0098] It should be noted that the security control module is provided with a processing result output encryption architecture to encrypt the processing result using the target encryption algorithm corresponding to the remote user node to obtain the ciphertext result. Figure 6 As shown. Figure 6 It can be seen that the processing result output encryption architecture includes a management information configuration module, a processing result receiving module, a computing unit ID comparison and extraction module, a GPGPU computing unit ID list, a processing result cache module, an encryption algorithm information selection module, an algorithm encryption FSM state machine, a ciphertext cache module, a MUX data merging module, and a processing result encryption processing cache module.

[0099] Among them, the management information configuration module is responsible for completing the necessary parameter settings and initialization configurations for other modules, and configuring the information of the management host; the processing result receiving module is responsible for receiving the processing results output by the GPGPU computing module from the AXI bus, and the processing result caching module caches the original unencrypted processing results to be output in sequence; the computing unit ID comparison extraction module extracts the encryption operation code and encryption algorithm data corresponding to the IP information of the remote user node from the GPGPU computing unit ID list according to the computing unit ID information of the input processing result; the encryption algorithm information selection module pre-stores a variety of decryption algorithms corresponding to the legitimate user IP, such as symmetric decryption algorithms AES and SHA, and asymmetric decryption algorithm RSA, and judges the current G according to the encryption operation code The encryption algorithm category corresponding to the user IP of the PGPU access request selects the corresponding encryption algorithm and the related encryption parameters involved; the algorithm encryption FSM state machine generates a ciphertext result in a specific format corresponding to the encryption algorithm for the current processing result data according to the encryption algorithm and encryption algorithm data corresponding to the current processing result; the ciphertext cache module is used to cache the processing result ciphertext generated by the algorithm encryption FSM state machine; the MUX data merging module is used to merge and splice the processing result and the related ciphertext involved in different processing results in a specific format to form an encrypted processing result, which can only be read and decrypted by a specific user; the processing result encryption processing cache module is used to cache the encrypted processing result and send it to the user terminal of the GPGPU access request in a specific format.

[0100] Therefore, if Figure 7 As shown, in some specific embodiments, the step of encrypting the processing result using the target encryption algorithm corresponding to the remote user node to obtain the ciphertext result may include:

[0101] Step S141: Determine the unit identification number of the target computing unit, and obtain the encryption operation code and encryption algorithm data corresponding to the IP information of the remote user node from the computing unit identification list corresponding to the unit identification number.

[0102] In this embodiment, the processing result receiving module receives the processing result from the target computing unit, determines the unit identification number of the target computing unit, and caches the original unencrypted processing result to the processing result caching module based on the computing unit ID (unit identification number). Further, the GPGPU computing unit ID comparison extraction module extracts the encryption operation code and related encryption algorithm data corresponding to the IP information of the remote user node from the corresponding computing unit identification list according to the unit identification number of the target computing unit of the input processing result.

[0103] Step S142: the encryption algorithm data and the unit identification number are associated with each other and sent to a locally preset encryption state machine, and a target encryption algorithm corresponding to the encryption operation code is obtained from a preset kernel.

[0104] In this embodiment, the encryption algorithm data and the unit identification number are associated with each other and sent to the algorithm encryption FSM state machine, and the encryption operation code is sent to the encryption algorithm information selection module; the encryption algorithm information selection module pre-stores a variety of decryption algorithms corresponding to the legitimate user IP, such as symmetric decryption algorithms AES, SHA, and asymmetric decryption algorithm RSA, and determines the encryption algorithm category corresponding to the current GPGPU access request user IP based on the encryption operation code, so as to select the corresponding target encryption algorithm and the related encryption parameters involved from the preset kernel.

[0105] Step S143: Establish an association relationship between the target encryption algorithm and the unit identification number and send them to the encryption state machine, so that in the encryption state machine, based on the unit identification number, the processing result is encrypted using the target encryption algorithm and the encryption algorithm data to obtain a ciphertext result.

[0106] In this embodiment, the target encryption algorithm and the unit identification number of the corresponding computing unit are sent as tags to the algorithm encryption FSM state machine. The algorithm encryption FSM state machine generates a ciphertext result in a specific format corresponding to the encryption algorithm for the current processing result based on the target encryption algorithm corresponding to the unit identification number and related encryption algorithm data, and sends the ciphertext result to the ciphertext cache module with the corresponding computing unit ID of the processing result as a tag.

[0107] Furthermore, after the processing result is encrypted using the target encryption algorithm corresponding to the remote user node to obtain a ciphertext result, the method further includes: splicing the ciphertext result and the processing result according to a second preset format based on the unit identification number to obtain second spliced ​​data; accordingly, sending the ciphertext result to the target host so that the target host sends the ciphertext result to the remote user node includes: sending the second spliced ​​data to the target host so that the target host sends the second spliced ​​data to the remote user node.

[0108] That is, the MUX data merging module will mark the ciphertext results cached by the ciphertext cache module and the original unencrypted processing results cached by the processing result cache module with the unit identification number, merge and splice the data according to the user's second preset format, and send the obtained second spliced ​​data to the processing result encryption processing cache module for storage. Furthermore, the processing result encryption processing cache module sequentially outputs the second spliced ​​data marked based on the unit identification number to the target data until the sending is completed, and the target host subsequently sends the second spliced ​​data to the remote user node. Similarly, by splicing the ciphertext results and the processing results with the unit identification number, it can be ensured that the corresponding relationship between each calculation unit and its result is accurate, ensuring the consistency and accuracy in data transmission. In addition, it can be transmitted as a whole during the data transmission process, reducing the additional overhead caused by multiple transmissions and improving the data transmission efficiency.

[0109] It can be seen that after receiving the GPGPU access request sent by the remote user node, the target host in this application first needs to parse the GPGPU access request to convert it into a relevant machine code stream recognizable by the GPGPU, so as to send the ciphertext instructions and request data carried in the GPGPU access request to the security control module in the GPGPU. The security control module first needs to use the target decryption algorithm corresponding to the remote user node to decrypt the ciphertext instruction to obtain the plaintext instruction, so as to verify the legitimacy of the GPGPU access request based on the plaintext instruction. That is, the security control module in this application is equipped with a variety of decryption algorithms, and different users have their own independent decryption protection methods, that is, the security control module can configure different decryption algorithms for users according to the information of legitimate users, and has high flexibility. Further, if it is determined that the current access is legitimate, the plaintext instruction and request data are sent to the preset scheduler through the bus, so that the preset scheduler calls the target computing unit determined from the GPGPU based on the preset scheduling algorithm to process the plaintext instruction and request data, and obtain the processing result. That is, the communication between the security control module and the preset scheduler is realized through the bus to achieve physical isolation between the two, and different processes do not interfere with each other. In addition, the security control module and the computing unit also communicate through the bus, so the security control module obtains the processing results sent by the target computing unit through the bus. Similarly, the security control module can also configure different encryption algorithms for users based on the information of legitimate users, that is, the processing results are encrypted using the target encryption algorithm corresponding to the remote user node to obtain the ciphertext result, and then the ciphertext result is sent to the host, so that the target host can then send the ciphertext result to the remote user node. In this way, the above scheme can improve the security protection efficiency of GPGPU access, realize the physical isolation between the security control module and the computing unit and scheduler, and help users better realize the unified scheduling control of GPGPU and significantly improve system performance.

[0110] See also Figure 8 As shown, the embodiment of the present application discloses a GPGPU security calling device, which is applied to a security control module in a GPGPU. The device includes:

[0111] The information acquisition module 11 is used to acquire the ciphertext instruction and request data carried in the GPGPU access request sent by the target host after parsing the GPGPU access request sent by the remote user node;

[0112] A decryption verification module 12, configured to decrypt the ciphertext instruction using a target decryption algorithm corresponding to the remote user node to obtain a plaintext instruction, and verify the legitimacy of the GPGPU access request based on the plaintext instruction;

[0113] The computing module 13 is configured to send the plaintext instruction and the request data to a preset scheduler through a bus if the GPGPU access request is a legitimate request, so that the preset scheduler calls a target computing unit determined from the GPGPU based on a preset scheduling algorithm to process the plaintext instruction and the request data and obtain a processing result;

[0114] The encryption module 14 is used to obtain the processing result sent by the target computing unit through the bus, and encrypt the processing result using the target encryption algorithm corresponding to the remote user node to obtain a ciphertext result, and then send the ciphertext result to the target host, so that the target host sends the ciphertext result to the remote user node.

[0115] It can be seen that after receiving the GPGPU access request sent by the remote user node, the target host in this application first needs to parse the GPGPU access request to convert it into a relevant machine code stream recognizable by the GPGPU, so as to send the ciphertext instructions and request data carried in the GPGPU access request to the security control module in the GPGPU. The security control module first needs to use the target decryption algorithm corresponding to the remote user node to decrypt the ciphertext instruction to obtain the plaintext instruction, so as to verify the legitimacy of the GPGPU access request based on the plaintext instruction. That is, the security control module in this application is equipped with a variety of decryption algorithms, and different users have their own independent decryption protection methods, that is, the security control module can configure different decryption algorithms for users according to the information of legitimate users, and has high flexibility. Further, if it is determined that the current access is legitimate, the plaintext instruction and request data are sent to the preset scheduler through the bus, so that the preset scheduler calls the target computing unit determined from the GPGPU based on the preset scheduling algorithm to process the plaintext instruction and request data, and obtain the processing result. That is, the communication between the security control module and the preset scheduler is realized through the bus to achieve physical isolation between the two, and different processes do not interfere with each other. In addition, the security control module and the computing unit also communicate through the bus, so the security control module obtains the processing results sent by the target computing unit through the bus. Similarly, the security control module can also configure different encryption algorithms for users based on the information of legitimate users, that is, the processing results are encrypted using the target encryption algorithm corresponding to the remote user node to obtain the ciphertext result, and then the ciphertext result is sent to the host, so that the target host can then send the ciphertext result to the remote user node. In this way, the above scheme can improve the security protection efficiency of GPGPU access, realize the physical isolation between the security control module and the computing unit and scheduler, and help users better realize the unified scheduling control of GPGPU and significantly improve system performance.

[0116] Fig. 9 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Specifically, it may include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the GPGPU secure calling method executed by the electronic device disclosed in any of the aforementioned embodiments.

[0117] In this embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present application, and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0118] Among them, the processor 21 may include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor 21 can be implemented in at least one hardware form of DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). The processor 21 may also include a main processor and a coprocessor. The main processor is a processor for processing data in the awake state, also known as a CPU (Central Processing Unit); the coprocessor is a low-power processor for processing data in the standby state. In some embodiments, the processor 21 may be integrated with a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the display screen. In some embodiments, the processor 21 may also include an AI (Artificial Intelligence) processor, which is used to process computing operations related to machine learning.

[0119] In addition, the memory 22, as a carrier for storing resources, can be a read-only memory, a random access memory, a disk or an optical disk, etc. The resources stored thereon include an operating system 221, a computer program 222 and data 223, etc. The storage method can be temporary storage or permanent storage.

[0120] Among them, the operating system 221 is used to manage and control the hardware devices and computer programs 222 on the electronic device 20, so as to realize the operation and processing of the massive data 223 in the memory 22 by the processor 21, which can be Windows, Unix, Linux, etc. In addition to including a computer program that can be used to complete the GPGPU security calling method executed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 can further include a computer program that can be used to complete other specific tasks. In addition to data transmitted from an external device received by the electronic device, the data 223 can also include data collected by its own input and output interface 25, etc.

[0121] Furthermore, an embodiment of the present application also discloses a computer-readable storage medium, in which a computer program is stored. When the computer program is loaded and executed by a processor, the steps of the GPGPU secure calling method disclosed in any of the aforementioned embodiments are implemented.

[0122] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0123] Those skilled in the art may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented with electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0124] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a compact disc read-only memory (CD-ROM), or any other form of storage medium known in the art.

[0125] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0126] The above is a detailed introduction to a GPGPU secure calling method, device, equipment and storage medium provided by the present invention. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for general technicians in this field, according to the ideas of the present invention, there will be changes in the specific implementation methods and application scopes. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A GPGPU secure calling method, characterized in that: A security control module applied to a GPGPU, the method comprising: Obtaining the ciphertext instruction and request data carried in the GPGPU access request sent by the target host after parsing the GPGPU access request sent by the remote user node; Decrypting the ciphertext instruction using a target decryption algorithm corresponding to the remote user node to obtain a plaintext instruction, and verifying the legitimacy of the GPGPU access request based on the plaintext instruction; If the GPGPU access request is a legitimate request, the plaintext instruction and the request data are sent to a preset scheduler through a bus, so that the preset scheduler calls a target computing unit determined from the GPGPU based on a preset scheduling algorithm to process the plaintext instruction and the request data and obtain a processing result; Obtain the processing result sent by the target computing unit through the bus, and encrypt the processing result using the target encryption algorithm corresponding to the remote user node to obtain a ciphertext result, and then send the ciphertext result to the target host, so that the target host sends the ciphertext result to the remote user node.

2. The GPGPU secure calling method according to claim 1, characterized in that: The step of decrypting the ciphertext instruction by using a target decryption algorithm corresponding to the remote user node to obtain a plaintext instruction includes: Authentication is performed on the target host. If the authentication is successful, the ciphertext to be decrypted, the instruction identification number and the IP information of the remote user node are extracted from the ciphertext instruction, and the ciphertext to be decrypted and the instruction identification number are associated with each other and sent to a locally preset decryption state machine; Determine the corresponding target decryption algorithm based on the IP information, and send the target decryption algorithm to the decryption state machine after establishing an association relationship with the instruction identification number; Determining the instruction encryption format by the decryption state machine using the access request category and the calculation type obtained from the preset instruction comparison table based on the instruction identification number; In the decryption state machine, based on the instruction identification number, the target decryption algorithm and the instruction encryption format are used to decrypt the ciphertext to be decrypted in the ciphertext instruction to obtain a plaintext instruction.

3. The GPGPU secure calling method according to claim 2, characterized in that: The preset instruction comparison table stores preset legal instruction parameters; Accordingly, the verifying the legitimacy of the GPGPU access request based on the plaintext instruction includes: Determining whether the instruction parameters of the plain text instruction are consistent with the legal instruction parameters stored in the preset instruction comparison table; If they are consistent, the GPGPU access request is determined to be a legal request, otherwise it is an illegal request.

4. The GPGPU secure calling method according to claim 2, characterized in that: After the GPGPU access request is a legal request, the method further includes: Based on the instruction identification number, splicing the corresponding plaintext instruction and the request data according to a first preset format to obtain first spliced ​​data; Accordingly, the preset scheduler calls the target computing unit determined from the GPGPU based on the preset scheduling algorithm to process the plaintext instruction and the request data, including: The preset scheduler calls a target computing unit determined from the GPGPU based on a preset scheduling algorithm to process the first spliced ​​data.

5. The GPGPU secure calling method according to claim 1, characterized in that: The step of encrypting the processing result by using a target encryption algorithm corresponding to the remote user node to obtain a ciphertext result includes: Determine the unit identification number of the target computing unit, and obtain the encryption operation code and encryption algorithm data corresponding to the IP information of the remote user node from the computing unit identification list corresponding to the unit identification number; The encryption algorithm data and the unit identification number are associated with each other and sent to a locally preset encryption state machine, and a target encryption algorithm corresponding to the encryption operation code is obtained from a preset kernel; The target encryption algorithm is associated with the unit identification number and then sent to the encryption state machine, so that in the encryption state machine, based on the unit identification number, the processing result is encrypted using the target encryption algorithm and the encryption algorithm data to obtain a ciphertext result.

6. The GPGPU secure calling method according to claim 5, characterized in that: After the processing result is encrypted using the target encryption algorithm corresponding to the remote user node to obtain a ciphertext result, the method further includes: Based on the unit identification number, the ciphertext result and the processing result are spliced ​​in a second preset format to obtain second spliced ​​data; Correspondingly, the step of sending the ciphertext result to the target host so that the target host sends the ciphertext result to the remote user node includes: The second spliced ​​data is sent to the target host, so that the target host sends the second spliced ​​data to the remote user node.

7. The GPGPU secure calling method according to any one of claims 1 to 6, characterized in that: After verifying the legitimacy of the GPGPU access request based on the plaintext instruction, the method further includes: If the GPGPU access request is an illegal request, the GPGPU access request is discarded to prohibit the step of calling a target computing unit determined from the GPGPU based on a preset scheduling algorithm to process the plaintext instruction and the request data.

8. A GPGPU security calling device, characterized in that: A safety control module applied to GPGPU, the device comprising: An information acquisition module, used for acquiring the ciphertext instruction and request data carried in the GPGPU access request sent by the target host after parsing the GPGPU access request sent by the remote user node; A decryption verification module, configured to decrypt the ciphertext instruction using a target decryption algorithm corresponding to the remote user node to obtain a plaintext instruction, and verify the legitimacy of the GPGPU access request based on the plaintext instruction; a computing module, configured to send the plaintext instruction and the request data to a preset scheduler through a bus if the GPGPU access request is a legitimate request, so that the preset scheduler calls a target computing unit determined from the GPGPU based on a preset scheduling algorithm to process the plaintext instruction and the request data and obtain a processing result; An encryption module is used to obtain the processing result sent by the target computing unit through the bus, and encrypt the processing result using a target encryption algorithm corresponding to the remote user node to obtain a ciphertext result, and then send the ciphertext result to the target host, so that the target host sends the ciphertext result to the remote user node.

9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor is used to execute the computer program to implement the steps of the GPGPU security calling method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: Used to store computer programs; wherein, when the computer program is executed by a processor, the steps of the GPGPU security calling method as described in any one of claims 1 to 7 are implemented.

Images