Safety protection system and safety protection method

Abstract

The embodiment of the invention provides a safety protection system and a safety protection method. The security protection system comprises a virtual machine monitor and an internal storage module, the internal storage module is configured to comprise a fixed memory space and a general memory space, and the fixed memory space is used by a target requester; the internal storage module is used for receiving a fixed memory address and providing data in a fixed memory space according to the fixed memory address; and the virtual machine monitor is used for receiving an address mapping request of a requester, confirming that the address mapping request is from a target requester and converting the address mapping request into a fixed memory address when the address mapping request requests to access the fixed memory space.

Description

Technical Field

[0001] The present disclosure relates to the field of virtualization security, and in particular to a security protection system and a security protection method. Background Art

[0002] AI models require protection during transmission and storage. Currently, the most common model protection solution is file encryption; AI models are transmitted and stored in ciphertext, and the NPU decrypts them in memory before executing inference. However, throughout the inference process, AI models remain in plaintext in memory, making them vulnerable to in-memory attacks and posing a threat to the security of AI model files. Summary of the Invention

[0003] The embodiments of the present disclosure provide a security protection system and a security protection method.

[0004] In a first aspect, an embodiment of the present disclosure provides a security protection system, comprising: a virtual machine monitor and an internal storage module; wherein:

[0005] The internal storage module is configured to include a fixed memory space and a general memory space, wherein the fixed memory space is used by the target requester; the internal storage module is configured to receive a fixed memory address and provide data in the fixed memory space according to the fixed memory address;

[0006] The virtual machine monitor is configured to receive an address mapping request from a requester, and when confirming that the address mapping request comes from the target requester and requests access to the fixed memory space, convert the address mapping request into a fixed memory address.

[0007] In some embodiments, the system further comprises: a virtual machine, a number of requesters, and a system memory management unit;

[0008] The virtual machine is used to call the requester corresponding to the current task, so that the requester corresponding to the current task outputs a memory access request; the memory access request includes a virtual address and a flow mark;

[0009] The system memory management unit is configured to map the virtual address to an intermediate memory address, and then forward the intermediate memory address and the flow identifier as the address mapping request.

[0010] In some embodiments, the target requester is a requester with fixed memory space access rights among the plurality of requesters;

[0011] The virtual machine monitor is specifically configured to receive the address mapping request and, when the flow indication is from the target requester and requests access to a fixed memory space, map the intermediate memory address to the fixed memory address.

[0012] In some embodiments, the virtual machine monitor is further configured to refuse to convert the address mapping request into a fixed memory address when the address mapping request comes from a non-target requester and requests access to the fixed memory space; and

[0013] The virtual machine monitor is further configured to convert the address mapping request into a general memory address when the address mapping request comes from the non-target requester and requests access to the general memory space;

[0014] The internal storage module is further configured to receive the general memory address and provide data in the general memory space according to the general memory address; the general memory space is used by the non-target requester.

[0015] In some embodiments, the target requester is used to run an artificial intelligence model; the fixed memory space includes: a model data space, an input data space, and an output data space;

[0016] The model data space is used to store artificial intelligence model data;

[0017] The input data space is used to store input data before the artificial intelligence runs;

[0018] The output data space is used to store the output data after the artificial intelligence runs.

[0019] In some embodiments, the system further comprises: an external storage module, and a trusted application running on a trusted operating system;

[0020] The external storage module is used to store encrypted data of the artificial intelligence model;

[0021] The trusted application is used to access the external storage module through the trusted operating system, decrypt the artificial intelligence model encrypted data, and write the obtained artificial intelligence model data into the model data space.

[0022] In some embodiments, the virtual machine is further configured to write the input data into the input data space through the trusted application; and read the output data from the output data space through the trusted application.

[0023] In a second aspect, an embodiment of the present disclosure provides a security protection method, the method comprising:

[0024] receiving an address mapping request from a requester and, upon confirming that the address mapping request comes from a target requester and requests access to a fixed memory space, converting the address mapping request into a fixed memory address; the fixed memory space being a fixed storage space in a memory module configured for use by the target requester;

[0025] The fixed memory address is received, and data in the fixed memory space is provided according to the fixed memory address.

[0026] In some embodiments, before receiving the address mapping request from the requester, the method further includes:

[0027] Calling the requester corresponding to the current task, so that the requester corresponding to the current task outputs a memory access request; the memory access request includes a virtual address and a flow mark;

[0028] After mapping the virtual address to an intermediate memory address, the intermediate memory address and the flow identifier are forwarded as the address mapping request.

[0029] In some embodiments, receiving an address mapping request from a requester and confirming that the address mapping request comes from a target requester and requests access to a fixed memory space, converting the address mapping request into a fixed memory address includes:

[0030] receiving the address mapping request, and mapping the intermediate memory address to the fixed memory address when the flow indication is from the target requester and the request is to access a fixed memory space;

[0031] The target requester is a requester with fixed memory space access rights among the plurality of requesters.

[0032] In some embodiments, the method further comprises:

[0033] When the address mapping request comes from a non-target requester and requests access to the fixed memory space, refusing to convert the address mapping request into a fixed memory address; and

[0034] When the address mapping request comes from a non-target requester and requests access to a general memory space, converting the address mapping request into a general memory address;

[0035] The general memory address is received, and data in the general memory space is provided according to the general memory address; the general memory space is used by the non-target requester. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1A schematic diagram of the structure of a security protection system provided in an embodiment of the present disclosure Figure 1 ;

[0037] Figure 2 A schematic diagram of the structure of a security protection system provided in an embodiment of the present disclosure Figure 2 ;

[0038] Figure 3 A schematic diagram of the structure of a fixed memory space provided in an embodiment of the present disclosure;

[0039] Figure 4 A schematic diagram of the structure of a security protection system provided in an embodiment of the present disclosure Figure 3 ;

[0040] Figure 5 A schematic diagram of the structure of a security protection system provided in an embodiment of the present disclosure Figure 4 ;

[0041] Figure 6 A flowchart of a security protection method provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0042] The following will be combined with the accompanying drawings in the embodiments of the present disclosure to clearly and completely describe the technical solutions in the embodiments of the present disclosure. It should be understood that the specific embodiments described herein are only used to illustrate the relevant disclosure and are not intended to limit the disclosure. It should also be noted that for ease of description, only the portions relevant to the relevant disclosure are shown in the drawings.

[0043] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art in the art of the present disclosure. The terms used herein are only for the purpose of describing the embodiments of the present disclosure and are not intended to limit the present disclosure.

[0044] In the following description, reference is made to “some embodiments”, which describes a subset of all possible embodiments, but it will be understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0045] It should be pointed out that the terms "first\second\third" involved in the embodiments of the present disclosure are only used to distinguish similar objects and do not represent a specific order for the objects. It can be understood that "first\second\third" can be interchanged with a specific order or sequence where permitted, so that the embodiments of the present disclosure described here can be implemented in an order other than that illustrated or described here.

[0046] Before further explaining the embodiments of the present disclosure in detail, the nouns and terms involved in the embodiments of the present disclosure are explained. The nouns and terms involved in the embodiments of the present disclosure are subject to the following interpretations:

[0047] Neural Processing Unit (NPU);

[0048] Artificial Intelligence Model (AI model);

[0049] Android Virtualization Framework (AVF);

[0050] Hypervisor;

[0051] Streamline Memory Management Unit (SMMU);

[0052] Memory Management Unit (MMU);

[0053] Stream ID;

[0054] Protected Virtual Machine (pVM);

[0055] Virtual Machines (VM);

[0056] Central Processing Unit (CPU);

[0057] Neural Network Processing Unit (NPU);

[0058] Direct Memory Access (DMA);

[0059] Trusted Application (TA).

[0060] Currently, Android 14 has expanded the scope of use of the Android virtualization framework, allowing the virtual machine monitor to provide the ability to isolate the Android host and virtual machines from each other. Specifically, the virtual machine monitor ensures that the SMMU and MMU are in the same virtual address space by controlling stage2 (IPA→PA mapping); the SMMU distinguishes different devices through stream labels to ensure that different devices each have independent memory access rights; and the virtual machine monitor controls stage2 to allocate different physical address spaces for different devices, thereby realizing the management of physical memory space. In this way, in a virtualization scenario, even if Android or other virtual machines are cracked, the virtual machine monitor can maintain the integrity of the executed code and the confidentiality of the virtual machine resources, thereby providing security protection for systems and applications running in a virtualized environment.

[0061] However, in virtualized scenarios, AI models are protected during transmission and storage using a file encryption-based model protection solution. Specifically, the AI ​​model is transmitted and stored in ciphertext, and the NPU decrypts it in memory before executing inference. Throughout the inference process, the AI ​​model remains in plaintext in memory, leaving the AI ​​model and other data unprotected. This makes it vulnerable to attacks and in-memory access, posing a security threat to the AI ​​model file.

[0062] Based on this, the embodiments of the present disclosure provide a security protection system and a security protection method; the embodiments of the present disclosure will be described in detail below with reference to the accompanying drawings.

[0063] In one embodiment of the present disclosure, see Figure 1 , shows a security protection system 100, including: a virtual machine monitor 110 and an internal storage module 120; wherein: the internal storage module 120 is configured to include a fixed memory space 121 and a general memory space 122, and the fixed memory space 121 is used by the target requester; the internal storage module 120 is used to receive a fixed memory address and provide data in the fixed memory space 121 according to the fixed memory address; the virtual machine monitor 110 is used to receive an address mapping request from the requester, and when confirming that the address mapping request comes from the target requester and requests access to the fixed memory space 121, converts the address mapping request into a fixed memory address.

[0064] In this disclosure, please continue to refer to Figure 1The security protection system 100 is a hardware or software module used to manage and restrict resource access rights in a computer system. Specifically, the security protection system 100 can be a standalone module or chip, or a function or unit integrated into an existing storage controller; for example, it can be a memory access control unit. The security protection system 100 ensures that system resources (such as data in fixed memory space) are only accessed in an authorized manner by legitimate entities (such as the target requester), thereby ensuring the security, stability, and isolation of system resources and preventing unauthorized programs or hardware components from unauthorized reading and writing of system resources.

[0065] In the embodiment of the present disclosure, the virtual machine monitor 110 is used to complete the sharing, isolation and switching of hardware resources, so that multiple operating systems or applications can run independently on the same physical device and share the underlying resources. Furthermore, the virtual machine monitor 110 is configured with an identity authentication module and an address mapping module; wherein the identity authentication module can verify the identity of the requester (such as the target requester) based on the address mapping request and confirm the access rights of the requester (such as the access rights to the fixed memory space 121); the address mapping module can map the address mapping request with access rights and convert the address mapping request into the corresponding memory address to ensure that the requester can only access the corresponding memory space, prevent illegal VMs or devices from bypassing the isolation mechanism, and ensure the security, stability and isolation of the security protection system 100.

[0066] In the embodiment of the present disclosure, the address mapping request includes the identifier of the requester and the address to be accessed. The identifier of the requester may be, for example, the ID of the virtual machine, a flow identifier, etc.; in other embodiments, the identifier of the requester may be set according to actual needs, such as the security level, the time period used (such as 09:30-11:30, 13:00-15:00), etc.; in this way, the identity of the requester may be verified by the identifier of the requester, thereby confirming the access rights of the requester. The address to be accessed may be a virtual address (VA) or an intermediate physical address (IPA), and the fixed memory address may be a fixed physical address (PA); address mapping through the virtual machine monitor 110 can ensure that the requester can only access the corresponding memory space.

[0067] In the embodiment of the present disclosure, the internal storage module 120 can be a chip or module with storage function such as static random access memory (SRAM), dynamic random access memory (DRAM), read-only memory (ROM), non-volatile random access memory (NVRAM), register, etc.

[0068] In the embodiment of the present disclosure, the internal storage module 120 is configured as a fixed memory space 121 and a general memory space 122; wherein, the fixed memory space 121 is used to store the data of the target requester, and the fixed memory space 121 can be, for example, the Secure Memory of the ARM Trust Zone, the Enclave Page Cache (EPC) of Intel SGX, or a protected physical address range configured by the SMMU; the data of the target requester can be, for example, sensitive data such as decrypted AI models and keys, which are only allowed to be accessed by the NPU or trusted VM through a secure path. The general memory space 122 is used to store the data of non-target requesters; the general memory space 122 can be, for example, conventional system memory for use by ordinary applications and VMs. In this way, the data in the fixed memory space 121 and the general memory space 122 are physically isolated, so that non-target requesters cannot access the data in the fixed memory space 121, thereby ensuring the security of the data in the internal storage module 120; at the same time, it supports on-demand allocation of memory space in the internal storage module 120 to avoid waste of resources.

[0069] In the embodiment of the present disclosure, the virtual machine monitor 110 filters the address mapping request of the requester, thereby limiting the access scope of the requester to the corresponding memory space, so that the fixed memory space 121 can only be accessed by the target requester, thereby clarifying the access scope of the fixed memory space and ensuring the security of the data in the fixed memory space 121.

[0070] In some embodiments, see Figure 2 The security protection system 100 also includes: a virtual machine 140, several requesters 130 and a system memory management unit 150; the virtual machine 140 is used to call the requester 130 corresponding to the current task, so that the requester 130 corresponding to the current task outputs a memory access request; the memory access request includes a virtual address and a flow identifier; the system memory management unit 150 is used to map the virtual address to an intermediate memory address, and then forward the intermediate memory address and the flow identifier as an address mapping request.

[0071] In the disclosed embodiments, virtual machine 140 uses virtualization technology to abstract physical resources (such as CPU, memory, storage, and network) into logical resources, providing each virtual machine with an independent computing environment. This isolates the virtual machines from each other and allows them to run different operating systems and applications. Virtual machines can be either system virtual machines or process virtual machines; system virtual machines (such as VMware and VirtualBox) can run complete operating systems, while process virtual machines (such as Java virtual machines) are used to run specific applications.

[0072] In the embodiment of the present disclosure, the requester 130 may be a CPU, NPU, etc. The requester 130 outputs a memory access request, where the memory access request includes a virtual address and a flow identifier. In other embodiments, the memory access request may also be configured according to actual needs, such as the virtual address and the ID of the virtual machine, the virtual address and the security level, etc. The number of requesters 130 may be 1, 2, 3, etc.; wherein, Figure 2 Two are shown.

[0073] In the disclosed embodiment, the system memory management unit 150 may be an SMMU, an MMU, etc. The system memory management unit 150 may provide stage 1 translation (VA→PA), that is, mapping a virtual address to an intermediate memory address; thereafter, the intermediate memory address and a flow identifier (which may also be a virtual machine ID, security level, etc.) are forwarded as an address mapping request.

[0074] For example, when the requester 130 is a CPU, the CPU outputs a memory access request, which includes the virtual address of the CPU accessing the memory space and the CPU's flow identifier; after the MMU maps the virtual address of the CPU accessing the memory space to the corresponding intermediate memory address, it forwards the corresponding intermediate memory address and flow identifier as an address mapping request.

[0075] For another example, when the requester 130 is an NPU, the NPU can output a memory access request through DMA, which memory access request includes the virtual address of the NPU access space and the flow identifier of the NPU; after the SMMU maps the virtual address of the CPU access memory space to the corresponding intermediate memory address, it forwards the corresponding intermediate memory address and flow identifier as an address mapping request.

[0076] In some embodiments, please refer to Figure 2 The target requester 131 is a requester 130 among the multiple requesters 130 that has access rights to the fixed memory space 121; the virtual machine monitor 110 is specifically used to receive an address mapping request and, when the flow is marked as coming from the target requester 131 and requests access to the fixed memory space 121, map the intermediate memory address to a fixed memory address.

[0077] For example, target requester 131 may be an NPU, which has access to fixed memory space 121. The NPU is used to run an artificial intelligence model, and fixed memory space 121 may store artificial intelligence model data, input data before the artificial intelligence model runs, and output data after the artificial intelligence model runs. Virtual machine monitor 110 determines, based on the flow identifier in the address mapping request, that the address mapping request is from the NPU, and maps the intermediate memory address to the fixed memory address when the NPU requests access to fixed memory space 121.

[0078] In other embodiments, the target requester 131 may also be used to run other models, and the fixed memory space 121 is used to store corresponding model data; this disclosure is not limited to this.

[0079] In some embodiments, please refer to Figure 2 The virtual machine monitor 110 is further configured to refuse to convert the address mapping request into a fixed memory address when the address mapping request comes from a non-target requester 132 and requests access to the fixed memory space 121 .

[0080] For example, the non-target requester 132 may be a CPU, and the CPU does not have access rights to the fixed memory space 121. The virtual machine monitor 110 determines, based on the flow identifier in the address mapping request, that the address mapping request is from the CPU, and when the CPU requests access to the fixed memory space 121, refuses to map the intermediate memory address to the fixed memory address and returns a webpage error.

[0081] In some embodiments, please refer to Figure 2 The virtual machine monitor 110 is further configured to convert an address mapping request into a general memory address when the address mapping request comes from a non-target requester 132 and requests access to the general memory space 122; the internal storage module 120 is further configured to receive the general memory address and provide data in the general memory space 122 according to the general memory address; the general memory space 122 is used by the non-target requester 132.

[0082] For example, the non-target requester 132 may be a CPU, and the CPU has access rights to the general memory space 122. The virtual machine monitor 110 determines, based on the flow identifier in the address mapping request, that the address mapping request is from the CPU, and when the CPU requests access to the general memory space 122, maps the intermediate memory address to a general memory address; thereby, the internal storage module 120 provides data in the general memory space 122.

[0083] In the embodiment of the present disclosure, the address mapping request of the requester is screened by the virtual machine monitor 110, thereby limiting the access scope of the requester to the corresponding memory space, so that the fixed memory space 121 can only be accessed by the target requester, and the general memory space is accessed by the non-target requester, thereby clarifying the access scope of the requester and ensuring the security of the data of the internal storage module.

[0084] In some embodiments, please refer to Figure 3The fixed memory space 121 includes: a model data space 121a, an input data space 121b and an output data space 121c; the model data space 121a is used to store artificial intelligence model data; the input data space 121b is used to store input data before artificial intelligence runs; the output data space 121c is used to store output data after artificial intelligence runs.

[0085] In the embodiment of the present disclosure, after the target requester 131 (e.g., NPU) accesses the fixed memory space 121, it loads the artificial intelligence model data in the model data space 121a, and imports the input data in the input data space 121b into the artificial intelligence model for inference, and writes the inferred output data into the output data space 121c through the same path.

[0086] In the embodiment of the present disclosure, the virtual machine monitor 110 can ensure the security of the target requester 131 when running the model therein by controlling the permissions of the fixed memory space 121; for example, ensuring the security of the NPU running the artificial intelligence model. In this way, compared with placing the NPU driver in the Trustzone to protect the security of the artificial intelligence model, the embodiment of the present disclosure uses virtualization technology to make the inference process more concise and have higher security performance.

[0087] In some embodiments, please refer to Figure 3 and Figure 4 The security protection system 100 also includes: an external storage module 160, and a trusted application 170 running on a trusted operating system; the external storage module 160 is used to store artificial intelligence model encrypted data; the trusted application 170 is used to access the external storage module 160 through the trusted operating system, decrypt the artificial intelligence model encrypted data, and write the obtained artificial intelligence model data into the model data space 121a.

[0088] In the embodiment of the present disclosure, the external storage module 160 may be a chip or module having a storage function such as a flash memory (UFS).

[0089] In the disclosed embodiments, trusted applications 170 are security-sensitive programs running in a trusted operating system (TEE OS) that handle tasks requiring a high level of security, such as encryption, authentication, and key management. Trusted applications 170 communicate with client applications (CAs) in a common operating system (REE, Rich Execution Environment) through a secure protocol, but their own code and data are protected by TEE hardware isolation. This ensures that trusted applications 170 are isolated, secure, and functionally specific. The trusted operating system is responsible for managing hardware resources, scheduling the execution of trusted applications 170, and providing a secure service interface.

[0090] In the embodiment of the present disclosure, the artificial intelligence model encrypted data in the external storage module 160 is decrypted by the trusted application 170, and the obtained artificial intelligence model data is written into the model data space 121a; in this way, malicious software or vulnerabilities cannot directly access or modify the artificial intelligence model data in the model data space 121a, thereby ensuring the security, stability and isolation of the artificial intelligence model data in the model data space 121a.

[0091] In some embodiments, please refer to Figure 3 and Figure 4 The virtual machine 140 is further configured to write input data into the input data space 121 b through the trusted application 170 ; and read output data from the output data space 121 c through the trusted application 170 .

[0092] In the embodiment of the present disclosure, due to the high security of the trusted application 170, the virtual machine 140 writes or reads through the trusted application 170, so that malicious software or vulnerabilities cannot directly access or modify the data in the input data space 121b and the output data space 121c, thereby ensuring the security, stability and isolation of the input data and output data.

[0093] In short, please refer to Figure 5 The requester 130 includes a target requester 131 and a non-target requester 132. Here, the target requester 131 is an NPU and the non-target requester 132 is a CPU. Specifically:

[0094] 1) The virtual machine monitor 110 divides the internal storage module 120 into a fixed memory space 121 and a general memory space 122; wherein, the fixed memory space 121 is a fixed memory dedicated to the NPU, and the fixed memory space 121 includes a model data space 121a, an input data space 121b and an output data space 121c.

[0095] 2) The trusted application 170 can directly access the fixed memory space 121 through the trusted operating system (TEE OS), load and decrypt the encrypted artificial intelligence model data in the external storage module 160 by the trusted application 170, and write the artificial intelligence model data into the model data space 121a.

[0096] 3) When the non-target requester 132 (CPU) requests the virtual machine monitor 110 to map from IPA to PA (ie, map the virtual address to a fixed memory address) through the MMU, the virtual machine monitor 110 rejects the request in stage 2 and falls into page faults.

[0097] 4) The application in the virtual machine 140 writes the input data of the target requester 131 (NPU) into the input data space 121 b through the trusted application program 170 .

[0098] 5) The virtual machine 140 calls the target requester 131 (NPU), and the target requester 131 (NPU) sends a virtual address (VA) and a stream identifier (stream id) to the memory management unit 150 (SMMU) via DMA.

[0099] 6) The virtual machine monitor 110 controls the memory management unit 150 (SMMU), determines that the stream ID is the target requester 131 (NPU), completes the VA→IPA→PA mapping (i.e., mapping the virtual address to a fixed memory address), and maps it to the internal storage module 120.

[0100] 7) The target requester 131 (NPU) loads the artificial intelligence model data, imports the input data into the artificial intelligence model data, and writes the output data into the output data space 121c through the same path.

[0101] 8) The virtual machine 140 reads the output data from the output data space 121 c through the trusted application 170 .

[0102] In summary, the non-target requester 132 (CPU) requests a transaction to access the NPU physical address space through the MMU, but the virtual machine monitor 110 rejects the request in stage 2. The target requester 131 (NPU) initiates a transaction request through DMA. The stream ID determines whether it is the NPU. If so, access to the AI ​​model data, input data, and output data in the fixed memory space 121 is allowed; otherwise, the request is rejected.

[0103] In the embodiment of the present disclosure, the virtual machine monitor 110 can protect the security of the artificial intelligence model of the NPU runtime by controlling the permissions of the NPU fixed memory (i.e., the fixed memory space 121). Compared with the related art of placing the NPU driver in the Trustzone to protect data, the embodiment of the present disclosure uses virtualization technology, and its implementation process is simpler. Compared with other dynamic protection solutions that rely on specific hardware or confidential computing, the embodiment of the present disclosure does not affect the NPU reasoning performance and accuracy.

[0104] In addition, the present disclosure also provides a security protection method, which is applied to the full protection system 100 in the above embodiment; please refer to Figure 6 , security protection methods include:

[0105] Step S110: receiving an address mapping request from a requester, and when confirming that the address mapping request comes from a target requester and requests access to a fixed memory space, converting the address mapping request into a fixed memory address; the fixed memory space is a fixed storage space in a memory module configured for use by the target requester;

[0106] Step S120: receiving a fixed memory address, and providing data in the fixed memory space according to the fixed memory address.

[0107] In some embodiments, before receiving the address mapping request from the requester, the security protection method also includes: calling the requester corresponding to the current task, so that the requester corresponding to the current task outputs a memory access request; the memory access request includes a virtual address and a flow identifier; after mapping the virtual address to an intermediate memory address, the intermediate memory address and the flow identifier are forwarded as an address mapping request.

[0108] In some embodiments, step S110 receives an address mapping request from a requester, and when confirming that the address mapping request comes from a target requester and requests access to a fixed memory space, converts the address mapping request into a fixed memory address, specifically including: receiving an address mapping request, and when the flow indicates that it comes from a target requester and requests access to a fixed memory space, mapping the intermediate memory address to a fixed memory address; wherein, the target requester is a requester among several requesters that has access rights to the fixed memory space.

[0109] In some embodiments, the security protection method also includes: when the address mapping request comes from a non-target requester and requests access to a fixed memory space, refusing to convert the address mapping request into a fixed memory address; and, when the address mapping request comes from a non-target requester and requests access to a general memory space, converting the address mapping request into a general memory address; receiving the general memory address and providing data in the general memory space based on the general memory address; the general memory space is used by the non-target requester.

[0110] In some embodiments, the target requester is used to run an artificial intelligence model; the fixed memory space includes: a model data space, an input data space, and an output data space; the model data space is used to store artificial intelligence model data; the input data space is used to store input data before artificial intelligence runs; and the output data space is used to store output data after artificial intelligence runs.

[0111] In some embodiments, the security protection method also includes: storing encrypted data of the artificial intelligence model; accessing an external storage module through a trusted operating system, decrypting the encrypted data of the artificial intelligence model, and writing the obtained artificial intelligence model data into the model data space.

[0112] In some embodiments, the security protection method further includes: writing input data into the input data space by the trusted application; and reading output data from the output data space by the trusted application.

[0113] In the embodiment of the present disclosure, the address mapping request of the requester is filtered, so that the access scope of the requester is limited to the corresponding memory space, so that the fixed memory space can only be accessed by the target requester, thereby clarifying the access scope of the fixed memory space and ensuring the security of the data in the fixed memory space.

[0114] It should be noted that the security protection method in the embodiment of the present disclosure is applied to the above security protection system. For technical features not fully disclosed in the embodiment of the present disclosure, please refer to the above embodiment for understanding, and no further details will be given here.

[0115] The above description is merely a preferred embodiment of the present disclosure and is not intended to limit the scope of protection of the present disclosure.

[0116] It should be noted that, in this disclosure, the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or apparatus comprising a series of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or apparatus comprising the element.

[0117] The serial numbers of the above-mentioned embodiments of the present disclosure are for description only and do not represent the advantages or disadvantages of the embodiments.

[0118] The methods disclosed in the several method embodiments provided in this disclosure can be arbitrarily combined without conflict to obtain new method embodiments.

[0119] The features disclosed in the several product embodiments provided in this disclosure can be arbitrarily combined without conflict to obtain new product embodiments.

[0120] The features disclosed in several method or device embodiments provided in this disclosure may be arbitrarily combined without conflict to obtain new method embodiments or device embodiments.

[0121] The above description is merely a specific embodiment of the present disclosure, but the scope of protection of the present disclosure is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this disclosure should be included in the scope of protection of the present disclosure. Therefore, the scope of protection of the present disclosure should be based on the scope of protection of the claims.

Claims

1. A security protection system comprising: A virtual machine monitor and an internal storage module; wherein: The internal storage module is configured to include a fixed memory space and a general memory space, wherein the fixed memory space is used by the target requester; the internal storage module is configured to receive a fixed memory address and provide data in the fixed memory space according to the fixed memory address; The virtual machine monitor is configured to receive an address mapping request from a requester, and when confirming that the address mapping request comes from the target requester and requests access to the fixed memory space, convert the address mapping request into a fixed memory address.

2. The system according to claim 1, further comprising: a virtual machine, several requestors, and a system memory management unit; The virtual machine is configured to call the requester corresponding to the current task, so that the requester corresponding to the current task outputs a memory access request; The memory access request includes a virtual address and a flow identifier; The system memory management unit is configured to map the virtual address to an intermediate memory address, and then forward the intermediate memory address and the flow identifier as the address mapping request.

3. The system according to claim 2, wherein the target requester is a requester with fixed memory space access rights among the plurality of requesters; The virtual machine monitor is specifically configured to receive the address mapping request and, when the flow indication is from the target requester and requests access to a fixed memory space, map the intermediate memory address to the fixed memory address.

4. The system according to claim 1, The virtual machine monitor is further configured to refuse to convert the address mapping request into a fixed memory address when the address mapping request comes from a non-target requester and requests access to the fixed memory space; and The virtual machine monitor is further configured to convert the address mapping request into a general memory address when the address mapping request comes from the non-target requester and requests access to the general memory space; The internal storage module is further configured to receive the general memory address and provide data in the general memory space according to the general memory address; the general memory space is used by the non-target requester.

5. The system according to claim 1, wherein the target requester is used to run an artificial intelligence model; and the fixed memory space comprises: Model data space, input data space and output data space; The model data space is used to store artificial intelligence model data; The input data space is used to store input data before the artificial intelligence runs; The output data space is used to store the output data after the artificial intelligence runs.

6. The system according to claim 5, further comprising: External storage modules and trusted applications running on a trusted operating system; The external storage module is used to store encrypted data of the artificial intelligence model; The trusted application is used to access the external storage module through the trusted operating system, decrypt the artificial intelligence model encrypted data, and write the obtained artificial intelligence model data into the model data space.

7. The system according to claim 6, The virtual machine is further configured to write the input data into the input data space through the trusted application; and read the output data from the output data space through the trusted application.

8. A security protection method, comprising: receiving an address mapping request from a requester and, upon confirming that the address mapping request comes from a target requester and requests access to a fixed memory space, converting the address mapping request into a fixed memory address; the fixed memory space being a fixed storage space in a memory module configured for use by the target requester; The fixed memory address is received, and data in the fixed memory space is provided according to the fixed memory address.

9. The method according to claim 8, before receiving the address mapping request from the requester, the method further comprises: Calling the requester corresponding to the current task, so that the requester corresponding to the current task outputs a memory access request; The memory access request includes a virtual address and a flow identifier; After mapping the virtual address to an intermediate memory address, the intermediate memory address and the flow identifier are forwarded as the address mapping request.

10. The method according to claim 9, receiving an address mapping request from a requester and, upon confirming that the address mapping request comes from a target requester and requests access to a fixed memory space, converting the address mapping request into a fixed memory address, comprises: receiving the address mapping request, and mapping the intermediate memory address to the fixed memory address when the flow indication is from the target requester and the request is to access a fixed memory space; The target requester is a requester with fixed memory space access rights among the plurality of requesters.

11. The method according to claim 8, further comprising: When the address mapping request comes from a non-target requester and requests access to the fixed memory space, refusing to convert the address mapping request into a fixed memory address; as well as, When the address mapping request comes from a non-target requester and requests access to a general memory space, converting the address mapping request into a general memory address; receiving the general memory address, and providing data in the general memory space according to the general memory address; The general memory space is used by the non-target requester.

Images