Data processing system and method and related equipment

Abstract

The invention discloses a data processing system and method and related equipment, and relates to the technical field of artificial intelligence. The data processing system comprises a general processor and an AI accelerator card. And the universal processor is used for sending an operation request comprising the authority authentication information and requesting to process the AI model deployed in the AI acceleration card. The AI acceleration card is constructed with a TEE (Trusted Execution Environment), and the AI acceleration card is used for running a PEP (Policy Enforcement Point) component deployed in the TEE, and is also used for receiving an operation request and determining whether authority authentication information in the operation request conforms to a verification rule in the PEP component, so that when the authority authentication information conforms to the verification rule, the operation request is sent to the PEP component; and executing the first operation request to execute a processing operation on the AI model. Therefore, the PEP component is deployed in the TEE of the AI accelerator card, namely, the PEP is deployed in the execution environment closer to the AI model, so that the AI model can be effectively prevented from being illegally accessed by the general processor, and the access security of the AI model in the AI accelerator card can be ensured.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of artificial intelligence, and particularly relates to a data processing system and method and related equipment. BACKGROUND

[0002] With the advent of the era of artificial intelligence (AI), AI model computing is increasingly concentrated in AI acceleration cards, such as deploying AI models in neural-network processing units (NPUs), which are a type of AI acceleration card. At the same time, the access security of AI models in AI acceleration cards has also become an important issue of increasing concern.

[0003] Currently, a trusted execution environment (TEE) is usually constructed in a general-purpose processor to construct a secure AI model computing environment for AI acceleration cards in a manner of combining software and hardware. In a specific implementation, when an application in the general-purpose processor needs to access an AI model in the AI acceleration card, the application needs to complete access control verification based on a policy enforcement point (PEP) mechanism in the TEE in advance. And only when the application passes the access control verification, can the application successfully access the AI model in the AI acceleration card.

[0004] However, in actual application scenarios, when there is an illegal application (or an application with higher permissions) in the general-purpose processor, the application may directly access the AI model in the AI acceleration card by bypassing the PEP component in the general-purpose processor, which makes the AI model in the AI acceleration card still subject to illegal access by the general-purpose processor, thereby affecting the security of the AI model in the AI acceleration card. SUMMARY

[0005] The present application provides a data processing system to improve the security of the general-purpose processor accessing the AI model in the AI acceleration card. In addition, the present application also provides a corresponding data processing method, an artificial intelligence acceleration card, a computer readable storage medium, and a computer program product.

[0006] In a first aspect, the present application provides a data processing system, comprising a general processor and an artificial intelligence acceleration card (hereinafter referred to as AI acceleration card). Wherein the general processor, for example, can be a CPU, is used to send a first operation request, the first operation request is used to request processing of an AI model deployed in the AI acceleration card, such as reading, modifying or executing the AI model and the like, and the first operation request includes permission authentication information. The AI acceleration card not only deploys the AI model, but also constructs a TEE (trusted execution environment), wherein the AI model can be deployed in the TEE, or can be deployed in a REE (rich execution environment) constructed in the AI acceleration card. And the AI acceleration card is used to run the PEP (policy enforcement point) component deployed in the TEE, and is also used to receive the first operation request sent by the general processor, and determine whether the permission authentication information in the first operation request meets the verification rule in the PEP component, so as to execute the first operation request to perform processing operation on the AI model when the permission authentication information in the first operation request meets the verification rule.

[0007] Since the PEP component is deployed in the TEE of the AI acceleration card in the data processing system, that is, the PEP is deployed to an execution environment closer to the AI model, when the AI model in the AI acceleration card is requested to be accessed, the AI acceleration card can use the PEP component to perform permission authentication on the operation request, and only in the case of passing the permission authentication, the AI model in the AI acceleration card is allowed to be accessed by the general processor. At this time, even if there is an illegal application in the general processor, or the application in the general processor requests illegal access to the AI model by bypassing the authentication process in the TEE in the general processor, the AI acceleration card can use the PEP component to perform permission authentication on the operation request of illegal access, so as to effectively avoid illegal access of the AI model by the general processor, and realize the security of the AI model in the AI acceleration card.

[0008] And when the general processor deploys a plurality of applications, and the plurality of applications can all request to access the AI model, the applications of different owners in the general processor can be set different operation permissions for accessing the AI model, such as setting a higher permission for the application of owner 1, which can perform multiple operations such as reading, modifying and executing the AI model, and setting a lower permission for the application of owner 2, which can only perform execution operation (cannot read or modify the AI model). In this way, the access flexibility of different applications to the AI model in the AI acceleration card can be improved, and fine-grained security access control can be realized. Or, for operation requests sent by different users using the same application, different operation permissions for accessing the AI model can be set for different users, so as to improve the access flexibility of different users to the AI model in the AI acceleration card, and realize fine-grained security access control.

[0009] In a possible implementation, the permission authentication information in the first operation request includes an identity, a processing operation on the AI model, and a token. For example, the processing operation can be an operation of reading the AI model, an operation of modifying the AI model (such as modifying a parameter in the AI model), or an operation of performing inference on input data by using the AI model, and the like. At this time, the AU accelerator can determine that the permission authentication information meets the verification rule when the identity in the permission authentication information matches the identity in the verification rule, the processing operation in the permission authentication information matches the processing operation in the verification rule, and the token in the permission authentication information matches the token in the verification rule. In this way, the AI accelerator can perform security verification according to the identity, the processing operation, and the token, and different operation permissions for accessing the AI model can be set for different identities, thereby improving the flexibility of accessing the AI model.

[0010] In a possible implementation, the general processor is configured to run a TEE, and the general processor includes a PDP (policy decision point) component running in the TEE; and the general processor is further configured to add a token to a second operation request generated by the general processor by using the PDP component before sending the first operation request, to obtain the first operation request, where the second operation request includes an identity and a processing operation. That is, the general processor can add a token participating in permission authentication to an operation request by using the PDP component running in the TEE. In this way, the AI accelerator can perform permission authentication on the identity, the processing operation, and the token in the first operation request by using the verification rule in the PEP component. In this way, by adding a token to an operation request by using the PDP component, the dimensions and quantities of data participating in permission authentication can be enriched, thereby further improving the security of accessing the AI model.

[0011] In a possible implementation, the AI accelerator includes an access controller; and the AI accelerator can perform permission authentication on the identity, the processing operation, and the token in the first operation request by using the verification rule in the access controller. The verification rule in the access controller is provided by the PEP component. In this way, by configuring the access controller in the AI accelerator, permission authentication on an operation request can be implemented. When the operation request is specifically used to request the AI model to perform inference, the access controller can first acquire the operation request and perform permission authentication on the operation request, and when the permission authentication fails, the data input to the AI model can not be acquired, thereby avoiding unnecessary data transmission and reducing resource consumption.

[0012] In a possible implementation, the access controller runs in the TEE in the AI acceleration card, and in this case, the access controller receives the first operation request based on a client application trusted application (CA-TA) communication interface, so as to ensure the security of data interaction between the REE environment and the TEE environment; or the access controller runs in the REE in the AI acceleration card.

[0013] In a possible implementation, the general processor can further perform encryption processing or obfuscation processing on a second operation request generated by the general processor by using the PDP component to obtain the first operation request before sending the first operation request, where the second operation request includes an identity and a processing operation for the AI model; and the AI acceleration card can specifically determine that the first operation request is successfully decrypted or de-obfuscated, and the permission authentication information meets the verification rule in the PEP component, when determining that the permission authentication information meets the verification rule. Correspondingly, when the first operation request fails to be decrypted (for example, decryption error) or de-obfuscated, it indicates that the general processor accesses the AI model illegally, and in this case, the AI acceleration card can refuse to respond to the first operation request. In this way, in the process of requesting the general processor to access the AI model in the AI acceleration card, the security of the general processor accessing the AI model can be improved by performing encryption (or obfuscation) and decryption (or de-obfuscation) processing on the operation request.

[0014] In a possible implementation, the PDP component runs in the TEE included in the AI acceleration card, that is, the PDP component is offloaded from the general processor to the AI acceleration card; and the AI acceleration card can further be configured to add a token to a second operation request generated by the general processor by using the PDP component to obtain the first operation request before the general processor sends the first operation request, where the second operation request includes an identity and a processing operation; and the AI acceleration card can specifically perform permission authentication on the identity, the processing operation, and the token in the first operation request by using the verification rule in the PEP component, when determining whether the permission authentication information meets the verification rule in the PEP component. In this way, by adding the token to the operation request by using the PDP component, the dimensions and quantities of data participating in the permission authentication can be enriched, so as to further improve the security of accessing the AI model.

[0015] In a possible implementation, the first operation request is used to request the AI model to perform inference according to target data, the target data is input data of the AI model, the content risk control model is run in the TEE included by the artificial intelligence acceleration card, and the content risk control model is used to verify whether the target data meets an inference condition, such as verifying whether the content of the target data is legal content. When the target data meets the inference condition, the AI acceleration card can execute the first operation request. In this way, the AI acceleration card can perform double verification on the first operation request by using the PEP component and the content risk control model, which can not only effectively avoid illegal access of the AI model by the general processor, but also avoid inference of the AI model based on illegal content by the general processor, thereby further ensuring the security of access to the AI model in the AI acceleration card.

[0016] In a possible implementation, the AI acceleration card includes a DPU (deep learning processor), a DPU (data processor), an NPU (neural network processor), or a GPU (graphics processing unit).

[0017] In a second aspect, the present application provides a data processing method, which is applied to an artificial intelligence acceleration card, the artificial intelligence acceleration card is deployed with an AI (artificial intelligence) model, and is constructed with a TEE (trusted execution environment), and the artificial intelligence acceleration card runs a PEP (policy enforcement point) component deployed in the TEE. The method includes: the artificial intelligence acceleration card receives a first operation request, the first operation request is used to request processing of the AI model, and the first operation request includes permission authentication information; the artificial intelligence acceleration card determines whether the permission authentication information meets a verification rule in the PEP component; and when the permission authentication information meets the verification rule, the artificial intelligence acceleration card executes the first operation request to perform a processing operation on the AI model.

[0018] In a possible implementation, the permission authentication information includes an identity, a processing operation on the AI model, and a token. When the AI acceleration card determines that the permission authentication information meets the verification rule, the AI acceleration card can specifically determine that the identity matches the identity in the verification rule, the processing operation matches the processing operation in the verification rule, and the token matches the token in the verification rule.

[0019] In a possible implementation, the artificial intelligence acceleration card includes an access controller. The artificial intelligence acceleration card determines that the permission authentication information meets the verification rule in the PEP component, including: the artificial intelligence acceleration card performs permission authentication on the identity, the processing operation, and the token in the first operation request by using the verification rule in the access controller, and the verification rule is provided to the access controller by the PEP component.

[0020] In a possible implementation, the access controller runs in a TEE in the artificial intelligence acceleration card, and the access controller receives the first operation request based on a client application trusted application CA-TA communication interface; or the access controller runs in a REE in the artificial intelligence acceleration card.

[0021] In a possible implementation, the first operation request is subjected to encryption processing or obfuscation processing; and the permission authentication information meets the verification rule, including that the first operation request is successfully subjected to decryption processing or de-obfuscation processing, and the permission authentication information meets the verification rule in the PEP component.

[0022] In a possible implementation, the artificial intelligence acceleration card comprises a PDP component running in a TEE, and the method further comprises: before receiving the first operation request, the artificial intelligence acceleration card adds a token for a second operation request from a general processor by using the PDP component, to obtain the first operation request, the second operation request comprising an identity and a processing operation; and the artificial intelligence acceleration card determines whether the permission authentication information meets the verification rule in the PEP component, including that the artificial intelligence acceleration card performs permission authentication on the identity, the processing operation and the token in the first operation request by using the verification rule in the PEP component.

[0023] In a possible implementation, the first operation request is used to request the AI model to perform inference according to target data, the target data being input data of the AI model, the artificial intelligence acceleration card comprising a content risk control model running in a TEE, the content risk control model being used to verify whether the target data meets an inference condition; and the artificial intelligence acceleration card performs the first operation request, including: when the target data meets the inference condition, the artificial intelligence acceleration card performs the first operation request.

[0024] In a possible implementation, the AI acceleration card comprises a DPU (deep learning processor), a DPU (data processor), an NPU (neural network processor), or a GPU (graphics processing unit).

[0025] The data processing method provided in the second aspect corresponds to the data processing system provided in the first aspect, and therefore the technical effects of any implementation manner of the second aspect are the same as those of the corresponding implementation manner of the first aspect, which will not be described here.

[0026] In a third aspect, the present application provides an artificial intelligence acceleration card, comprising a processor and a memory. The processor and the memory are in communication with each other. The processor is configured to execute instructions stored in the memory, so that the artificial intelligence acceleration card performs the data processing method performed by the AI acceleration card in the second aspect or any implementation manner of the second aspect. It should be noted that the memory can be integrated into the processor or independent of the processor. The computing device can also include a bus. The processor connects the memory through the bus. The memory can include a readable memory and a random access memory.

[0027] In a fourth aspect, the present application provides a computer readable storage medium, which stores instructions, when executed on a computing device, causes the computing device to perform the operation steps of the data processing method of the second aspect or any implementation manner of the second aspect.

[0028] In a fifth aspect, the present application provides a computer program product comprising instructions, when executed on a computing device, causes the computing device to perform the operation steps of the data processing method of the second aspect or any implementation manner of the second aspect.

[0029] On the basis of the implementation manners of the above aspects, the present application can be further combined to provide more implementation manners. BRIEF DESCRIPTION OF DRAWINGS

[0030] Figure 1 Structure diagram of an exemplary data processing system provided by the present application;

[0031] Figure 2 Structure diagram of another exemplary data processing system provided by the present application;

[0032] Figure 3 Flowchart of a data processing method provided by the present application;

[0033] Figure 4 Schematic diagram of configuring the access controller 202 in the REE of the AI acceleration card 200 provided by the present application;

[0034] Figure 5 Schematic diagram of configuring the access controller 202 in the TEE of the AI acceleration card 200 provided by the present application;

[0035] Figure 6 Schematic diagram of configuring the forwarding module 203 in the REE of the AI acceleration card 200 provided by the present application;

[0036] Figure 7 Flowchart of another data processing method provided by the present application;

[0037] Figure 8 A schematic diagram of deploying a content risk control model in an AI acceleration card 200 is provided for the present application;

[0038] Figure 9 A hardware structure schematic diagram of an AI acceleration card is provided for the present application. DETAILED DESCRIPTION

[0039] The terms "first", "second", etc. in the specification and claims of the present application and in the above-described drawings are used to distinguish similar objects, and do not necessarily have to be used to describe a specific order or sequence. It should be understood that the terms used in this way can be interchanged as appropriate, and this is merely a way of distinguishing the objects of the same attribute used in the description of the embodiments of the present application when describing.

[0040] The technical solutions in the present application will be described below in conjunction with the drawings provided by the present application.

[0041] Referring to Figure 1 , a structural schematic diagram of an exemplary data processing system 10. As Figure 1 shown, the data processing system 10 includes a general-purpose processor 100 and at least one AI acceleration card, Figure 1 two AI acceleration cards are taken as an example for illustration, which are AI acceleration card 200 and AI acceleration card 300 respectively, and the general-purpose processor 100 and each AI acceleration card can communicate through a bus.

[0042] Exemplarily, the bus through which the general-purpose processor 100 and each AI acceleration card communicate, for example, can be a peripheral component interconnect express (PCIe) bus, a non-volatile memory express (NVMe) bus, a compute Express link (CXL) bus, a HCCS (Huawei Collective Communication Server) bus, a unified bus (UB or Ubus) or other types of buses, etc. And the general-purpose processor 100, for example, can be a central processing unit (CPU)

[0043] The AI ​​accelerator card 200 (similar to the AI ​​accelerator card 300) can be, for example, a deep-learning processing unit (DPU), a data processing unit (DPU), a neural-network processing unit (NPU), or a graphics processing unit (GPU). In practical applications, the AI ​​accelerator card 200 can also be other types of accelerator cards capable of supporting AI model execution, such as a tensor processing unit (TPU) or a smart network interface card (NIC), and there are no limitations on this.

[0044] Applications 101 and 102 can be deployed in the general-purpose processor 100. For example, the applications can be pre-deployed in the general-purpose processor 100 by maintenance personnel, or the applications can be deployed in the general-purpose processor 100 by users during the use of the data processing system 10. Figure 1 The following example uses a general-purpose processor 100 with two applications. In practical applications, the general-purpose processor 100 can deploy any number of applications. Application 101 can run in a rich execution environment (REE) within the general-purpose processor 100. Typically, an REE is an open execution environment, vulnerable to attacks such as the theft of sensitive resources. Therefore, the security of application 101 performing operations within the REE is relatively low. Applications running in the REE can also be called client applications (CAs).

[0045] Furthermore, a TEE (Trusted Execution Environment) can be built into the general-purpose processor 100. The TEE is an independent execution environment that runs concurrently with the REE, providing a secure execution environment for authorized trusted applications (TAs). Therefore, operations performed within the TEE are typically trusted and secure.

[0046] like Figure 1 As shown, the TEE can be configured with a policy decision point (PDP) component 103. The PDP component 103 can generate access control policies. These access control policies can be used to implement access control for applications 101 in the REE to process AI models in AI accelerator cards 200 or 300, thereby improving the security of applications 101 accessing AI models, and thus improving the security of general-purpose processors 100 accessing AI models.

[0047] AI accelerator cards 200 and 300 can jointly deploy AI models, such as deploying different network layers of an AI model on different AI accelerator cards. In this case, the AI ​​model can be, for example, a large language model meta AI (LLaMA) model, a bidirectional encoder representations from transformers (BERT) model, or a generative pre-trained Transformer 3 (GPT-3) model, or other types of models such as GPT-4, etc., without limitation. Alternatively, AI accelerator cards 200 and 300 can each deploy one AI model, different AI accelerator cards can deploy different AI models, and different AI accelerator cards can deploy the same (large) model in a distributed manner. In this case, the AI ​​model can be a neural network model with a relatively small number of parameters. For ease of understanding, the following explanation uses AI accelerator cards 200 and 300 configured with AI models individually as an example.

[0048] like Figure 1 As shown, the AI ​​model in the AI ​​accelerator card 200 can run in the REE, and the AI ​​accelerator card 200 can have a TEE built in it, which can be configured with a policy enforcement point (PEP) component 201. Figure 1 This explanation uses the example of an application running in a REE (Extended Relationship to the REE) within the general-purpose processor 100. In other embodiments, the application in the general-purpose processor 100 can also run in a TEE. The PEP (Programmable Execution Program) component 201 can control access to the AI ​​model by the application 101 (and other applications) in the general-purpose processor 100 based on the access control policy generated by the PDP component 103. That is, when an application makes an unauthorized access to the AI ​​model (such as unauthorized updates to the AI ​​model or reading parameters of the AI ​​model), the PEP component 201 can deny the application access to the AI ​​model.

[0049] It is understandable that if a PEP component is deployed in the general-purpose processor 100, then application 101 can access the AI ​​model in the AI ​​accelerator card 200 after passing the authorization authentication (or access control verification) of the PEP component in the general-purpose processor 100. Although this can improve the security of accessing the AI ​​model in the AI ​​accelerator card 200 to a certain extent, if there is an application with higher privileges or an unauthorized application in the general-purpose processor 100, that application may directly bypass the PEP component in the general-purpose processor 100 and directly access the AI ​​model in the AI ​​accelerator card 200, thereby affecting the security of the AI ​​model in the AI ​​accelerator card 200.

[0050] Therefore, in Figure 1 In the illustrated embodiment, by building a TEE in the AI ​​accelerator card 200 and configuring the PEP component 201 in the TEE, each application in the general-purpose processor 100 can obtain authorization from the PEP component 201 when accessing the AI ​​model in the AI ​​accelerator card 200, thereby ensuring the security of accessing the AI ​​model.

[0051] In specific implementation, when application 101 (or application 102) sends an operation request to AI accelerator card 200 to request processing of the AI ​​model in AI accelerator card 200 (such as reading, modifying, or executing AI model processing), AI accelerator card 200 can use PEP component 201 in TEE to determine whether the authorization authentication information in the operation request conforms to the verification rules in PEP component 201. When the authorization authentication information in the operation request conforms to the verification rules, it indicates that the operation request has passed authorization authentication. AI accelerator card 200 executes the operation request to perform processing operations on AI model, such as using AI model to perform corresponding inference processes, and feeds back the obtained processing results (such as the inference results of AI model) to application 101.

[0052] Thus, in the data processing system 10, by deploying the PEP component 201 in an execution environment closer to the AI ​​model, the AI ​​accelerator card 200 can use the PEP component 201 to authenticate operation requests sent by the general-purpose processor 100 (specifically, application 101 or application 102 within the general-purpose processor 100). Only after successful authentication is the application allowed to access the AI ​​model. Even if an unauthorized application exists in the general-purpose processor 100, or if an application in the general-purpose processor 100 bypasses the authentication process in the TEE within the general-purpose processor 100 and requests unauthorized access to the AI ​​model, the AI ​​accelerator card 200 can still use the PEP component 201 to authenticate the unauthorized access request. This effectively prevents the AI ​​model from being unauthorized accessed by the general-purpose processor 100, ensuring the security of access to the AI ​​model within the AI ​​accelerator card 200.

[0053] Furthermore, when multiple applications (such as application 101 and application 102) are deployed in the general-purpose processor 100, and these applications belong to different users, applications from different users can access the AI ​​model in the AI ​​accelerator card 200 based on different permissions. For example, application 101 belonging to user 1 may have higher permissions to access the AI ​​model, thus application 101 can request to read, modify, and execute processing operations on the AI ​​model (e.g., the AI ​​model may have been deployed to the AI ​​accelerator card 200 by user 1). Application 102 belonging to user 2 has lower permissions to access the AI ​​model (e.g., application 102 can request to execute the AI ​​model with authorization from user 1), thus application 102 of user 2 can only request to execute the AI ​​model. When application 102 of user 2 illegally requests to read parameters in the AI ​​model or illegally requests to modify parameters in the AI ​​model, the PEP component 201 may refuse application 102's access to the AI ​​model. In this way, the AI ​​accelerator card 200 can achieve fine-grained secure access control, thereby improving the flexibility of different applications accessing the AI ​​models in the AI ​​accelerator card 200. Alternatively, for operation requests sent by different users using the same application, such as multiple different users sending operation requests using application 101 based on different accounts, different users (specifically, different user accounts) can be assigned different operation permissions to access the AI ​​models. This can improve the flexibility of different users accessing the AI ​​models in the AI ​​accelerator card, achieving fine-grained secure access control and increasing the flexibility of different users accessing the AI ​​models in the AI ​​accelerator card 200 using the same application.

[0054] For example, the PEP component 201 can be implemented by software or hardware.

[0055] In the first example, when implemented in software, the PEP component 201 can be, for example, program code running in a TEE.

[0056] In the second example, when implemented in hardware, the PEP component 201 can be implemented using an application-specific integrated circuit (ASIC), a programmable logic device (PLD), a complex programmable logical device (CPLD), a field-programmable gate array (FPGA), or a generic array logic (GAL), etc., and this application does not limit it in this regard.

[0057] Similarly, for the AI ​​model in the AI ​​accelerator card 300, by building a TEE in the AI ​​accelerator card 300 and deploying a PEP component in the TEE, the AI ​​accelerator card 300 can prevent applications from illegally accessing the AI ​​model in the AI ​​accelerator card 300 through the PEP component, thereby improving the security of accessing the AI ​​model in the AI ​​accelerator card 300.

[0058] It is worth noting that the above Figure 1 The data processing system 10 shown is only an example and is not intended to be limiting.

[0059] For example, in practical application scenarios, the data processing system 10 may include more numbers or more types of AI accelerator cards, or it may include only one AI accelerator card, etc.

[0060] For example, in other possible data processing systems, PEP component 201 can restrict unauthorized access to the AI ​​model by applications in the general-purpose processor 100, and also restrict unauthorized access to the AI ​​model by other entities outside the general-purpose processor 100.

[0061] For example, in other possible data processing systems, PDP components can also be deployed within AI accelerator cards. Specifically, in Figure 2 The data processing system 20 shown may include a general-purpose processor 100, an AI accelerator card 200, an AI accelerator card 300, and an AI accelerator card 400. The general-purpose processor 100 can communicate with the other AI accelerator cards via a bus. Each of the REEs included in AI accelerator cards 200 and 300 runs an AI model, and each of the REEs included in AI accelerator cards 200 and 300 is equipped with a PEP component, such as... Figure 2 As shown, an AI accelerator card 400 can contain a TEE (Technical Equipment Environment), and this TEE can be configured with a PDP (Programmable Component Platform) component 401. The PDP component 401 can generate access control policies and configure access control for the PEP (Programmable Component Platform) components in other AI accelerator cards according to these policies. Therefore, under the configuration of the PDP component 401, the PEP components in each AI accelerator card can improve the security of access to their respective AI models. Alternatively, Figure 2 The PDP component 401 can also be deployed in the TEE of the AI ​​accelerator card 200 or the TEE of the AI ​​accelerator card 300, without limitation.

[0062] In practical applications, data processing system 10 (and data processing system 20) can be deployed on a single computing device, such as a server, to ensure the security of access to AI assets in the AI ​​accelerator card. Alternatively, data processing system 10 (and data processing system 20) can be deployed in a cluster of multiple computing devices, allowing the general-purpose processor 100 to access resources such as AI models in the AI ​​accelerator cards on multiple computing devices.

[0063] For ease of understanding, embodiments of the data processing method provided in this application will be described below with reference to the accompanying drawings.

[0064] See Figure 3 , Figure 3 This is a flowchart illustrating a data processing method provided in an embodiment of this application. This method can be applied to... Figure 1 or Figure 2 The data processing system described above can also be applied to other applicable data processing systems. For ease of explanation, this embodiment uses an application... Figure 1 The following example illustrates how the data processing system 10 and the general-purpose processor 100 request access to the AI ​​model in the AI ​​accelerator card 200.

[0065] in, Figure 3 The data processing methods shown may specifically include:

[0066] S301: The general-purpose processor 100 sends an operation request 1 to the AI ​​accelerator card 200. The operation request 1 is used to request processing of the AI ​​model in the AI ​​accelerator card 200, and the operation request 1 includes authorization and authentication information.

[0067] In this embodiment, the AI ​​accelerator card 200 can deploy AI models. These AI models can be high-value business models or models with high security requirements, such as models for attack detection, content risk control, license control, and audit traceability. Specifically, when used for attack detection, the AI ​​model can identify whether an attack has occurred based on the data input to the model. When used for content risk control, the AI ​​model can identify risky content data and prohibit further operations on that data, such as prohibiting the model from making inferences based on sensitive data after identification. When used for license control, the AI ​​model can identify models granted a license that are not bound to the correct hardware, such as backing up authorized AI models and running them on multiple unauthorized hardware devices. When used for audit traceability, the AI ​​model can identify processing operations on the AI ​​model's usage logs and prohibit deletion or modification of the AI ​​model's logs (but allows querying and copying logs).

[0068] Furthermore, the general-purpose processor 100 can request access to the AI ​​model. For example, during operation, application 101 or application 102 in the general-purpose processor 100 can request to read the parameters in the AI ​​model, or request to update the AI ​​model (i.e., update the parameters in the AI ​​model), or request to execute the AI ​​model (i.e., use the AI ​​model to perform inference based on the model input data), or perform other types of processing operations on the AI ​​model.

[0069] In practical applications, Application 101 and the AI ​​model can belong to the same entity (hereinafter referred to as the owner), such as the same user. The owner can pre-load the AI ​​model into the AI ​​accelerator card 200 and deploy Application 101 on the general-purpose processor 100 so that business needs can be met by accessing the AI ​​model during the operation of Application 101. Alternatively, Application 101 and the AI ​​model can belong to different users. In this case, User 101 can have access to the AI ​​model with authorization from the owner of the AI ​​model.

[0070] If the general-purpose processor 100 needs to access the AI ​​model in the AI ​​accelerator card 200 during operation, it can generate a corresponding operation request so as to request processing of the AI ​​model.

[0071] In one possible implementation, application 101 (or application 102 or other applications) running in the general-purpose processor 100 can first generate operation request 2, which may include processing operations for the AI ​​model and an identity identifier. For example, the processing operation could be an operation to read the AI ​​model, modify the AI ​​model, or execute the AI ​​model. The identity identifier could be, for example, the application's identifier, or the identifier of the application's owner (such as a user identifier), or other information used to identify the entity requesting access to the AI ​​model. Then, the general-purpose processor 100 can call the application programming interface (API) provided by the TEE to send operation request 2 to the TEE, specifically to the PDP component 103 within the TEE. The PDP component 103 can add verification information to operation request 2 for subsequent authorization authentication, thereby obtaining operation request 1, and return operation request 1 to application 101. Thus, application 101 can send operation request 1, carrying the verification information, identity identifier, and processing operation, to the AI ​​accelerator card 200.

[0072] In this embodiment, the following implementation examples are provided for the implementation of adding verification information to operation request 2 by PDP component 103.

[0073] As a first implementation example, the PDP component 103 adds verification information to operation request 2, such as a token. In this case, operation request 1 may carry data 'a', and the PDP component 103 can encrypt this data 'a' using a pre-configured key to generate a corresponding token. This token is then used to replace data 'a' in operation request 2, thus generating operation request 1. The key can be pre-configured in the PDP component 103 by a technician or user. Therefore, after application 101 sends operation request 1 to the AI ​​accelerator card 200, the AI ​​accelerator card 200 can determine whether application 101's access to the AI ​​model is legitimate based on the token in operation request 1. At this time, the token, identity identifier, and processing operation in operation request 1 can serve as authorization information for the AI ​​accelerator card to authenticate the general processor 100's request to access the AI ​​model.

[0074] As a second implementation example, when PDP component 103 adds verification information to operation request 2, it can specifically encrypt operation request 2 to obtain operation request 1 (i.e., the encrypted operation request 2). For example, PDP component 103 can use symmetric encryption algorithms or asymmetric encryption algorithms to encrypt operation request 2. Alternatively, when PDP component 103 adds verification information to operation request 2, it can specifically obfuscate operation request 2 to obtain operation request 1 (i.e., the obfuscated operation request 2). For example, PDP component 103 can use data conversion or other obfuscation techniques to obfuscate operation request 2. Thus, when application 101 sends operation request 1 to AI accelerator card 200, AI accelerator card 200 can decrypt or deobfuscate operation request 1, and determine whether application 101's access to the AI ​​model is legitimate by judging whether the operation request obtained by decryption or deobfuscation is correct. For example, if the format of the operation request obtained by decryption or deobfuscation is incorrect, the access can be judged as illegitimate. Therefore, after the PDP component 103 encrypts or obfuscates the operation request, the operation request carries verification information that can be used for subsequent authorization authentication. Simultaneously, the identity identifier and processing operation in operation request 1 can serve as authorization authentication information and can also be used by the AI ​​accelerator card to verify whether the general-purpose processor 100 has legitimate access to the AI ​​model.

[0075] In practical applications, after receiving operation request 2, PDP component 103 can determine whether the application sending the operation request 2 (such as application 101 or application 102) is a legitimate application. For example, it can determine whether the application and the processing operation in operation request 2 match the application and processing operation recorded in the user-preferred configuration table (which records applications and at least one allowed processing operation). If they match, PDP component 103 can determine that the application sending the operation request is a legitimate application and encrypt or obfuscate the operation request 2 provided by that application. If they do not match, PDP component 103 can determine that the application is an illegitimate application, and therefore does not need to encrypt or obfuscate the operation request 2.

[0076] It is understood that the above methods for adding verification information to operation request 2 are only illustrative examples. In actual applications, PDP component 103 may also use other methods to add verification information to operation request 2, such as the added verification information being other types of information besides token, etc., without limitation.

[0077] S302: AI Accelerator Card 200 determines whether the authorization authentication information in Operation Request 1 conforms to the verification rules in PEP Component 201 in TEE.

[0078] For example, the AI ​​accelerator card 200 can use multiple verification methods to verify whether operation request 1 is legitimate.

[0079] In a first possible implementation, the authentication information in operation request 1 includes an identity identifier, processing operation, and token. Then, the AI ​​accelerator card 200 simultaneously verifies the validity of the identity identifier, processing operation, and token in operation request 1.

[0080] As a first implementation example, such as Figure 4 As shown, the REE of the AI ​​accelerator card 200 can be configured with an access controller 202, which can receive operation request 1 sent by the general-purpose processor 100. The access controller 202 can then use verification rules to verify the correctness of the identity, processing operation, and token carried in operation request 1. If correct, the access controller 202 can determine that operation request 1 has passed authentication, and the AI ​​accelerator card 200 can then perform corresponding operations on the AI ​​model based on the processing operation carried in operation request 1, such as reading parameters from the AI ​​model, updating parameters in the AI ​​model, or using the AI ​​model to perform inference based on the model's input data. If incorrect, the AI ​​accelerator card 200 will refuse to execute operation request 1. In this way, the access controller 202 in the REE can directly execute operation request 1, thereby ensuring that the processing efficiency of operation request 1 reaches a high level.

[0081] The verification rules in the access controller 202 can be pre-configured in the access controller 202 by the PEP component 201 in the TEE. Specifically, taking the operation request 1 as an example generated by application 101 in the general processor 100, the owner of application 101 can pre-access the PDP component 103 in the general processor 100 through the CA-TA (Client Application-Trusted Application) communication interface, and configure the identity identifier (such as user identifier or application identifier, etc.) for requesting access to the AI ​​model, the key used to generate the token when requesting access to the AI ​​model, and the processing operations that each application can perform on the AI ​​model during the access process. Then, the PDP component 103 can generate an access control policy using its policy engine 1031 according to the owner's configuration, and provide this access control policy to the policy administrator 1032. The policy administrator 1032 can convert the access control policy into an authentication rule that the PEP component 201 can recognize, and transmit the authentication rule to the PEP component 201 through a secure channel between the TEE in the general-purpose processor 100 and the TEE in the AI ​​accelerator card 200. The secure channel between different TEEs can be constructed using appropriate encryption algorithms and security protocols to ensure the security of data transmitted between different TEEs; furthermore, different TEEs can use streaming ciphers (bit-by-bit encryption) to encrypt and protect the transmitted data to meet high security performance requirements. In practical applications, the amount of communication data for transmitting authentication rules between the PDP component 103 and the PEP component 201 is relatively small, which means that the communication speed of the secure channel does not need to reach line speed, thereby reducing communication overhead. In this way, the PEP component 201 can configure the verification rule in the access controller 202 through the CA-TA-based communication interface in the AI ​​accelerator card 200, so that the access controller 202 can perform authorization authentication on each received operation request according to the verification rule.

[0082] For example, when access controller 202 performs authorization authentication on operation request 1 according to the verification rules, it may specifically verify whether the token in operation request 1 matches the token in the verification rules (e.g., verifying whether two tokens are the same), whether the identity in operation request 1 matches the identity in the verification rules (e.g., verifying whether two identity identifiers are the same), and whether there is a processing operation in the verification rules that matches the processing operation in operation request 1 (e.g., verifying whether the processing operation in the verification rules includes the processing operation in operation request 1). Access controller 202 will only determine that operation request 1 passes authorization authentication if the token, identity, and processing operation in operation request 1 all have matching information in the verification rules. Otherwise, access controller 202 determines that operation request 1 fails authorization authentication, i.e., authorization authentication fails.

[0083] It is worth noting that in this implementation example, the verification rules in the access controller 202 can be pre-configured by the PEP component 201 before the AI ​​accelerator card 200 receives operation request 1. In other possible implementations, the access controller 202 may not store verification rules. In this case, after receiving operation request 1, the access controller 202 can request verification rules for operation request 1 from the PEP component 201 through the CA-TA communication interface. Specifically, it can request verification rules including the identity identifier in operation request 1 from the PEP component 201. The verification rules can be pre-stored in the PEP component 201, or the PEP component 201 can temporarily request verification rules for application 101 from the PDP component 103 through a secure channel. Then, the access controller 202 can receive the verification rules fed back by the PEP component 201 through the CA-TA communication interface and verify operation request 1 according to the received verification rules. This avoids the leakage of verification rules stored in the REE, thereby ensuring the security and reliability of the access controller 202's authorization authentication for operation request 1. Meanwhile, for new applications (or new users) that have obtained authorization from the owner, the application can successfully access the AI ​​model by requesting the corresponding verification rules from the PDP component 103, thus preventing the new application from failing to access the AI ​​model due to the verification rules in the access controller 202 not being updated in time.

[0084] As a second implementation example, such as Figure 5As shown, the TEE of the AI ​​accelerator card 200 can be configured with an access controller 202. In this case, application 101 can send operation request 1 to the AI ​​accelerator card 200 via the CA-TA communication interface. Correspondingly, the access controller 202 receives operation request 1 through the CA-TA communication interface and verifies the correctness of the token, identity identifier, and processing operation carried in operation request 1 according to pre-configured verification rules. If correct, the access controller 202 can determine that operation request 1 has passed authentication, and thus the AI ​​accelerator card 200 can perform the corresponding operation on the AI ​​model based on the processing operation carried in operation request 1. If incorrect, the AI ​​accelerator card 200 refuses to execute operation request 1. For the specific implementation method of configuring verification rules for the access controller 202, please refer to the relevant description in the aforementioned implementation example, which will not be repeated here. Thus, the access controller 202 executes operation request 1 in the TEE, thereby ensuring a high level of security for the execution of operation request 1, which helps to improve the security of the general-purpose processor 100 accessing the AI ​​model.

[0085] In a second possible implementation, the AI ​​accelerator card 200 verifies whether the application 101's access to the AI ​​model is legitimate by decrypting or deobfuscating the operation request 1.

[0086] In specific implementation, the operation request 1 received by the AI ​​accelerator card 200 is obtained by encrypting the PDP component 103 in the general-purpose processor 100. Therefore, as... Figure 6As shown, the REE of the AI ​​accelerator card 200 can be configured with a forwarding module 203. This forwarding module 203 can be a software-implemented functional module or a hardware-implemented functional module. After receiving operation request 1, the forwarding module 203 can forward operation request 1 to the TEE through the CA-TA communication interface. At this time, the PEP component 201 in the TEE can decrypt the operation request 1 received through the CA-TA communication interface to obtain the decrypted operation request, and send the decrypted operation request (plaintext) to the forwarding module 203 through the CA-TA communication interface. In this way, the forwarding module 203 can verify whether the decrypted operation request is data of the correct request type. If not, the forwarding module 203 can determine that operation request 1 has not passed the authorization authentication. For example, the operation request generated by application 101 has not completed the corresponding encryption processing in the TEE in the general processor 100 (such as application 101 requesting access to the AI ​​model under illegal conditions); accordingly, the decrypted operation request is usually garbled data. Simultaneously, PEP component 201 also uses verification information to authenticate the permission authentication information in operation request 1. At this time, the permission authentication information in operation request 1 may specifically include the identity identifier and the processing operation. Furthermore, when PEP component 201 determines that the permission authentication information in operation request 1 does not match the verification rules, PEP component 201 can determine that operation request 1 has failed permission authentication. Conversely, when PEP component 201 determines that the permission authentication information in operation request 1 conforms to the verification rules, and the decrypted operation request is data of the correct request type, forwarding module 203 can determine that operation request 1 has passed permission authentication.

[0087] Similarly, when the operation request 1 received by the AI ​​accelerator card 200 is obtained by obfuscation processing by the PDP component 103, the PDP component 201 can deobfuscate the operation request 1 sent by the forwarding module 203 through the CA-TA communication interface to obtain the deobfuscated operation request, and then feed the deobfuscated operation request back to the forwarding module 203 through the CA-TA communication interface. In this way, the forwarding module 203 can verify whether the deobfuscated operation request is data of the correct request type. If it is, the forwarding module 203 can determine that the operation request 1 has passed authentication. If not, the forwarding module 203 can determine that the operation request 1 has not passed authentication.

[0088] S303: When the authentication information in operation request 1 meets the verification rules, AI accelerator card 200 executes operation request 1 to perform processing operations on the AI ​​model.

[0089] S304: The AI ​​accelerator card 200 will feed back the processing result obtained from the execution of operation request 1 to the general processor 100.

[0090] In this embodiment, assuming that the operation request 1 sent by the general processor 100 passes the authorization authentication, the AI ​​accelerator card 200 can perform corresponding operations on the AI ​​model according to the processing operations carried in the operation request 1.

[0091] Specifically, when the processing operation carried in operation request 1 is to read model parameters, model structure, or model file, AI accelerator card 200 can copy the AI ​​model parameters, structure, or model file in memory and feed back the copied AI model parameters, structure, or model file as the processing result obtained from executing operation request 1 to application 101.

[0092] When the processing operation carried in operation request 1 is specifically an operation to update model parameters, operation request 1 can also carry training samples. Then, the AI ​​accelerator card 200 can use the training samples to perform one or more rounds of training on the AI ​​model, thereby updating the parameter values ​​in the AI ​​model. The AI ​​accelerator card 200 can then return a processing result to the general-purpose processor 100 indicating that the model parameter update is complete. Alternatively, operation request 1 can also directly carry the parameter values ​​in the AI ​​model. The AI ​​accelerator card 200 can then directly use the parameter values ​​carried in operation request 1 to replace the parameter values ​​in the AI ​​model and can return a processing result to the general-purpose processor 100 indicating that the model parameter update is complete.

[0093] When the processing operation carried in operation request 1 is specifically an operation to update the AI ​​model, operation request 1 can also carry data as input to the AI ​​model. Thus, the AI ​​accelerator card 200 can use the AI ​​model to perform inference based on the model input data, obtain the corresponding inference result, and feed the inference result back to the general processor 100 as the processing result obtained from executing operation request 1.

[0094] Alternatively, when the processing operation carried in operation request 1 is specifically an operation to update / execute the AI ​​model, operation request 1 may not carry training samples / model input data. Figure 4 or Figure 5In the AI ​​accelerator card 200 shown, after determining that operation request 1 has passed authentication, access controller 202 then obtains training samples / model input data (which can be stored in the memory of AI accelerator card 200) from general-purpose processor 100 based on memory-mapped input / output (MMIO) or direct memory access (DMA) technology. The AI ​​controller 202 then trains the AI ​​model using the obtained training samples to update the parameter values ​​in the AI ​​model, or performs inference using the obtained model input data to obtain the corresponding inference results. In this way, AI accelerator card 200 only obtains training samples / model input data from general-purpose processor 100 if the operation request has passed authentication. This ensures that for operation requests that fail authentication, the training samples or model input data do not need to be transmitted to AI accelerator card 200, thus avoiding the resource consumption caused by data transmission between general-purpose processor 100 and AI accelerator card 200 in scenarios of illegal requests.

[0095] It is understood that the above implementation of the AI ​​accelerator card 200 using the AI ​​model to execute operation request 1 is only an example. In actual applications, the AI ​​accelerator card 200 may also use other methods to execute operation request 1.

[0096] When application 101 requests access to the AI ​​model in AI accelerator card 300, AI accelerator card 300 can also refer to the above method, use the PEP component in TEE to authenticate the operation request received by AI accelerator card 300, and if the operation request passes the authentication, execute the operation request to enable general processor 100 to access the AI ​​model.

[0097] In this embodiment, the AI ​​accelerator card 200 determines, based on the PEP component 201, that the operation request 1 sent by the general processor 100 has passed authentication. When the general processor 100 illegally accesses the AI ​​model in the AI ​​accelerator card 200, the AI ​​accelerator card 200 can identify the unauthenticated operation request based on the PEP component 201 and refuse to execute the operation request. This prevents the AI ​​model in the AI ​​accelerator card 200 from being illegally accessed by the general processor 100. Specifically, it can prevent the AI ​​model from being illegally accessed by applications in the general processor 100. The following explanation uses the example of the general processor 100 illegally accessing the AI ​​model.

[0098] In specific implementation, the general-purpose processor 100 can generate operation request 3 and send operation request 3 to the AI ​​accelerator card 200. Figure 4 or Figure 5In the AI ​​accelerator card 200 shown, the access controller 202 can determine that operation request 3 has failed authentication if it does not carry an identity identifier or if the identity identifier carried does not match the identity identifier in the verification rules. Alternatively, the access controller 202 can determine that operation request 3 has failed authentication if it does not carry a token. Alternatively, the access controller 202 can determine that operation request 3 has failed authentication if it determines, based on the verification rules configured in the PEP component 201, that the token carried in operation request 3 is incorrect. Alternatively, the access controller 202 can determine that operation request 3 has failed authentication if, based on the verification rules configured in the PEP component 201, the token carried in operation request 3 is correct but the requested processing operation does not match the processing operation in the verification rules (exceeding access permissions). Figure 6 In the AI ​​accelerator card 200 shown, after the forwarding module 203 forwards the operation request 3 to the PEP component 201 in the TEE, the PEP component 201 can decrypt or deobfuscate the operation request 3 and feed back the data obtained after decryption or deobfuscation to the forwarding module 203. Thus, the forwarding module 203 can further determine that the operation request 3 has not passed authentication after confirming that the data obtained after decryption or deobfuscation is incorrect. At this time, the AI ​​accelerator card 200 can refuse to execute the operation request 3, thereby preventing the general-purpose processor 100 from accessing the AI ​​model in the AI ​​accelerator card 200. In this way, the AI ​​accelerator card 200 can use the PEP component 201 to identify unauthorized access requests to the AI ​​model, thereby ensuring the security of access to the AI ​​model.

[0099] The above Figure 3 The illustrated embodiment uses the AI ​​accelerator card 200 to perform authorization authentication on operation requests using a single-layer verification mechanism. In other embodiments, the AI ​​accelerator card 200 can also further enhance the security of accessing the AI ​​model by performing multiple authentications on operation requests. The following will combine... Figure 7 Please provide a detailed explanation.

[0100] See Figure 7 This illustrates a flowchart of another data processing method, which is applied to... Figure 1 In the data processing system 10 shown. For example... Figure 7 As shown, the method may specifically include:

[0101] S701: The general-purpose processor 100 sends an operation request 1 to the AI ​​accelerator card 200. The operation request 1 is used to request the AI ​​model in the AI ​​accelerator card 200 to perform inference on target data, which is the input data of the AI ​​model. The operation request 1 includes authorization and authentication information.

[0102] For example, the target data may be carried in operation request 1. For instance, when AI accelerator card 200 passes through... Figure 6 When the forwarding module 203 shown receives the operation request 1 sent by the general processor 100, the operation request 1 may carry target data.

[0103] Alternatively, operation request 1 may not have included the target data. For example, when AI accelerator card 200 passes through... Figure 4 or Figure 5 When the access controller 202 receives the operation request 1 sent by the general processor 100, the access controller 202 may continue to obtain the target data from the general processor 100 if it determines that the operation request 1 has passed the authorization authentication.

[0104] S702: The AI ​​accelerator card 200 determines whether the authorization information in operation request 1 conforms to the verification rules in PEP component 201. If the authorization information conforms to the verification rules, then proceed to step S703; if the authorization information does not conform to the verification rules, then proceed to step S706.

[0105] In this embodiment, the specific implementation of steps S701 to S702 can be found in the above description. Figure 3 The relevant descriptions of steps S301 to S302 in the illustrated embodiment will not be repeated here.

[0106] S703: If the authorization information meets the verification rules, the AI ​​accelerator card 200 uses the content risk control model running in the TEE to verify whether the target data meets the inference conditions. If the target data meets the inference conditions, proceed to step S704; if the target data does not meet the inference conditions, proceed to step S706.

[0107] For example, such as Figure 8 As shown, the content risk control model can run in the TEE of the AI ​​accelerator card 200, and this content risk control model can run using some of the hardware resources in the AI ​​accelerator card 200. These hardware resources may include, for example, the hardware resources within the AI ​​accelerator card 200 itself. Figure 8 The diagram shows memory resources, AI CPU, and AI cores. Correspondingly, another portion of the hardware resources in the AI ​​accelerator card 200 can run AI models within the REE. Figure 8 In the AI ​​accelerator card 200 shown, the hardware resources used to implement REE and the hardware resources used to implement TEE can be isolated from each other to ensure the security of operations performed in TEE.

[0108] If PEP component 201 determines that operation request 1 has passed authentication according to the verification rules, AI accelerator card 200 can also use a content risk control model in TEE to verify whether the target data input to the AI ​​model meets the inference conditions. For example, AI accelerator card 200 can input the target data into the content risk control model to obtain the inference result output by the content risk control model. This inference result indicates whether the target data has content risk. For example, when the semantics indicated by the target data are related to illegal or criminal activities, the inference result can indicate that the target data has content risk; or, when the semantics indicated by the target data are in compliance with laws, regulations, or specific rules, the inference result can simply indicate that the target data does not have content risk. Thus, when AI accelerator card 200 determines that the target data has content risk based on the inference result, it can determine that the target data does not meet the inference conditions, and AI accelerator card 200 can refuse to execute operation request 1. When AI accelerator card 200 determines that the target data does not have content risk based on the inference result, it can determine that the target data meets the inference conditions, and AI accelerator card 200 can continue to execute subsequent steps to execute operation request 1.

[0109] S704: AI accelerator card 200 executes operation request 1 and obtains processing results, which include inference results generated by using AI models to infer the target data.

[0110] S705: The AI ​​accelerator card 200 feeds back the processing results to the general-purpose processor 100.

[0111] In this embodiment, the specific implementation of steps S704 to S705 can be found in the above description. Figure 3 The relevant descriptions of steps S303 to S304 in the illustrated embodiment will not be repeated here.

[0112] S706: AI accelerator card 200 refused to execute operation request 1.

[0113] In this way, the AI ​​accelerator card 200 can use the PEP component 201 and the content risk control model to perform dual verification on operation request 1. This can not only effectively prevent the AI ​​model from being illegally accessed by applications, but also prevent the general processor 100 (application 101 or application 102 in it) from using the AI ​​model to make inferences based on illegal content, thereby further ensuring the security of access to the AI ​​model in the AI ​​accelerator card 200.

[0114] It should be noted that the above Figure 3 as well as Figure 7 The illustrated embodiment uses a PDP component 103 deployed in a TEE within a general-purpose processor 100 as an example. Figure 2In the data processing system 20 shown, the PDP component 401 is deployed in the TEE of the AI ​​accelerator card 400. The implementation process of the general-purpose processor 100 requesting access to the AI ​​model in the AI ​​accelerator card 200 can be referred to the above. Figure 3 or Figure 7 The relevant details in the illustrated embodiment are not repeated here. The general-purpose processor 100 and the PDP component 401 can communicate via a CA-TA communication interface. For example, the PDP component 401 can add verification information to the operation request 2 generated by the general-purpose processor 100 through this CA-TA communication interface, and also feed back the newly generated operation request 1 to the general-purpose processor 100 through the same CA-TA communication interface. The PDP component 401 and the PEP component 201 can communicate via a secure channel, such as transmitting verification rules through the secure channel.

[0115] It is worth noting that other reasonable combinations of steps that can be conceived by those skilled in the art based on the above description also fall within the scope of protection of this application. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are preferred embodiments, and the actions involved are not necessarily essential to this application.

[0116] The above combination Figures 1 to 8 The data processing system and data processing method provided in the embodiments of this application will be introduced. Next, the structure of the AI ​​accelerator card provided in the embodiments of this application will be described with reference to the accompanying drawings.

[0117] See Figure 9 The diagram shows a hardware structure of an AI accelerator card 900, which can, for example, implement the AI ​​accelerator card 200 mentioned in the above embodiments.

[0118] like Figure 9 As shown, the AI ​​accelerator card 900 includes a processor 901, a memory unit 902, and a communication interface 903. The processor 901, memory unit 902, and communication interface 903 communicate via a bus 904, or via wireless transmission or other means. Furthermore, the computing device 900 may also include a memory 905, which is connected to the processor 901, memory unit 902, and communication interface 903 via the bus 904. The memory 902 can be used to store instructions, and the processor 901 can execute the instructions stored in the memory 902.

[0119] The processor 901 can perform the following operations:

[0120] Receive a first operation request, the first operation request being used to request processing of the AI ​​model, the first operation request including authorization authentication information;

[0121] Determine whether the authorization information conforms to the verification rules in the PEP component;

[0122] When the authentication information meets the verification rules, the first operation request is executed to perform processing operations on the AI ​​model.

[0123] It should be understood that in this embodiment, the processor 901 may be a CPU, or it may be a digital signal processor (DSP), application-specific integrated circuit (ASIC), field-programmable gate array (FPGA), or other programmable logic device, discrete gate or transistor logic device, discrete device assembly, or other conventional processor.

[0124] When the AI ​​accelerator card 900 includes a memory 905, the memory 905 may include read-only memory and random access memory, and provide instructions and data to the processor 905. The memory 905 may also include non-volatile random access memory.

[0125] The memory 905 can be volatile memory or non-volatile memory, or it can include both. The non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous linked dynamic random access memory (SLDRAM), and direct rambus RAM (DR RAM).

[0126] The communication interface 903 is used to communicate with other devices connected to the AI ​​accelerator card 900. The bus 904 may include a data bus, a power bus, a control bus, and a status signal bus, etc. However, for clarity, all buses are labeled as bus 904 in the figure.

[0127] It should be understood that the AI ​​accelerator card 900 according to the embodiments of this application can correspond to the AI ​​accelerator card 200 in the embodiments of this application, and can correspond to the methods executed by the AI ​​accelerator card 200 in the above embodiments. The above and other operations and / or functions implemented by the AI ​​accelerator card 900 are respectively the flow of implementing the corresponding methods of the AI ​​accelerator card 200 in the above embodiments. For the sake of brevity, they will not be described in detail here.

[0128] This application also provides a computer-readable storage medium. The computer-readable storage medium can be any available medium capable of being stored by a computing device, or a data storage device such as a data center containing one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state drive). The computer-readable storage medium includes instructions that instruct the computing device to perform the aforementioned data processing method.

[0129] This application also provides a computer program product. The computer program product includes one or more computer instructions. When the computer instructions are loaded and executed on a computing device, all or part of the processes or functions described in this application are generated.

[0130] The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions may be transmitted from one website, computer, or data center to another website, computer, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means.

[0131] The computer program product can be a software installation package. When any of the aforementioned data processing methods is required, the computer program product can be downloaded and executed on a computing device.

[0132] The above embodiments can be implemented, in whole or in part, by software, hardware, firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded or executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more sets of available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium. A semiconductor medium can be a solid-state drive.

[0133] The terminology used in the above embodiments is for the purpose of describing specific embodiments only and is not intended to be limiting of this application. As used in the specification and appended claims of this application, the singular expressions “a,” “an,” “the,” “the,” “the,” and “this” are intended to also include expressions such as “one or more,” unless the context clearly indicates otherwise. It should also be understood that in the embodiments of this application, “one or more” refers to one, two, or more; the character “ / ” generally indicates that the preceding and following objects are in an “or” relationship. In the embodiments of this application, “simultaneously” means within the same time period, including situations where they are at the same moment.

[0134] References to "one embodiment" or "some embodiments" as described in this specification mean that one or more embodiments of this application include a specific feature, structure, or characteristic described in connection with that embodiment. Therefore, the phrases "in one embodiment," "in some embodiments," "in other embodiments," "in still other embodiments," etc., appearing in different parts of this specification do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically emphasized. The terms "comprising," "including," "having," and variations thereof mean "including but not limited to," unless otherwise specifically emphasized.

[0135] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in this application, and these modifications or substitutions should all be covered within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A data processing system, characterized in that, The data processing system includes: A general-purpose processor is used to send a first operation request, the first operation request being used to request processing of an artificial intelligence (AI) model, the first operation request including authorization and authentication information; The AI ​​accelerator card is equipped with the AI ​​model and a Trusted Execution Environment (TEE) for running a Policy Enforcement Point (PEP) component deployed in the TEE. It is also used to receive the first operation request, determine whether the permission authentication information conforms to the verification rules in the PEP component, and, when the permission authentication information conforms to the verification rules, execute the first operation request to perform processing operations on the AI ​​model.

2. The system according to claim 1, characterized in that, The authorization information includes an identity identifier, processing operations for the AI ​​model, and a token; The permission authentication information conforms to the verification rules, including: the identity identifier matches the identity identifier in the verification rules, the processing operation matches the processing operation in the verification rules, and the token matches the token in the verification rules.

3. The system according to claim 2, characterized in that, The general-purpose processor includes a TEE, and the TEE includes a policy decision point (PDP) component. The general-purpose processor is further configured to add the token to the second operation request generated by the general-purpose processor using the PDP component before sending the first operation request, thereby obtaining the first operation request, wherein the second operation request includes the identity identifier and the processing operation; When determining whether the authorization information conforms to the verification rules in the PEP component, the AI ​​acceleration card is specifically used for: The AI ​​acceleration card uses the verification rules in the PEP component to authenticate the identity, the processing operation, and the token in the first operation request.

4. The system according to claim 3, characterized in that, The AI ​​accelerator card includes an access controller; When the AI ​​acceleration card uses the verification rules in the PEP component to authenticate the identity, the processing operation, and the token in the first operation request, it is specifically used for: The AI ​​accelerator card uses the verification rules in the access controller to authenticate the identity, the processing operation, and the token in the first operation request. The verification rules are provided to the access controller by the PEP component.

5. The system according to claim 3 or 4, characterized in that, The access controller runs on the TEE in the artificial intelligence acceleration card, and the access controller receives the first operation request based on the client application trusted application CA-TA communication interface. Alternatively, the access controller operates within the REE of the AI ​​accelerator card.

6. The system according to claim 1, characterized in that, Before sending the first operation request, the general-purpose processor is also used to encrypt or obfuscate the second operation request generated by the general-purpose processor using the PDP component to obtain the first operation request. The second operation request includes the identity identifier and processing operations for the AI ​​model. The permission authentication information conforms to the verification rules, including: the first operation request was successfully decrypted or deobfuscated, and the permission authentication information conforms to the verification rules in the PEP component.

7. The system according to claim 2, characterized in that, The AI ​​acceleration card includes a TEE that runs a PDP component; The AI ​​acceleration card is also used to add the token to the second operation request generated by the general processor using the PDP component before the general processor sends the first operation request, so as to obtain the first operation request. The second operation request includes the identity identifier and the processing operation. When determining whether the authorization information conforms to the verification rules in the PEP component, the AI ​​acceleration card is specifically used for: The AI ​​acceleration card uses the verification rules in the PEP component to authenticate the identity, the processing operation, and the token in the first operation request.

8. The system according to any one of claims 1 to 7, characterized in that, The first operation request is used to request the AI ​​model to perform inference based on the target data, where the target data is the input data of the AI ​​model. The content risk control model runs in the TEE included in the artificial intelligence acceleration card, and the content risk control model is used to verify whether the target data meets the inference conditions. When the AI ​​acceleration card executes the first operation request, it is specifically used for: When the target data satisfies the inference condition, the artificial intelligence acceleration card executes the first operation request.

9. The system according to any one of claims 1 to 8, characterized in that, The AI ​​accelerator card includes a deep learning processor (DPU), a data processor (DPU), a neural network processor (NPU), or a graphics processing unit (GPU).

10. A data processing method, characterized in that, The method is applied to an artificial intelligence accelerator card, which deploys an artificial intelligence AI model and constructs a Trusted Execution Environment (TEE). The artificial intelligence accelerator card runs a Policy Enforcement Point (PEP) component deployed in the TEE. The method includes: The AI ​​acceleration card receives a first operation request, which requests processing of the AI ​​model and includes authentication information. The AI ​​accelerator card determines whether the authorization authentication information conforms to the verification rules in the PEP component; When the authorization information matches the verification rules, the AI ​​accelerator card executes the first operation request to perform processing operations on the AI ​​model.

11. The method according to claim 10, characterized in that, The authorization information includes an identity identifier, processing operations for the AI ​​model, and a token; The permission authentication information conforms to the verification rules, including: the identity identifier matches the identity identifier in the verification rules, the processing operation matches the processing operation in the verification rules, and the token matches the token in the verification rules.

12. The method according to claim 11, characterized in that, The AI ​​accelerator card includes an access controller; The AI ​​accelerator card determines whether the authorization information conforms to the verification rules in the PEP component, including: The AI ​​accelerator card uses the verification rules in the access controller to authenticate the identity, the processing operation, and the token in the first operation request. The verification rules are provided to the access controller by the PEP component.

13. The method according to claim 11 or 12, characterized in that, The access controller runs on the TEE in the artificial intelligence acceleration card, and the access controller receives the first operation request based on the client application trusted application CA-TA communication interface. Alternatively, the access controller operates within the REE of the AI ​​accelerator card.

14. The method according to claim 10, characterized in that, The first operation request is encrypted or obfuscated; The permission authentication information conforms to the verification rules, including: the first operation request was successfully decrypted or deobfuscated, and the permission authentication information conforms to the verification rules in the PEP component.

15. The method according to claim 11, characterized in that, The AI ​​accelerator card includes a TEE that runs a PDP component, and the method further includes: Before receiving the first operation request, the AI ​​accelerator card uses the PDP component to add the token to the second operation request from the general processor to obtain the first operation request, wherein the second operation request includes the identity identifier and the processing operation; The AI ​​accelerator card determines whether the authorization information conforms to the verification rules in the PEP component, including: The AI ​​acceleration card uses the verification rules in the PEP component to authenticate the identity, the processing operation, and the token in the first operation request.

16. The method according to any one of claims 10 to 15, characterized in that, The first operation request is used to request the AI ​​model to perform inference based on the target data, where the target data is the input data of the AI ​​model. The content risk control model runs in the TEE included in the artificial intelligence acceleration card, and the content risk control model is used to verify whether the target data meets the inference conditions. The AI ​​accelerator card executes the first operation request, including: When the target data satisfies the inference condition, the artificial intelligence acceleration card executes the first operation request.

17. The method according to any one of claims 10 to 16, characterized in that, The AI ​​accelerator card includes a deep learning processor (DPU), a data processor (DPU), a neural network processor (NPU), or a graphics processing unit (GPU).

18. An artificial intelligence accelerator card, characterized in that, Including the processor and memory; The AI ​​accelerator card is used to execute instructions stored in the memory, causing the AI ​​accelerator card to perform the steps of the method as described in any one of claims 10 to 17.

19. A computer-readable storage medium, characterized in that, Includes instructions that, when executed on a computing device, cause the computing device to perform the steps of the method as described in any one of claims 10 to 17.

20. A computer program product containing instructions, characterized in that, When it is run on at least one computing device, it causes the at least one computing device to perform the method as described in any one of claims 10 to 17.

Images