Fault injection resistant AI chip model encryption loading and execution method

Abstract

The invention relates to the field of electric digital data processing, and discloses an anti-fault-injection AI chip model encryption loading and execution method, which comprises the following steps of: latching a micro-architecture state vector in real time at a pipeline execution level of a calculation unit, initializing a hardware rolling hash accumulator, and performing loading and execution on the hardware rolling hash accumulator; forcing the numerical value and a state vector expected value of a previous data processing stage to participate in one-way hash operation together to generate a dynamic mask, and encrypting transmission data; according to the method, an internal immune mechanism based on micro-architecture state entanglement is constructed, the correctness of an instruction time sequence is converted into a mathematical necessary condition for data decryption, and the correctness of the instruction time sequence is converted into the mathematical necessary condition for data decryption. High-entropy noise self-destruction of a data level is directly caused by execution stream abnormity caused by any fault injection, the security vulnerability of orthogonality of a control stream and a data stream is avoided, and mathematical blocking of physical attacks is realized.

Description

Technical Field

[0001] This invention relates to a fault-injection-resistant AI chip model encryption loading and execution method, belonging to the field of electronic digital data processing technology. Background Technology

[0002] In current high-performance computing and artificial intelligence acceleration chip architectures, the security of the neural network model parameter loading and execution process determines the system's trustworthiness. The mainstream protection solutions in the industry are based on the cryptographic trust chain mechanism. In a trusted execution environment or secure storage area, the model parameters are decrypted using encryption algorithms, and the data integrity is verified by hash algorithms. This mechanism relies on strict program execution timing. The processor first executes the decryption and verification instructions. After confirming the data integrity, it jumps to the data loading instructions, allowing the parameters to flow into the computing pipeline. This protection logic constructs logical thresholds controlled by software or firmware instructions in the data path.

[0003] Faced with fault injection attacks targeting the physical layer of chips, the logic threshold protection system reveals architectural flaws. In the general computing model, the control flow and data flow are logically orthogonal, the instruction execution path is determined by the program counter and status register, and data parsing and computation are performed by the arithmetic logic unit. The two are only coupled through finite conditional jump instructions. Attackers use physical means such as laser injection, voltage glitches, or electromagnetic pulses to interfere with the chip clock or power network, causing the program counter to jump unexpectedly or the status register flags to flip. This type of fault injection causes the processor to skip critical decryption and verification instructions and directly execute subsequent data loading operations. The data path itself lacks the ability to perceive the execution history of the control flow. When the control logic is bypassed, the computing unit still mechanically receives and processes tampered or unauthorized data. Over-reliance on upper-level instruction logic ignores the limitations of the underlying physical state binding, and this has not been fundamentally improved in applications that pursue high concurrency and throughput chips. For example, the Chinese invention patent CN112783650B, authorized by the patent, discloses a multi-model parallel inference method based on AI chips. By establishing a master-slave thread collaboration mechanism and multi-queue data buffering, it achieves parallel scheduling of Context and Stream resources, improving the computing power utilization of the Ascend310 chip. From a security perspective, the architecture achieves fine task segmentation at the software level, and the model loading and inference execution control is completely entrusted to the linear advancement of the instruction flow. The data path relies on software-level resource application and ID call, lacking deep entanglement with the micro-state of the hardware. Once an attacker injects interference with thread scheduling timing or skips ACL permission verification through physical fault injection, the parallel computing unit cannot perceive the abnormal instruction execution history and still processes sensitive data based on the tampered program counter. The lack of physical security anchors in the pursuit of computing power scheduling confirms the urgent need to break the orthogonality of control flow and data flow.

[0004] Therefore, the technical problem to be solved by this invention is how to break the logical orthogonality between control flow and data flow, construct a defense mechanism that internalizes the instruction execution history as a necessary condition for data parsing, so that physical interference with control timing will inevitably lead to mathematical self-destruction at the data operation level, and achieve immunity to fault injection attacks without relying on external detection circuits. Summary of the Invention

[0005] To address the problems mentioned in the background art, the technical solution of the present invention is as follows: A fault-injection-resistant AI chip model encryption loading and execution method, applied to a data processing system that connects a security module and a computing unit through a point-to-point data path that shields external interruptions, the method includes the following steps: Step 101: At each effective edge of the instruction pipeline operation executed by the computing unit, the set of signals containing the physical address of the program counter, the status flag of the arithmetic logic unit and the XOR value of the control signal are latched in real time using hardware state sampling logic, and the set of signals is cascaded to generate a microarchitecture state vector that objectively records the current micro-execution history of the computing unit. Step 102: Initialize the hardware rolling hash accumulator in the security module and establish a synchronous step mapping relationship between the hardware rolling hash accumulator and the instruction execution cycle of the computing unit. On the security module side, execute the encryption constraint rules based on the historical execution state. The encryption constraint rules call the current value of the hardware rolling hash accumulator and the expected value of the microarchitecture state vector of the N-1th data processing stage to participate in the one-way hash operation to generate a dynamic mask. Then, use the dynamic mask to perform XOR encryption on the Nth transmitted data. Step 103: On the computing unit side, a closed-loop decryption operation based on the real-time microarchitecture state is executed. When the computing unit completes the (N-1)th data processing instruction, the actual value of the microarchitecture state vector presented in the internal physical register is directly read, and the decryption mask is derived by combining the locally synchronously maintained accumulator value to restore the Nth transmitted data. Among them, when the actual value of the microarchitecture state vector and the expected value of the microarchitecture state vector are bit-level different due to instruction timing interference, the closed-loop decryption operation directly generates a decryption mask that does not match the dynamic mask according to the hash operation rules, and restores the Nth transmitted data to high-entropy noise data that destroys the mathematical convergence of the neural network.

[0006] Preferably, the process of generating the microarchitecture state vector in step 101 includes the following sub-steps: Step 201, extracting the zero flag, carry flag, and overflow flag of the arithmetic logic unit from the program status word register of the computing unit, and performing bit concatenation of the extracted zero flag, carry flag, and overflow flag with the low-order byte of the program counter; Step 202, acquiring the fetch signal, decode signal, and execute signal output by the instruction decoder, and performing XOR compression operation on the acquired fetch signal, decode signal, and execute signal to generate a control flow fingerprint; Step 203, merging the bit concatenation result with the control flow fingerprint, and writing the merged result into the shadow register at the rising edge of the clock in each machine cycle to form the microarchitecture state vector, so that the numerical change of the microarchitecture state vector strictly corresponds to the timing progression state of the instruction pipeline.

[0007] Preferably, the specific operational logic for generating the dynamic mask in step 102 performs the following mathematical transformations: Step 301, setting the initial state value of the hardware rolling hash accumulator, and performing iterative updates based on the accumulation state of the previous moment within the atomic operation cycle of processing each data packet; Step 302, for the first... For each transmitted data packet, a dynamic mask is calculated based on the following formula. : ,in, This represents a lightweight one-way hash function implemented in hardware. Indicates processing the first The value stored in the hardware rolling hash accumulator for each data packet. Indicates the pre-stored first The expected value of the microarchitecture state vector that the computing unit should present after each data packet is correctly processed. Indicates bitwise XOR operation; Step 303, utilizes the generated dynamic mask. For the The original payload of each transmitted data packet undergoes a streaming XOR operation to generate a ciphertext data stream that needs to be transmitted through the data path.

[0008] Preferably, the initialization phase before step 102 includes the following seed injection and synchronization operations: Step 401, an initial seed is generated using the true random number generator inside the security module, and the initial seed is synchronously loaded into the hardware rolling hash accumulator of the security module and the decryption status register of the computing unit through hard-wired logic; Step 402, during the data loading process, the handshake signal between the security module and the computing unit is kept silent, and the step synchronization of the accumulators of both parties is maintained only through the counting logic of the bus clock, so as to avoid leaking the current encryption status information through handshake interaction.

[0009] Preferably, the iterative update mechanism of the hardware rolling hash accumulator includes: step 501, after completing the first step... After the encryption operation of the transmitted data packet, the state of the hardware rolling hash accumulator is immediately updated using the current hash operation result; in step 502, the updated accumulator state is temporarily stored in a volatile storage unit with power-off erasure characteristics, and then entered into the next step. In each data packet processing cycle, the state in the volatile storage unit is directly called; in step 503, when a system reset or an unexpected power failure event is detected, a physical zeroing operation is immediately performed on the volatile storage unit.

[0010] Preferably, the decryption mask derivation process in the closed-loop decryption operation follows the following intrinsic verification logic: Step 601, the decryption circuit of the control computing unit directly reads the actual value of the microarchitecture state vector from the local pipeline state register and shields any state parameter injection from the software layer; Step 602, using a hash algorithm completely consistent with the security module and the locally synchronized accumulator value, combined with the read actual value of the microarchitecture state vector, the local decryption mask is calculated; Step 603, the calculated local decryption mask is directly applied to the received ciphertext data. If the actual value of the microarchitecture state vector undergoes a single-bit flip due to a fault injection attack, the decrypted data is restored to high-entropy noise data.

[0011] Preferably, the method further includes a chain-like trust anchoring step for loading model parameters in blocks: Step 701, the AI ​​model parameters are divided into multiple consecutive data blocks, and the decryption key of each data block depends on the cumulative pipeline state after all previous data blocks have been processed; Step 702, when loading the Nth data block, the processing completion flag of the previous N-1 data block is checked. If the flag is not set or the timing is ahead, it is determined that the current microarchitecture state vector of the computing unit is different from the expected value; Step 703, this chain-like dependency relationship based on state evolution is used to prevent the model structure from being tampered with by replaying historical data blocks or skipping the loading of specific network layer parameters.

[0012] Preferably, the data path construction process performs the following physical layer security hardening operations: Step 801, configure the on-chip bus interface connecting the security module and the computing unit, and shield all external interrupt request signals and debug port access permissions within the bus area except for the reset signal; Step 802, establish a point-to-point direct memory access channel between the security module and the computing unit, and lock the read and write address space image of the channel, prohibiting any third-party bus master device from addressing the address space; Step 803, lock the transmission clock frequency of the data path to be consistent with the main frequency of the computing unit, and maintain strict phase synchronization between the data transmission clock and the execution clock of the instruction pipeline.

[0013] Preferably, the method utilizes a parallel hardware architecture to ensure the real-time performance of data loading, including: step 901, allocating an independent pipeline level within the security module for parallel execution of the lookup of the expected value of the microarchitecture state vector, hash iteration operation, and XOR encryption operation; step 902, decomposing the data encryption process into multiple pipeline stages to ensure that the logical delay of each stage is less than the critical path delay of the system clock cycle; and step 903, using a dedicated direct memory access controller to move encrypted data in the background, so that the encryption operation process is masked within the data bus transmission delay.

[0014] Preferably, the method further includes a passive blocking response step under abnormal conditions: Step 1001, when the computing unit performs closed-loop decryption operation, it does not actively compare the checksum of the decryption result, but directly writes the decrypted data into the operation register or cache; Step 1002, the high-entropy noise data generated by the erroneous decryption causes numerical overflow or a sharp drop in classification confidence of the subsequent convolution or matrix multiplication operation results; Step 1003, this numerical anomaly at the operation level is taken as the final indication that the attack has been blocked, and effective inference is terminated without triggering additional interruption signals.

[0015] Compared with the prior art, the beneficial effects of the present invention are: 1. In the fault-injection-resistant AI chip model, the sampling circuit coupled to the computing unit pipeline is used to capture the physical address of the program counter, the status flag of the arithmetic logic unit, and the instruction control signal in real time. A dynamic mask bound to the instruction stream is generated by a rolling hash algorithm. The decryption of the model parameters directly depends on the time-domain execution trajectory of the processor pipeline. When the control logic of the processing unit encounters a physical fault injection that causes unexpected jumps or abnormal states, the microarchitecture state vector undergoes a bit-level mutation, generating a demask that does not mathematically match the encrypted data packet. This mechanism avoids the logical orthogonality between the control flow and the data flow, blocks the loading of data through bypass verification logic or tampering with jump instructions, and is physically immune to fault injection attacks targeting the control timing.

[0016] 2. Utilizing the sensitivity of dynamic mask streams to microarchitecture states and the avalanche effect of hash functions, when execution flow anomalies are detected, attacks are inevitably blocked through mathematical operations. The actual execution instruction sequence deviates from the preset timing, and the erroneous microarchitecture state vector causes the demasking operation to output high-entropy random numbers. The model parameter data packets are XORed back to invalid noise data. For artificial intelligence neural network models that are sensitive to numerical precision, the introduction of noise data disrupts the weight distribution and mathematical convergence of network layers, leading to distorted inference results or overflow interruption of the calculation process. This passive defense feature avoids the security failure risk of active defense mechanisms due to bypassing the detection circuit or response delay, ensuring the security boundary of data in untrusted physical environments.

[0017] 3. A rolling hash accumulator is introduced into the mask generation logic to establish a strong temporal dependency between adjacent data packet processing processes. The correct parsing of each model parameter data packet is based on the correct execution state of the preceding instruction cycle. An indivisible and non-replayable temporal trust chain is built inside the data processing pipeline. The chain verification mechanism prevents attackers from skipping the loading of specific network layers through local fault injection, prevents the interception of historical data packets for replay attacks, and prevents data packets that are out of the original temporal context from being verified by the current accumulator state. This solves the technical problem that the lack of logical connection between data blocks in the large-scale model parameter block loading process makes them easy to be replaced or tampered with, and ensures the continuity and integrity of the temporal dimension of the model loading process. Attached Figure Description

[0018] Figure 1 This is a schematic diagram of the dynamic mask generation and closed-loop decryption process for the microarchitecture state entanglement of the present invention. Figure 2 This is a comparison chart of the accumulator value evolution and avalanche effect under normal and fault conditions of the present invention; Figure 3 This is an internal security architecture diagram of the present invention, which integrates atomic data pathways with microarchitectural fingerprint binding. Detailed Implementation

[0019] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0020] This invention discloses a fault-injection-resistant AI chip model encryption loading and execution method. It constructs an intrinsically secure data processing architecture based on microarchitecture state entanglement, consisting of a security module, a computing unit, and atomic data paths connecting them. The microarchitecture state vector of the computing unit in the previous clock cycle is used as a necessary mathematical parameter for generating the decryption mask of the current data packet. The security module and the computing unit are synchronized through a hardware rolling hash accumulator. Once a physical fault injection targeting instruction timing or control logic occurs, the real-time state vector of the computing unit will undergo bit-level mutations, leading to errors in the decryption mask generation. This causes the model parameters to be reduced to high-entropy noise data that disrupts the convergence of the neural network, achieving attack blocking without external interruption. To address the risks of physical side-channel eavesdropping and fault injection bypass encountered during the transmission of AI model parameters from the secure storage area to the computing unit via the on-chip bus, this embodiment of the invention constructs a physically isolated atomic data path. To cope with the timing uncertainties and side-channel leakage that may be introduced by the bus arbitration mechanism, the system establishes a point-to-point hard-wired channel between the secure module's direct memory access (DMA) controller and the computing unit's local memory by configuring a bus interconnect matrix. During the model loading phase, this channel uses hardware logic to shield all external interrupt requests and debug port access permissions except for the reset signal, and locks the transmission clock frequency to be consistent with the computing unit's main frequency. The data transmission clock and the instruction pipeline execution clock maintain strict phase synchronization.

[0021] Building upon the aforementioned atomization pathway, this embodiment further employs a dynamic mask generation mechanism based on pipelined microarchitecture state entanglement to address the vulnerability of traditional static keys or independent random masks to fault injection. Since relying solely on a pre-set key cannot verify the correctness of instruction execution history, this system deploys a pipelined state sampler between the security module and the computing unit. This sampler is directly coupled to the instruction pipeline register set and program status word register of the computing unit via dedicated signal lines. At the rising edge of the clock in each data processing cycle, the sampler captures the microarchitecture state vector of the computing unit in real time. This vector is constructed by bitwise concatenation of the real-time values ​​of the following physical registers: the lower 8 bits of the program counter (PC), representing the physical address offset of the current instruction; the zero flag (ZF), carry flag (CF), and overflow flag (OF) of the arithmetic logic unit (ALU), representing the execution result status of the previous instruction; and the XOR value of the fetch, decode, and execution phase control signals output by the instruction decoder. This is the microarchitecture state vector. It directly reflects the current micro-execution history and control flow state of the computing unit; to establish a strong mathematical dependence of data decryption on the control flow history, the security module is equipped with a hardware rolling hash accumulator, and during the system initialization phase, an on-chip true random number generator (TRNG) is used to generate the initial seed. And loaded into the synchronization accumulator of the security module and the computing unit, during the processing of the first... When processing the model parameter data packet, the system does not directly use the static key, but instead performs chained entanglement operations to generate a dynamic mask. The specific mask generation procedure is as follows: Read the previous time step, i.e., process the... The value stored in the accumulator at the end of each data packet. Secondly, obtain the corresponding expected microarchitecture state vector. Then, the lightweight one-way hash function implemented in hardware is called. (In this embodiment, the SipHash algorithm core is selected), and the operation is performed. Get the current mask ,in This represents the mask generated by the bitwise XOR operation. Then with the A raw model parameter data package Perform an XOR operation to generate a ciphertext data packet. And send it into the data path.

[0022] On the computing unit side, a closed-loop demasking operation synchronized with the security module is performed. The computing unit only executes the first step correctly according to the preset timing sequence. Only after the data packet is loaded and processed by the instructions will the internal physical registers present the correct actual microarchitecture state vector. The computing unit uses the locally maintained accumulator value and the actual state vector to derive the decryption mask based on the same hash function. and the received ciphertext Perform decryption operation If an attacker interferes with instruction timing through laser injection or voltage glitches, such as skipping a check instruction, causing the program counter or status flag of the computing unit to flip, the actual state vector will be affected. The result is inconsistent with expectations because, due to the avalanche effect of the hash function, even small differences in the input will lead to discrepancies in the generated decryption mask. With encryption mask Completely mismatched; at this point, the decrypted data... The transformation from valid floating-point parameters to high-entropy noisy data can lead to numerical overflow or a sharp drop in classification confidence in subsequent matrix multiplication operations for deep neural network models, thus automatically blocking invalid inferences generated by attacks at the mathematical level. To ensure the efficiency and security of loading parameters for large-scale models, this embodiment uses a parallel pipeline architecture to perform Authentication, Encryption and Decryption (AEAD) and state verification. The security module allocates an independent pipeline level for parallel execution of microarchitecture state vector lookup, hash iteration, and XOR encryption operations. The data encryption process is decomposed into multi-stage pipeline steps, with the logical delay of each step designed to be a critical path delay less than the system clock cycle. During data loading, the security module uses a dedicated direct memory access controller to move data in the background, making the encryption operation and hash iteration process time-covered within the transmission delay of the data bus.

[0023] Meanwhile, this embodiment introduces a chain-like trust anchoring mechanism for block loading of model parameters. The AI ​​model parameters are divided into multiple consecutive data blocks, and the decryption key for each data block depends on the cumulative pipeline state after all preceding data blocks have been processed. When the data block is in the order of the hardware logic check, the preceding step is... The processing completion flag and accumulator status of each data block are monitored. If a timing delay or flag anomaly is detected, a replay attack or skip execution risk is identified, and the accumulator state enters an unrecoverable deadlock mode, permanently destroying the decryption capability of all subsequent data until the system is reset. To address the synchronization drift problem that may occur during long-term system operation, this invention designs a periodic state resynchronization mechanism. At each preset model layer loading boundary, the security module inserts a special synchronization frame. This synchronization frame does not contain valid model parameters but contains an encrypted checksum of the current accumulator state. Upon receiving the synchronization frame, the computing unit pauses pipeline execution and compares the local accumulator state checksum. If... If the comparison matches, a handshake signal is used to confirm and the loading of the next layer continues. If the comparison does not match, it indicates that an undetected soft error or attack attempt has occurred. The computing unit then triggers a security interruption, clears the local cache, and requests a renegotiation of the session key. This mechanism ensures the stability of the microarchitecture state entanglement mechanism in long-cycle model inference tasks. In summary, this embodiment implements a fault-injection-resistant AI chip model loading scheme through physical-level atomic path construction, logical-level microarchitecture state entanglement, and algorithm-level rolling hash masking. It internalizes the integrity of the control flow as a mathematical prerequisite for the correctness of the data flow, solving the security vulnerabilities caused by the separation of control and data logic in the prior art.

[0024] Example 1: In a high-security AI cloud computing node application scenario for financial-grade big data processing, the system needs to load and execute a deep neural network model with hundreds of billions of parameters in an untrusted physical environment. This environment faces a continuous threat of voltage spike injection attacks targeting the chip's power domain. Attackers attempt to introduce voltage transients during specific clock cycles of the chip's execution of model parameter decryption and verification instructions, inducing unexpected jumps in the processor's program counter, thereby bypassing the integrity verification logic and directly loading the tampered parameters. Under this condition, the anti-fault injection mechanism of this invention initiates an atomic loading procedure. The security module establishes a point-to-point direct memory access channel with the local memory of the computing unit by configuring the on-chip interconnect matrix, and uses hardware logic to lock the arbitration right of the transmission bus, shielding the channel from all external interrupt requests during data burst transmission. When the computing unit processes the first... When processing the model parameter data block, the system is in a high-frequency pipeline operation state. The pipeline state sampler synchronously latches the microarchitectural state vector of the computation unit on the rising edge of each clock cycle. Assuming the attacker is processing the first... A voltage spike was successfully injected during the integrity verification phase of a data block, causing a single-bit flip in the low-order address of the program counter of the computation unit. This caused the instruction stream to skip the hash comparison operation that should have been executed. Although the control flow appeared to continue executing the data loading instructions macroscopically, the sampler captured the real-time microarchitecture state vector. It has already matched the pre-set expected vector at the physical level. To generate bit-level differences, the hardware rolling hash accumulator on the security module side, according to predetermined cryptographic constraints, calls the accumulator value from the previous moment. Perform entanglement operations with the actual state vector of the error.

[0025] Due to the use of a one-way hash function Exhibiting an avalanche effect, tiny bit-level differences in the input vector lead to variations in the derived decryption mask. Compared to the original encryption mask Completely orthogonal, the computational unit utilizes this error mask. For the first to reach through the atomization pathway A ciphertext data packet Perform an XOR decryption operation, the result of which is... Instead of the original floating-point parameters, the data is high-entropy noise data with no mathematical meaning. After being written into the arithmetic register of the computing unit, this noise data spreads rapidly in subsequent convolution matrix multiplication operations, causing the activation values ​​of each layer of the neural network to deviate by orders of magnitude. Ultimately, the classification confidence of the model output drops sharply to the level of random guessing. Although the attacker physically bypasses the threshold logic of the verification instruction, what he obtains is only invalid data that is mathematically self-destructed due to microarchitectural mismatch. The system achieves intrinsic blocking of fault injection attacks without triggering any explicit alarm signals.

[0026] Example 2: To verify the actual defensive effect of the fault injection resistance mechanism proposed in this invention under complex electromagnetic environments, this example constructs a hardware-in-the-loop (HIL) verification platform including a voltage glitch generator, an electromagnetic pulse (EMP) simulation source, and a high-precision oscilloscope. The platform uses two 28nm FPGA development boards based on the same process node, serving as the sample group (deploying the atomization path, state entanglement, and rolling hash logic of this invention) and the control group (deploying only traditional AES-GCM decryption and static hash verification logic). The experiment aims to quantitatively evaluate the ability of the two systems to protect the integrity of model parameters and the stability of system operation when facing physical fault injection attacks of different intensities. The experimental process is divided into three stages, covering the complete verification process from benchmark testing to high-intensity attacks, under a standard, interference-free laboratory environment (temperature 25°C). With voltage ripple <10mV, benchmark performance tests were performed on the two systems to ensure that the model loading throughput and inference accuracy were consistent under normal operating conditions. Fault injection tests were initiated by using a voltage glitch generator to superimpose nanosecond-level negative pulses on the FPGA core voltage (VCCINT). The pulse width was gradually increased from 5ns to 50ns, and the amplitude was gradually increased from -5%VCCINT to -30%VCCINT to simulate voltage attacks on instruction execution timing. At the same time, transient magnetic field interference was generated on the chip surface through an EMP simulation source to further increase clock jitter. At each attack intensity level, 1000 model loading and inference tasks were executed continuously. The level changes of key signal lines were monitored using an oscilloscope, and the program counter (PC) value and status register flags of the computing unit were captured by an on-chip logic analyzer.

[0027] The collection and analysis of experimental data focused on two core indicators: the attack success rate, which is the proportion of attackers who successfully bypassed the verification logic and loaded incorrect parameters into the computing unit; and the system crash rate, which is the proportion of attacks that caused the system to crash or reset and become unable to continue running. As shown in Table 1 below, with the increase of fault injection intensity, the attack success rate of the control group showed an upward trend. When the voltage spike amplitude reached -15% and the pulse width exceeded 20ns, the attack success rate of the control group exceeded 45%, indicating that attackers could skip the static verification instructions with a high probability by interfering with the timing. In contrast, the attack success rate of the sample group of this invention remained at 0% under all test intensities. Even under extreme attacks with an amplitude of -30%, although the system crash rate increased due to signal integrity damage, no successful illegal parameter loading occurred.

[0028] Table 1: Comparison of defense effectiveness under different fault injection intensities

[0029] Based on confirming the effectiveness of the defense mechanism, this embodiment further quantifies and evaluates the engineering cost of the atomic security architecture. A logic analyzer is used to monitor the payload transmission rate of the on-chip AXI bus over a long period, and the system throughput is compared between two states: without security features enabled (baseline mode) and with the atomic loading of this invention enabled (security mode). Simultaneously, the utilization rate of FPGA logic units (LUTs) and registers (FFs) by the security module is extracted using the comprehensive report from EDA tools. Measured data shows that in a typical loading scenario processing a 1GB continuous model parameter block, the average bus throughput in baseline mode is 12.85GB / s, while after enabling the full set of state entanglement and rolling hash security logic, the average... The throughput remains at 12.78 GB / s, with a rate loss of only 0.54%, which is far less than the inherent jitter range of the system bus arbitration. This result objectively confirms that the hash iteration and XOR operation logic inside the security module is precisely masked within the physical delay window of DMA data transfer in terms of timing, without introducing additional blocking delay. In terms of resource overhead, the logic synthesis area of ​​the security module of this invention accounts for only 3.2% of the total logic resources of the 28nm process FPGA, and the on-chip memory (BRAM) utilization rate is only 1.5%, as shown in Table 2 below. Under the premise of ensuring inherent security, this architecture achieves extremely low intrusion on computing performance and hardware cost, meeting the stringent constraints of edge AI chips on real-time performance and power consumption.

[0030] Table 2: Measured Data on System Performance Loss and Resource Consumption

[0031] Further analysis of the internal state data of the prototype under attack revealed that when the oscilloscope detected a voltage spike causing an unexpected jump in the program counter, such as skipping a verification instruction for four clock cycles, the pipeline state sampler captured the microarchitecture state vector. A bit-level mutation occurs, which affects the decryption mask generated by the hardware rolling hash accumulator. Compared to the original mask The avalanche-like difference is generated. Statistical analysis of the decrypted data shows that the entropy value suddenly rises from the typical value of about 3.5 bits / byte of the model parameters to 7.9 bits / byte, which is close to random noise. After inputting this noisy data into the first layer of the neural network for convolution, the distribution of activation values ​​of each layer completely deviates from the pre-training distribution. The confidence of the final output classification result fluctuates around 0.1 (random guess).

[0032] Example 3: This example combines Figures 1 to 3 Explanation of methods for encrypted loading and execution of AI chip models to combat fault injection, such as... Figure 1 As shown, the security module on the left uses a true random number generator to generate an initial seed and synchronization state, drives a hardware rolling hash accumulator to maintain the expected state evolution history and provide the accumulator state, and the dynamic mask generation logic outputs a dynamic mask based on the expected vector hash operation. It generates ciphertext data packets through data stream XOR encryption. The ciphertext is transmitted to the computing unit on the right via an atomic data path DMA. At the effective clock edge of the instruction pipeline execution stage, the hardware state sampling logic latches the microarchitecture physical signals containing the PC address, ALU flag and control signals in real time. After bit concatenation and XOR compression, it generates the actual value of the microarchitecture state vector that objectively records the current execution history. This vector participates in the closed-loop decryption operation to deduce the local mask to restore the data. Finally, depending on whether the recovered data is parameters or noise, the neural network operation result is either valid inference or high-entropy noise self-destruction.

[0033] like Figure 2 As shown, the horizontal axis represents the execution cycles marked as cycles 1 to 8, and the vertical axis represents the accumulator state values. The solid lines in the graph represent the normal execution trajectory, showing a stable upward trend in the state values ​​as the cycle progresses. The dashed lines represent the trajectory after fault injection, showing that after a fault injection event occurs in cycle 4, the accumulator state values ​​deviate from the normal trajectory and show a downward trend. Figure 3As shown, the system architecture diagram details the connection relationships between various functional modules. The upper secure trust zone integrates a hardware rolling hash accumulator (main), a true random number seed injection unit, and a direct memory access controller. It transmits ciphertext to the lower state entanglement verification logic through an atomic point-to-point path. Combining real-time state sampling provided by the shadow register state latch and the microarchitecture state vector pipeline fingerprint, it performs closed-loop decryption operations. Based on the verification results, it directs the data flow to different branches of the computation unit pipeline: when the timing is correct, it performs effective inference to achieve correct convergence of the neural network; when fault injection or timing anomalies are detected, it generates high-entropy noise to cause numerical overflow or automatically blocks the process.

[0034] Example 4: This example designs a set of stress tests to evaluate the response capability of the method of the present invention to voltage disturbances of different degrees. The test uses a 28nm process FPGA development board with the security module of the present invention as the sample group of the present invention, and a development board of the same model with only the conventional AES-GCM encryption scheme as the control group. The core purpose of the test is to verify whether the microarchitecture state entanglement mechanism constructed by the present invention exhibits the expected gradient defense effect under different intensities of timing disturbances by introducing voltage noise through gradient. The test platform supplies power to the FPGA core through a programmable power supply and couples a broadband Gaussian white noise generator on the power supply path. During the test, the root mean square amplitude (RMS) of the noise gradually increases from 0mV to 200mV in increments of 10mV to simulate the working conditions from slight power ripple to severe voltage drop. After each noise level is set, the system executes 1000 model parameter loading and inference tasks. The data acquisition system monitors the inference accuracy of the computing unit, the number of system resets, and the toggling of the internal state register in real time.

[0035] Test data shows that in the low-interference region (noise RMS less than 50mV), both systems maintain inference accuracy above 99%, indicating that conventional circuit design is sufficient to handle minor disturbances. When the noise RMS increases to the medium-interference region (50mV to 100mV), the inference accuracy of the control group begins to fluctuate randomly, with the accuracy dropping to 80% in some test cycles without triggering any safety alarms. However, the inference accuracy of the present invention's sample remains above 99% in this range, or triggers a safety reset directly due to state verification failure, without exhibiting any intermediate states of outputting incorrect results. Entering the 100mV range... After reaching a high interference range of V to 200mV, the performance of the two systems diverged significantly, as shown in Table 3. When the noise RMS reached 150mV, the inference accuracy of the control group dropped sharply to about 45%, accompanied by a large number of unpredictable error outputs, indicating that its verification logic had been bypassed by noise. In contrast, the inference accuracy of the sample group of this invention quickly dropped to zero, and the system entered a continuous denial-of-service state. All decryption outputs were high-entropy noise. As the intensity of physical interference increased, the defense mechanism of this invention could deterministically switch the system state from normal operation to secure failure, rather than uncontrollable error operation.

[0036] Table 3: Impact of Voltage Noise Intensity Gradient on System Inference Reliability

[0037] This embodiment verifies the stability of the microarchitecture state entanglement mechanism at the physical level through gradient voltage noise interference testing. The experimental results show that when the interference intensity of the physical environment exceeds the tolerance of microarchitecture state maintenance, the method of this invention can utilize the avalanche effect of the state vector to force data decryption failure and build a security baseline.

[0038] Example 5: To address the potential data consistency risks associated with long-term static storage of AI model parameters in non-volatile memory and during system cold starts, this example provides an offline calibration and data filling procedure. During the chip factory testing phase, a set of standard reference vector tables is pre-set in the protected storage area of ​​the security module using a dedicated automated test equipment (ATE). The construction of this reference vector table is based on statistical analysis of the microarchitecture states of a large number of sample chips under standard temperature, voltage, and process angles. Specifically, the ATE simulates the system power-on reset and initialization sequence, continuously executes the preset benchmark test program, and synchronously collects the feature values ​​of the program counter, status register, and control signals in each clock cycle. By performing statistical filtering and feature extraction on the massive amount of collected data, a set of expected microarchitecture state values ​​representing the standard behavior pattern of the chip under fault-free conditions is generated. This set is encrypted and written into the chip's one-time programmable (OTP) memory as the trust foundation for all subsequent dynamic mask generation.

[0039] Furthermore, considering the subtle differences in manufacturing processes that may exist between different batches of chips, as well as the potential impact of changes in deployment environment temperature on timing characteristics, this embodiment also includes a set of on-site deployment pre-calibration procedures. When the AI ​​chip is powered on for the first time or when a major system update is performed, the safety module automatically starts a self-calibration routine. During the controlled boot loading phase, this routine executes a series of micro-instruction sequences with deterministic timing characteristics and monitors the output of the pipeline state sampler in real time. The safety module compares the actual sampled state vector with a preset reference vector table and calculates the timing deviation correction factor under the current physical conditions. This correction factor is dynamically loaded into the compensation register of the hardware rolling hash accumulator for real-time fine-tuning of the expected state value during subsequent model loading, thereby avoiding the risk of false alarms caused by process deviations or environmental drift.

[0040] Example 6: To address the microarchitecture state timing drift caused by differences in AI model scale and chip process variations, this example provides an adaptive pre-deployment calibration and model building procedure. This procedure quantifies the timing characteristics of key microarchitecture events when models of different scales run on the target chip through specific offline calibration experiments, generating a benchmark state vector table for dynamic mask calculation. The calibration process is carried out in a controlled cleanroom environment, using a high-precision logic analyzer to monitor key signal nodes inside the chip, and selecting a set of representative AI models of different scales as a benchmark test set, covering everything from lightweight convolutional neural networks to large-scale Transformer architectures. For each model, multiple complete inference cycles are executed under standard voltage and frequency conditions, and the state signals of each stage of the instruction pipeline are collected simultaneously, including program counter values, branch prediction results, and cache hit rates.

[0041] By statistically analyzing the collected raw signal data, timing feature parameters strongly correlated with the model structure and chip microarchitecture characteristics are extracted, including the mean and variance of instruction execution cycles, the toggle frequency of specific control signals, and the distribution pattern of pipeline pauses. These feature parameters are used to construct a microarchitecture state fingerprint model that reflects the inherent processing rhythm of the chip. For each target AI model to be deployed, the expected microarchitecture state vector sequence under the ideal execution path is calculated based on the fingerprint model. When generating the baseline state vector table required for dynamic masking, a tolerance window based on statistical variance is introduced so that the calculated expected state vector can cover the small and reasonable timing fluctuations caused by process deviations. Finally, the baseline state vector table containing tolerance information is encrypted and burned into the non-volatile memory of the security module, serving as the sole reference for microarchitecture state entanglement and anomaly detection during system operation.

[0042] Example 7: Based on the reproducibility principle of Finite State Machine (FSM), it is determined that in a synchronous digital logic system, when the initial states are consistent and the clock and input stimuli are strictly synchronized, the internal logic state transition path is unique. In this example, during the chip factory test or first power-on safety initialization phase, a golden reference state recording procedure is executed to generate and solidify the expected values ​​of the microarchitecture state vector. The recording procedure is executed in a physically protected safety test environment. The steps include: Step 1: Environment Reset: A global reset signal is sent to the computing unit to clear the program counter, general-purpose registers, and all status flags. The hardware rolling hash accumulator is initialized to a preset seed value. Step 2: Stimulus Injection: Through the direct memory access channel, a standard calibration data packet sequence is input to the computing unit at a preset fixed clock frequency. The sequence content and timing structure are consistent with the actual runtime model parameter data packet. Step 3: State Snapshot: Process the first state snapshot of each calibration data packet. Each clock cycle is the hash iteration trigger point, and the state sampling logic captures the current microarchitecture state vector. Step 4: Baseline Curing: Capture The expected state lookup table is constructed by directly writing to the on-chip one-time programmable memory (OTP) or a dedicated sector of encrypted flash memory. During subsequent inference and execution, the security module directly reads the corresponding data packet index value from the lookup table. Non-real-time simulation generation.

[0043] Due to clock network skew or metastability in cross-clock domain signal transmission during the digital logic sampling process, some non-critical path control signals, such as the low-order bits of the dynamic buffer hit counter or the bus arbitration wait bits, may exhibit non-functional random jitter. To ensure that the data input to the one-way hash function has absolute mathematical determinism and to prevent false alarms caused by non-aggressive physical noise triggering an avalanche effect, the system performs a valid bit mask filtering procedure before hashing. This procedure is based on bit manipulation logic and utilizes a preset mask register. Deterministically filter the original sampling vector, where For bit width Bit-based original sampled microarchitecture state vector; For bit width The bitmask register value is represented by logic 1, which indicates strongly time-dependent deterministic bits such as the program counter and ALU zero flag, and logic 0, which indicates potentially jittery nondeterministic bits. For the stable state vectors participating in the hash operation, the filtering operation follows the Boolean logic relation: ,symbol Indicates bitwise AND operation, mask register The values ​​were determined through stability calibration experiments, under constant temperature and pressure standard operating conditions, by repeatedly executing the gold reference state recording procedure. Next, take ;collect Sampling points during the same clock cycle in the next run Compare the original vector samples. For each of the samples, if the first... The bit remains constant as either all 0s or all 1s across all samples. No. If the first bit is set to 1; If a bit has been flipped, set it to 0; this will generate... The configuration is embedded in the security module register, and the subsequent dynamic mask generation formula is revised as follows: To ensure that only deterministic state bits of the core logic of the instruction stream participate in hash entanglement, environmental noise is filtered out, and the input space of the hash function converges to a finite and deterministic discrete set. Given that during long-term operation, single-event flips (SEUs) caused by high-energy particle collisions may result in non-malicious loss of synchronization between the accumulator state and the instruction stream, the system is configured with a windowed state resynchronization mechanism.

[0044] The mechanism is based on the sliding window principle, periodically inserting synchronization anchors, and setting the synchronization window size to [value missing]. Data packets such as Each transmission After a data packet, the security module pauses hash iteration and sends a NOP data frame containing a special synchronization terminal. Upon receiving the NOP frame, the computation unit executes the following atomic operations: Operation 1: Suspend the current pipeline execution and empty the instruction queue; Operation 2: Read the current value from the local accumulator. The reference accumulation value is carried in the NOP frame. Compare; Operation 3: If and If consistent, send an ACK signal and continue execution; Operation 4: If inconsistent and the error count does not exceed the preset threshold This triggers a soft reset procedure. The soft reset procedure does not clear the model parameters; it only rolls the program counter back to the previous state. Define a checkpoint and request the security module to resend the data within the window; Operation 5: When continuous If the resynchronization fails, it is determined to be a persistent physical fault injection attack, triggering a system-wide lockout or key destruction operation.

[0045] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the present invention can be implemented in other specific forms without departing from the spirit or essential characteristics of the present invention.

[0046] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention.

Claims

1. A fault-injection-resistant AI chip model encryption loading and execution method, applied to a data processing system that connects a secure module and a computing unit via a point-to-point data path that shields against external interrupts, characterized in that... The method includes the following steps: Step 101: At each effective edge of the instruction pipeline operation executed by the computing unit, the set of signals containing the physical address of the program counter, the status flag of the arithmetic logic unit and the XOR value of the control signal are latched in real time using hardware state sampling logic, and the set of signals is cascaded to generate a microarchitecture state vector that objectively records the current micro-execution history of the computing unit. Step 102: Initialize the hardware rolling hash accumulator in the security module and establish a synchronous step mapping relationship between the hardware rolling hash accumulator and the instruction execution cycle of the computing unit. On the security module side, execute the encryption constraint rules based on the historical execution state. The encryption constraint rules call the current value of the hardware rolling hash accumulator and the expected value of the microarchitecture state vector of the N-1th data processing stage to participate in the one-way hash operation to generate a dynamic mask. Then, use the dynamic mask to perform XOR encryption on the Nth transmitted data. Step 103: On the computing unit side, a closed-loop decryption operation based on the real-time microarchitecture state is executed. When the computing unit completes the (N-1)th data processing instruction, the actual value of the microarchitecture state vector presented in the internal physical register is directly read, and the decryption mask is derived by combining the locally synchronously maintained accumulator value to restore the Nth transmitted data. Among them, when the actual value of the microarchitecture state vector and the expected value of the microarchitecture state vector are bit-level different due to instruction timing interference, the closed-loop decryption operation directly generates a decryption mask that does not match the dynamic mask according to the hash operation rules, and restores the Nth transmitted data to high-entropy noise data that destroys the mathematical convergence of the neural network.

2. The method for encrypted loading and execution of an AI chip model resistant to fault injection according to claim 1, characterized in that, The process of generating the microarchitecture state vector in step 101 includes the following sub-steps: Step 201, extracting the zero flag, carry flag, and overflow flag of the arithmetic logic unit from the program status word register of the computing unit, and bit-concatenating the extracted zero flag, carry flag, and overflow flag with the low-order byte of the program counter; Step 202, acquiring the fetch signal, decode signal, and execute signal output by the instruction decoder, and performing an XOR compression operation on the acquired fetch signal, decode signal, and execute signal to generate a control flow fingerprint; Step 203: The bit concatenation result is merged with the control flow fingerprint, and the merged result is written to the shadow register at the rising edge of the clock in each machine cycle to form a microarchitecture state vector, so that the numerical change of the microarchitecture state vector strictly corresponds to the timing progression state of the instruction pipeline.

3. The method for encrypted loading and execution of an AI chip model resistant to fault injection according to claim 1, characterized in that, The specific operational logic for generating the dynamic mask in step 102 performs the following mathematical transformations: Step 301, set the initial state value of the hardware rolling hash accumulator, and perform iterative updates based on the accumulation state of the previous moment within the atomic operation cycle of processing each data packet; Step 302, for the first... For each transmitted data packet, a dynamic mask is calculated based on the following formula. : ,in, This represents a lightweight one-way hash function implemented in hardware. Indicates processing the first The value stored in the hardware rolling hash accumulator for each data packet. Indicates the pre-stored first The expected value of the microarchitecture state vector that the computing unit should present after each data packet is correctly processed. Indicates bitwise XOR operation; Step 303, utilizes the generated dynamic mask. For the The original payload of each transmitted data packet undergoes a streaming XOR operation to generate a ciphertext data stream that needs to be transmitted through the data path.

4. The method for encrypted loading and execution of an AI chip model resistant to fault injection according to claim 1, characterized in that, The initialization phase prior to step 102 includes the following seed injection and synchronization operations: Step 401, an initial seed is generated using the true random number generator inside the security module, and the initial seed is synchronously loaded into the hardware rolling hash accumulator of the security module and the decryption status register of the computing unit through hard-wired logic; Step 402, during the data loading process, the handshake signal between the security module and the computing unit is kept silent, and the step synchronization of the accumulators of both parties is maintained only through the counting logic of the bus clock, so as to avoid leaking the current encryption status information through handshake interaction.

5. The method for encrypted loading and execution of an AI chip model resistant to fault injection according to claim 3, characterized in that, The iterative update mechanism of the hardware rolling hash accumulator includes: Step 501, after completing the first step... After the encryption operation of the transmitted data packet, the state of the hardware rolling hash accumulator is immediately updated using the current hash operation result; in step 502, the updated accumulator state is temporarily stored in a volatile storage unit with power-off erasure characteristics, and then entered into the next step. In each data packet processing cycle, the state in the volatile storage unit is directly called; in step 503, when a system reset or an unexpected power failure event is detected, a physical zeroing operation is immediately performed on the volatile storage unit.

6. The method for encrypted loading and execution of an AI chip model resistant to fault injection according to claim 1, characterized in that, The decryption mask derivation process in the closed-loop decryption operation follows the following intrinsic verification logic: Step 601, the decryption circuit of the control computing unit directly reads the actual value of the microarchitecture state vector from the local pipeline state register and masks any state parameter injection from the software layer; Step 602, using a hash algorithm completely consistent with the security module and the locally synchronized accumulator value, combined with the read actual value of the microarchitecture state vector, the local decryption mask is calculated; Step 603, the calculated local decryption mask is directly applied to the received ciphertext data. If the actual value of the microarchitecture state vector undergoes a single-bit flip due to a fault injection attack, the decrypted data is restored to high-entropy noise data.

7. The method for encrypted loading and execution of an AI chip model resistant to fault injection according to claim 1, characterized in that, The method also includes a chain-like trust anchoring step for loading model parameters in blocks: Step 701, the AI ​​model parameters are divided into multiple consecutive data blocks, and the decryption key of each data block depends on the cumulative pipeline state after all the preceding data blocks have been processed; Step 702, when loading the Nth data block, the processing completion flag of the preceding N-1th data block is checked. If the processing completion flag is not set or the timing is ahead, it is determined that the current microarchitecture state vector of the computing unit is different from the expected value; Step 703, this chain-like dependency relationship based on state evolution is used to prevent the model structure from being tampered with by replaying historical data blocks or skipping the loading of specific network layer parameters.

8. The method for encrypted loading and execution of an AI chip model resistant to fault injection according to claim 1, characterized in that, The data path construction process performs the following physical layer security hardening operations: Step 801, configure the on-chip bus interface connecting the security module and the computing unit, and shield all external interrupt request signals and debug port access permissions within the bus area except for the reset signal; Step 802, establish a point-to-point direct memory access channel between the security module and the computing unit, and lock the read and write address space image of the channel to prohibit any third-party bus master device from addressing the address space; Step 803, lock the transmission clock frequency of the data path to be consistent with the main frequency of the computing unit, and maintain strict phase synchronization between the data transmission clock and the execution clock of the instruction pipeline.

9. The method for encrypted loading and execution of an AI chip model resistant to fault injection according to claim 1, characterized in that, The method utilizes a parallel hardware architecture to ensure the real-time performance of data loading, including: Step 901, allocating an independent pipeline level within the security module for parallel execution of the lookup of the expected value of the microarchitecture state vector, hash iteration operation, and XOR encryption operation; Step 902, decomposing the data encryption process into multiple pipeline stages to ensure that the logical delay of each stage is less than the critical path delay of the system clock cycle; Step 903, using a dedicated direct memory access controller to move encrypted data in the background, so that the encryption operation process is masked within the data bus transmission delay.

10. The method for encrypted loading and execution of an AI chip model resistant to fault injection according to claim 1, characterized in that, The method also includes a passive blocking response step under abnormal conditions: Step 1001, when the computing unit performs a closed-loop decryption operation, it does not actively compare the checksum of the decryption result, but directly writes the decrypted data into the operation register or cache; Step 1002, it uses the high-entropy noise data generated by the erroneous decryption to cause numerical overflow or a sharp drop in classification confidence of the subsequent convolution or matrix multiplication operation results; Step 1003, it takes this numerical anomaly at the operation level as the final indication that the attack has been blocked, and terminates effective inference without triggering additional interruption signals.

Images