Method and device for measuring credibility of display data, electronic device and program product

Abstract

This invention discloses a trusted measurement method, apparatus, electronic device, and program product for GPU memory data, relating to the fields of artificial intelligence system security and trusted computing technology. The trusted measurement method includes: determining the data object to be measured and obtaining the target measurement strategy and target baseline measurement value corresponding to the data object from a root of trust; generating a measurement instruction based on the target measurement strategy and encrypting the measurement instruction to obtain an encrypted measurement instruction; sending the encrypted measurement instruction to the measurement engine in the graphics processor through a secure measurement channel; receiving the encrypted hash value sent by the measurement engine through a trusted measurement proxy, decrypting the encrypted hash value, and comparing the decrypted hash value with the target baseline measurement value to obtain a trusted measurement result. This invention solves the technical problem in related technologies where real-time trusted measurement of data blocks in specific areas of GPU memory is impossible, reducing data security.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence system security and trusted computing technology, and more specifically, to a method, apparatus, electronic device, and program product for measuring the trustworthiness of video memory data. Background Technology

[0002] The process of a model from deployment to destruction typically involves key stages such as loading, decryption, inference, and unloading. Trusted computing technology and encryption / decryption techniques can protect the static security of the model and ensure the security of the system's operating environment. During the model loading and decryption stage: the model is loaded into CPU (Central Processing Unit) memory and decrypted. Currently, only static data in CPU memory can be measured, and the integrity of model data during transmission to GPU (Graphics Processing Unit) memory cannot be guaranteed. During the model residency and inference stage: core parameters such as model weights and embedding vectors reside in GPU memory in plaintext for extended periods. Current trusted computing capabilities for measuring GPU memory are limited, and existing GPU confidential computing only provides isolation encryption, unable to detect runtime tampering (such as malicious kernel modification of weights). During the model unloading and destruction stage: if residual data is not thoroughly removed when the model is unloaded from GPU memory, it may be stolen by subsequent tasks.

[0003] Inference computation for large models heavily relies on heterogeneous accelerators such as GPUs, which are the key devices for handling core computational tasks. After the model is loaded, its core parameters (weights, embedding vectors, etc.) are transferred from system memory to the GPU's global video memory and remain there throughout the entire inference service cycle. The model's weights, intermediate activation values, and other core data also reside in GPU video memory in plaintext, making them a primary target for attackers.

[0004] Currently, there is an imbalance in the security protection of computing device memory data, with an emphasis on CPU and a neglect of GPU. Current methods mainly focus on: 1. CPU memory encryption and trusted measurement: such as TEE (Trusted Execution Environment) technologies based on static measurements using TPM (Trusted Platform Module) / TCM (Trusted Cryptography Module). Their protection boundary ends at system memory, lacking effective coverage of the GPU's independent address space and computing domain. 2. GPU virtualization and isolation: such as NVIDIA MIG (Multi-Instance GPU) and vGPU (virtual GPU) technologies. These mainly achieve resource isolation and quota management between memory and computing power, falling under the category of resource management. Their security assumptions are based on the absolute trustworthiness of the GPU driver and Hypervisor (Virtual Machine Monitor), lacking the ability to verify the trusted content of the memory data itself. 3. GPU confidential computing: protecting code and data by creating an encrypted secure execution environment within the GPU. However, this technology is essentially a static isolation and encryption scheme. Its core objective is to ensure that data within the GPU is not spied on by the host or other virtual machines, but it cannot answer a crucial security question: whether the data currently being used in the GPU memory has been tampered with. In other words, while this method guarantees data confidentiality, it is difficult to actively verify its integrity. 4. Current trusted computing mainly focuses on the CPU, such as static trust chains based on CPU hardware roots of trust. Their measurement and verification scope stops at CPU memory and firmware, unable to penetrate into the GPU device, resulting in a lack of measurement of the operational status of memory data. This makes attacks such as data tampering and memory injection targeting memory difficult to detect in a timely manner, seriously threatening the security and correctness of model inference.

[0005] There is currently no effective solution to the above problems. Summary of the Invention

[0006] This invention provides a method, apparatus, electronic device, and program product for reliable measurement of video memory data, to at least solve the technical problem in related technologies that it is impossible to perform real-time reliable measurement of data blocks in specific areas of GPU video memory, which reduces data security.

[0007] According to one aspect of the embodiments of this application, a trusted measurement method for video memory data is provided, applied to a measurement system. The measurement system includes a central processing unit (CPU), a secure measurement channel, and a graphics processing unit (GPU). The trusted measurement method for video memory data includes: determining a data object to be measured, and obtaining a target measurement policy corresponding to the data object to be measured and a target baseline measurement value corresponding to the target measurement policy from a trusted root through a trusted measurement agent in the CPU. The trusted root stores multiple measurement policies corresponding to the data objects and baseline measurement values ​​corresponding to the measurement policies. The target measurement policy includes at least: the target address range of the data object to be measured in the GPU's video memory; generating a measurement instruction based on the target measurement policy and encrypting the measurement instruction to obtain an encrypted measurement instruction; sending the encrypted measurement instruction to a measurement engine in the GPU through the secure measurement channel, wherein the measurement engine responds to the encrypted measurement instruction, processes the encrypted measurement instruction to obtain an encrypted hash value, and returns the encrypted hash value to the trusted measurement agent; receiving the encrypted hash value through the trusted measurement agent, decrypting the encrypted hash value to obtain a decrypted hash value, and comparing the decrypted hash value with the target baseline measurement value to obtain a trusted measurement result.

[0008] Furthermore, before obtaining the target measurement policy corresponding to the data object to be measured from the root of trust through the trusted measurement agent in the central processing unit, the process includes: identifying multiple measurement data objects and calculating the hash value of each measurement data object to obtain the baseline measurement value; constructing a measurement policy for each measurement data object and binding the measurement policy with the baseline measurement value; and storing each measurement policy and the corresponding baseline measurement value in the root of trust.

[0009] Furthermore, before sending the encrypted measurement instructions to the measurement engine in the graphics processor through the secure measurement channel, the process includes: verifying the identity credentials of the trusted measurement agent and the measurement engine to obtain the verification result; and constructing the secure measurement channel if the verification result indicates that the identity verification of the trusted measurement agent and the measurement engine is successful.

[0010] Further, the step of encrypting the measurement instruction to obtain the encrypted measurement instruction includes: encrypting the measurement instruction to obtain a first encrypted measurement instruction; calculating the message authentication code of the measurement instruction; and encapsulating the first encrypted measurement instruction and the message authentication code to obtain the encrypted measurement instruction.

[0011] Furthermore, after comparing the decrypted hash value with the target baseline metric value to obtain a trusted metric result, the process further includes: monitoring the environment state of the central processing unit (CPU) and sending the environment state and the trusted metric result to the policy engine, wherein the policy engine controls whether to use the data object to be measured in the graphics processor's memory for inference calculation; if the trusted metric result indicates that the decrypted hash value is the same as the target baseline metric value, and if the CPU's environment state is trusted, then the use of the data object to be measured for inference calculation is allowed; if the trusted metric result indicates that the decrypted hash value is different from the target baseline metric value, and / or if the CPU's environment state is untrusted, then a preset response action is triggered.

[0012] Furthermore, the steps of the measurement engine responding to the encrypted measurement command, processing the encrypted measurement command to obtain an encrypted hash value, and returning the encrypted hash value to the trusted measurement agent include: receiving the encrypted measurement command through the measurement engine of the graphics processor; decrypting the encrypted measurement command to obtain a decrypted measurement command, wherein the decrypted measurement command includes at least: a target address range; accessing the video memory address range corresponding to the target address range through the graphics processor and calculating the hash value of the data in the video memory address range; encrypting the hash value to obtain an encrypted hash value; and returning the encrypted hash value to the trusted measurement agent of the central processing unit through a secure measurement channel.

[0013] Further, the step of encrypting the hash value to obtain the encrypted hash value includes: encrypting the hash value to obtain encrypted data; calculating the message authentication code of the hash value; and encapsulating the encrypted data and the message authentication code to obtain the encrypted hash value.

[0014] According to another aspect of the embodiments of this application, a trusted measurement device for video memory data is also provided, applied to a measurement system. The measurement system includes a central processing unit, a secure measurement channel, and a graphics processing unit. The trusted measurement device for video memory data includes an acquisition unit, configured to determine a data object to be measured, and acquire, through a trusted measurement agent in the central processing unit, a target measurement policy corresponding to the data object to be measured and a target baseline measurement value corresponding to the target measurement policy from a trusted root. The trusted root stores multiple measurement policies corresponding to measurement data objects and baseline measurement values ​​corresponding to the measurement policies. The target measurement policy includes at least: the target value of the data object to be measured in the graphics processing unit's video memory. Address range; encryption unit, used to generate measurement instructions based on the target measurement strategy and encrypt the measurement instructions to obtain encrypted measurement instructions; sending unit, used to send the encrypted measurement instructions to the measurement engine in the graphics processor through the secure measurement channel, wherein the measurement engine responds to the encrypted measurement instructions, processes the encrypted measurement instructions, obtains the encrypted hash value, and returns the encrypted hash value to the trusted measurement agent; comparison unit, used to receive the encrypted hash value through the trusted measurement agent, decrypt the encrypted hash value to obtain the decrypted hash value, compare the decrypted hash value with the target baseline measurement value, and obtain the trusted measurement result.

[0015] Furthermore, the trusted measurement device for video memory data includes: a first calculation module, used to determine multiple measurement data objects and calculate the hash value of each measurement data object to obtain a baseline measurement value before obtaining the target measurement policy corresponding to the data object to be measured from the root of trust through the trusted measurement agent in the central processing unit; a first construction module, used to construct the measurement policy for each measurement data object and bind the measurement policy to the baseline measurement value; and a first storage module, used to store each measurement policy and the baseline measurement value corresponding to the measurement policy to the root of trust.

[0016] Furthermore, the trusted measurement device for video memory data also includes: a first verification module, used to verify the identity credentials of the trusted measurement agent and the measurement engine before sending the encrypted measurement command to the measurement engine in the graphics processor through the secure measurement channel, and obtain the verification result; and a second construction module, used to construct the secure measurement channel when the verification result indicates that the identity verification of the trusted measurement agent and the measurement engine is successful.

[0017] Furthermore, the encryption unit includes: a first encryption module for encrypting the measurement instruction to obtain a first encrypted measurement instruction; a second calculation module for calculating the message authentication code of the measurement instruction; and a first encapsulation module for encapsulating the first encrypted measurement instruction and the message authentication code to obtain an encrypted measurement instruction.

[0018] Furthermore, the trusted measurement device for video memory data also includes: a first monitoring module, used to monitor the environment state of the central processing unit after comparing the decrypted hash value with the target baseline measurement value to obtain a trusted measurement result, and send the environment state and the trusted measurement result to the policy engine, wherein the policy engine is used to control whether to use the data object to be measured in the video memory of the graphics processor for inference calculation; a first processing module, used to allow the data object to be measured to be used for inference calculation when the trusted measurement result indicates that the decrypted hash value is the same as the target baseline measurement value, and when the environment state of the central processing unit is trusted; and a first triggering module, used to trigger a preset response action when the trusted measurement result indicates that the decrypted hash value is different from the target baseline measurement value, and / or when the environment state of the central processing unit is untrusted.

[0019] Furthermore, the sending unit includes: a first receiving module, used to receive the encrypted measurement instruction through the measurement engine of the graphics processor; a first decryption module, used to decrypt the encrypted measurement instruction to obtain the decrypted measurement instruction, wherein the decrypted measurement instruction includes at least: a target address range; a third calculation module, used to access the video memory address range corresponding to the target address range through the graphics processor and calculate the hash value of the data in the video memory address range; a second encryption module, used to encrypt the hash value to obtain the encrypted hash value; and a first return module, used to return the encrypted hash value to the trusted measurement agent of the central processing unit through a secure measurement channel.

[0020] Furthermore, the second encryption module includes: a first encryption submodule for encrypting the hash value to obtain encrypted data; a first calculation submodule for calculating the message authentication code of the hash value; and a first encapsulation submodule for encapsulating the encrypted data and the message authentication code to obtain the encrypted hash value.

[0021] According to another aspect of the embodiments of this application, a computer program product is also provided, including a non-volatile computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor, implements any of the above-mentioned methods for measuring the reliability of video memory data.

[0022] According to another aspect of the embodiments of this application, an electronic device is also provided, including one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by one or more processors, the one or more processors implement any of the above-described methods for measuring the reliability of video memory data.

[0023] In this invention, a data object to be measured is determined, and the target measurement policy corresponding to the data object and the target baseline measurement value corresponding to the target measurement policy are obtained from the root of trust through the trusted measurement agent in the central processing unit. Based on the target measurement policy, a measurement instruction is generated and encrypted to obtain the encrypted measurement instruction. The encrypted measurement instruction is sent to the measurement engine in the graphics processing unit through the secure measurement channel. The encrypted hash value is received by the trusted measurement agent and decrypted to obtain the decrypted hash value. The decrypted hash value is compared with the target baseline measurement value to obtain the trusted measurement result. This solves the technical problem in related technologies that it is impossible to perform real-time trusted measurement of data blocks in specific areas of GPU memory, which reduces data security.

[0024] In this invention, firstly, the GPU memory data object requiring trusted measurement is identified. Then, a trusted measurement agent in the central processing unit (CPU) retrieves the target measurement policy corresponding to this data object and its associated target baseline measurement value from the hardware root of trust. The root of trust stores multiple measurement policies corresponding to measurement data objects and their corresponding baseline measurement values. The target measurement policy includes at least the target address range of the data object to be measured in the GPU memory. Based on the target measurement policy, the trusted measurement agent generates a measurement instruction containing the target address range and algorithm type, encrypts the instruction, and attaches a message authentication code to obtain the encrypted measurement instruction. This encrypted instruction is then sent to the measurement key inside the GPU via a secure measurement channel. The measurement engine receives, decrypts, and verifies the integrity and authenticity of instructions within a protected kernel environment. It then directly accesses the target address range specified in the instructions, performs hash operations on the data within that range, generates corresponding hash values, and encrypts these hash values ​​using the same key. This encrypted hash value is then returned to the trusted measurement agent via the same secure channel. The trusted measurement agent receives the encrypted hash value, decrypts it, and compares it with the target baseline measurement value read from the trusted root to generate a trusted measurement result. This achieves online, fine-grained, low-overhead, and verifiable integrity measurement of specific data regions in GPU memory, improving the security of model parameters. Attached Figure Description

[0025] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this invention, illustrate exemplary embodiments of the invention and are used to explain the invention, but do not constitute an undue limitation of the invention. In the drawings:

[0026] Figure 1 A hardware block diagram of a computer terminal (or mobile device) for implementing a reliable measurement method for video memory data is shown.

[0027] Figure 2 This is a flowchart of a reliable measurement method for video memory data according to Embodiment 1 of this application;

[0028] Figure 3 This is a schematic diagram of a measurement system architecture according to Embodiment 1 of this application;

[0029] Figure 4 This is a schematic diagram of a metric engine architecture according to Embodiment 1 of this application;

[0030] Figure 5 This is a flowchart of a measurement execution and verification process according to Embodiment 1 of this application;

[0031] Figure 6 This is a flowchart of a strategy configuration according to Embodiment 1 of this application;

[0032] Figure 7 This is a flowchart illustrating the establishment of a security measurement channel according to Embodiment 1 of this application;

[0033] Figure 8 This is a flowchart illustrating the linkage between a measurement result and a response action according to Embodiment 1 of this application;

[0034] Figure 9 This is a flowchart illustrating information transmission via a secure measurement channel according to Embodiment 1 of this application;

[0035] Figure 10 This is a schematic diagram of an optional device for measuring the reliability of video memory data according to an embodiment of this application;

[0036] Figure 11 This is a structural block diagram of an electronic device according to an embodiment of this application. Detailed Implementation

[0037] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0038] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0039] It should be noted that all relevant information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, and displayed data) collected and involved in this invention are information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of this data comply with the relevant laws, regulations, and standards of the relevant regions, do not violate public order and good morals, and provide corresponding operation entry points for users to choose to authorize or refuse. For example, this system has an interface with relevant users or organizations. Before obtaining relevant information, a request to obtain the information needs to be sent to the aforementioned user or organization through the interface. After receiving consent from the aforementioned user or organization, the relevant information is obtained. If the user chooses to refuse, the process enters the expert decision-making process.

[0040] Unlike cumbersome solutions that encrypt or isolate all GPU memory, this invention proposes a precise, guided measurement of high-value data objects. By predefining key objects and baselines, it achieves fine-grained, low-overhead online verification. A dedicated GPU-side measurement engine avoids performance interference and security risks associated with conventional measurement paths. Furthermore, by establishing a secure channel independent of the general GPU driver and computation path, it ensures that the measurement instructions themselves are not tampered with and that the measurement results are authentic and reliable, effectively defending against attacks targeting the GPU driver layer and guaranteeing the security of the measurement system itself. It dynamically and verifiably extends the static, CPU-based trust chain to the GPU device's internal structure. When anomalies are detected during measurement, they are transmitted to the control center in real time, triggering an automated closed loop of access permission revocation or task termination, thus evolving memory security from the perception level to the proactive handling level. Through the dynamic and continuous trusted verification cycle of GPU memory, attacks can be detected promptly and linked with upper-layer security policies to improve proactive defense capabilities.

[0041] The present invention will now be described in detail with reference to various embodiments.

[0042] Example 1

[0043] According to an embodiment of this application, an embodiment of a reliable measurement method for video memory data is also provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0044] The method embodiment provided in Embodiment 1 of this application can be executed on a mobile terminal, computer terminal, or similar computing device. Figure 1 A hardware block diagram of a computer terminal (or mobile device) for implementing a reliable measurement method for video memory data is shown. Figure 1 As shown, computer terminal 10 (or mobile device) may include one or more ( Figure 1 The processor 102 (which may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.), a memory 104 for storing data, and a transmission device 106 for communication functions may also be included. In addition, it may include: a display, a keyboard, a cursor control device, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of a BUS bus), a network interface, a power supply, and / or a camera, wherein the network interface can be connected to wired and / or wireless networks. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, computer terminal 10 may also include... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0045] It should be noted that the aforementioned one or more processors 102 and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be embodied, in whole or in part, in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be integrated, in whole or in part, into any other element within the computer terminal 10 (or mobile device). As involved in the embodiments of this application, the data processing circuits serve as a processor control mechanism (e.g., selection of a variable resistor termination path connected to an interface).

[0046] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the video memory data reliability measurement method in this embodiment. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby realizing the aforementioned video memory data reliability measurement method. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0047] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the computer terminal 10. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0048] The display may be, for example, a touchscreen liquid crystal display (LCD) that allows the user to interact with the user interface of the computer terminal 10 (or mobile device).

[0049] Under the aforementioned operating environment, this application provides the following: Figure 2 The method for measuring the reliability of video memory data is shown. Figure 2 This is a flowchart of a reliable measurement method for video memory data according to Embodiment 1 of this application, as follows: Figure 2 As shown, the method includes the following steps:

[0050] Step S201: Determine the data object to be measured, and obtain the target measurement policy corresponding to the data object to be measured and the target baseline measurement value corresponding to the target measurement policy from the trusted root through the trusted measurement agent in the central processing unit. The trusted root stores multiple measurement policies corresponding to the measurement data objects and the baseline measurement values ​​corresponding to the measurement policies. The target measurement policy includes at least the target address range of the data object to be measured in the graphics processor's video memory.

[0051] In this embodiment of the invention, the data object to be measured refers to data that resides in GPU memory in plaintext form for an extended period, such as model weight matrices, embedding vectors, and key tensors in attention mechanisms. The Trusted Measurement Agent is a software-level extension of the Trusted Platform Configuration Module (TPCM). It does not directly access GPU memory but acts as a policy scheduling hub, responsible for coordinating measurement tasks on the GPU side. The Trusted Module is a hardware trusted computing chip with secure storage, cryptographic operations, policy management, and adjudication capabilities; its stored content cannot be tampered with by the operating system or malicious programs.

[0052] In this embodiment of the invention, the trusted measurement agent can trigger a measurement task (i.e., measure the data object to be measured) according to a pre-configured strategy (periodic or event-based). The trusted measurement agent obtains the corresponding target measurement strategy and target baseline measurement value from the root of trust.

[0053] Trustworthy measurement methods for video memory data can be applied to measurement systems, which include: central processing unit (CPU), secure measurement channel, and graphics processing unit (GPU). Figure 3 This is a schematic diagram of a measurement system architecture according to Embodiment 1 of this application, as shown below. Figure 3 As shown, the system includes: a CPU-side trust chain root area, a secure channel (i.e., a secure measurement channel), and a GPU-side measurement execution area. This system architecture allows trust to be transferred from the CPU hardware root of trust (TPCM), through the CPU trusted measurement agent and the secure channel, and ultimately implemented on the GPU-side measurement engine. The GPU-side measurement engine can access key areas of GPU memory and calculate data hash values. Specifically, the CPU side is responsible for control and verification, i.e., policy management, measurement scheduling, and result verification; the GPU side is responsible for execution and computation, i.e., direct access to memory data and hash calculation. The two sides achieve trusted exchange of instructions and data through the secure channel, forming an efficient collaborative measurement architecture and realizing the connection of heterogeneous trust chains.

[0054] Optionally, the core functions of the CPU-side hardware root of trust include: Trusted boot and verification: supporting boot metrics and proactive metrics to ensure the integrity of CPU-side hardware, firmware, operating system, and trusted metrics agent; Trusted keys: providing compliant cryptographic computation capabilities based on the root of trust, supporting multiple key types; Trusted storage: storing baseline metrics, metrics policies (such as data object address ranges, model IDs (Identifiers)), and sensitive files such as keys, certificates, and configuration files in a protected manner based on the root of trust; Policy engine: receiving policies and supporting trusted policy parsing to achieve high-level security requirements through policies. The adjudication and control modules in the policy engine can generate judgment conclusions and trigger control actions based on the metrics results and policy rules; Audit log anchoring: generating immutable audit log roots for all metrics events.

[0055] In this embodiment of the invention, the CPU trusted measurement agent, as an extension agent of the root of trust in the operating system kernel layer, is a high-privilege, protected kernel module. The main functions of the CPU-side trusted measurement agent include: Policy management and scheduling: loading and parsing measurement policies from the TPCM, and triggering measurement tasks according to the policies (periodic or event-based). Acquiring measurement-related information: collecting measurement-related information according to policy requirements. Verification and response: receiving measurement values ​​returned by the GPU, comparing them with baseline values, and triggering predefined security responses (such as alarms, interrupting inference, and reporting to the management center) based on the comparison results (i.e., the trustworthiness results).

[0056] Step S202: Based on the target measurement strategy, generate measurement instructions and encrypt the measurement instructions to obtain encrypted measurement instructions.

[0057] In this embodiment of the invention, a measurement instruction can be constructed based on the target measurement strategy (which may include the target memory address range (i.e., the target address range) and the measurement algorithm. The measurement instruction can also be encrypted to obtain an encrypted measurement instruction.

[0058] Optionally, the measurement command can be encrypted using the SM4 symmetric encryption algorithm to ensure confidentiality. An SM3 hash algorithm can be used as the underlying hash function to construct a Message Authentication Code (MAC). This MAC is appended to the encrypted measurement command to prevent data tampering during transmission. The encrypted measurement command can carry a monotonically increasing sequence number and a timestamp. The sequence number is used to filter duplicate commands, and the timestamp is used to filter commands outside a preset time range. The receiver can verify the sequence number and timestamp to reject duplicate or expired commands.

[0059] Step S203: Send the encrypted measurement command to the measurement engine in the graphics processor through the secure measurement channel. The measurement engine responds to the encrypted measurement command, processes the encrypted measurement command, obtains the encrypted hash value, and returns the encrypted hash value to the trusted measurement agent.

[0060] Optionally, the encrypted measurement command is sent to the GPU-side measurement engine through a secure measurement channel. After receiving and verifying the measurement command, the GPU measurement engine directly accesses the physical address of the video memory specified by the measurement command (i.e., the address of the data object to be measured in the graphics processor's video memory), reads the original data in that area, and calls the built-in hash calculation unit to generate the measurement value (i.e., hash value) of the current data snapshot. The measurement value can be encrypted to obtain the encrypted measurement value (i.e., the encrypted hash value), and the encrypted hash value is returned to the trusted measurement agent.

[0061] The GPU metrics engine is integrated into the GPU driver stack as a kernel-mode module. It is a high-privilege, protected kernel-mode module and a key execution entity that extends the trust chain into the GPU's interior. A separate functional module can be added as the GPU metrics engine to the core layer of the GPU driver (such as the kernel-mode driver in CUDA (Compute Unified Device Architecture) drivers, or the KMD (Kernel Mode Driver) portion of AMD ROCm (AMD Open Compute Platform) drivers). This module runs alongside the driver's existing memory management, command scheduling, and interrupt handling subsystems, but with a higher level of security isolation. During the GPU driver initialization phase, it is dynamically loaded and initialized by the driver loader, ensuring that the metrics engine is ready before user-mode applications (such as the CUDA runtime) access the GPU. This module runs at the highest privilege level of the CPU (i.e., Ring 0) or a protected execution environment supported by the GPU hardware (such as the GPU's microcontroller firmware layer), ensuring that its execution context is not interfered with by user-mode programs.

[0062] Figure 4 This is a schematic diagram of a metric engine architecture according to Embodiment 1 of this application, as shown below. Figure 4As shown, the GPU metrics engine includes: an instruction parsing and verification module, a memory access controller, a hash calculation unit, and a result encapsulation and transmission unit. The instruction parsing and verification module receives instructions from the CPU-side trusted metrics agent sent via the secure metrics channel. This module first decrypts and verifies the integrity of the instructions. Integrity verification verifies whether the instructions have been tampered with. After successful verification (i.e., the instructions have not been tampered with), the module parses the instruction content, including the target memory address range, hash algorithm type (such as SM3), task ID, etc. The memory access controller can directly access the physical address of the GPU memory based on the address information in the instructions. The hash calculation unit supports hash algorithms such as SM3 and SHA-256 (Secure Hash Algorithm 256-bit). It can be implemented in software or utilize the GPU's built-in hardware acceleration units to perform calculations. This hash calculation unit processes large blocks of data in a pipelined manner, minimizing the consumption of memory bandwidth. The result encapsulation and sending unit encapsulates the calculated metric value (hash digest) into a response message, encrypts it, and returns it to the trusted agent on the CPU side through the secure metric channel.

[0063] Optionally, the encrypted instructions sent to the GPU metric engine can be encrypted using the SM4 symmetric encryption algorithm and carry a MAC (Message Authentication Code). The integrity verification steps can include: decrypting the instructions with the SM4 key to obtain the original plaintext instructions, recalculating the MAC for the original plaintext instructions, comparing the calculated MAC with the received MAC, and if they match, it indicates that the instructions are complete and have not been tampered with; if they do not match, it indicates that the instructions have been tampered with.

[0064] Step S204: Receive the encrypted hash value through the trusted measurement agent, decrypt the encrypted hash value to obtain the decrypted hash value, compare the decrypted hash value with the target baseline measurement value to obtain the trusted measurement result.

[0065] In this embodiment of the invention, after receiving the returned result (i.e., the encrypted hash value), the CPU trusted measurement agent decrypts the encrypted hash value to obtain the decrypted hash value, and compares it with the target baseline measurement value obtained from the root of trust to obtain the verification result (i.e., the trusted measurement result). If the target baseline measurement value is the same as the decrypted hash value, it is considered that the integrity of the critical data object in the GPU memory has not been compromised, and the CPU trusted agent can record a successful measurement event and send this result to the upper-layer policy engine (access control engine or security policy engine). If they are different, it is immediately determined that a data tampering or memory injection attack has occurred, the CPU trusted agent triggers a high-risk alarm, and executes strong response actions according to the preset policy, such as: immediately terminating the ongoing GPU inference task, sending an alarm to the system security operations center, isolating the affected GPU computing instance, and revoking access permissions.

[0066] Figure 5 This is a flowchart of a measurement execution and verification process according to Embodiment 1 of this application, as follows: Figure 5 As shown, during the dynamic measurement execution and verification phase, the CPU trusted agent triggers the measurement task according to the policy and obtains the corresponding measurement policy (i.e., the target measurement policy corresponding to the data object to be measured) from the root of trust. It then constructs a measurement instruction, encrypts it, and sends the encrypted instruction through a secure channel. The GPU measurement engine receives, decrypts, and verifies the instruction. If verification is successful (i.e., the instruction has not been tampered with), the GPU measurement engine executes the decrypted measurement instruction, performs hash calculations on the data within the target address range, and encrypts the measurement value (i.e., the hash value) to obtain the encrypted hash value. This encrypted hash value is then returned through a secure channel. The CPU trusted agent receives and decrypts the returned value to obtain the decrypted hash value. This decrypted hash value is compared with the baseline measurement value obtained from the root of trust (i.e., the target baseline measurement value corresponding to the target measurement policy) to obtain the trusted measurement result. Whether the verification is successful (i.e., the target baseline measurement value is the same as the decrypted hash value) or fails (i.e., the target baseline measurement value is different from the decrypted hash value), the corresponding event is recorded and returned to the policy engine. The policy engine then handles the issue according to the pre-defined policy.

[0067] In summary, the system, based on the measurement strategy and baseline hash value of the trusted root of trust (TPCM) secure storage, generates encrypted measurement instructions by the CPU trusted agent. These instructions are transmitted to the protected measurement engine within the GPU via a dedicated secure channel. After decrypting and verifying the integrity of the instructions, the engine directly accesses the specified video memory address area, performs hash calculations on the data therein, encrypts it, and sends the encryption result back. The CPU decrypts and compares the results to determine in real time whether the video memory data has been tampered with. This triggers proactive responses such as task termination and permission revocation by the policy engine. By constructing a collaborative system architecture of CPU hardware trusted root of trust (TPCM), trusted measurement agent, secure measurement channel, and GPU measurement engine, the trust chain is extended from the CPU to the GPU video memory. This enables proactive, dynamic, and fine-grained integrity verification of key model data in the GPU video memory, thereby solving the technical problem in related technologies where real-time trusted measurement of data blocks in specific areas of GPU video memory is impossible, which reduces data security.

[0068] In order to accurately store each measurement strategy and its corresponding baseline measurement value to the root of trust, the trusted measurement method for video memory data provided in Embodiment 1 of this application determines multiple measurement data objects and calculates the hash value of each measurement data object to obtain the baseline measurement value; constructs a measurement strategy for each measurement data object and binds the measurement strategy to the baseline measurement value; and stores each measurement strategy and its corresponding baseline measurement value to the root of trust.

[0069] In this embodiment of the invention, before model deployment, key data objects to be measured can be defined according to the model's structure and security requirements. These objects can be the weights of the entire model, specific network layer parameters, key tensors in the attention mechanism, or user-defined sensitive knowledge base vectors, etc. In a trusted environment (such as when training is complete), the initial hash value of the defined key data objects is calculated as a baseline metric. Based on this baseline metric, the memory address mapping information (starting address, size) of the data objects, the unique identifier of the model (Model ID), the unique identifier of the task (Task ID), as well as the measurement frequency, triggering conditions, etc., a measurement strategy is generated. The generated measurement strategy and its corresponding baseline value are bound together and securely stored in the CPU hardware root of trust to ensure that they cannot be tampered with.

[0070] Figure 6 This is a flowchart of a strategy configuration according to Embodiment 1 of this application, such as... Figure 6As shown, in the strategy configuration phase, key data objects are first defined, then the baseline metric value of the data object is calculated (i.e., the baseline metric value is generated). Then, based on the baseline metric value, the memory address mapping information of the data object (starting address, size), the unique identifier of the model to which it belongs (Model ID), the unique identifier of the task (Task ID), as well as the metric frequency, triggering conditions, etc., a metric strategy is generated, and the metric strategy and the baseline metric value are stored in the root of trust.

[0071] In order to accurately construct a secure measurement channel, in the trusted measurement method for video memory data provided in Embodiment 1 of this application, the identity credentials of the trusted measurement agent and the measurement engine are verified to obtain the verification result; if the verification result indicates that the identity verification of the trusted measurement agent and the measurement engine is successful, a secure measurement channel is constructed.

[0072] In this embodiment of the invention, the secure measurement channel is a dedicated, authenticated communication link established between the CPU trusted agent and the GPU measurement engine. It is the core infrastructure for realizing the issuance of trusted instructions across devices and the return of measurement results.

[0073] Optionally, this channel can utilize existing hardware interconnect channels with basic security attributes (such as PCIe (Peripheral Component Interconnect Express, a high-speed serial bus standard)) and enhance them with upper-layer cryptographic protocols. For example, based on the PCIe hardware channel, combined with TLS (Transport Layer Security), DTLS (Datagram Transport Layer Security), or SM (ShangMi, a collective term for commercial cryptographic algorithms) series cryptographic protocols, an end-to-end encryption and authentication mechanism can be established. This channel is independent of conventional GPU computing data paths (such as the command submission channel used by CUDA drivers), avoiding mixing with ordinary business traffic, thereby reducing the risk of side-channel attacks and ensuring the real-time performance and reliability of measurement operations.

[0074] The secure measurement channel can adopt a layered design, from top to bottom, including: Application layer protocol: Defines the format of measurement commands and responses, including fields such as command type, task ID, address range, algorithm identifier, and timestamp. Security layer protocol: Employs standard or secure protocols, such as TLS 1.3, DTLS, or SSL (Secure Sockets Layer, based on SM2, SM3, SM4), providing encryption, integrity verification, and two-way authentication. Transport layer: Based on PCIe vendor-defined messages (VDM) or dedicated DMA queues (Direct Memory Access Queues), enabling reliable data transmission. Physical layer: PCIe hardware link, supporting Gen3 / Gen4 / Gen5 standards (three consecutive evolutions of the PCIe bus standard). The security layer and transport layer are encapsulated through a lightweight adapter layer to ensure efficient transmission of secure protocol data units via PCIe VDM.

[0075] Before a channel is established, both communicating parties must complete identity authentication to ensure endpoint trustworthiness. The credentials (such as certificates or identity identifiers) of the CPU-side trusted measurement agent are securely stored in the trusted storage area of ​​the CPU Hardware Trusted Root (TPCM). The credentials of the GPU-side measurement engine are measured and injected by the TPCM during driver loading and stored in the GPU's secure non-volatile memory. Cryptographic operations such as certificate signing verification and key generation are all performed internally within the TPCM, ensuring that the private key is never exposed. Figure 7 This is a flowchart of a security measurement channel establishment according to Embodiment 1 of this application, as follows: Figure 7As shown, the authentication process is as follows: During the initialization phase, the CPU trusted proxy (i.e., the CPU-side trusted measurement proxy) loads its own credentials from the TPCM. The CPU trusted proxy further obtains the trust anchor (such as the root certificate) of the TPCM for the GPU measurement engine credentials. During driver initialization, the GPU measurement engine loads credentials from secure non-volatile memory and waits for authentication requests. During the handshake phase, the CPU trusted proxy sends a handshake request to the GPU measurement engine. The two parties exchange credentials (i.e., certificates / identity identifiers) and perform bidirectional certificate verification. That is, the CPU trusted proxy calls the trust anchor in the TPCM to verify the engine credentials (completed within the TPCM). The engine verifies the proxy credentials through the verification logic embedded in the driver. After successful verification, the two parties perform key exchange and generate a session key. At this point, the secure measurement channel is successfully built, and the two parties can conduct a session through this secure measurement channel. That is, during the channel-ready phase, all measurement communication is transmitted through this secure measurement channel (i.e., encrypted communication begins). After a secure channel is established, the system can continuously monitor the channel status and decide whether to maintain the connection, rebuild the connection, or disconnect completely (i.e., maintenance and disconnection judgment). When the connection is maintained, the session key is updated periodically or triggered based on the number of measurement tasks. The update process does not interrupt the current measurement task. When the connection is disconnected, a disconnection detection is performed. If system hibernation or GPU reset is detected, the channel needs to be rebuilt. At this time, the handshake phase needs to be returned to and the connection re-established.

[0076] By constructing a secure measurement channel, strong authentication and a trusted communication channel are established across heterogeneous devices (CPU-GPU). Only legitimate agents certified by TPCM can communicate with the measurement engine, and no malicious user-space program can impersonate or access this channel.

[0077] To ensure that measurement communication is not interfered with by other GPU communications, it can be separated from regular business traffic. The GPU measurement engine registers an independent PCIe endpoint, physically isolated from CUDA kernel, DMA transfer, and other business traffic via a dedicated virtual channel, avoiding congestion and side-channel leakage. When the measurement engine accesses video memory, it uses a dedicated DMA engine or memory copy unit, whose address translation and permission checks are isolated from the CUDA kernel, preventing malicious kernels from unauthorized access via DMA. When a measurement task completes, it notifies the CPU via an independent interrupt vector or MSI-X queue (Message Signaled Interrupts-Extended Queue), avoiding confusion with business interrupts and ensuring real-time measurement response.

[0078] To improve the security of measurement instructions, in the trusted measurement method for video memory data provided in Embodiment 1 of this application, the measurement instructions are encrypted to obtain a first encrypted measurement instruction; the message authentication code of the measurement instruction is calculated; and the first encrypted measurement instruction and the message authentication code are encapsulated to obtain an encrypted measurement instruction.

[0079] Optionally, the measurement instruction is a structured command generated by the CPU trusted measurement agent according to the policy, used to instruct the GPU to perform data measurement. For example, performing hash calculation using the SM3 algorithm on the GPU memory address range [0x8000_0000, x8000_1FFF] (corresponding to the weight of the 12th layer of the 01 model), with the task ID being Task-20260405-01 and the timestamp being 2026-04-05T10:00:00Z.

[0080] In this embodiment of the invention, encryption refers to using the SM4 symmetric encryption algorithm to encrypt the plaintext instruction with the session key negotiated through the secure measurement channel, outputting a first encrypted measurement instruction. The message authentication code is a fixed-length digital digest generated using the SM3 hash algorithm based on the original measurement instruction (unencrypted) and the same session key, used to verify whether the instruction has been tampered with. The encrypted instruction (first encrypted measurement instruction) and the corresponding message authentication code can be merged into a structured message, i.e., the encrypted measurement instruction. The encrypted measurement instruction can also carry a sequence number and a timestamp to prevent replay attacks. The session key exists only within the TPCM and GPU secure areas; no key traces are left in the CPU main memory and GPU video memory, so even if the system is compromised, the key cannot be extracted.

[0081] To achieve a closed-loop protection mechanism that links measurement awareness to response actions, the trusted measurement method for video memory data provided in Embodiment 1 of this application monitors the environment state of the central processing unit (CPU) and sends the environment state and trusted measurement results to the policy engine. The policy engine controls whether to use the data object to be measured in the graphics processor's video memory for inference calculations. If the trusted measurement result indicates that the decrypted hash value is the same as the target baseline measurement value, and the CPU's environment state is trusted, then the data object to be measured is allowed to be used for inference calculations. If the trusted measurement result indicates that the decrypted hash value is different from the target baseline measurement value, and / or the CPU's environment state is untrusted, then a preset response action is triggered.

[0082] In this embodiment of the invention, after each measurement of a critical region of GPU memory is completed and the CPU trusted proxy receives and decrypts the measurement result, the measurement result (success / failure) and associated metadata (e.g., timestamp, model ID, abnormal address range, etc.) are encapsulated into a trusted event. This event is sent to the upper-layer policy engine (such as the admission controller of Kubernetes (an orchestration and scheduling engine responsible for managing the lifecycle of model services) or the authorization policy of Istio (an open platform for service governance). The policy engine maintains two states: "CPU environment trusted" and "GPU data intact." Only when both are true (i.e., the trusted measurement result indicates that the decrypted hash value is the same as the target baseline measurement value, and the CPU environment is in a trusted state), is the model (the data object to be measured) allowed to perform inference computation. The CPU environment trusted state is continuously maintained by the TPCM's startup and runtime measurements, while GPU data integrity is dynamically updated by the periodic or triggered measurement results of the GPU measurement engine.

[0083] Once the GPU metric result changes from consistent to inconsistent (i.e., the decrypted hash value changes from being the same as the target baseline metric value to being different), the policy engine immediately sets the "GPU data integrity" status to false and triggers a preset response action (i.e., a predefined response action). Examples include: immediately terminating the ongoing GPU inference task, sending an alert to the system security operations center, isolating the affected GPU compute instance, and revoking access permissions. All response actions are logged by TPCM for audit purposes and subsequent traceability.

[0084] Figure 8 This is a flowchart illustrating the linkage between a measurement result and a response action according to Embodiment 1 of this application, as follows: Figure 8 As shown, measurement events are recorded. During the audit and policy linkage phase, regardless of whether the measurement is successful or not (i.e., whether the decrypted hash value is the same as the target baseline measurement value), each measurement result (including timestamp, object ID, and measurement result) is recorded to TPCM. TPCM signs the log to form a tamper-proof trusted audit log, providing a credible basis for post-event evidence collection. The measurement results are synchronized to the policy engine in the system in real time and handled according to the pre-set policies. For example, if a measurement fails, the permission downgrade of the data object to be measured can be triggered immediately, realizing a closed loop from passive detection to proactive defense.

[0085] To securely perform proactive integrity verification of video memory data, the trusted measurement method for video memory data provided in Embodiment 1 of this application receives encrypted measurement instructions through the measurement engine of the graphics processor; decrypts the encrypted measurement instructions to obtain decrypted measurement instructions, wherein the decrypted measurement instructions include at least: a target address range; accesses the video memory address interval corresponding to the target address range through the graphics processor and calculates the hash value of the data in the video memory address interval; encrypts the hash value to obtain an encrypted hash value; and returns the encrypted hash value to the trusted measurement agent of the central processing unit through a secure measurement channel.

[0086] In this embodiment of the invention, the GPU metrics engine can directly access video memory, possessing the ability to directly read specified physical or virtual video memory addresses, bypassing the conventional computing kernel (CUDA kernel) data path that could be hijacked by attackers. It receives and decrypts encrypted metrics instructions from the CPU side. After decryption, it performs efficient hash operations (such as SM3, SHA-256, etc.) on the specified video memory address range, generating a digest value (i.e., hash value) of the data snapshot. The hash value is then encrypted to obtain the encrypted hash value, which is returned to the trusted metrics agent of the central processing unit for trusted verification through a secure metrics channel. The GPU metrics engine supports multi-task concurrent metrics, ensuring minimal performance overhead.

[0087] To ensure the measurement engine itself is not tampered with or bypassed, its code segments and critical data structures are measured by the CPU hardware root of trust during loading and undergo periodic self-verification. Any unintended modifications will trigger self-destruction or an alarm mechanism. Leveraging the hardware isolation features of the GPU (such as secure regions in GPU confidential computing mode), the measurement engine runs in an independent, protected context, physically isolating it from regular GPU kernels (such as CUDA kernels) and preventing malicious kernels from attacking the measurement engine through side-channel or memory access vulnerabilities. The measurement engine does not expose any standard user-mode APIs (Application Programming Interfaces), such as ioctl (i.e., I / O control). Its communication entry points interact with the CPU-side trusted proxy only through hardware-level secure channels (such as PCIe vendor-defined messages or dedicated mailboxes (a hardware communication mechanism embedded in the chip)), completely blocking direct call paths from ordinary user-mode programs.

[0088] The metric engine collaborates with other modules of the GPU driver, but maintains minimal dependencies. It obtains the physical mapping of a specified virtual address through a controlled interface with the driver's memory management module. This interface is restricted to the metric engine and subject to strict permission checks. Upon completion of a metric task, the CPU can be notified via the driver's interrupt mechanism. However, to reduce latency, the metric engine can use polling or a dedicated completion queue to return results. The metric engine can employ an asynchronous processing model, allowing multiple metric tasks to execute concurrently. It also supports cached measurements of frequently accessed memory regions (such as model weights) to avoid redundant reads. Through these steps, the GPU metric engine achieves direct, efficient, and secure access to GPU memory data, providing a reliable technical foundation for subsequent integrity measurements.

[0089] To improve the security of data transmission, in the trusted measurement method for video memory data provided in Embodiment 1 of this application, the hash value is encrypted to obtain encrypted data; the message authentication code of the hash value is calculated; and the encrypted data and the message authentication code are encapsulated to obtain the encrypted hash value.

[0090] Similar to the CPU side, before transmitting data through the secure metric channel, the hash value is encrypted using the SM4 symmetric encryption algorithm to ensure confidentiality. A message authentication code (MAC) is then added to the encrypted data to prevent data from being tampered with during transmission, resulting in the encrypted hash value.

[0091] Figure 9 This is a flowchart illustrating information transmission via a secure measurement channel according to Embodiment 1 of this application, as follows: Figure 9 As shown, the CPU trusted agent encapsulates the measurement instructions (i.e., generates measurement instructions based on the target measurement strategy) and performs security processing, such as SM4 encryption + SM3 MAC + serial number + timestamp. It then reliably transmits the encrypted measurement instructions (i.e., transport layer encapsulation) through a custom communication design mechanism (VDM) or an independent DMA queue. The encrypted measurement instructions are sent to the GPU measurement engine via a secure channel. The GPU measurement engine receives, decrypts, and verifies the instructions (determining if the instructions have been tampered with). If verification fails, it follows a pre-defined strategy. If verification succeeds, it executes the measurement task based on the decrypted measurement instructions (relying on an isolated environment and dedicated DMA), and encapsulates and sends the measurement results back (SM4 encryption + SM3 MAC + serial number + timestamp). This is then sent to the CPU trusted agent via a secure channel. The CPU trusted agent receives, decrypts, and verifies the results. If verification fails, it follows a pre-defined strategy. If verification succeeds, it compares the decrypted hash value with the baseline value obtained from the trusted root (i.e., trusted verification) to obtain the trusted measurement result.

[0092] The trusted measurement method for GPU memory data provided in this application can achieve highly trusted integrity verification of key model data in GPU memory by using the CPU hardware root of trust (TPCM) as a trust anchor point and combining the GPU kernel-mode isolation environment and dedicated DMA channel. The policy engine jointly verifies the CPU environment state and GPU memory measurement results, and only allows the model to perform inference when both factors are trusted, thus realizing a closed-loop defense from passive isolation to active immunity.

[0093] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0094] The following describes in detail another optional implementation method.

[0095] During model deployment, the CPU trusted agent registers the model's lifecycle events (such as model loading completion, first inference request, periodic metric thresholds, unload instructions, etc.) with the TPCM and binds a predefined response strategy to each event. The metric strategy is strongly bound to the model ID and inference task ID, ensuring that the metric results can be accurately mapped to the specific business context.

[0096] The CPU trusted agent triggers measurement tasks according to policies (such as periodicity, event-triggered, etc.) and sends encrypted measurement instructions to the GPU measurement engine through a secure channel. The GPU measurement engine verifies and decrypts the instructions. After successful verification, it directly accesses the specified video memory area, performs hash calculations, and returns the encrypted measurement results to the CPU trusted agent.

[0097] After each measurement of critical regions of GPU memory is completed, the CPU trusted agent receives the measurement result, decrypts and verifies it, and encapsulates the measurement result (success / failure) and associated metadata (timestamp, model ID, abnormal address range) into a trusted event. This event is sent to the policy engine (such as Kubernetes' admission controller or Istio's authorization policy). The policy engine maintains two states: "CPU environment trusted" and "GPU data intact." The model is only allowed to perform inference computation when both are true. "CPU environment trusted" is continuously maintained by TPCM's startup and runtime measurements, while "GPU data intact" is dynamically updated by the periodic or triggered measurement results of the GPU measurement engine.

[0098] Once the GPU metric result changes from "consistent" to "inconsistent," the policy engine immediately sets the "GPU data integrity" status to false and triggers predefined response actions. These actions may include immediately terminating ongoing GPU inference tasks, sending alerts to the system security operations center, isolating affected GPU compute instances, and revoking access permissions. All response actions are logged by TPCM for audit purposes and subsequent traceability.

[0099] During the model loading phase: After the model is transferred from CPU memory to GPU memory, the integrity of the data is verified through an initial trigger-based metric to ensure that it has not been tampered with or injected during the transfer. If the metric is abnormal, the loading process is terminated to prevent a corrupted model from entering the service state, thus ensuring the integrity of the model data during the transfer to GPU memory.

[0100] During the model residency and inference phases: While the model resides in GPU memory, the integrity of key data regions (such as weights and embedding vectors) is continuously monitored through periodic or event-triggered dynamic metrics. Upon detecting an anomaly, the inference task is immediately halted and a response is triggered, providing real-time protection against attacks such as memory injection and malicious kernel tampering.

[0101] During the model unloading phase: After the model service terminates, an unloading command is issued. During the unloading process, the GPU metrics engine or driver actively performs a safe cleanup operation (such as overwriting or zeroing) on ​​the corresponding data area in the video memory to ensure that the residual data is physically unrecoverable. Subsequent tasks have no right to access the released video memory area to prevent data leakage.

[0102] By incorporating the integrity protection of GPU memory data into the entire lifecycle management of the model, continuous and reliable monitoring of the model throughout its lifecycle is achieved. Measurement results are no longer isolated alarm signals, but are deeply integrated with business logic, automatically triggering precise responses such as access control adjustments and task termination, greatly improving defense efficiency and realizing a business-aware security closed loop.

[0103] Example 2

[0104] This application also provides a device for measuring the reliability of video memory data. It should be noted that this device can be used to execute the method for measuring the reliability of video memory data provided in this application. The following describes the device for measuring the reliability of video memory data provided in this application.

[0105] According to an embodiment of this application, an apparatus for implementing the above-described method for measuring the reliability of video memory data is also provided. Figure 10 This is a schematic diagram of an optional device for measuring the reliability of video memory data according to an embodiment of this application, as shown below. Figure 10As shown, the device for measuring the reliability of video memory data may include: an acquisition unit 100, an encryption unit 101, a sending unit 102, and a comparison unit 103.

[0106] The acquisition unit 100 is used to determine the data object to be measured and to obtain the target measurement policy and the target baseline measurement value corresponding to the target measurement policy from the root of trust through the trusted measurement agent in the central processing unit. The root of trust stores multiple measurement policies and baseline measurement values ​​corresponding to the measurement policies for multiple data objects. The target measurement policy includes at least the target address range of the data object to be measured in the graphics processor memory.

[0107] The encryption unit 101 is used to generate a measurement instruction based on the target measurement strategy and encrypt the measurement instruction to obtain the encrypted measurement instruction.

[0108] The sending unit 102 is used to send an encrypted measurement command to the measurement engine in the graphics processor through a secure measurement channel. The measurement engine responds to the encrypted measurement command, processes the encrypted measurement command, obtains an encrypted hash value, and returns the encrypted hash value to the trusted measurement agent.

[0109] The comparison unit 103 is used to receive the encrypted hash value through the trusted measurement agent, decrypt the encrypted hash value to obtain the decrypted hash value, compare the decrypted hash value with the target baseline measurement value, and obtain the trusted measurement result.

[0110] The trusted measurement device for video memory data provided in this application embodiment can determine the data object to be measured through the acquisition unit 100, and obtain the target measurement policy corresponding to the data object to be measured and the target baseline measurement value corresponding to the target measurement policy from the trusted root through the trusted measurement agent in the central processing unit. It can generate a measurement instruction based on the target measurement policy through the encryption unit 101, and encrypt the measurement instruction to obtain the encrypted measurement instruction. It can send the encrypted measurement instruction to the measurement engine in the graphics processor through the sending unit 102 through the secure measurement channel. It can receive the encrypted hash value through the trusted measurement agent through the comparison unit 103, and decrypt the encrypted hash value to obtain the decrypted hash value. It compares the decrypted hash value with the target baseline measurement value to obtain the trusted measurement result.

[0111] Optionally, the trusted measurement device for video memory data includes: a first calculation module, used to determine multiple measurement data objects and calculate the hash value of each measurement data object to obtain a baseline measurement value before obtaining the target measurement policy corresponding to the data object to be measured from the root of trust through the trusted measurement agent in the central processing unit; a first construction module, used to construct the measurement policy for each measurement data object and bind the measurement policy to the baseline measurement value; and a first storage module, used to store each measurement policy and the baseline measurement value corresponding to the measurement policy to the root of trust.

[0112] Optionally, the trusted measurement device for video memory data further includes: a first verification module, used to verify the identity credentials of the trusted measurement agent and the measurement engine before sending the encrypted measurement command to the measurement engine in the graphics processor through the secure measurement channel, and obtain the verification result; and a second construction module, used to construct the secure measurement channel when the verification result indicates that the identity verification of the trusted measurement agent and the measurement engine is successful.

[0113] Optionally, the encryption unit 101 includes: a first encryption module for encrypting the measurement instruction to obtain a first encrypted measurement instruction; a second calculation module for calculating the message authentication code of the measurement instruction; and a first encapsulation module for encapsulating the first encrypted measurement instruction and the message authentication code to obtain an encrypted measurement instruction.

[0114] Optionally, the trusted measurement device for video memory data further includes: a first monitoring module, used to monitor the environment state of the central processing unit after comparing the decrypted hash value with the target baseline measurement value to obtain a trusted measurement result, and send the environment state and the trusted measurement result to the policy engine, wherein the policy engine is used to control whether to use the data object to be measured in the video memory of the graphics processor for inference calculation; a first processing module, used to allow the data object to be measured to be used for inference calculation when the trusted measurement result indicates that the decrypted hash value is the same as the target baseline measurement value, and when the environment state of the central processing unit is trusted; and a first triggering module, used to trigger a preset response action when the trusted measurement result indicates that the decrypted hash value is different from the target baseline measurement value, and / or when the environment state of the central processing unit is untrusted.

[0115] Optionally, the sending unit 102 includes: a first receiving module, configured to receive an encrypted measurement instruction through the measurement engine of the graphics processor; a first decryption module, configured to decrypt the encrypted measurement instruction to obtain a decrypted measurement instruction, wherein the decrypted measurement instruction includes at least a target address range; a third calculation module, configured to access the video memory address range corresponding to the target address range through the graphics processor and calculate the hash value of the data in the video memory address range; a second encryption module, configured to encrypt the hash value to obtain an encrypted hash value; and a first return module, configured to return the encrypted hash value to the trusted measurement agent of the central processing unit through a secure measurement channel.

[0116] Optionally, the second encryption module includes: a first encryption submodule for encrypting the hash value to obtain encrypted data; a first calculation submodule for calculating the message authentication code of the hash value; and a first encapsulation submodule for encapsulating the encrypted data and the message authentication code to obtain the encrypted hash value.

[0117] The aforementioned device for measuring the reliability of video memory data may also include a processor and a memory. The aforementioned acquisition unit 100, encryption unit 101, sending unit 102, comparison unit 103, etc., are all stored in the memory as program units, and the processor executes the aforementioned program units stored in the memory to realize the corresponding functions.

[0118] The aforementioned processor contains a kernel, which retrieves the corresponding program unit from memory. One or more kernels can be configured. By adjusting kernel parameters, the kernel receives encrypted hash values ​​through a trusted measurement agent, decrypts the encrypted hash values, obtains the decrypted hash values, and compares these decrypted hash values ​​with the target baseline measurement value to obtain the trusted measurement result.

[0119] The aforementioned memory may include non-permanent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0120] It should be noted that the acquisition unit 100, encryption unit 101, sending unit 102, and comparison unit 103 mentioned above correspond to steps S201 to S204 in Embodiment 1. The instances and application scenarios implemented by the above units and corresponding steps are the same, but are not limited to the content disclosed in Embodiment 1. It should be noted that the above units can be hardware or software components stored in memory (e.g., memory 104) and processed by one or more processors (e.g., processors 102a, 102b, ..., 102n). The above units can also be part of a device and run in the computer terminal 10 provided in Embodiment 1.

[0121] Example 3

[0122] Embodiments of this application may provide a computer terminal, which may be any computer terminal device in a group of computer terminals. Optionally, in this embodiment, the aforementioned computer terminal may also be replaced with a mobile terminal or an electronic device, etc.

[0123] Optionally, in this embodiment, the computer terminal may be located in at least one of a plurality of network devices in a computer network.

[0124] In this embodiment, the computer terminal described above can execute the program code for the following steps in the trusted measurement method for graphics memory data: determining the data object to be measured, and obtaining the target measurement policy corresponding to the data object to be measured and the target baseline measurement value corresponding to the target measurement policy from the root of trust through the trusted measurement agent in the central processing unit, wherein the root of trust stores multiple measurement policies corresponding to measurement data objects and baseline measurement values ​​corresponding to measurement policies, and the target measurement policy includes at least: the target address range of the data object to be measured in the graphics processor's video memory; generating a measurement instruction based on the target measurement policy, and encrypting the measurement instruction to obtain an encrypted measurement instruction; sending the encrypted measurement instruction to the measurement engine in the graphics processor through a secure measurement channel, wherein the measurement engine responds to the encrypted measurement instruction, processes the encrypted measurement instruction, obtains an encrypted hash value, and returns the encrypted hash value to the trusted measurement agent; receiving the encrypted hash value through the trusted measurement agent, decrypting the encrypted hash value to obtain a decrypted hash value, and comparing the decrypted hash value with the target baseline measurement value to obtain a trusted measurement result.

[0125] Optionally, the aforementioned computer terminal can execute the program code for the following steps in the trusted measurement method for video memory data: determining multiple measurement data objects and calculating the hash value of each measurement data object to obtain a baseline measurement value; constructing a measurement policy for each measurement data object and binding the measurement policy with the baseline measurement value; and storing each measurement policy and the corresponding baseline measurement value to the root of trust.

[0126] Optionally, the aforementioned computer terminal can execute program code for the following steps in the trusted measurement method for video memory data: verifying the identity credentials of the trusted measurement agent and the measurement engine to obtain the verification result; and constructing a secure measurement channel if the verification result indicates that the identity verification of the trusted measurement agent and the measurement engine is successful.

[0127] Optionally, the aforementioned computer terminal can execute the program code for the following steps in the trusted measurement method for video memory data: encrypting the measurement instruction to obtain a first encrypted measurement instruction; calculating the message authentication code of the measurement instruction; and encapsulating the first encrypted measurement instruction and the message authentication code to obtain an encrypted measurement instruction.

[0128] Optionally, the aforementioned computer terminal can execute program code for the following steps in the trusted measurement method for graphics memory data: monitoring the environment state of the central processing unit (CPU) and sending the environment state and trusted measurement results to the policy engine, wherein the policy engine is used to control whether to use the data object to be measured in the graphics processor's memory for inference calculation; allowing the data object to be measured to be used for inference calculation when the trusted measurement result indicates that the decrypted hash value is the same as the target baseline measurement value, and when the CPU's environment state is trusted; triggering a preset response action when the trusted measurement result indicates that the decrypted hash value is different from the target baseline measurement value, and / or when the CPU's environment state is untrusted.

[0129] Optionally, the aforementioned computer terminal can execute the program code for the following steps in the trusted measurement method for video memory data: receiving an encrypted measurement instruction through the measurement engine of the graphics processor; decrypting the encrypted measurement instruction to obtain a decrypted measurement instruction, wherein the decrypted measurement instruction includes at least: a target address range; accessing the video memory address interval corresponding to the target address range through the graphics processor and calculating the hash value of the data in the video memory address interval; encrypting the hash value to obtain an encrypted hash value; and returning the encrypted hash value to the trusted measurement agent of the central processing unit through a secure measurement channel.

[0130] Optionally, the aforementioned computer terminal can execute the program code for the following steps in the trusted measurement method for video memory data: encrypting the hash value to obtain encrypted data; calculating the message authentication code of the hash value; and encapsulating the encrypted data and the message authentication code to obtain the encrypted hash value.

[0131] Optionally, Figure 11 This is a structural block diagram of an electronic device according to an embodiment of this application. Figure 11 As shown, the electronic device may include: one or more ( Figure 11 (Only one is shown) processor 1102, memory 1104, memory controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module and display.

[0132] The memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the video memory data reliability measurement method and apparatus in this application embodiment. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, thereby realizing the aforementioned video memory data reliability measurement method. The memory may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include memory remotely located relative to the processor, and these remote memories can be connected to the terminal via a network. Examples of the aforementioned networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0133] The processor can access the information and application programs stored in the memory via the transmission device to execute the steps described above in the method for measuring the reliability of video memory data.

[0134] The embodiments of this application provide a scheme for the trusted measurement of GPU memory data. By constructing a dynamic measurement architecture with the CPU hardware root of trust as the trust anchor point and the CPU trusted proxy and the secure region within the GPU working together, and based on a dedicated communication channel, it realizes direct access to predefined key data regions in GPU memory, efficient hash calculation, and closed-loop integrity verification. It can perform periodic or event-triggered online integrity verification of plaintext data such as model weights and embedding vectors without affecting model inference performance. This solves the technical problem in related technologies that it is impossible to perform real-time trusted measurement of data blocks in specific regions of GPU memory, which reduces data security.

[0135] Those skilled in the art will understand that Figure 11 The structure shown is for illustrative purposes only. Electronic devices can also be terminal devices such as smartphones, tablets, PDAs, and mobile internet devices (MIDs). Figure 11 This does not limit the structure of the aforementioned electronic device. For example, electronic devices may also include components that are more... Figure 11 The more or fewer components shown (such as network interfaces, display devices, etc.), or having the same Figure 11 The different configurations shown.

[0136] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a computer-readable storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0137] Example 4

[0138] Embodiments of this application also provide a storage medium. Optionally, in this embodiment, the storage medium can be used to store the program code executed by the reliability measurement method for video memory data provided in Embodiment 1.

[0139] Optionally, in this embodiment, the storage medium may be located in any computer terminal in a group of computer terminals in a computer network, or in any mobile terminal in a group of mobile terminals.

[0140] This application also provides a computer program product, which, when executed on a data processing device, is adapted to perform steps of a method for measuring the reliability of video memory data.

[0141] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0142] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0143] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0144] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0145] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0146] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0147] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A method for measuring the reliability of video memory data, characterized in that, The measurement system, which includes a central processing unit, a secure measurement channel, and a graphics processing unit, is applied to a measurement system whereby the reliable measurement method for the video memory data includes: The data object to be measured is determined, and the target measurement policy corresponding to the data object to be measured and the target baseline measurement value corresponding to the target measurement policy are obtained from the root of trust through the trusted measurement agent in the central processing unit. The root of trust stores multiple measurement policies corresponding to measurement data objects and baseline measurement values ​​corresponding to the measurement policies. The target measurement policy includes at least the target address range of the data object to be measured in the graphics processor memory. Based on the target measurement strategy, a measurement instruction is generated and encrypted to obtain an encrypted measurement instruction. The encrypted measurement command is sent to the measurement engine in the graphics processor through the secure measurement channel. The measurement engine responds to the encrypted measurement command, processes the encrypted measurement command to obtain an encrypted hash value, and returns the encrypted hash value to the trusted measurement agent. The trusted measurement agent receives the encrypted hash value, decrypts the encrypted hash value to obtain the decrypted hash value, and compares the decrypted hash value with the target baseline measurement value to obtain the trusted measurement result.

2. The method for measuring the reliability of video memory data according to claim 1, characterized in that, Before obtaining the target measurement policy corresponding to the data object to be measured from the root of trust through the trusted measurement agent in the central processing unit, the process further includes: A plurality of the metric data objects are identified, and the hash value of each metric data object is calculated to obtain the baseline metric value; Construct the measurement strategy for each of the measurement data objects, and bind the measurement strategy to the baseline measurement value; Each of the metric strategies and the corresponding baseline metric values ​​are stored in the root of trust.

3. The method for measuring the reliability of video memory data according to claim 1, characterized in that, Before sending the encrypted measurement command to the measurement engine in the graphics processor through the secure measurement channel, the method further includes: The identity credentials of the trusted measurement agent and the measurement engine are verified to obtain the verification results; If the verification result indicates that the trusted measurement agent and the measurement engine have passed authentication, the secure measurement channel is constructed.

4. The method for measuring the reliability of video memory data according to claim 1, characterized in that, The step of encrypting the measurement command to obtain the encrypted measurement command includes: The measurement instruction is encrypted to obtain a first encrypted measurement instruction; Calculate the message authentication code of the measurement instruction; The first encrypted measurement instruction is encapsulated with the message authentication code to obtain the encrypted measurement instruction.

5. The method for measuring the reliability of video memory data according to claim 1, characterized in that, After comparing the decrypted hash value with the target baseline metric value to obtain the trust metric result, the method further includes: The environment status of the central processing unit is monitored, and the environment status and the trust measurement result are sent to the policy engine, wherein the policy engine is used to control whether to use the data object to be measured in the graphics processor's video memory for inference calculation; If the trust measurement result indicates that the decrypted hash value is the same as the target baseline measurement value, and if the environment state of the central processor is in a trusted state, then inference computation using the data object to be measured is permitted. If the trusted measurement result indicates that the decrypted hash value is different from the target baseline measurement value, and / or if the environment state of the central processing unit is untrusted, a preset response action is triggered.

6. The method for measuring the reliability of video memory data according to claim 1, characterized in that, The steps of the metric engine responding to the encrypted metric command, processing the encrypted metric command to obtain an encrypted hash value, and returning the encrypted hash value to the trusted metric agent include: The encrypted measurement command is received by the measurement engine of the graphics processor; The encrypted measurement instruction is decrypted to obtain a decrypted measurement instruction, wherein the decrypted measurement instruction includes at least the target address range; The graphics processor accesses the video memory address range corresponding to the target address range and calculates the hash value of the data in the video memory address range. The hash value is encrypted to obtain the encrypted hash value; The encrypted hash value is returned to the trusted measurement agent of the central processor through the secure measurement channel.

7. The method for measuring the reliability of video memory data according to claim 6, characterized in that, The step of encrypting the hash value to obtain the encrypted hash value includes: The hash value is encrypted to obtain encrypted data; The message authentication code that calculates the hash value; The encrypted data and the message authentication code are encapsulated to obtain the encrypted hash value.

8. A device for measuring the reliability of video memory data, characterized in that, The measurement system is applied to a measurement system, which includes a central processing unit, a secure measurement channel, and a graphics processing unit. The trusted measurement device for the video memory data includes: The acquisition unit is used to determine the data object to be measured, and to obtain the target measurement policy corresponding to the data object to be measured and the target baseline measurement value corresponding to the target measurement policy from the trusted root through the trusted measurement agent in the central processing unit. The trusted root stores multiple measurement policies corresponding to the data objects and the baseline measurement values ​​corresponding to the measurement policies. The target measurement policy includes at least the target address range of the data object to be measured in the graphics processor memory. An encryption unit is used to generate a measurement instruction based on the target measurement strategy and encrypt the measurement instruction to obtain an encrypted measurement instruction. The sending unit is configured to send the encrypted measurement instruction to the measurement engine in the graphics processor through the secure measurement channel, wherein the measurement engine responds to the encrypted measurement instruction, processes the encrypted measurement instruction to obtain an encrypted hash value, and returns the encrypted hash value to the trusted measurement agent. The comparison unit is used to receive the encrypted hash value through the trusted measurement agent, decrypt the encrypted hash value to obtain the decrypted hash value, and compare the decrypted hash value with the target baseline measurement value to obtain the trusted measurement result.

9. A computer program product, characterized in that, The method includes a non-volatile computer-readable storage medium storing a computer program that, when executed by a processor, implements the reliable measurement method for video memory data as described in any one of claims 1 to 7.

10. An electronic device, characterized in that, It includes one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the reliable measurement method for video memory data as described in any one of claims 1 to 7.

Images