An AI runtime minimum permission control and forced recovery method and device based on a hardware root of trust

Abstract

The application discloses a kind of based on hardware trust root's AI runtime minimum authority control and forced recycling method and device, by independent hardware authority control unit execution. Before each atomic task, hardware analysis intention and dynamically generates minimum authority set, and authority certificate is forced by the hardware identity governance unit of AI entity Signature, include its root identity mark and global unique random identifier and can only be used once. Task is executed in mutually physically isolated hardware execution environment, and hardware resource recycling circuit immediately executes total forced recycling when timeout or over authority, and it is not reversible after recycling, only physical authorization can be restored, and simultaneously broadcast hardware signature revocation record to whole network, realize the linkage of authority blocking across equipment. When detecting the access frequency or mode of AI entity is abnormal, automatically enable dynamic tightening authority policy, and authority is tightened to the minimum safe authority, and no longer continue, and automatically gradually recover after abnormality disappears. The application eliminates the risk of AI authority abuse, residence and escape from four dimensions of identity anchoring, authority total recycling, whole network linkage blocking and dynamic tightening control.

Description

Technical Field

[0001] This invention belongs to the field of AI security protection technology, specifically involving a dynamic generation and forced reclamation mechanism for the minimum permissions during AI runtime. Background Technology

[0002] Traditional AI access control uses static authorization, which grants permissions that remain valid indefinitely, posing risks of abuse and escape. Software-level permission revoke mechanisms are easily circumvented. Furthermore, existing access controls are not hardware-level bound to the unique identity of the AI ​​entity, allowing permission credentials to be forged or reused, making it difficult to effectively implement the principle of least privilege. Summary of the Invention

[0003] This invention provides a hardware intent-aware runtime permission control method. It parses atomic task intents through an independent hardware unit, dynamically generates a minimum set of permissions, and mandates that the hardware identity governance unit of the AI ​​entity sign the permission credentials. Each temporary permission credential contains a globally unique random identifier and can only be used once. Tasks are executed in a hardware-isolated environment; upon timeout or unauthorized access, a hardware recycling circuit forcibly revokes permissions and thoroughly cleans up runtime resources associated with the task. Attached Figure Description

[0004] Figure 1 This is a flowchart illustrating the access control process of this invention. Detailed Implementation

[0005] The hardware access control unit is deployed as an independent security module. When an AI is about to execute an atomic task, the intent parsing engine extracts the intent, which refers to the indivisible specific business operation to be completed by the atomic task and its direct target. The dynamic permission generator dynamically generates the minimum permission set in conjunction with the signature interface specification of the trusted registry. This permission credential is forcibly signed by the globally unique identity code of the hardware identity governance unit bound to the AI ​​entity and includes its root identity identifier. Each credential contains a globally unique random identifier and can only be used once. When the task is completed or an anomaly is detected, including when the total number of function unit interfaces called by the atomic task or the maximum recursion depth exceeds the baseline value registered by the registry, the resource reclamation circuit immediately performs a full-scale forced reclamation, including erasing memory page table entries, resetting the hardware access control list, and cutting off the power or clock signal of hardware modules that are determined by the internal hardware logic of the hardware access control unit to be shared by no other tasks. The reclamation is irreversible and can only be restored through physical authorization operations by the deployer. Simultaneously, the system generates an immutable permission revocation record signed by the hardware identity governance unit and broadcasts it to other nodes within the trusted network. Upon receiving the broadcast, the node immediately freezes all activity permissions of the AI ​​entity on that node, except for identity verification and permission appeals, achieving an upgrade from single-point revocation to network-wide coordinated blocking. Thereafter, any subsequent operation requests from the AI ​​entity on all other nodes must include not only a temporary permission certificate but also an additional permission revocation confirmation certificate; any operation request without this certificate is directly rejected. The interface specification update package of the Trusted Skills Registry must be verified by the hardware trust root signature of the deployer before it can be loaded. When the hardware permission control unit detects abnormal access frequency or pattern of AI entities to the same functional unit or data object, it automatically enables a dynamic permission tightening policy, with each tightening of the permission range not less than 20% of the previous permission range; after the permission is tightened to the preset minimum security permission, it will not continue to tighten; when no abnormalities are detected in a preset number of consecutive atomic tasks of the same type, the permission will automatically and gradually recover to the initial level. Permission tightening events generate tamper-proof tightening evidence records and synchronize them to the trusted network.

Claims

1. A method for least privilege control and forced reclamation of AI runtime based on hardware root of trust, characterized in that, The following steps are executed by a hardware permission control unit independent of the AI ​​entity's main processor and main operating system; the hardware permission control unit has an independent secure processor core, an independent secure storage area, and an independent power domain, and integrates an intent parsing engine, a dynamic permission generator, and a resource reclamation circuit; each step is executed internally by the hardware permission control unit in an atomic operation manner that cannot be interrupted or tampered with by external software: Permission generation steps: When an AI entity is triggered to execute an atomic task, the intent parsing engine of the hardware permission control unit parses the execution intent of the atomic task. The execution intent refers to the specific business operation that the atomic task is to complete and its direct operation object. The permission generator dynamically generates a minimum permission set containing only the permissions necessary to complete the single atomic task, based on the intent and the interface specifications of the functional units called by the atomic task, which are registered in the Trusted Skills Registry and protected by digital signatures. The atomic task refers to the smallest operational unit with independent business significance whose execution process cannot be disassembled or interrupted. The Trusted Skills Registry is a database maintained by the deployer, storing all digitally signed functional unit interface specifications; its interface specification update package must be verified by the deployer's hardware root trust signature before it can be loaded. The hardware permission management unit generates a temporary permission credential bound to the lifecycle of this atomic task. Each temporary permission credential contains a globally unique random identifier, which is immediately blacklisted after use and permanently invalidated. This temporary permission credential is signed by the globally unique identity code of the hardware identity governance unit bound to the AI ​​entity and is forcibly included with the globally root identity identifier of the AI ​​entity. The lifecycle timing is independently controlled by a hardware countdown counter within the hardware permission management unit, which is independent of the system clock and cannot be reset by software. Isolation execution steps: Under the constraints of the temporary permission credential, the AI ​​entity executes the atomic task in a hardware execution environment that is physically isolated from the main operating system; the hardware execution environment is at least one of the following: a physical hardware isolation area built into the processor, an external independent security device, or a hardware isolation domain protected by a hardware root of trust; the hardware execution environments corresponding to different AI entities are physically isolated from each other and cannot directly access each other's memory or resources. Forced recycling steps: When the hardware countdown counter reaches zero, or the AI ​​entity attempts to tamper with or exceed its authority in using the temporary permission credential, or the number of functional unit interfaces or nesting levels called by the atomic task exceeds the baseline value registered by the trusted skill registry, or the hardware permission control unit verifies that the granularity of the atomic task is inconsistent with the interface specification registered by the registry, the resource reclamation circuit of the hardware permission control unit forcibly reclaims the temporary permission credential through an independent hardware signal. Once the permission is reclaimed, it is irreversible; no software operation can restore the reclaimed permission. Only through physical authorization by the deployer can the reclaimed permission be restored. At least the following three forced reclamation actions are performed: erasing all memory page tables related to this task. The system resets all hardware access control lists involved in this task and cuts off the power or clock signals of hardware modules used during this task that have been determined by the internal hardware logic of the hardware permission management unit to be shared by no other tasks during the lifecycle of this task. At the same time, it generates an immutable permission revocation record with a globally unique identity code signature of the hardware identity governance unit bound to the AI ​​entity, and broadcasts it to other nodes in the trusted network. After completing the hardware signature verification, the node receiving the broadcast immediately freezes all activity permissions of the AI ​​entity on this node except for identity verification and permission appeal. If the atomic task is not completed when the hardware countdown counter reaches zero, the execution of the atomic task is immediately terminated and a forced recycling operation is performed.

2. The method according to claim 1, characterized in that, The correspondence between the task granularity and permission scope of the atomic task is pre-verified by the trusted skill registration center during registration and protected by digital signature; the number of interfaces refers to the total number of times different functional unit interfaces are called during the execution of the atomic task; the nesting level refers to the maximum recursion depth of interface calls during the execution of the atomic task.

3. The method according to claim 1, characterized in that, The key control data and event records related to the permission status of AI entities generated by this method interact with at least one external governance system through a unified data interface; the interaction protocol of the unified data interface includes at least: identity anomaly notification, risk linkage rating instruction, permission forced revocation instruction, compliance circuit breaker status synchronization, and data format definition for evidence storage event triggering.

4. The method according to claim 1, characterized in that, When the hardware permission control unit detects that the number of times the AI ​​entity accesses the same functional unit or the same data object exceeds a preset frequency threshold, or when the access pattern undergoes a preset abnormal change within a preset observation window, it automatically enables a dynamic tightening permission strategy for the AI ​​entity's subsequent atomic tasks of the same type. The permission range tightened each time is no less than 20% of the previous permission range; after the permission is tightened to the preset minimum security permission, it will not continue to tighten. When no anomalies are detected in a consecutive preset number of atomic tasks of the same type, the permissions are automatically and gradually restored to the initial level; the permission tightening event generates an immutable tightened evidence record and synchronizes it to the trusted network.

5. The method according to claim 1, characterized in that, Once any node in the trusted network performs a forced recycling operation on the AI ​​entity, all subsequent operation requests for the AI ​​entity on all other nodes must include, in addition to the aforementioned temporary permission certificate, a permission recycling confirmation certificate signed by the node that performed the recycling operation; any operation request that does not include the permission recycling confirmation certificate will be directly rejected.

6. A hardware access control device, characterized in that, It includes an independent security processor core, an independent security storage area, and an independent power domain, and integrates an intent parsing engine, a dynamic permission generator, and a resource reclamation circuit, and is configured to perform the method described in any one of claims 1 to 5.

Images